Sequence Anomaly Score

In Sequence-to-Sequence Autoencoders (Seq2Seq AE), the anomaly score is the Mean Squared Error (MSE) between the input sequence and the decoder's reconstruction. A high reconstruction error signals that the latent space cannot compress the sequence without significant information loss, indicating a deviation from learned normal patterns.

• Normal behavior: Low reconstruction error (e.g., < 0.01)
• Anomalous behavior: High reconstruction error (e.g., > 0.1)
• Sensitive to both out-of-order events and novel event types

Autoregressive models like LSTMs and Transformers assign a probability to each event given its history. The sequence anomaly score is the sum of negative log-likelihoods across all time steps. A high NLL indicates the model found the sequence highly improbable.

• Formula: Score = -Σ log P(x_t | x_{<t})
• Captures unexpected event values, timings, and ordering
• Naturally handles variable-length sequences

A raw anomaly score is rarely used in isolation. Production systems apply dynamic thresholds that adapt to user-specific baselines, time-of-day patterns, and transaction volume. A score is flagged only if it exceeds a moving percentile (e.g., 99th percentile of the user's 30-day history).

• Static threshold: Fixed value (brittle)
• Adaptive threshold: Percentile-based, updates continuously
• Prevents alert fatigue from high-spending but normal users

Advanced systems decompose the sequence anomaly score into local and global components. A local score measures per-event surprise, while a global score captures the overall session abnormality. This decomposition helps distinguish a single unusual purchase from a completely hijacked session.

• Local score: Max per-step NLL or reconstruction error
• Global score: Aggregate over the full sequence
• Enables fine-grained alert triage and investigation

Raw anomaly scores are often uncalibrated and opaque. Isotonic regression or Platt scaling can map scores to calibrated probabilities (e.g., a score of 15.2 maps to a 92% fraud likelihood). SHAP or attention weights can then attribute the score to specific transactions within the sequence.

• Converts arbitrary scores to actionable risk probabilities
• Enables regulatory compliance through explainability
• Links score directly to suspicious events for investigator review

When using Hawkes Processes or Temporal Point Processes (TPPs), the anomaly score is derived from the conditional intensity function λ(t). A sequence where events occur at times of unexpectedly low modeled intensity receives a high anomaly score, flagging deviations in transaction timing patterns.

• Detects bursty or unusually sparse activity
• Score = -log L(sequence) under the fitted process
• Effective for modeling inter-arrival time anomalies

The foundational unsupervised architecture for generating a sequence anomaly score. An encoder LSTM compresses a variable-length transaction history into a fixed-dimensional latent vector. A decoder LSTM then attempts to reconstruct the original sequence from this compressed representation. The reconstruction error—often calculated as the Mean Squared Error (MSE) between the input and reconstructed sequence—serves directly as the anomaly score. A normal user session reconstructs well (low error), while a fraudulent sequence deviates from learned patterns, yielding a high error score.

An alternative probabilistic method for deriving a sequence anomaly score using autoregressive models like LSTMs or Transformers. The model is trained to predict the next event in a sequence, outputting a probability distribution over possible actions. The anomaly score for a full sequence is the sum of the negative log-likelihood of each observed event given its history. A sequence of highly probable actions yields a low NLL, while an improbable chain of events—such as a sudden high-value transfer to a new beneficiary—results in a very high NLL, flagging the session.

The analytical framework that defines the boundaries for a sequence anomaly score. Rather than scoring individual transactions in isolation, this approach treats a user's entire continuous string of actions within a single login session as the atomic unit of analysis. A model like a GRU processes the sequence of clicks, page views, and transfers. The output is a single holistic anomaly score for the session, which is highly effective at detecting account takeover (ATO) attacks where the overall behavioral pattern deviates from the genuine user's historical sessions, even if individual steps appear benign.

A non-learned, distance-based method for computing a sequence anomaly score by comparing a new sequence to a library of known normal sequences. DTW calculates the optimal non-linear alignment between two temporal sequences that may vary in speed. The minimal cumulative distance after warping becomes the anomaly score. This is particularly useful for comparing the 'shape' of a transaction time series—such as spending velocity over a week—to a user's typical pattern, detecting anomalies where the rhythm of behavior is off, even if the total amount is normal.

A state-of-the-art architecture for interpretable multi-horizon forecasting that can be adapted to produce a sequence anomaly score. TFT integrates static metadata (e.g., account age), known future inputs (e.g., upcoming holidays), and past transaction observations. It outputs a prediction interval for the next expected transaction. The anomaly score is derived from the deviation of the actual observation from this predicted distribution. A key advantage is TFT's variable selection networks, which provide explicit feature importance, allowing an analyst to understand why a sequence scored highly.

An emerging architecture offering a linear-time alternative to the Transformer for calculating sequence anomaly scores on extremely long transaction histories. Unlike attention mechanisms with quadratic complexity, Mamba uses a selective scan to efficiently compress the entire historical context into a hidden state. This allows it to process thousands of past transactions without truncation, capturing very long-range dependencies. The anomaly score is derived from the model's prediction error, providing a computationally efficient method for scoring a user's complete financial life history in real-time fraud pipelines.