Session-Based Modeling

A recurrent neural network gating mechanism that serves as the primary architecture for session-based fraud models. GRUs use a reset gate to determine how much past information to forget and an update gate to control how much of the new hidden state is retained.

• Computationally more efficient than LSTM with fewer parameters
• Excels at modeling bounded session sequences of 50-200 events
• Reset gate adaptively truncates irrelevant history when a user switches tasks
• Update gate maintains persistent signals of anomalous behavior across a session

In practice, a GRU processes a sequence of user actions—login, balance check, beneficiary addition, transfer—and learns the normal temporal dynamics of each action type within a session window.

The process of mapping a variable-length sequence of discrete session events into a fixed-length dense vector that captures both the semantic identity and temporal ordering of actions.

• Encodes merchant category codes, action types, and page transitions as continuous vectors
• Preserves the sequential nature of user behavior in a compact representation
• Enables similarity comparisons between sessions using cosine distance
• Feeds directly into downstream classifiers or clustering algorithms

A typical session embedding might compress 150 heterogeneous events—clicks, swipes, form submissions—into a 256-dimensional vector where anomalous sessions occupy distinct regions of the embedding space.

A derived temporal feature measuring the rate of specific actions within a sliding session window, serving as a critical real-time indicator of automated attacks.

• Login velocity: attempts per minute—spikes indicate credential stuffing
• Transfer velocity: outbound transactions per 5-minute window
• Page transition speed: time between form load and submission
• Inter-event interval: median time between consecutive actions

Velocity features are computed using event stream processing engines that maintain rolling counters with configurable decay functions. A session where transfer velocity suddenly jumps from 1 to 15 per minute while inter-event intervals drop below 200ms strongly signals scripted behavior.

A scalar value quantifying the degree of abnormality of an entire session sequence, derived from the model's internal representation of normal behavior.

• Reconstruction error: Mean squared error between input and output of a sequence autoencoder
• Negative log-likelihood: Probability of the observed sequence under a trained generative model
• Mahalanobis distance: Distance of the session embedding from the centroid of normal sessions
• One-class SVM output: Decision function value from a boundary-based anomaly detector

Scores are typically normalized to a 0-100 scale with dynamic thresholds. A session with a score above 85 might trigger step-up authentication, while scores above 95 automatically block the session and alert the fraud operations team.

An algorithmic technique that identifies the exact moment within a session where the statistical properties of user behavior shift abruptly, signaling a potential account takeover.

• Pruned Exact Linear Time (PELT): Finds multiple change points by minimizing a cost function with a penalty term
• Bayesian Online Change Point Detection: Computes the posterior probability of a change at each time step
• CUSUM: Accumulates deviations from an expected mean until a threshold is breached

When a legitimate user's session is hijacked mid-stream, change point detection isolates the transition from normal browsing to fraudulent activity. This enables precise forensic analysis and reduces false positives by focusing only on the anomalous segment rather than the entire session.

A dynamic graph neural network that extends session-based modeling by connecting individual user sessions into a broader temporal graph of interacting entities.

• Updates node representations as new transactions create edges in continuous time
• Captures evolving fraud ring structures that span multiple sessions and accounts
• Combines session-level GRU encodings with graph-level message passing
• Enables detection of coordinated attacks where individual sessions appear normal in isolation

A TGN might reveal that five seemingly benign sessions across different accounts are actually part of a coordinated mule network, connected by shared device fingerprints and temporal proximity that only become visible at the graph level.