Temporal Point Process (TPP)

The conditional intensity function is the fundamental building block of any TPP. It represents the instantaneous expected rate of events at time t, given the entire history of past events up to, but not including, t.

• Core Insight: It models the 'excitation' or 'inhibition' caused by past events. A high λ*(t) after a transaction signals bursty, potentially fraudulent behavior.
• Mathematical Form: λ*(t) = lim Δt→0 E[N(t+Δt) - N(t) | H(t)] / Δt, where H(t) is the event history.
• Fraud Application: A sudden spike in λ*(t) for high-value transfers immediately following a login from a new device is a strong anomaly signal that a simple velocity counter might miss.

The Hawkes process is a specific TPP where past events increase the probability of future events in the near term, a phenomenon called self-excitation. This makes it exceptionally good at modeling clustered, bursty behavior.

• Mechanism: The intensity λ*(t) = μ + Σ g(t - ti), where μ is a baseline rate and g(t) is a decaying kernel function (e.g., exponential decay) that sums the influence of all past events ti.
• Fraud Application: A fraud ring executing a coordinated attack will generate a cascade of transactions. A Hawkes process captures this self-exciting cascade, distinguishing it from a random, Poisson-distributed background of legitimate transactions.
• Key Parameter: The branching ratio n indicates the expected number of events directly triggered by a single event. A ratio near 1 indicates a highly contagious, potentially fraudulent cascade.

Traditional TPPs rely on parametric forms for the intensity function, which can be too rigid for complex fraud patterns. Neural TPPs use deep learning (RNNs, Transformers) to learn a flexible, non-linear representation of the event history H(t) and parameterize λ*(t).

• Architecture: A recurrent neural network encodes the sequence of past events (timing and marks like transaction amount) into a hidden state h(t). A feed-forward network then maps h(t) to the parameters of the intensity function.
• Advantage: They can learn complex, non-linear excitation and inhibition patterns without manual feature engineering, capturing interactions between event timing and event type.
• Example: A Neural TPP can learn that a small transaction followed by a long pause is inhibitory, while a large transaction followed immediately by another large one is highly excitatory for fraud risk.

A marked TPP extends the basic model by associating a 'mark' (a random variable) with each event. In finance, the mark is typically the transaction amount, merchant category, or transaction type.

• Joint Modeling: The model learns the joint distribution of event times and marks, P(time, mark | history). This captures the crucial relationship between when a transaction occurs and what it is.
• Fraud Application: A marked TPP can learn that a high-value wire transfer (mark) is normal during business hours but highly anomalous at 3:00 AM (time). The anomaly score is derived from the low conditional probability of observing that specific mark at that specific time.
• Mark-Specific Intensity: The intensity function can be decomposed into a ground intensity for any event and a conditional distribution over the mark space, λ*(t, m) = λ*(t) * f*(m | t).

The primary method for using a TPP in anomaly detection is to compute the log-likelihood of an observed sequence of events under a model trained on normal behavior. A low likelihood indicates an anomalous sequence.

• Calculation: The log-likelihood of a sequence of events {t1, t2, ..., tn} up to time T is Σ log λ*(ti) - ∫ λ*(τ) dτ. The first term rewards high intensity at actual event times; the integral penalizes high intensity everywhere else.
• Anomaly Score: The negative log-likelihood per event serves as a normalized anomaly score, allowing comparison between sequences of different lengths.
• Real-Time Use: The log-likelihood can be updated incrementally with each new event, providing a continuously updating risk score for a user session without waiting for the session to end.

At its core, a TPP models the probability distribution of the inter-arrival time τ = ti - ti-1 between consecutive events, conditional on history. This is a direct alternative to modeling event counts in fixed time bins.

• Poisson Process Baseline: The simplest TPP is the homogeneous Poisson process, where inter-arrival times are independent and identically distributed (i.i.d.) from an exponential distribution. Any deviation from this memoryless property is a signal of patterned behavior.
• Fraud Insight: Legitimate user transactions often follow a quasi-periodic or slowly varying pattern. Fraudulent scripts or bots generate inter-arrival times with a distinct statistical signature (e.g., extremely regular or bursty) that a TPP can capture.
• Goodness-of-Fit: Statistical tests like the Kolmogorov-Smirnov test on the transformed inter-arrival times can validate if a trained TPP correctly captures the normal timing dynamics.