Anomaly detection

Spotting activity that doesn't match a person's or a system's usual pattern, like a sudden flood of orders from a location that normally has almost none.

The system learns what normal looks like, and it raises a flag when something departs sharply from that pattern.

A machine-learning approach that flags deviations from an established behavioral baseline, rather than matching against fixed rules or known bad actors, making it effective against fraud patterns nobody has explicitly defined yet. A behavioral baseline is a model of typical activity, such as normal order sizes, locations, and times.

Anomaly detection typically works like this:

1. The system learns a baseline from historical activity for a person, a segment, or the whole business.
2. It compares new activity with the baseline.
3. It scores how unusual the activity is.
4. Activity above a threshold becomes an alert for a rule, a stronger check, or a review.

Several approaches are common:

• Statistical methods, which flag values far from the usual range.
• Clustering, which groups similar activity and flags points that do not fit any group.
• Learned models, which use machine learning to represent normal behavior and spot departures.

The approach has known limits:

• It needs a stable baseline, since the definition of normal has to be reasonably steady.
• Unusual is not always bad, so honest changes in behavior can trigger false alarms.
• Attackers can blend in, by acting in ways that look normal.

Anomaly detection sits next to terms that are easy to mix up:

• Risk signal is a single piece of evidence, and an anomaly score can be one of them.
• Velocity checks are fixed rules about speed, while anomaly detection learns what is unusual.
• Model drift is the decay of a model's accuracy, which can affect a baseline.