Learn→Fraud Detection & Anomaly Detection→Feature Engineering (Temporal Patterns, Aggregations, Velocity)→1 of 6

Fraud Detection & Anomaly Detection • Feature Engineering (Temporal Patterns, Aggregations, Velocity)Easy⏱️ ~2 min

Temporal Patterns: Capturing Seasonality and Time Based Signals

Core Concept: Temporal features capture time-based patterns in user behavior. Fraud patterns differ by hour of day, day of week, and season. A transaction at 3 AM from an account that normally transacts during business hours is more suspicious than the same transaction at noon—temporal context transforms raw data into fraud signals.
Cyclical Encoding
Time features are cyclical: hour 23 is close to hour 0, December is close to January. Linear encoding treats these as distant values. Cyclical encoding uses sine and cosine transformations: hour_sin = sin(2π × hour/24), hour_cos = cos(2π × hour/24). This preserves the circular relationship—the model learns that midnight and 11 PM are neighbors.
Time Since Events
Elapsed time features measure recency: seconds since last login, hours since last transaction, days since account creation. These capture behavioral velocity without explicit aggregation. A purchase 30 seconds after login is more suspicious than one 30 minutes after—the user had no time to browse.
Feature Insight: Combine absolute time (hour of day) with relative time (seconds since last action). Absolute time captures population-level patterns; relative time captures individual behavioral anomalies.
Seasonality Indicators
Boolean flags for known patterns: is_weekend, is_holiday, is_business_hours, is_month_end. These simple features capture when normal behavior differs from baseline. Payroll fraud spikes at month-end; gift card fraud spikes during holidays. The model learns these correlations without manual rule creation.
User-Specific Baselines
Compare current time to the user's typical activity window. If a user normally transacts between 9 AM and 6 PM, a 2 AM transaction deviates from their personal baseline even if 2 AM is normal for the population. Features: is_outside_typical_hours, hours_from_typical_center.

💡 Key Takeaways

✓Cyclical encoding (sine/cosine) preserves circular relationships—hour 23 and hour 0 become neighbors in feature space

✓Combine absolute time (hour of day) with relative time (seconds since last action) to capture both population and individual patterns

✓Compare to user-specific baselines: a 2 AM transaction may be normal for population but anomalous for a 9-5 user

📌 Interview Tips

1Explain cyclical encoding formula: hour_sin = sin(2π × hour/24), hour_cos = cos(2π × hour/24)

2Use elapsed time features: seconds since last login, hours since last transaction, days since account creation

← Back to Feature Engineering (Temporal Patterns, Aggregations, Velocity) Overview