Learn→Fraud Detection & Anomaly Detection→Feature Engineering (Temporal Patterns, Aggregations, Velocity)→1 of 6
Fraud Detection & Anomaly Detection • Feature Engineering (Temporal Patterns, Aggregations, Velocity)Easy⏱️ ~2 min
Temporal Patterns: Capturing Seasonality and Time Based Signals
Temporal patterns encode when events happen and help models learn seasonality. They transform raw timestamps into features that capture cyclical behavior like weekday versus weekend shopping, lunchtime traffic spikes, or end of month billing surges.
The simplest patterns are calendar features: hour of day (0 to 23), day of week (0 to 6), month (1 to 12), and boolean holiday indicators. These work but have a critical flaw: hour 23 and hour 0 are adjacent in time but far apart numerically. This breaks continuity. The solution is cyclical encoding using sine and cosine transformations. For hour of day, compute sin(2π × hour / 24) and cos(2π × hour / 24). Now midnight wraps smoothly to the next day, and the model learns that 11 PM and 1 AM are close.
History aware features include lag values at specific offsets. A model seeing transaction amount at time t, t minus 1, t minus 7, and t minus 30 can learn momentum (rising amounts), mean reversion (return to baseline), or weekly repetition (same day last week). Stripe uses lag features for merchant transaction patterns: if average ticket suddenly doubles from last week, it signals potential account takeover. PayPal combines hour of day with day of week to detect that legitimate users rarely transact at 3 AM on Tuesday, but attackers show flat time distributions.
The key decision is which temporal resolutions to include. Fraud detection needs hour of day and day of week. Retail forecasting adds week of year and distance to major holidays. Ride sharing needs minute of hour for rush patterns. Start with domain intuition about cyclical behavior, then validate importance via feature ablation studies that measure accuracy drop when removing each temporal feature.
💡 Key Takeaways
•Calendar features like hour of day and day of week capture coarse seasonality but treat adjacent times like 23 and 0 as distant
•Cyclical encoding with sine and cosine preserves time adjacency: sin(2π × hour / 24) and cos(2π × hour / 24) make midnight wrap smoothly
•Lag features expose prior values at offsets like t minus 1, t minus 7, t minus 30 to help models learn momentum, mean reversion, and weekly patterns
•Stripe detects account takeover when merchant ticket size suddenly doubles from t minus 7 baseline, indicating abnormal behavior
•PayPal flags fraud when transactions occur at 3 AM on weekdays, a time pattern rare for legitimate users but common for attackers
•Choose temporal resolution by domain: fraud needs hour and day, retail adds week of year and holiday distance, ride sharing includes minute of hour for rush patterns
📌 Examples
Cyclical hour encoding: hour 23 becomes sin(2π × 23/24) = 0.26, cos(2π × 23/24) = 0.97, and hour 0 becomes sin(0) = 0, cos(0) = 1, which are numerically close
Stripe merchant monitoring: if average transaction at t is $500 but t minus 7 average was $250, the 2x jump triggers account takeover review
PayPal time of day distribution: legitimate user transactions peak at 10 AM to 8 PM, but compromised accounts show flat distribution across all 24 hours