Anomaly Detection transactions financial data

[Maretti (Giovanni Carpentier)]

I have a data set that holds data like this:

I want to create an anomaly detection job that alerts about suspicious large transactions but when I create a anomaly detection job it always looks at for example 1 day and not at every single transaction separately

Any Idea how I can make a anomaly detection rule that looks at a single transaction?

[richcollier]

Anomaly Detection jobs fundamentally work off the concept of time-slices (called bucket_span). The user has the ability to make the bucket_span small, but that does not guarantee one transaction per bucket.

If unsupervised ML is still desired, an alternative approach is to use population analysis such that each entity (perhaps the sending or the receiving account) is defined as the population. Then, model a feature like the high_sum of the transaction amounts. In this way, you could find accounts that send/receive amounts that are much larger than the collective norm.

Alternatively, if you already know what constitutes a "large transaction" then just build a threshold rule - no ML required.

[Maretti (Giovanni Carpentier)]

Thanks for the response!