Behavioral Baseline and Ratio
Definition: is this normal for this entity, or is this proportion right? Self-referential deviation, or any proportion-of-two-counters question. The mechanism is the same either way.
Construction: an Abstraction Rule with Function Type Average, Median, Standard Deviation, Sum, Max or Min over a Search Interval, optionally two Abstraction reads combined through an Abstraction Calculation before thresholding. A ratio of two TTL Counters is also in scope. See the Rule Taxonomy for how this type differs from its neighbours.
| Question an analyst asks | Rule Taxonomy type that answers it |
|---|---|
| Is this amount far above this customer’s usual amount? | Behavioral Baseline: Average and Standard Deviation, then a z-score |
| Are refunds an unusual proportion of sales? | Behavioral Baseline: a ratio of two Abstraction Sums |
| Is today’s volume more than double the 30 day daily norm? | Behavioral Baseline: a TTL Counter compared to a longer window counter |
| Is the count over a fixed number? | Not this type: Velocity and Volume |
| Are amounts clustered just below a limit? | Not this type: Structuring |
Behavioral Baseline: Three Construction Patterns
The taxonomy has one mechanism and three shapes. Choose the shape by where the baseline comes from.
| Shape | Baseline source | Where the comparison is made |
|---|---|---|
| Deviation from the entity’s own history | Abstraction Rule: Average, Median, Standard Deviation over a window | An Abstraction Calculation, compared by the rule |
| Ratio of two measures | Two Abstraction Rules, or two TTL Counters | An Abstraction Calculation, read by the rule |
| Short window against long window | Two TTL Counters over different windows | An Abstraction Calculation, compared by the rule |
Behavioral Baseline: Construction Steps
Step 1: Build the Baseline Measure
For a baseline drawn from history, build an Abstraction Rule with the entity as the Search Key, a Search Interval long
enough to be representative (for example 90 Days), and the Function Type for the statistic, using the Function Key of
the field measured (for example CurrencyAmount). Build one Abstraction Rule per statistic, for example
AvgAmount90d and StdDevAmount90d. Measures that need only a count or sum should use TTL Counters, per
Velocity and Volume, as they are far lighter than an Abstraction Rule. See
Abstraction Rules.
Step 2: Create the Ratio as an Abstraction Calculation
An Abstraction Calculation is the preferred way to create a ratio for Activation Rules. It is a function fragment that uses the fluent calculation methods, for example refunds divided by sales, and the operands can be a payload field, a TTL Counter, an Abstraction Rule, a Sanction, a Dictionary value or an earlier calculation:
```vb calculation Matched = Abstraction.Refunds.RatioOf(Abstraction.Sales).ZeroIfUndefined()
The fragment is the only form. The result is defined once, named, and available to every rule as
`AbstractionCalculation.<Name>`, and to models as an input, so the rule and the model agree on what the ratio is. See
[Abstraction Calculations](../../Configuration/Models/AbstractionCalculations/index.html) and
[Generalisation, Adaptation and Model Thresholds](../GeneralisationAdaptationAndModelThresholds.html).
Every derived number in this type, whether a ratio, a deviation or a growth, is created the same way. As a standard, use
an Abstraction Calculation, because it can be reused and it organises concerns, although an inline calculation in an
Activation Rule remains fully supported. See
[Derived Values: Use an Abstraction Calculation](../RuleAuthoringMethodology.html#derived-values-use-an-abstraction-calculation).
An undefined result is `NaN` in a calculation unless the function ends in `.ZeroIfUndefined()`, which stores zero. A
rule that fires on a *low* value needs a count guard when it reads a stored zero. That is covered under Abstraction
Calculations.
### Step 3: Threshold the Stored Value in an Activation Rule
Each measure below is an Abstraction Calculation, shown with its function, and the Activation Rule beneath it only
compares.
A z-score of the current amount against the entity's own history, as a calculation `AmountZScore90d`:
```vb calculation
Matched = Payload.CurrencyAmount.ZScore(Abstraction.AvgAmount90d, Abstraction.StdDevAmount90d).ZeroIfUndefined()
Matched = AbstractionCalculation.AmountZScore90d.MatchGreater(3)
A percentage increase against the entity’s average, as a calculation AmountIncreaseVsAverage90d:
```vb calculation Matched = Payload.CurrencyAmount.PercentageChangeFrom(Abstraction.AvgAmount90d).ZeroIfUndefined()
```vb
Matched = AbstractionCalculation.AmountIncreaseVsAverage90d.MatchGreater(200)
A ratio of refunds to sales, as a calculation RefundToSalesRatio:
```vb calculation Matched = Abstraction.Refunds.RatioOf(Abstraction.Sales).ZeroIfUndefined()
```vb
Matched = AbstractionCalculation.RefundToSalesRatio.MatchGreater(0.15)
A ratio of two TTL Counters, as a calculation DeclineRate24h. The same value serves a threshold rule and a band rule,
which is the reuse the calculation is for, for example a decline rate that is suspiciously steady:
```vb calculation Matched = TTLCounter.DeclinedPayments24h.RatioOf(TTLCounter.Payments24h).ZeroIfUndefined()
```vb
Matched = AbstractionCalculation.DeclineRate24h.MatchGreater(0.5)
Matched = AbstractionCalculation.DeclineRate24h.MatchInRange(0.28, 0.32)
A short window against a long window, as a calculation Volume1hToDailyNorm, using the last hour’s volume against the
30 day daily average:
```vb calculation Matched = TTLCounter.Volume1h.RatioOf(TTLCounter.Volume30d.DividedBy(30)).ZeroIfUndefined()
```vb
Matched = AbstractionCalculation.Volume1hToDailyNorm.MatchGreater(2)
Thresholds should be derived from the actual distribution of the data, and not from best practice lists, per the Rule Taxonomy. The stored value is what makes that possible, because it is recorded and can be reported.
Behavioral Baseline: Cold Start and Priority
An entity with no history has no baseline. Guard against this in the rule, for example with a Require step on a
minimum count of prior events before a deviation rule is allowed to match, otherwise every new customer deviates:
Matched = Abstraction.Count90d.RequireGreaterOrEqual(30).Against(AbstractionCalculation.AmountZScore90d).MatchGreater(3)
Where the baseline is a TTL Counter, incrementation timing follows the Priority rules in Velocity and Volume: a counter incremented earlier in Priority order includes the current event in the baseline, which biases a comparison of the current event against itself, so increment the baseline counter after the reading rule.
Behavioral Baseline: Common Faults
Symptoms of a misbuilt Behavioral Baseline rule, with the likely cause.
| Symptom in a Behavioral Baseline rule | Likely cause |
|---|---|
| Every new customer alerts | No cold start guard; the baseline is zero or absent. |
| The ratio is zero, or the rule does not fire | The denominator is zero. The calculation is NaN, or zero with ZeroIfUndefined(), and a NaN fails every comparison. |
| The deviation never fires | The baseline includes the current event because the baseline counter was incremented ahead of the reading rule. |
| The baseline is unstable | The Search Interval is too short, or truncated by the fetch limit in the model definition. |
Examples by Sub-Class
Validated. Every fragment in this section is compiled individually through the Jube Parser, with its payload fields and its TTL Counter, Abstraction, Calculation, List and Sanction tokens declared, so each extension method and argument type is checked against the engine. Compilation does not validate a rule’s logic or its thresholds, which are illustrative placeholders to be tuned on data.
4.1 Deviation from own average / standard deviation
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 4.1-01 | Transaction amount above personal average (z-score) | Amount exceeds the customer’s mean by N standard deviations. | Average and Standard Deviation Abstraction Rules over CurrencyAmount, Search Key AccountId, Search Interval 90 Days, plus a Count Abstraction Rule on the same key as the cold start guard. No activation rule increments them; they aggregate the stored history. The minimum count of 30 and the z threshold of 3 are placeholders. | Matched = Abstraction.CountAmount90d.RequireGreaterOrEqual(30).Against(Payload.CurrencyAmount).MatchZScoreAbove(Abstraction.MeanAmount90d, Abstraction.StdDevAmount90d, 3) |
Tag: Baseline · Fraud · Account · 90d, z ≥ 3 |
| 4.1-02 | Transaction amount above personal maximum | Amount exceeds the highest in the lookback window. | Max Abstraction Rule over CurrencyAmount, Search Key AccountId, Search Interval 180 Days. The Search Interval must exclude the current payment, otherwise the payment is compared with itself and the rule never fires. | Matched = Payload.CurrencyAmount.MatchGreater(Abstraction.MaxAmount180d) |
Tag: Baseline · Fraud · Account · 180d |
| 4.1-03 | Transaction amount above personal 95th percentile | Amount above the customer’s own distribution tail. | Single event. The account’s 180 day 95th percentile of amount is precomputed upstream and supplied as TailAmount (placeholder). The comparison is against that field. | Matched = Payload.Amount.MatchGreater(Payload.TailAmount) |
Tag: Baseline · Fraud · Account · 180d |
| 4.1-04 | Daily spend above personal average multiple | Day’s spend is a multiple of the typical daily spend. | TTL Counters Spend1Day (Interval Days 1) and Spend30Days (Interval Days 30), both keyed on AccountId with Sum on CurrencyAmount. Both are incremented by an always-matching Activation Rule with a later Priority than the reading rule, so the reading rule sees earlier payments only and Plus adds the current one; subtracting the one day counter leaves a 29 day baseline. The multiple of 5 is a placeholder. | Matched = TTLCounter.Spend1Day.Plus(Payload.CurrencyAmount).RatioOf(TTLCounter.Spend30Days.DifferenceFrom(TTLCounter.Spend1Day).RatioOf(29)).MatchGreater(5) |
Tag: Baseline · Fraud · Account · 30d, ≥ 5× |
| 4.1-05 | Weekly spend above personal average multiple | Same at weekly level. | TTL Counters Spend7Days (Interval Days 7) and Spend90Days (Interval Days 90), keyed on AccountId with Sum on CurrencyAmount and the same always-matching incrementing rule, with a later Priority than the reading rule. The weekly norm is the 90 day sum scaled to seven days. The multiple of 3 is a placeholder; the source gives none. | Matched = TTLCounter.Spend7Days.Plus(Payload.CurrencyAmount).RatioOf(TTLCounter.Spend90Days.Times(7).RatioOf(90)).MatchGreater(3) |
Tag: Baseline · Both · Account · 90d |
| 4.1-06 | Monthly turnover above 12-month average multiple | Turnover step-change. | TTL Counters Turnover1Month (Interval Months 1) and Turnover12Months (Interval Months 12), keyed on AccountId with Sum on CurrencyAmount, using the same Priority arrangement as 4.1-04. The twelve month sum is divided by 12 to give a monthly norm. The multiple of 3 is a placeholder. | Matched = TTLCounter.Turnover1Month.Plus(Payload.CurrencyAmount).RatioOf(TTLCounter.Turnover12Months.RatioOf(12)).MatchGreater(3) |
Tag: Baseline · AML · Account · 12m, ≥ 3× |
| 4.1-07 | Monthly turnover well below average | Sharp fall may indicate account migration or takeover aftermath. | The same two counters as 4.1-06, read by a rule that tests the low side. A zero twelve month sum gives NaN, which fails the comparison, so the rule fails closed on an account with no history. The 0.5 is a placeholder. | Matched = TTLCounter.Turnover1Month.RatioOf(TTLCounter.Turnover12Months.RatioOf(12)).MatchLess(0.5) |
Tag: Baseline · AML · Account · 12m |
| 4.1-08 | Inbound credit total above personal baseline | Credits far above normal. | TTL Counters Inbound90Days (Interval Days 90) and Inbound12Months (Interval Months 12), keyed on AccountId with Sum on CurrencyAmount. An Activation Rule gated on Payload.Direction.MatchEqual(“Credit”) (the value Credit is a placeholder) increments them, so they hold credits only. The twelve month total is scaled to 90 days, and the multiple of 2 is a placeholder. | Matched = TTLCounter.Inbound90Days.RatioOf(TTLCounter.Inbound12Months.Times(90).RatioOf(365)).MatchGreater(2) |
Tag: Baseline · AML · Account · 90d |
| 4.1-09 | Cash deposit amount above personal baseline | Cash deposit larger than typical. | Average Abstraction Rule over CurrencyAmount, Search Key AccountId, Search Interval 90 Days, whose filter (its Matched) keeps only cash deposits, for example Payload.TxnType.MatchEqual(“CashDeposit”), a placeholder value. The comparison is a multiple of that average, and 2 is a placeholder. | Matched = Payload.CurrencyAmount.RatioOf(Abstraction.MeanCashDeposit90d).MatchGreater(2) |
Tag: Baseline · AML · Account · 90d |
| 4.1-10 | ATM withdrawal above personal baseline | Cash-out above normal. | Average Abstraction Rule over CurrencyAmount, Search Key CardId, Search Interval 90 Days, whose filter keeps only ATM withdrawals, for example Payload.TxnType.MatchEqual(“AtmWithdrawal”), a placeholder value. The multiple of 2 is a placeholder. | Matched = Payload.CurrencyAmount.RatioOf(Abstraction.MeanAtmWithdrawal90d).MatchGreater(2) |
Tag: Baseline · Fraud · Card · 90d |
| 4.1-11 | Online spend above personal baseline | CNP spend increase. | Average Abstraction Rule over CurrencyAmount, Search Key CardId, Search Interval 90 Days, whose filter keeps only card-not-present spend, for example Payload.IsCardNotPresent.MatchIsTrue(), a placeholder flag. The multiple of 2 is a placeholder. | Matched = Payload.CurrencyAmount.RatioOf(Abstraction.MeanOnlineSpend90d).MatchGreater(2) |
Tag: Baseline · Fraud · Card · 90d |
| 4.1-12 | International spend above personal baseline | Overseas spend increase. | Average Abstraction Rule over CurrencyAmount, Search Key CardId, Search Interval 90 Days, whose filter keeps only cross-border spend, for example Payload.IsInternational.MatchIsTrue(), a placeholder flag. The multiple of 2 is a placeholder. | Matched = Payload.CurrencyAmount.RatioOf(Abstraction.MeanInternationalSpend90d).MatchGreater(2) |
Tag: Baseline · Fraud · Card · 90d |
| 4.1-13 | Average ticket size shift | Mean transaction value changes substantially. | Four TTL Counters keyed on AccountId: Spend30Days and Spend180Days (Sum on CurrencyAmount), and Count30Days and Count180Days (Sum off), all incremented by an always-matching rule with a later Priority than the reading rule. The ratio of average tickets is read with an outside-range test, so a shift in either direction fires. The bounds are placeholders. | Matched = TTLCounter.Spend30Days.RatioOf(TTLCounter.Count30Days).RatioOf(TTLCounter.Spend180Days.RatioOf(TTLCounter.Count180Days)).MatchOutsideRange(0.5, 2) |
Tag: Baseline · Fraud · Card · 30d vs 180d |
| 4.1-14 | Median payment size shift | Median payment size changes (less outlier-driven). | Two Median Abstraction Rules over CurrencyAmount, Search Key AccountId, one with Search Interval 30 Days and one with 180 Days. PercentDifferenceFrom is symmetric, so both directions are caught. The 50 percent is a placeholder. | Matched = Abstraction.MedianAmount30d.PercentDifferenceFrom(Abstraction.MedianAmount180d).MatchGreater(50) |
Tag: Baseline · Fraud · Account · 30d vs 180d |
| 4.1-15 | Payment count above personal average | Number of payments exceeds typical. | TTL Counters Count30Days (Interval Days 30, Sum off) and Count12Months (Interval Months 12, Sum off), keyed on AccountId and incremented by an always-matching rule with a later Priority than the reading rule. The twelve month count is divided by 12 to give a monthly rate. The multiple of 2 is a placeholder. | Matched = TTLCounter.Count30Days.RatioOf(TTLCounter.Count12Months.RatioOf(12)).MatchGreater(2) |
Tag: Baseline · Both · Account · 30d |
| 4.1-16 | Transaction time-of-day outside personal pattern | Activity in hours the customer never uses. | Abstraction Rule with Function Type Mode over Payload.HourOfDay, Search Key AccountId, Search Interval 90 Days, giving the usual hour. Payload.HourOfDay is a placeholder field the caller supplies as text and parses with ToDoubleOrNaN, distinct from the DateTime HourOfDay() step. CircularDistanceFrom takes the shorter distance around a 24 hour clock, so 23 and 1 are 2 apart. The 6 hour threshold is a placeholder. | Matched = Payload.HourOfDay.ToDoubleOrNaN().CircularDistanceFrom(Abstraction.ModeHourOfDay90d, 24).MatchGreater(6) |
Check: The multiple-of-6 threshold is illustrative. Tag: Baseline · Fraud · Account · 90d |
| 4.1-17 | Transaction day-of-week outside personal pattern | Activity on unusual day. | Abstraction Rule with Function Type Mode over Payload.DayOfWeek, a placeholder field from the caller as text, parsed with ToDoubleOrNaN, with values 0 to 6, Search Key AccountId, Search Interval 90 Days. CircularDistanceFrom with period 7 treats Saturday and Sunday as adjacent. The 3 is a placeholder; a per-day count would be more robust than a single mode over seven values. | Matched = Payload.DayOfWeek.ToDoubleOrNaN().CircularDistanceFrom(Abstraction.ModeDayOfWeek90d, 7).MatchGreater(3) |
Tag: Baseline · Fraud · Account · 90d |
| 4.1-18 | Transaction channel mix change | Share of transactions per channel shifts. | TTL Counters per channel per window, keyed on AccountId, for example MobileCount30Days incremented by an Activation Rule on Payload.Channel.MatchEqual(“Mobile”) (Channel and Mobile are placeholders). Each channel needs a counter for each window, and Count30Days is the denominator. The 0.2 is a placeholder. | Matched = TTLCounter.MobileCount30Days.RatioOf(TTLCounter.Count30Days).AbsoluteDifferenceFrom(TTLCounter.MobileCount180Days.RatioOf(TTLCounter.Count180Days)).MatchGreater(0.2) |
Tag: Baseline · Fraud · Account · 30d vs 180d |
| 4.1-19 | Beneficiary type mix change | Shift from domestic to international or from known to new payees. | TTL Counters for domestic and international payments over 30 and 180 days, keyed on AccountId, with the international counters incremented by Payload.IsInternational.MatchIsTrue(), a placeholder flag. The known-versus-new payee half is not in this fragment: it needs a payee-seen flag from the caller and a second counter ratio. The 0.2 is a placeholder. | Matched = TTLCounter.InternationalCount30Days.RatioOf(TTLCounter.Count30Days).AbsoluteDifferenceFrom(TTLCounter.InternationalCount180Days.RatioOf(TTLCounter.Count180Days)).MatchGreater(0.2) |
Tag: Baseline · Both · Account · 30d vs 180d |
| 4.1-20 | Merchant category mix change | New spending categories dominate. | Sum TTL Counters for spend in a fixed set of merchant category groups, keyed on AccountId, for example HighRiskMccSpend30Days, with each increment gated on membership of a maintained List of its category codes, for example Payload.MccCode.MatchInList(List.HighRiskMcc). A category outside the fixed groups has no counter, so only pre-named groups are tested. The 0.2 is a placeholder. | Matched = TTLCounter.HighRiskMccSpend30Days.RatioOf(TTLCounter.Spend30Days).AbsoluteDifferenceFrom(TTLCounter.HighRiskMccSpend180Days.RatioOf(TTLCounter.Spend180Days)).MatchGreater(0.2) |
Tag: Baseline · Fraud · Card · 30d vs 180d |
| 4.1-21 | Login time deviation | Login at unusual time relative to history. | Abstraction Rule with Function Type Mode over Payload.LoginHourOfDay, a placeholder field from the caller as text, parsed with ToDoubleOrNaN, Search Key AccountId, Search Interval 90 Days. Circular distance with period 24 treats 23 and 1 as 2 apart. The 6 hour threshold is a placeholder. | Matched = Payload.LoginHourOfDay.ToDoubleOrNaN().CircularDistanceFrom(Abstraction.ModeLoginHour90d, 24).MatchGreater(6) |
Check: The multiple-of-6 threshold is illustrative. Tag: Baseline · Fraud · Account · 90d |
| 4.1-22 | Session duration deviation | Session length well off norm (bot/RAT). | Mean and Standard Deviation Abstraction Rules over SessionSeconds, a placeholder numeric payload field, Search Key AccountId, Search Interval 90 Days, with a Count Abstraction Rule as the cold start guard. The z threshold of 3 is a placeholder. | Matched = Abstraction.CountSessionSeconds90d.RequireGreaterOrEqual(30).Against(Payload.SessionSeconds).MatchZScoreAbove(Abstraction.MeanSessionSeconds90d, Abstraction.StdDevSessionSeconds90d, 3) |
Tag: Baseline · Fraud · Account · 90d |
| 4.1-23 | Typing/behavioural biometric deviation | Keystroke/mouse/touch pattern differs from baseline. | The closest construct is the z-score of 4.1-01, replaced by a vendor biometric deviation score read as a threshold. Upstream field: Payload.BiometricScore, supplied before Jube or by an inline-script hook. Higher means more deviation. Threshold 0.8 is an illustrative placeholder. | Matched = Payload.BiometricScore.MatchGreater(0.8) |
Tag: Baseline · Fraud · Account · model score |
| 4.1-24 | Balance drawdown deviation | Account drained relative to typical balance. | Max Abstraction Rule over Payload.Balance, Search Key AccountId, Search Interval 24 Hours, excluding the current payment so the balance is read before the drawdown. PercentBelowThreshold gives how far under that maximum the current balance sits. The 30 percent is a placeholder. | Matched = Payload.Balance.PercentBelowThreshold(Abstraction.MaxBalance24h).MatchGreater(30) |
Tag: Baseline · Fraud · Account · 24h |
| 4.1-25 | Balance spike deviation | Balance far above norm following credits. | Average Abstraction Rule over Payload.Balance, Search Key AccountId, Search Interval 7 Days, with PercentDeviationFromMean measuring the current balance against that mean. The 50 percent is a placeholder. | Matched = Payload.Balance.PercentDeviationFromMean(Abstraction.MeanBalance7d).MatchGreater(50) |
Tag: Baseline · AML · Account · 7d |
4.2 Peer-group and segment baselines
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 4.2-01 | Turnover above peer-group average | Account turnover high versus similar customers (segment, occupation, geography). | Sum Abstraction Rule over CurrencyAmount and Distinct Count Abstraction Rule over AccountId, both with Search Key Payload.Segment (a placeholder field from KYC) and Search Interval 90 Days. The peer average per account is the segment sum over distinct accounts, and the tested customer’s own history sits inside it. TTL Counter Turnover90Days is keyed on AccountId with Sum on CurrencyAmount. The multiple of 2 is a placeholder. | Matched = TTLCounter.Turnover90Days.RatioOf(Abstraction.SumAmountBySegment90d.RatioOf(Abstraction.DistinctAccountsBySegment90d)).MatchGreater(2) |
Tag: Baseline · AML · Customer vs peer · 90d |
| 4.2-02 | Cash intensity above peer group | Cash share above peers. | TTL Counters CashAmount90Days and Turnover90Days keyed on AccountId, Sum on CurrencyAmount, with CashAmount90Days incremented on a cash flag. The peer side is an Average Abstraction Rule over Payload.IsCash, a placeholder numeric flag of 1 or 0, with Search Key Payload.Segment, so the peer figure is a count-based share. The multiple of 2 is a placeholder. | Matched = TTLCounter.CashAmount90Days.RatioOf(TTLCounter.Turnover90Days).MatchGreater(Abstraction.MeanIsCashBySegment90d.Times(2)) |
Tag: Baseline · AML · Customer vs peer · 90d |
| 4.2-03 | International share above peer group | Cross-border share above peers. | As 4.2-02 with a placeholder 1 or 0 cross-border flag, Payload.IsInternational, averaged by segment through an Abstraction Rule for the peer side, against TTL Counters InternationalAmount90Days and Turnover90Days. The multiple of 2 is a placeholder. | Matched = TTLCounter.InternationalAmount90Days.RatioOf(TTLCounter.Turnover90Days).MatchGreater(Abstraction.MeanIsInternationalBySegment90d.Times(2)) |
Tag: Baseline · AML · Customer vs peer · 90d |
| 4.2-04 | Transaction count above peer group | Count above peer norm. | TTL Counter Count30Days keyed on AccountId, read against a Count Abstraction Rule and a Distinct Count Abstraction Rule over AccountId, both with Search Key Payload.Segment and Search Interval 30 Days. Their ratio is the peer average count per account. The multiple of 2 is a placeholder. | Matched = TTLCounter.Count30Days.MatchGreater(Abstraction.CountBySegment30d.RatioOf(Abstraction.DistinctAccountsBySegment30d).Times(2)) |
Tag: Baseline · Both · Customer vs peer · 30d |
| 4.2-05 | Business turnover above sector peer norm | Business revenue inconsistent with its sector. | Dictionary SectorTurnoverNorm90d keyed on a placeholder payload field SectorCode, holding the curated norm for each sector, read against TTL Counter Turnover90Days keyed on AccountId. The norm is maintained reference data that needs its own refresh process. The multiple of 2 is a placeholder. | Matched = TTLCounter.Turnover90Days.RatioOf(Dictionary.SectorTurnoverNorm90d).MatchGreater(2) |
Tag: Baseline · AML · Business vs sector · 90d |
| 4.2-06 | Merchant chargeback ratio above acquirer peer | Chargeback ratio relative to peers. | Dictionary AcquirerChargebackNorm keyed on a placeholder AcquirerId payload field, read against TTL Counters Chargebacks30Days and Sales30Days keyed on MerchantId. The comparison is a plain threshold from the Dictionary, so the rule has no number of its own. | Matched = TTLCounter.Chargebacks30Days.RatioOf(TTLCounter.Sales30Days).MatchGreater(Dictionary.AcquirerChargebackNorm) |
Check: Card-scheme and acquirer chargeback monitoring thresholds, if used to set the norm, must be checked against current scheme rules. Tag: Baseline · Fraud · Merchant vs peer · 30d |
| 4.2-07 | ATM withdrawal pattern above peer group | Withdrawals higher than segment. | TTL Counter AtmCount30Days keyed on CardId, incremented by an ATM withdrawal condition, read against the segment average per card: a Count Abstraction Rule over ATM withdrawals and a Distinct Count Abstraction Rule over CardId, both with Search Key Payload.Segment and Search Interval 30 Days. The multiple of 2 is a placeholder. | Matched = TTLCounter.AtmCount30Days.MatchGreater(Abstraction.CountAtmBySegment30d.RatioOf(Abstraction.DistinctCardsBySegment30d).Times(2)) |
Tag: Baseline · Fraud · Card vs peer · 30d |
| 4.2-08 | Agent volume above peer agents | Agent activity above peers. | TTL Counter AgentVolume7Days keyed on AgentId, read against a Count Abstraction Rule and a Distinct Count Abstraction Rule over AgentId, both with Search Key Payload.AgentRegion (a placeholder field) and Search Interval 7 Days. The multiple of 2 is a placeholder. | Matched = TTLCounter.AgentVolume7Days.MatchGreater(Abstraction.CountByRegion7d.RatioOf(Abstraction.DistinctAgentsByRegion7d).Times(2)) |
Tag: Baseline · AML · Agent vs peer · 7d |
| 4.2-09 | Account age-adjusted activity | Activity too high for the age of account. | Dictionary ExpectedCount30dByAgeBand keyed on a placeholder payload field AgeBand, read against TTL Counter Count30Days keyed on AccountId. The age band is derived from Payload.AccountOpened by the caller, and the Dictionary key shape must be confirmed before relying on it. The multiple of 2 is a placeholder. | Matched = TTLCounter.Count30Days.RatioOf(Dictionary.ExpectedCount30dByAgeBand).MatchGreater(2) |
Tag: Baseline · Fraud · Account · age bands |
| 4.2-10 | Student/low-income segment high-value activity | Activity inconsistent with declared segment. | Dictionary SegmentHighValueThreshold keyed on Payload.Segment (a placeholder field from KYC), read directly against CurrencyAmount. A missing key returns zero, so every segment the rule should test must hold a value, or the rule fires on any amount. | Matched = Payload.CurrencyAmount.MatchGreater(Dictionary.SegmentHighValueThreshold) |
Tag: Baseline · AML · Customer vs segment · 30d |
| 4.2-11 | Pensioner segment unusual online transfers | Elderly-segment customer starts large online transfers. | TTL Counter OnlineTransferAmount30Days keyed on AccountId, Sum on CurrencyAmount, incremented by an online transfer condition (a placeholder), and read before that increment. The Dictionary PensionerOnlineTransferCeiling, keyed on Payload.Segment, supplies the ceiling, and the Segment check in the same rule limits it to pensioners. | Matched = TTLCounter.OnlineTransferAmount30Days.Plus(Payload.CurrencyAmount).MatchGreater(Dictionary.PensionerOnlineTransferCeiling) And Payload.Segment.MatchEqual("Pensioner") |
Tag: Baseline · Fraud · Customer vs segment · 30d |
4.3 Expected-activity and KYC profile comparison
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 4.3-01 | Activity exceeds declared expected monthly turnover | Observed turnover above the KYC declaration. | TTL Counter Turnover30Days keyed on AccountId, Sum on CurrencyAmount, read with the current payment added. DeclaredMonthlyTurnover is a KYC field in the payload (a placeholder name). If it is not in the payload it becomes a customer-keyed Dictionary lookup. The 1.5 is a placeholder multiple. | Matched = TTLCounter.Turnover30Days.Plus(Payload.CurrencyAmount).RatioOf(Payload.DeclaredMonthlyTurnover.ToDoubleOrNaN()).MatchGreater(1.5) |
Tag: Baseline · AML · Customer · 30d, ≥ 1.5× |
| 4.3-02 | Activity exceeds declared income | Credits far above declared income. | TTL Counter Inbound90Days keyed on AccountId, incremented by the credit condition as in 4.1-08. DeclaredAnnualIncome is a KYC field (a placeholder name), and it is scaled to 90 days, treating it as an annual figure, so both periods match. | Matched = TTLCounter.Inbound90Days.RatioOf(Payload.DeclaredAnnualIncome.ToDoubleOrNaN().Times(90).RatioOf(365)).MatchGreater(1) |
Check: Confirm the period of the declared income in the KYC record; the chain assumes annual. Tag: Baseline · AML · Customer · 90d |
| 4.3-03 | Activity exceeds declared source-of-wealth plausibility | Inflows inconsistent with declared source. | TTL Counter Inbound12Months keyed on AccountId, read against DeclaredSourceOfWealthAmount, a KYC numeric field (a placeholder name). This tests the magnitude only. Whether the declared source type matches the counterparties, such as salary against gambling payouts, is categorical and is not covered here. | Matched = TTLCounter.Inbound12Months.RatioOf(Payload.DeclaredSourceOfWealthAmount).MatchGreater(1) |
Tag: Baseline · AML · Customer · 12m |
| 4.3-04 | Payments to countries not declared | Destinations outside stated countries of operation. | The declared destination countries travel as a delimited text field in the payload (a placeholder name, DeclaredCountries), because a List is global and cannot hold a per-customer set. The rule matches when the destination is present and is not in that set, using the membership test. | Matched = Payload.DestinationCountry.RequireIsNotNullOrEmpty().MatchWhen(Not Payload.DestinationCountry.IsDelimitedMember(Payload.DeclaredCountries, ",")) |
Tag: Baseline · AML · Customer · 90d |
| 4.3-05 | Cash activity with no declared cash business | Cash movement for a non-cash business. | Two conditions on one rule. The KYC flag Payload.CashBusinessDeclared (a placeholder Boolean field) must be false, and TTL Counter Cash30Days, keyed on AccountId and summing CurrencyAmount over cash transactions, must be positive once the current payment is added. | Matched = Payload.CashBusinessDeclared.ParseBoolean().MatchIsFalse() And TTLCounter.Cash30Days.Plus(Payload.CurrencyAmount).MatchGreater(0) |
Tag: Baseline · AML · Customer · 30d |
| 4.3-06 | Dormant account sudden high activity | Account with no activity for N months suddenly moves large value. | TTL Counter Count12Months (Interval Months 12, Sum off) keyed on AccountId. It is read before the current payment increments it, so a zero reading means no activity in the window. The 500 threshold is a placeholder for the size of a sudden payment. | Matched = TTLCounter.Count12Months.MatchEqual(0) And Payload.CurrencyAmount.MatchGreater(500) |
Tag: Baseline · AML · Account · 12m dormancy |
| 4.3-07 | New account high activity | Activity far above norm for a recently opened account. | Payload.AccountOpened, a placeholder Date field, gives the account age, and TTL Counter Spend30Days keyed on AccountId supplies the recent activity. NewAccountSpendNorm is a Dictionary keyed on a placeholder payload field, holding the expected spend for a new account. | Matched = Payload.AccountOpened.ParseDate().MatchYoungerThanDays(30) And TTLCounter.Spend30Days.Plus(Payload.CurrencyAmount).MatchGreater(Dictionary.NewAccountSpendNorm) |
Tag: Baseline · AML · Account · first 30d |
| 4.3-08 | Low-risk rating with high-risk behaviour | Behaviour inconsistent with assigned customer risk rating. | Payload.CustomerRiskRating, a placeholder field from KYC, must equal Low, and TTL Counter HighRiskEvents90Days keyed on AccountId, incremented by the rule that defines high-risk behaviour, must be above zero. | Matched = Payload.CustomerRiskRating.MatchEqual("Low") And TTLCounter.HighRiskEvents90Days.MatchGreater(0) |
Tag: Baseline · AML · Customer · 90d |
| 4.3-09 | Trade activity inconsistent with business profile | Goods/values unrelated to declared business. | Same pattern as 4.3-04. The permitted trade categories travel as a delimited payload string (a placeholder name, DeclaredTradeCategories), because a List is global and a numeric Dictionary holds one code per key. The rule matches when the category is present and outside that set. | Matched = Payload.TradeCategory.RequireIsNotNullOrEmpty().MatchWhen(Not Payload.TradeCategory.IsDelimitedMember(Payload.DeclaredTradeCategories, ",")) |
Tag: Baseline · AML · Customer · 90d |
| 4.3-10 | Charity/NPO inflows inconsistent with profile | Donation inflows or outflows outside purpose. | TTL Counter Inbound90Days keyed on AccountId, read against DeclaredProgrammeBudget90d, a placeholder payload figure for the programme. It is a numeric proxy for outside purpose; the purpose mismatch itself needs a categorical purpose code. | Matched = TTLCounter.Inbound90Days.RatioOf(Payload.DeclaredProgrammeBudget90d.ToDoubleOrNaN()).MatchGreater(1) |
Tag: Baseline · AML · Customer · 90d |
4.4 Ratios (proportion of two counters)
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 4.4-01 | Cash-in to total-in ratio | Share of inbound that is cash. | TTL Counters CashIn30Days and TotalIn30Days keyed on AccountId, Sum on CurrencyAmount, with CashIn30Days incremented by a cash-channel condition and TotalIn30Days by the credit condition. The 0.8 is the figure in the source tag, used as a placeholder. | Matched = TTLCounter.CashIn30Days.RatioOf(TTLCounter.TotalIn30Days).MatchGreater(0.8) |
Tag: Ratio · AML · Account · 30d, ≥ 0.8 |
| 4.4-02 | Cash-out to total-out ratio | Share of outbound that is cash. | Mirror of 4.4-01 with TTL Counters CashOut30Days and TotalOut30Days keyed on AccountId, using the debit condition. The source gives no figure, so the 0.8 is a placeholder. | Matched = TTLCounter.CashOut30Days.RatioOf(TTLCounter.TotalOut30Days).MatchGreater(0.8) |
Tag: Ratio · Both · Account · 30d |
| 4.4-03 | Debit-to-credit ratio near 1 | All money in goes out (pass-through). | TTL Counters TotalOut7Days and TotalIn7Days keyed on AccountId, Sum on CurrencyAmount. The band of 0.9 to 1.1 is the source’s, with both ends included. Zero inflow gives NaN and fails closed. | Matched = TTLCounter.TotalOut7Days.RatioOf(TTLCounter.TotalIn7Days).MatchInRange(0.9, 1.1) |
Tag: Ratio · AML · Account · 7d, 0.9–1.1 |
| 4.4-04 | Retained balance ratio low | Little of inflow retained. | TTL Counters TotalIn7Days and TotalOut7Days keyed on AccountId. RetentionAfter is negative when more went out than came in, so MatchLess also catches full pass-through. The 0.1 is a placeholder. | Matched = TTLCounter.TotalIn7Days.RetentionAfter(TTLCounter.TotalOut7Days).MatchLess(0.1) |
Tag: Ratio · AML · Account · 7d |
| 4.4-05 | International-to-domestic ratio | Proportion of international payments. | Count TTL Counters InternationalCount30Days and DomesticCount30Days keyed on AccountId, incremented on the international and domestic conditions. The 0.5 is a placeholder. | Matched = TTLCounter.InternationalCount30Days.RatioOf(TTLCounter.DomesticCount30Days).MatchGreater(0.5) |
Tag: Ratio · AML · Account · 30d |
| 4.4-06 | High-risk-country share of outflows | Percentage of value to higher-risk countries. | TTL Counter OutToHighRiskCountry30Days keyed on AccountId, Sum on CurrencyAmount, incremented by an Activation Rule gated on Dictionary.CountryRisk.MatchGreaterOrEqual(4), where CountryRisk is keyed on a placeholder destination country field. It is read against TotalOut30Days. The 0.1 is a placeholder. | Matched = TTLCounter.OutToHighRiskCountry30Days.RatioOf(TTLCounter.TotalOut30Days).MatchGreater(0.1) |
Check: The high-risk country list and the cut-off of 4 used in Dictionary.CountryRisk must come from current FATF or jurisdictional lists; verify before use. Tag: Ratio · AML · Account · 30d |
| 4.4-07 | New-beneficiary share of payments | Fraction of payments to new payees. | TTL Counter NewPayeePayments7Days keyed on AccountId, incremented by Payload.IsNewPayee.MatchIsTrue(), a placeholder flag the caller must supply, and read against Payments7Days, a count of all payments. The 0.5 is a placeholder. | Matched = TTLCounter.NewPayeePayments7Days.RatioOf(TTLCounter.Payments7Days).MatchGreater(0.5) |
Tag: Ratio · Fraud · Account · 7d |
| 4.4-08 | Declined-to-approved ratio | High share of declines. | TTL Counters Declined1Hour and Approved1Hour (Interval Hours 1, Sum off) keyed on CardId, incremented by decline and approval outcomes. The 0.5 is a placeholder. | Matched = TTLCounter.Declined1Hour.RatioOf(TTLCounter.Approved1Hour).MatchGreater(0.5) |
Tag: Ratio · Fraud · Card · 1h |
| 4.4-09 | Failed-login-to-successful-login ratio | Many failures per success. | TTL Counters FailedLoginIp1Hour and SuccessLoginIp1Hour (Interval Hours 1) keyed on IP, incremented on failed and successful logins. The ratio is undefined with no success, so a raw failure count is OR’d in to catch brute force. The 5 and 20 are placeholders. | Matched = TTLCounter.FailedLoginIp1Hour.RatioOf(TTLCounter.SuccessLoginIp1Hour).MatchGreater(5) Or TTLCounter.FailedLoginIp1Hour.MatchGreater(20) |
Tag: Ratio · Fraud · Account/IP · 1h |
| 4.4-10 | Chargeback-to-sales ratio | Chargeback ratio by count or value. | TTL Counters Chargebacks30Days and Sales30Days keyed on MerchantId, Sum on CurrencyAmount, the value-based version. The 0.01 is the figure in the source, used as a placeholder; scheme thresholds differ. | Matched = TTLCounter.Chargebacks30Days.RatioOf(TTLCounter.Sales30Days).MatchGreater(0.01) |
Check: The 1 percent figure in the source is not a scheme or acquirer threshold; card-scheme chargeback monitoring thresholds vary by scheme and may count by number rather than value. Verify before use. Tag: Ratio · Fraud · Merchant · 30d, ≥ 1% |
| 4.4-11 | Refund-to-sales ratio | Refund share of sales. | TTL Counters Refunds30Days and Sales30Days keyed on MerchantId, Sum on CurrencyAmount. The 0.2 is a placeholder. | Matched = TTLCounter.Refunds30Days.RatioOf(TTLCounter.Sales30Days).MatchGreater(0.2) |
Tag: Ratio · Both · Merchant · 30d |
| 4.4-12 | Fraud-to-sales ratio (TC40/SAFE reported) | Reported-fraud share of sales. | Fraud-to-sales ratio read from two TTL Counters keyed on MerchantId over 30 days: ReportedFraudSum30d is a sum fed by the scheme report feed, and SalesSum30d is a sum of sales amounts. Upstream field: Payload.ReportedFraudAmount, supplied before Jube or by an inline-script hook. Ratio 0.01 is an illustrative placeholder. | Matched = TTLCounter.ReportedFraudSum30d.MatchRatioOfAbove(TTLCounter.SalesSum30d, 0.01) |
Check: Confirm the report names (TC40 and SAFE), the filing lag and the feed that carries them before relying on the rule. Tag: Ratio · Fraud · Merchant · 30d |
| 4.4-13 | Card-not-present to card-present ratio | Skew to CNP. | TTL Counters CardNotPresentCount30Days and CardPresentCount30Days keyed on MerchantId, Sum off, incremented by card-not-present and card-present conditions (a placeholder field Payload.IsCardNotPresent). The 3 is a placeholder. | Matched = TTLCounter.CardNotPresentCount30Days.RatioOf(TTLCounter.CardPresentCount30Days).MatchGreater(3) |
Tag: Ratio · Fraud · Merchant/Card · 30d |
| 4.4-14 | Keyed-entry to chip/contactless ratio | High manual-key share suggests fraud or skimming. | TTL Counters KeyedCount30Days and ChipOrContactlessCount30Days keyed on MerchantId, Sum off, incremented on a placeholder payload field Payload.EntryMode. The 0.5 is a placeholder. | Matched = TTLCounter.KeyedCount30Days.RatioOf(TTLCounter.ChipOrContactlessCount30Days).MatchGreater(0.5) |
Tag: Ratio · Fraud · Merchant · 30d |
| 4.4-15 | Average ticket to merchant average ratio | Transaction value relative to the merchant’s norm. | Average Abstraction Rule over CurrencyAmount, Search Key MerchantId, Search Interval 30 Days, giving a per-merchant norm for the ticket. The 3 is a placeholder. | Matched = Payload.CurrencyAmount.RatioOf(Abstraction.MeanAmountByMerchant30d).MatchGreater(3) |
Tag: Ratio · Fraud · Merchant · 30d |
| 4.4-16 | Single-payment share of monthly turnover | One transaction dominates the month. | Max Abstraction Rule over CurrencyAmount, Search Key AccountId, Search Interval 30 Days, divided by TTL Counter Turnover30Days keyed on AccountId. The Abstraction window and the counter should both exclude or both include the current payment. The 0.5 is a placeholder. | Matched = Abstraction.MaxAmount30d.RatioOf(TTLCounter.Turnover30Days).MatchGreater(0.5) |
Tag: Ratio · AML · Account · 30d |
| 4.4-17 | Loan amount to income ratio | Credit request out of proportion to income. | Single event. LoanAmount and DeclaredAnnualIncome both come from the application payload (placeholder names). The 5 is a placeholder. | Matched = Payload.LoanAmount.RatioOf(Payload.DeclaredAnnualIncome.ToDoubleOrNaN()).MatchGreater(5) |
Check: Any loan-to-income cap used as the threshold is a lender or regulator limit that varies by jurisdiction; verify the current rule and value before use. Tag: Ratio · Fraud · Application · single event |
| 4.4-18 | Early repayment to loan size ratio | Loan repaid in full soon after drawdown, often with third-party funds. | TTL Counter EarlyRepaymentAmount90Days keyed on LoanId, Sum on the repayment amount, incremented only within 90 days of drawdown. It is read against the loan amount in the payload. The 0.5 is a placeholder. | Matched = TTLCounter.EarlyRepaymentAmount90Days.RatioOf(Payload.LoanAmount).MatchGreater(0.5) |
Tag: Ratio · AML · Account · 90d |
| 4.4-19 | Overpayment ratio on credit/loan | Overpayments followed by refunds. | TTL Counters Overpayments90Days and Repayments90Days keyed on AccountId, Sum on the repayment amount. Overpayments increment on a placeholder payload flag Payload.IsOverpayment. The 0.3 is a placeholder. | Matched = TTLCounter.Overpayments90Days.RatioOf(TTLCounter.Repayments90Days).MatchGreater(0.3) |
Tag: Ratio · AML · Account · 90d |
| 4.4-20 | Payment from third party to loan ratio | Share of loan repaid by non-borrowers. | TTL Counters ThirdPartyRepayments90Days and Repayments90Days keyed on AccountId, with the third-party counter incremented on a placeholder payload flag Payload.IsThirdPartyPayer. The 0.5 is a placeholder. | Matched = TTLCounter.ThirdPartyRepayments90Days.RatioOf(TTLCounter.Repayments90Days).MatchGreater(0.5) |
Tag: Ratio · AML · Account · 90d |
| 4.4-21 | Utilisation ratio on revolving credit | Credit line used close to limit rapidly. | Single balance against limit, from two payload fields, Balance and CreditLimit. The word rapidly needs a second condition against a baseline, such as Abstraction.MeanBalance30d, which this fragment does not include. The 0.9 is a placeholder. | Matched = Payload.Balance.RatioOf(Payload.CreditLimit).MatchGreater(0.9) |
Tag: Ratio · Fraud · Account · 30d |
| 4.4-22 | Cash advance to credit limit ratio | Cash advances as fraction of limit. | TTL Counter CashAdvance30Days keyed on CardId, Sum on CurrencyAmount, incremented by a cash advance condition, read against the CreditLimit payload field. The 0.5 is a placeholder. | Matched = TTLCounter.CashAdvance30Days.RatioOf(Payload.CreditLimit).MatchGreater(0.5) |
Tag: Ratio · Fraud · Card · 30d |
| 4.4-23 | Trade invoice value to market value ratio (over/under-invoicing) | Goods priced far from market. | Dictionary UnitMarketPrice keyed on a placeholder payload field GoodsCode holds the curated reference price per unit. The band of 0.8 to 1.2 is a placeholder. Reference prices go stale and need a refresh process. | Matched = Payload.InvoiceValue.RatioOf(Payload.Quantity.Times(Dictionary.UnitMarketPrice)).MatchOutsideRange(0.8, 1.2) |
Tag: Ratio · AML · Trade · single event |
| 4.4-24 | Quantity declared to shipped ratio | Mismatch between invoice and shipping data. | Single event. QuantityDeclared and QuantityShipped both come from the trade payload (placeholder names). The band of 0.95 to 1.05 is a placeholder. | Matched = Payload.QuantityDeclared.ToDoubleOrNaN().RatioOf(Payload.QuantityShipped.ToDoubleOrNaN()).MatchOutsideRange(0.95, 1.05) |
Tag: Ratio · AML · Trade · single event |
| 4.4-25 | Premium to policy value ratio | Over-funding of insurance products. | TTL Counter Premiums90Days keyed on PolicyId, Sum on the premium amount, read against the PolicyValue payload field. The 0.5 is a placeholder. | Matched = TTLCounter.Premiums90Days.RatioOf(Payload.PolicyValue).MatchGreater(0.5) |
Tag: Ratio · AML · Policy · 90d |
| 4.4-27 | Reverse-to-original transaction ratio | Share reversed or voided. | TTL Counters Reversals7Days and Originals7Days keyed on TerminalId, Sum off, incremented on reversal and original transaction conditions. The 0.1 is a placeholder. | Matched = TTLCounter.Reversals7Days.RatioOf(TTLCounter.Originals7Days).MatchGreater(0.1) |
Tag: Ratio · Fraud · Terminal · 7d |
| 4.4-28 | Voided transaction ratio per cashier | Void rate by employee. | TTL Counters Voids7Days and Transactions7Days keyed on EmployeeId, Sum off, incremented on void and transaction conditions. The 0.05 is a placeholder. | Matched = TTLCounter.Voids7Days.RatioOf(TTLCounter.Transactions7Days).MatchGreater(0.05) |
Tag: Ratio · Fraud · Employee · 7d |
| 4.4-29 | Manual override ratio per employee | Share of manual overrides. | TTL Counters ManualOverrides7Days and Transactions7Days keyed on EmployeeId, Sum off. The 0.1 is a placeholder. | Matched = TTLCounter.ManualOverrides7Days.RatioOf(TTLCounter.Transactions7Days).MatchGreater(0.1) |
Tag: Ratio · Fraud · Employee · 7d |
| 4.4-30 | Rejected-to-submitted ratio on applications | High decline ratio by introducer. | TTL Counters Rejected30Days and Submitted30Days keyed on IntroducerId, Sum off. The 0.5 is a placeholder. | Matched = TTLCounter.Rejected30Days.RatioOf(TTLCounter.Submitted30Days).MatchGreater(0.5) |
Tag: Ratio · Fraud · Introducer · 30d |
| 4.4-31 | Mobile-to-web login ratio shift | Large change in channel share (takeover). | TTL Counters MobileLogins30Days and Logins30Days keyed on AccountId, and the same pair over 180 days. The source gives the 30 day ratio only, so this adds the 180 day baseline, since a large change needs one. The 0.2 is a placeholder. | Matched = TTLCounter.MobileLogins30Days.RatioOf(TTLCounter.Logins30Days).AbsoluteDifferenceFrom(TTLCounter.MobileLogins180Days.RatioOf(TTLCounter.Logins180Days)).MatchGreater(0.2) |
Tag: Ratio · Fraud · Account · 30d |
4.5 Trend and acceleration
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 4.5-01 | Week-over-week turnover growth | Rapid acceleration of turnover. | TTL Counters Turnover7Days and Turnover14Days (Interval Days 7 and 14) keyed on AccountId, Sum on CurrencyAmount. Both windows are rolling and end now, so the previous week is the 14 day counter minus the 7 day counter. The 1, meaning a doubling, is a placeholder. | Matched = TTLCounter.Turnover7Days.Plus(Payload.CurrencyAmount).RelativeChangeFrom(TTLCounter.Turnover14Days.DifferenceFrom(TTLCounter.Turnover7Days)).MatchGreater(1) |
Tag: Baseline · AML · Account · 4w |
| 4.5-02 | Month-over-month growth in cash deposits | Rising trend in cash. | TTL Counters CashDeposits30Days and CashDeposits60Days keyed on AccountId, Sum on CurrencyAmount over cash deposits. The change compares this 30 days with the 30 before it. The source’s six month trend would need more windows or a slope across them. The 0.5 is a placeholder. | Matched = TTLCounter.CashDeposits30Days.RelativeChangeFrom(TTLCounter.CashDeposits60Days.DifferenceFrom(TTLCounter.CashDeposits30Days)).MatchGreater(0.5) |
Tag: Baseline · AML · Account · 6m |
| 4.5-04 | Decreasing balance trend with rising outflow | Bust-out signs on credit accounts. | Two conditions in one rule. The first is the drawdown of Payload.Balance from the 90 day maximum of Abstraction Rule MaxBalance90d, with Search Key AccountId. The second is TTL Counter Outbound30Days read against Outbound90Days scaled to a 30 day average. Both thresholds are placeholders. | Matched = Payload.Balance.PercentBelowThreshold(Abstraction.MaxBalance90d).MatchGreater(30) And TTLCounter.Outbound30Days.RatioOf(TTLCounter.Outbound90Days.RatioOf(3)).MatchGreater(1.5) |
Tag: Baseline · Fraud · Account · 90d |
| 4.5-05 | Decay of activity before closure | Activity drops and then a large final transfer. | TTL Counters Count30Days and Count90Days (Sum off) keyed on AccountId, read for the decay of activity, and the final transfer read against Abstraction MeanAmount90d. The closure event is a placeholder payload flag, Payload.IsAccountClosure, which could gate a second Activation Rule. Both thresholds are placeholders. | Matched = TTLCounter.Count30Days.RatioOf(TTLCounter.Count90Days.RatioOf(3)).MatchLess(0.5) And Payload.CurrencyAmount.RatioOf(Abstraction.MeanAmount90d).MatchGreater(2) |
Tag: Baseline · AML · Account · 90d |
| 4.5-08 | Rate of change of decline ratio | Rising decline ratio over short intervals. | TTL Counters Declines1Hour, Total1Hour, Declines2Hours and Total2Hours keyed on MerchantId (Interval Hours 1 and 2, Sum off). The previous hour’s ratio is the two hour counter minus the one hour counter, per the two hour total. SlopeFrom takes an elapsed value of 1 hour. The 0.1 is a placeholder. | Matched = TTLCounter.Declines1Hour.RatioOf(TTLCounter.Total1Hour).SlopeFrom(TTLCounter.Declines2Hours.DifferenceFrom(TTLCounter.Declines1Hour).RatioOf(TTLCounter.Total2Hours.DifferenceFrom(TTLCounter.Total1Hour)), 1).MatchGreater(0.1) |
Tag: Baseline · Fraud · Merchant · 1h |
4.6 Sector-specific baselines and ratios
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 4.6-01 | Claim amount versus policy premium ratio (insurance) | Claim far exceeds premium history. | Single event against the lifetime premium history. Payload.PremiumsPaidLifetime is a placeholder payload field, because TTL windows are bounded (Years is the longest interval) and cannot hold a lifetime total. The 1 is a placeholder. | Matched = Payload.ClaimAmount.RatioOf(Payload.PremiumsPaidLifetime.ToDoubleOrNaN()).MatchGreater(1) |
Tag: Ratio · Fraud · Policy · lifetime |
| 4.6-02 | Claim amount versus peer claims for the same peril | Outlier claim size. | Mean and Standard Deviation Abstraction Rules over ClaimAmount, Search Key Payload.Peril (a placeholder field), Search Interval 12 Months, with a Count Abstraction Rule on the same key as the cold start guard. The z threshold of 3 is a placeholder. | Matched = Abstraction.CountClaimByPeril12Months.RequireGreaterOrEqual(30).Against(Payload.ClaimAmount).MatchZScoreAbove(Abstraction.MeanClaimByPeril12Months, Abstraction.StdDevClaimByPeril12Months, 3) |
Tag: Baseline · Fraud · Claim vs peer · 12m |
| 4.6-03 | Loss ratio per broker above peers | Broker book performing abnormally. | The broker ratio is an Abstraction Calculation, BrokerLossRatio12Months, defined as Abstraction.BrokerClaims12Months.RatioOf(Abstraction.BrokerPremiums12Months) with the Abstraction Rules keyed on BrokerId over a 12 month Search Interval. The threshold is an illustrative placeholder; comparing each broker with a portfolio figure needs a stored peer value, which is outside one fragment. | Matched = AbstractionCalculation.BrokerLossRatio12Months.MatchGreater(1.5) |
Tag: Ratio · Fraud · Broker · 12m |
| 4.6-04 | Repair cost versus vehicle value ratio | Repair exceeds plausible share of value. | Single event. RepairCost and VehicleValue both come from the claim payload (placeholder names). The 0.5 is a placeholder. | Matched = Payload.RepairCost.ToDoubleOrNaN().RatioOf(Payload.VehicleValue).MatchGreater(0.5) |
Tag: Ratio · Fraud · Claim · single event |
| 4.6-05 | Surrender value withdrawn versus premium paid ratio | Policy used as pass-through. | TTL Counter SurrenderWithdrawals keyed on PolicyId, Sum on the withdrawal amount, read against the lifetime premium Payload.PremiumsPaidLifetime as in 4.6-01. The 0.9 is a placeholder. | Matched = TTLCounter.SurrenderWithdrawals.RatioOf(Payload.PremiumsPaidLifetime.ToDoubleOrNaN()).MatchGreater(0.9) |
Tag: Ratio · AML · Policy · lifetime |
| 4.6-06 | Wagering-to-deposit ratio low (gaming) | Money cycled with minimal play. | TTL Counters Wagered30Days and Deposits30Days keyed on PlayerId, Sum on amounts. Zero deposits give NaN and fail closed. The 0.5 is a placeholder. | Matched = TTLCounter.Wagered30Days.RatioOf(TTLCounter.Deposits30Days).MatchLess(0.5) |
Tag: Ratio · AML · Player · 30d, < 0.5 |
| 4.6-07 | Win rate far above expected for game | Collusion/bot/bonus abuse. | TTL Counters Wins30Days and Plays30Days keyed on PlayerId, Sum off. Dictionary ExpectedWinRateByGame, keyed on a placeholder GameId field, holds the expected rate. A minimum of plays, 50 as a placeholder, stops a small sample firing. A missing game key returns zero, which makes any win rate above zero exceed the expectation, so the Dictionary must carry every game. | Matched = TTLCounter.Plays30Days.MatchGreater(50) And TTLCounter.Wins30Days.RatioOf(TTLCounter.Plays30Days).MatchGreater(Dictionary.ExpectedWinRateByGame) |
Tag: Baseline · Fraud · Player · 30d |
| 4.6-08 | Withdrawal-to-deposit ratio near 1 (gaming) | Deposit and withdraw. | TTL Counters Withdrawals30Days and Deposits30Days keyed on PlayerId, Sum on amounts. The band of 0.9 to 1.1 is a placeholder; the source gives none. | Matched = TTLCounter.Withdrawals30Days.RatioOf(TTLCounter.Deposits30Days).MatchInRange(0.9, 1.1) |
Tag: Ratio · AML · Player · 30d |
| 4.6-09 | Deposit size versus declared income (gaming affordability) | Affordability threshold. | TTL Counter Deposits30Days keyed on PlayerId, read against DeclaredMonthlyIncome from KYC in the payload (a placeholder name). The 0.5 is a placeholder. | Matched = TTLCounter.Deposits30Days.RatioOf(Payload.DeclaredMonthlyIncome.ToDoubleOrNaN()).MatchGreater(0.5) |
Check: Affordability thresholds for gambling are set by the regulator in some jurisdictions; verify the current figure before using any value. Tag: Ratio · Both · Player · 30d |
| 4.6-10 | Trade size versus account equity (brokerage) | Oversized trades. | Single event. TradeValue and AccountEquity both come from the trade payload (placeholder names). The 0.5 is a placeholder. | Matched = Payload.TradeValue.RatioOf(Payload.AccountEquity.ToDoubleOrNaN()).MatchGreater(0.5) |
Tag: Ratio · Both · Account · single event |
| 4.6-11 | Order-to-trade ratio high | Many orders per execution (spoofing). | TTL Counters Orders1Day and Trades1Day keyed on AccountId, Sum off, Interval Days 1. The 10 is a placeholder. | Matched = TTLCounter.Orders1Day.RatioOf(TTLCounter.Trades1Day).MatchGreater(10) |
Check: Any order-to-trade cut-off is a venue or regulator figure; the source gives none. Verify before use. Tag: Ratio · Fraud · Account · 1d |
| 4.6-12 | Profit concentrated in illiquid securities | Gains in thin markets (manipulation). | TTL Counters IlliquidProfit90Days and TotalProfit90Days keyed on AccountId, Sum on profit. The illiquid counter is incremented only when Dictionary SecurityIlliquidity, keyed on a placeholder SecurityId field, is above zero. The positive total guards against a negative denominator giving a meaningless share. The 0.5 is a placeholder. | Matched = TTLCounter.IlliquidProfit90Days.RatioOf(TTLCounter.TotalProfit90Days).MatchGreater(0.5) And TTLCounter.TotalProfit90Days.MatchGreater(0) |
Tag: Ratio · AML · Account · 90d |
| 4.6-14 | Stablecoin share of volume | Proportion in stablecoins. | TTL Counters StablecoinVolume30Days and TotalVolume30Days keyed on AccountId, Sum on CurrencyAmount. StablecoinVolume30Days is incremented by an Activation Rule whose condition is Payload.Asset.MatchInList(List.Stablecoins), a maintained List. The 0.5 is a placeholder. | Matched = TTLCounter.StablecoinVolume30Days.RatioOf(TTLCounter.TotalVolume30Days).MatchGreater(0.5) |
Tag: Ratio · AML · Account · 30d |
| 4.6-15 | Privacy-coin share of volume | Proportion in privacy-enhanced assets. | As 4.6-14, with the privacy-coin List (List.PrivacyCoins) gating PrivacyCoinVolume30Days. The 0.2 is a placeholder. | Matched = TTLCounter.PrivacyCoinVolume30Days.RatioOf(TTLCounter.TotalVolume30Days).MatchGreater(0.2) |
Tag: Ratio · AML · Account · 30d |
| 4.6-16 | High-risk-exposure share of inbound on-chain funds | Portion of inbound tainted by flagged sources. | Ratio of tainted inbound value to total inbound value over 30 days, from two TTL sum Counters keyed on AccountId. The tainted counter is incremented only where the exposure verdict is above a placeholder cut-off. Upstream field: Payload.InboundRiskExposure, supplied before Jube or by an inline-script hook. Ratio 0.2 and cut-off 0.5 are illustrative placeholders. | Matched = TTLCounter.TaintedInbound30Days.MatchRatioOfAbove(TTLCounter.Inbound30Days, 0.2) |
Tag: Ratio · AML · Account · 30d |
| 4.6-17 | Agent float turnover versus peers (mobile money) | Agent float cycling abnormally. | TTL Counter FloatTurnover7Days keyed on AgentId, Sum on the float amount. Abstraction Rules, a Sum of the float amount and a Distinct Count of AgentId, both with Search Key Payload.AgentTier (a placeholder) over 7 Days, give the per-agent average, which is the peer figure. The 2 is a placeholder. | Matched = TTLCounter.FloatTurnover7Days.MatchGreater(Abstraction.SumFloatByTier7d.RatioOf(Abstraction.DistinctAgentsByTier7d).Times(2)) |
Tag: Baseline · AML · Agent vs peer · 7d |
| 4.6-18 | Airtime purchase to wallet activity ratio | Airtime dominating wallet use. | TTL Counters AirtimeSpend30Days and WalletActivity30Days keyed on WalletId, Sum on amounts. AirtimeSpend30Days is gated on Payload.TxnType.MatchEqual(“Airtime”), a placeholder value. The 0.4 is a placeholder. | Matched = TTLCounter.AirtimeSpend30Days.RatioOf(TTLCounter.WalletActivity30Days).MatchGreater(0.4) |
Tag: Ratio · AML · Wallet · 30d |
| 4.6-19 | Remittance send amount versus occupation baseline | Sends exceed income plausibility. | TTL Counter Sent90Days keyed on WalletId, Sum on the send amount, read against Dictionary OccupationIncomeNorm90Days, keyed on a placeholder OccupationCode field. The norm is external reference data. The 1 is a placeholder. | Matched = TTLCounter.Sent90Days.RatioOf(Dictionary.OccupationIncomeNorm90Days).MatchGreater(1) |
Tag: Baseline · AML · Sender · 90d |
| 4.6-20 | Vendor payment amount versus purchase order (corporate) | Overpayment ratio. | Single invoice. InvoiceAmount and PurchaseOrderAmount both come from the accounts payable payload (placeholder names). The 1.1 is a placeholder. | Matched = Payload.InvoiceAmount.RatioOf(Payload.PurchaseOrderAmount).MatchGreater(1.1) |
Tag: Ratio · Fraud · Vendor · per invoice |
| 4.6-21 | Expense claim versus role baseline | Claims above role norm. | Average Abstraction Rule over ExpenseAmount, a placeholder field, with Search Key Payload.Role (a placeholder) and Search Interval 90 Days. PercentDeviationFromMean measures the claim against the role norm. The 100 percent is a placeholder. | Matched = Payload.ExpenseAmount.PercentDeviationFromMean(Abstraction.MeanExpenseByRole90d).MatchGreater(100) |
Tag: Baseline · Fraud · Employee · 90d |
| 4.6-22 | Payroll amount change versus prior run | Unexplained changes. | Payroll amount deviates from the prior run by more than a percentage. Upstream field: Payload.PreviousRunAmount, supplied before Jube or by an inline-script hook. Percent 20 is an illustrative placeholder. | Matched = Payload.CurrencyAmount.MatchDeviatesFromByPercent(Payload.PreviousRunAmount, 20) |
Tag: Baseline · Fraud · Employee · per run |
| 4.6-23 | Return rate per customer versus platform baseline (e-commerce) | Return abuse. | The customer rate is an Abstraction Calculation, ReturnRate90Days, defined as Abstraction.Returns90Days.RatioOf(Abstraction.Orders90Days) keyed on CustomerId over a 90 day Search Interval. The threshold is an illustrative placeholder for the platform baseline, which is set by tuning rather than compared inside the fragment. | Matched = AbstractionCalculation.ReturnRate90Days.MatchGreater(0.3) |
Tag: Ratio · Fraud · Account · 90d |
| 4.6-24 | Discount share of order value | Heavy promo stacking. | Single order. DiscountAmount and OrderValue both come from the order payload (placeholder names). The 0.3 is a placeholder. | Matched = Payload.DiscountAmount.RatioOf(Payload.OrderValue).MatchGreater(0.3) |
Tag: Ratio · Fraud · Account · 30d |
| 4.6-25 | Seller refund-to-sales ratio | Seller refund abuse. | TTL Counters Refunds30Days and Sales30Days keyed on SellerId, Sum on CurrencyAmount. The 0.3 is a placeholder. | Matched = TTLCounter.Refunds30Days.RatioOf(TTLCounter.Sales30Days).MatchGreater(0.3) |
Tag: Ratio · Fraud · Seller · 30d |
| 4.6-26 | Trip distance versus fare ratio (ride-hailing) | Fare manipulation. | Single trip. Pickup and drop-off coordinates and the fare are payload fields (placeholder names). HaversineDistanceKilometers gives the straight-line distance, which understates road distance, so the band is tolerant. Dictionary FarePerKm, keyed on a placeholder region field, gives the expected fare per kilometre. | Matched = Payload.Fare.ToDoubleOrNaN().RatioOf(Payload.PickupLatitude.HaversineDistanceKilometers(Payload.PickupLongitude, Payload.DropLatitude, Payload.DropLongitude).Times(Dictionary.FarePerKm)).MatchOutsideRange(0.5, 1.5) |
Tag: Ratio · Fraud · Trip · single event |
| 4.6-27 | BNPL repayment default ratio by merchant | Merchant with high default share. | TTL Counters Defaults90Days and BnplLoans90Days keyed on MerchantId, Sum off. The 0.1 is a placeholder. | Matched = TTLCounter.Defaults90Days.RatioOf(TTLCounter.BnplLoans90Days).MatchGreater(0.1) |
Tag: Ratio · Fraud · Merchant · 90d |
| 4.6-28 | Loan-to-value ratio out of policy | Lending ratio exceptions. | Single event. LoanAmount and PropertyValue come from the application payload (placeholder names). The 0.8 stands in for a lender or regulator cap, which is a placeholder. | Matched = Payload.LoanAmount.RatioOf(Payload.PropertyValue).MatchGreater(0.8) |
Check: LTV caps are lender policy or regulator limits and vary by jurisdiction; verify the current cap before using any value. Tag: Ratio · Fraud · Application · single event |
| 4.6-29 | Debt-service to income ratio inconsistent with declared income | Affordability mismatch. | Single event. DebtServiceMonthly and DeclaredMonthlyIncome come from the application payload (placeholder names). The 0.4 is a placeholder. | Matched = Payload.DebtServiceMonthly.ToDoubleOrNaN().RatioOf(Payload.DeclaredMonthlyIncome.ToDoubleOrNaN()).MatchGreater(0.4) |
Check: Debt-service limits are regulator-set in some jurisdictions; verify before using any figure. Tag: Ratio · Fraud · Application · single event |
| 4.6-30 | Donation inflow versus programme outflow ratio (NPO) | Funds not reaching stated purpose. | TTL Counters ProgrammeOutflow12Months and DonationInflow12Months keyed on NpoId, Sum on amounts (Interval Months 12). A low outflow-to-inflow ratio is the funds-not-reaching-purpose signal, so the test is MatchLess. The 0.5 is a placeholder. | Matched = TTLCounter.ProgrammeOutflow12Months.RatioOf(TTLCounter.DonationInflow12Months).MatchLess(0.5) |
Tag: Ratio · AML · NPO · 12m |
4.7 Statistical and distributional tests
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 4.7-01 | Benford’s-law deviation on amounts | First-digit distribution deviates (fabricated figures, invoice fraud). | Nine TTL Counters, LeadDigit1Count90Days to LeadDigit9Count90Days, keyed on AccountId with Sum off, each incremented by an always-matching Activation Rule that tests the leading digit, for example Matched = Payload.CurrencyAmount.LeadingSignificantDigit() = 1 for digit 1. Count90Days is the total. The expected count for each digit is the total times its Benford probability, 0.30103 for 1 down to 0.04576 for 9. The sum of squared standardised differences is a chi-square statistic, and 15.51 is the chi-square 0.05 critical value for eight degrees of freedom, a choice rather than a source figure. A minimum total count must be required before the test, which this fragment does not include. | Matched = TTLCounter.LeadDigit1Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.30103)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.30103)).SumWith(TTLCounter.LeadDigit2Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.17609)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.17609)), TTLCounter.LeadDigit3Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.12494)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.12494)), TTLCounter.LeadDigit4Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.09691)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.09691)), TTLCounter.LeadDigit5Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.07918)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.07918)), TTLCounter.LeadDigit6Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.06695)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.06695)), TTLCounter.LeadDigit7Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.05799)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.05799)), TTLCounter.LeadDigit8Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.05115)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.05115)), TTLCounter.LeadDigit9Count90Days.DifferenceFrom(TTLCounter.Count90Days.Times(0.04576)).Pow(2).DividedBy(TTLCounter.Count90Days.Times(0.04576))).MatchGreater(15.51) |
Check: Benford first-digit probabilities are log10(1 plus 1 over d): 0.30103, 0.17609, 0.12494, 0.09691, 0.07918, 0.06695, 0.05799, 0.05115, 0.04576. Verify these if used as constants. The critical value is a chi-square quantile for eight degrees of freedom; choose it deliberately. Tag: Baseline · Fraud · Entity · 90d |
| 4.7-02 | Round-number proportion above baseline | Share of round amounts unusually high. | TTL Counters RoundAmountCount30Days and RoundAmountCount180Days keyed on AccountId, Sum off, incremented by Payload.CurrencyAmount.IsRoundAmount(1000), where 1000 is a placeholder unit. Count30Days and Count180Days are the denominators. The 2 is a placeholder. | Matched = TTLCounter.RoundAmountCount30Days.RatioOf(TTLCounter.Count30Days).MatchGreater(TTLCounter.RoundAmountCount180Days.RatioOf(TTLCounter.Count180Days).Times(2)) |
Tag: Ratio · Both · Account · 30d |
| 4.7-03 | Amount entropy drop | Transactions become unusually uniform. | TTL Counters Bucket1Count to Bucket4Count per amount band, keyed on AccountId, Sum off, each incremented by a band test on CurrencyAmount (the band limits are placeholders). EntropyOfSharesWith gives the Shannon entropy in bits across the bands. The baseline is the same calculation over 180 days, and the 0.8 multiplier is a placeholder. | Matched = TTLCounter.Bucket1Count30Days.EntropyOfSharesWith(TTLCounter.Bucket2Count30Days, TTLCounter.Bucket3Count30Days, TTLCounter.Bucket4Count30Days).MatchLess(TTLCounter.Bucket1Count180Days.EntropyOfSharesWith(TTLCounter.Bucket2Count180Days, TTLCounter.Bucket3Count180Days, TTLCounter.Bucket4Count180Days).Times(0.8)) |
Check: The title says entropy drop, but the description says transactions become unusually uniform, which is high entropy. Confirm the intended direction before building it. Tag: Baseline · Fraud · Account · 30d |
| 4.7-04 | Inter-arrival time regularity (robotic cadence) | Events spaced too evenly. | Coefficient of variation of the gaps between events over 24 hours, from Abstraction Rules over Payload.SecondsSinceLastEvent (Search Key AccountId): StdDev and Mean. Upstream field: Payload.SecondsSinceLastEvent, supplied before Jube or by an inline-script hook. Bound 0.1 is an illustrative placeholder. | Matched = Abstraction.StdDevSecondsSinceLast24h.MatchCoefficientOfVariationBelow(Abstraction.MeanSecondsSinceLast24h, 0.1) |
Tag: Baseline · Fraud · Account · 24h |
| 4.7-05 | Burstiness index | Clustering of events in time well above norm. | Burstiness index B = (sigma minus mu) over (sigma plus mu), from Abstraction Rules over Payload.SecondsSinceLastEvent over 7 days. B is above 0.2 exactly when the coefficient of variation sigma over mu is above 1.5, so the fragment tests that. Upstream field: Payload.SecondsSinceLastEvent, supplied before Jube or by an inline-script hook. Bound 1.5 (B above 0.2) is an illustrative placeholder. | Matched = Abstraction.StdDevSecondsSinceLast7d.MatchCoefficientOfVariationAbove(Abstraction.MeanSecondsSinceLast7d, 1.5) |
Tag: Baseline · Both · Account · 7d |
| 4.7-07 | Kurtosis/skew change in amount distribution | Shape change. | Skewness Abstraction Rules over CurrencyAmount, Search Key AccountId, one over 90 Days and one over 30 Days. Kurtosis is the same with its own Abstraction Rules. Non-finite Abstraction results are sanitised to zero, so a short window reads as zero rather than undefined, and a minimum count must guard it. The 1 is a placeholder. | Matched = Abstraction.Skewness90d.AbsoluteDifferenceFrom(Abstraction.Skewness30d).MatchGreater(1) |
Tag: Baseline · Both · Account · 90d |
| 4.7-08 | Coefficient of variation of deposits | Very low variance in cash deposits (structured). | Standard Deviation and Average Abstraction Rules over CurrencyAmount, Search Key AccountId, filtered to cash deposits, Search Interval 30 Days. A minimum deposit count must guard it, since one or two deposits can give a low spread by chance. The 0.3 is a placeholder. | Matched = Abstraction.StdDevDeposit30d.CoefficientOfVariation(Abstraction.MeanDeposit30d).MatchLess(0.3) |
Tag: Baseline · AML · Account · 30d |
| 4.7-10 | Percentile rank within peer group above 99th | Extreme relative to peers. | Single event. The peer percentile rank is precomputed upstream and supplied as PeerPercentile (placeholder). The 99 cut-off is illustrative. | Matched = Payload.PeerPercentile.MatchGreater(99) |
Tag: Baseline · Both · Customer · 30d |