BehaviourGuard LSTM
Account takeover (ATO) fraud passes Models 1 & 2 because the transaction amount looks normal and the card details are correct — only the PATTERN is wrong. This model asks: 'Is this user behaving like themselves?' A GBM scores behavioral deviation features; an LSTM reads the user's last 5 transactions as a sequence to detect unusual ordering, velocity, or hour patterns.
Testing Lab
Enter values to run a single prediction
~0.91+
Ensemble AUC
~0.87
GBM AUC
~0.89
LSTM AUC
ATO sessions
Detects
Security Report
Fill in the fields and run analysis to see the prediction result
Architecture Notes
GBM (300 estimators, max_depth=5, lr=0.05) on 19 behavioral features: amt_deviation, amt_vs_max_pct, time_since_last, gap_deviation, hour_deviation, is_rapid_tx, tx_rank_pct, user stats. LSTM: Input(5,7)→Masking→LSTM(64,return_seq)→Dropout(0.2)→LSTM(32)→Dropout(0.2)→Dense(16)→Sigmoid. Ensemble = w_gbm × GBM_score + w_lstm × LSTM_score (weights from AUC). ATO label: compromised card + transaction at or after first confirmed fraud event.