{'fraction_non_alphanumeric': 0.01487964989059081, 'fraction_numerical': 0.00175054704595186, 'mean_word_length': 5.145161290322581, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Bayesian Methods and Extensions for the Two State Markov Modulated Poisson Process

We develop a framework for detecting fraud committed by a criminal existing outside the network of accounts he victimizes. The cornerstone of our approach is a Markov modulated Poisson process (MMPP), a Poisson process on which a second Poisson process is superimposed at random intervals determined by a Markov process. The MMPP is known in queuing theory but rare in statistics. The Markov process describes the presence/absence of the criminal. The second Poisson process describes the criminal's tra c when he is present. The theory switches from continuous time to a discrete index set by considering intervals between observations as a sequence of dependent random variables. A result from hidden Markov models (Baum et al., 1970) enables sampling of MMPP parameters from their posterior distribution, given event times, using a Gibbs sampler with only two steps per iteration. One Gibbs step reconstructs the original Poisson and Markov processes from their superposition. The other samples model parameters given the complete data. Displays are produced showing the probability a criminal is present as a function of time. Several extensions to the MMPP are developed. An expanded de nition of hidden Markov models is given, enabling consideration of background tra c generated by a nonhomogeneous Poisson process. Parallel series of events are modeled with mixtures of hierarchical models. Covariates associated with each event are allowed. The ability to stochastically reconstruct the original processes from their superposition in a single Gibbs step is preserved throughout. Our approach is an important departure from earlier fraud detection procedures focusing on characteristics of a single event. The model accepts output from such procedures as covariates, resulting in a principled accumulation of evidence over time. From an applied perspective this means the algorithm may be viewed either as a supplement to existing fraud detection systems or as a free standing procedure in its own right. This and other features of the model are illustrated on an AT&T data set containing information about fraud in international telephone tra c. This thesis was supervised by Arthur Dempster.