"The alert was correct, but it arrived after the money moved, after the password changed, after the graph connected the mule accounts, and after the analyst queue was full. Correct is not the same as on time."
A Security Operations Center Learning to Measure Time
Cybersecurity and fraud are temporal AI under adversarial pressure. The data are not a table of independent examples; they are evolving event streams over accounts, devices, IP addresses, sessions, merchants, credentials, alerts, labels, and analyst feedback. The attacker adapts, the label arrives late, the graph changes before the investigation finishes, and the decision is capacity-limited: only the top alerts can be reviewed. This makes security the application in Chapter 35 where anomaly detection, point processes, temporal graphs, online learning, uncertainty, and human-in-the-loop decision making must operate as one system.
Security teams do not need a generic anomaly score. They need a ranked queue that catches account takeover, transaction fraud, insider movement, malware beaconing, credential stuffing, privilege escalation, and lateral movement early enough to intervene. That queue must be explainable enough for an analyst, robust enough under drift, and evaluated with the labels that would actually have been known at the time. Chargebacks, confirmed incidents, takedowns, and post-investigation notes often arrive weeks or months after prediction. Treating them as immediate ground truth is one of the cleanest ways to build a model that looks excellent in a notebook and fails in a SOC.
The frontier now has three anchors. Temporal graph models represent connected abuse across entities and shared infrastructure. Log-sequence and language-model systems parse, summarize, and reason over noisy event streams. Foundation models for anomaly detection act as encoders, detectors, or interpreters, especially when labels are sparse. The deployment question remains older and harder: which alert enters the next analyst slot, what evidence is shown, how quickly is harm stopped, and how does the model adapt when attackers change behavior?
1. Security Data Are Event Streams With Adversaries
A security event is a timestamped relation: account $a$ logged in from device $d$, card $c$ paid merchant $m$, process $p$ opened socket $s$, host $h$ connected to host $h'$, analyst $u$ dismissed alert $j$. The right unit is not a row but a stream of typed events, often represented as a dynamic heterogeneous graph. Nodes are accounts, users, devices, IP addresses, hosts, merchants, sessions, payment instruments, and files. Edges are logins, transactions, transfers, process launches, DNS queries, shared-device links, and analyst actions.
This graph is temporal in two ways. First, edges have event time and ingestion time, and late events are normal. Second, the graph state used for prediction at time $t$ must include only edges known by $t$. A model that uses tomorrow's shared-device edge to flag today's account takeover has leaked the investigation future into the detection past. This is the security version of the as-of discipline from Chapter 2.
Adversaries add a control loop. Once a detector penalizes one behavior, attackers route around it: new IP ranges, lower transaction amounts, slower credential stuffing, residential proxies, mule networks, or synthetic identities. Concept drift in security is partly natural behavior change and partly an intelligent opponent probing the boundary. That is why monitoring without fresh labels, delayed-label learning, and drift-aware evaluation are not optional add-ons.
2. Label Delay, Temporal Graphs, and Analyst Queues
Fraud and incident labels often arrive after the decision. A chargeback may appear weeks after a transaction. A confirmed intrusion may be known only after forensics. Account takeover may be reported after the attacker has changed credentials and moved funds. Let $y_i$ be the true label and $\tau_i$ the time the label becomes known. The training table at time $t$ may use example $i$ only if $\tau_i \le t$, not merely if the event time is before $t$.
The operational decision is a top-$K$ ranking. If a team can review $K$ alerts per hour, then precision at $K$, detected loss at $K$, mean time to detection, and actionability at $K$ matter more than area under a curve computed over every threshold. The score should be calibrated enough to compare alerts, but the queue is where the model meets the business constraint.
Temporal graphs supply evidence. A login from a new device is suspicious; a new device shared by five recently compromised accounts is much more suspicious. A merchant with a sudden burst of cards from newly created accounts may be a fraud hub. A host process that starts communicating with infrastructure seen in other incidents may be part of lateral movement. Dynamic graph neural networks, temporal random walks, graph anomaly detectors, and graph foundation models all try to encode this evolving neighborhood without peeking at future edges.
3. From Anomaly Score to Investigation Policy
A security model usually emits a risk score $s_t(e)$ for entity or event $e$ at time $t$. The decision policy maps those scores to actions: send to analyst, force MFA, block transaction, quarantine host, step up authentication, or suppress as low value. A time-decayed feature captures a common pattern:
$$v_t(a)=\sum_{i:e_i \in a} \exp\left(-\frac{t-t_i}{\lambda}\right) w(e_i),$$where recent suspicious events count more than old ones, and $w(e_i)$ weights event type. Such features are primitive compared with a dynamic graph model, but they have two virtues: they are explainable and they are hard to accidentally train on future edges.
from collections import defaultdict
from math import exp
def risk_queue(events, now, half_life_hours=6.0, capacity=20):
decay = half_life_hours / 0.69314718056
score = defaultdict(float)
reason = defaultdict(list)
weights = {"failed_login": 1.0, "new_device": 3.0, "password_reset": 4.0, "high_value_payment": 5.0}
for event in events:
if event["time"] > now:
continue
age = (now - event["time"]).total_seconds() / 3600.0
inc = weights.get(event["type"], 0.0) * exp(-age / decay)
score[event["account"]] += inc
if inc > 0.5:
reason[event["account"]].append(event["type"])
ranked = sorted(score, key=score.get, reverse=True)[:capacity]
return [(acct, score[acct], reason[acct][-3:]) for acct in ranked]
now can enter the score, and the returned reasons are evidence the analyst can inspect.A production system replaces the hand weights with learned sequence, graph, or foundation-model representations, but the policy interface stays similar. The model ranks alerts; the queue consumes only the top capacity; the analyst needs compact evidence; and the evaluation measures which harms were stopped in time.
4. Researcher Benchmark Map
| Domain task | Public benchmark | Temporal unit and split | Baseline to beat | Modern model family | Prediction metric | Decision-value metric | Leakage trap |
|---|---|---|---|---|---|---|---|
| Account takeover and login anomaly | LANL authentication logs, enterprise auth logs where available | User-device-IP event stream, blocked by event time and ingestion time | Velocity rules, EWMA score, isolation forest | Sequence transformer, temporal graph model, anomaly foundation model | Precision-recall, precision at K | Compromised accounts stopped at analyst capacity | Using future sessions, future shared devices, or investigation labels too early |
| Transaction fraud | Credit-card fraud datasets, IEEE-CIS, financial graph benchmarks | Transaction time with delayed chargeback label | Gradient boosting with as-of aggregates | Graph neural network, temporal tabular model, delayed-label learner | Average precision, recall at fixed false-positive budget | Fraud dollars stopped, customer friction cost | Chargeback labels treated as known at transaction time |
| Temporal graph fraud | Elliptic, dynamic transaction networks, synthetic mule networks | Node or edge state by graph snapshot | Static graph features plus logistic regression | Dynamic GNN, heterogeneous graph anomaly detector, graph foundation model | Node or edge detection F1, AP | Fraud ring value disrupted and time to ring detection | Future graph edges and connected components crossing the split |
| Log anomaly and SOC triage | HDFS, BGL, Thunderbird, public log-anomaly datasets | Log line or session sequence, forward split | Template counts, n-gram model, DeepLog-style baseline | Self-supervised log transformer, LLM-assisted parser, SOC summarizer | Sequence anomaly F1, top-K alert precision | Analyst minutes saved and incidents escalated in time | Templates learned on full logs or post-incident labels used during detection |
5. Frontier Stack and Researcher Checklist
The strongest current systems combine three layers. The first layer is an as-of event store that can reconstruct the graph and feature state at any prediction time. The second layer is a family of detectors: transparent velocity and rule baselines, tabular gradient boosting for strong operational baselines, sequence models for logs and sessions, graph models for connected abuse, and foundation models for low-label anomaly detection and explanation. The third layer is the analyst policy: a top-$K$ queue, evidence packaging, escalation rules, feedback capture, and drift monitoring.
The SOC does not investigate thresholds; it investigates alerts. A defensible benchmark therefore fixes analyst capacity, label delay, event-time split, and cost table before comparing models. The best system is the one that places the right incidents into the finite queue early enough to act, with enough evidence for a human to trust the escalation.
river is useful for online baselines and drift-aware learning, pyod for anomaly detectors, ruptures for change points, and PyTorch Geometric or temporal-graph extensions for graph models. For logs, template parsers and transformer encoders handle sequence structure; LLM-based SOC tools can summarize evidence, but the risk score and evaluation must still be generated from as-of data. A simple, transparent top-K queue remains the baseline every sophisticated model should beat.
6. Exercises
A fraud model uses chargeback labels as if they were known at transaction time. Explain the label-delay leakage, define the correct as-of training table, and state how evaluation changes when analyst capacity is fixed at 500 alerts per day.
Build a temporal graph split for account, login, device, IP, and payment events. Train a transparent baseline and a graph model. Report precision at the top $K$ analyst slots, detected fraud dollars, mean time to detection, and the performance drop after removing all future edges from feature construction.
Design a monitoring protocol for a credential-stuffing detector after attackers lower their request rate and rotate residential proxies. Specify which unlabeled statistics can warn you before confirmed labels arrive, how analyst feedback should enter the model, and what rollback or shadow-test rule protects the SOC from shipping an overreactive detector.