Can I apply Hidden Markov Models this way?

Question

I have just gotten my feet wet with Hidden Markov Models. Now I want to apply them to tell whether a transaction from an ATM is suspicious or not. I have great confusion in defining my Hidden States.

My attempt: A transaction is either suspicious or non-suspicious. Since I cannot tell, ("this is hidden to me"), whether a transaction is suspicious or not before analyzing it, therefore my Hidden States(Suspicious, Non-Suspicious). Does this hold?

My great confusion: When I read about Hidden Markov Models on Weather example, I understood it this way: "weather can be rainy or sunny - I mean its the 'same' weather that is switching between the two states". In my transaction case - one transaction cannot switch between being suspicious and non-suspicious. So, does my hidden states hold?

Questions: Does my hidden states hold? Can I apply the HMM that way? Please advice, thanks.

P.S: I had my Observations as location, time and amount of money but as of now I want clarification on Hidden states.

Answer 1

This is a reasonable application for a hidden markov model only if you have reason to believe that the transactions have the markov property - that the next state depends only on the present state, and not on any of the previous ones. This often makes sense for models in time series (like in the weather example, in which the fact that it's already raining makes it more likely that in the next time step it will still be raining). Of course, the model can be useful even if it's not a perfect fit.

The way you've formulated the model is saying that the hidden state (suspicious/non-suspicious) of an ATM may be predictive of the emitted, or observed states (location, time, and amount of money). At least for the first two, this feels a bit off, particularly if there are multiple ATMs involved, as is suggested by the presence of a location variable. I'll try to explain what I think the way you've formulated the model suggests in terms of observed variables and how it might be nonsensical, and suggest some alternatives.

First, this seems to suggest that suspicious/non-suspicious is a shared state of all ATMs, and that that state somehow influences where an ATM is being used (each hidden state has a particular distribution from the location is drawn). It may make more sense to have a separate model for each ATM location. Maybe this is already what you were intending. If that is the case, location wouldn't really be an observed variable. Instead of thinking of the transactions switching between states, which doesn't seem to make much sense, as you say, perhaps you want to be thinking of the ATMs switching states.

Second, it's not clear how time would be a random variable that would be emitted based on a state of suspiciousness. Instead, time would probably make more sense as the way of ordering the observations you feed into the model.

If you do want to combine all transactions into a single model, maybe an SVM would be more straightforward as a binary classifier.