Predictive Analytics
Transaction Anomaly Detection
Streaming anomaly detection over transaction events with tunable alert sensitivity.
Near real-time
Latency
Severity ranked
Alerts
Feedback driven
Learning
Architecture
Hover or tap any stage to see its role in the pipeline.
Data flow
Transactions stream through the feature pipeline where rolling behavioural baselines are maintained, the anomaly model scores each event, rules are blended in, alerts are ranked by severity and analyst dispositions feed back into threshold tuning.
Problem statement
Rule-only monitoring caught known patterns and missed novel ones, while generating high alert noise for analysts.
Business objective
Detect unusual transaction behaviour in near real time with alert volumes analysts can actually work through.
Solution overview
An unsupervised anomaly model over engineered behavioural features, combined with existing rules and a scoring layer that ranks alerts by severity.
AI / ML approach
Isolation-forest style unsupervised scoring plus per-entity baselines, blended with deterministic rules and a feedback loop from analyst dispositions.
Model / LLM used
Unsupervised anomaly detection with per-entity baselines
Technology stack
Pythonscikit-learnKafkaSparkSQLAirflow
Key capabilities
- Near real-time scoring
- Per-entity behavioural baselines
- Severity-ranked alert queue
- Analyst feedback loop
Evaluation approach
- Precision at top-k alerts as reviewed by analysts
- Coverage against known historical cases
- Alert volume monitoring per threshold setting
Challenges
- No labelled ground truth
- Seasonal behaviour shifts
- Alert fatigue
Solution decisions
- Unsupervised scoring with analyst feedback as weak supervision
- Rolling baselines rather than static thresholds
- Alert budget per analyst enforced by ranking, not by dropping signal
Business impact
Extended monitoring beyond known rules while keeping the alert queue at a volume the team can genuinely review.