Time-Based Anomaly Detection in Financial Transactions

Project Overview

This project analyzes anomalous behavior in financial transaction data by examining transaction patterns over time. Instead of classifying individual transactions as fraudulent, the focus is on identifying abnormal time windows that exhibit suspicious behavior.

Using a large synthetic transaction dataset (PaySim), transactions are aggregated into hour-level behavioral features. A statistical rule-based baseline is compared against an unsupervised machine learning model (Isolation Forest) to understand tradeoffs between precision and recall in anomaly detection.

---

Dataset

• Name: PaySim Synthetic Financial Transactions Dataset

• Source: Kaggle

• Description: Simulated mobile money transactions with injected fraud scenarios

• Time Feature: step (hour index since simulation start)

The dataset is not included in this repository due to size.
Download it from Kaggle and place the CSV in the data/ directory.

---

Exploratory Data Analysis (EDA)

Initial analysis focused on understanding raw transaction behavior over time.

Raw Transaction Distribution

The plot below shows individual transaction amounts over time.
A clear sustained spike of high-value transactions appears around step ~300.

---

Transaction Count per Hour

Transaction volume remains relatively stable during the anomalous period, indicating that the spike is not driven by transaction frequency.

---

Average Transaction Amount per Hour

Average transaction amounts do not spike dramatically, as extreme values are diluted by many small transactions.

---

Maximum Transaction Amount per Hour

The maximum transaction amount per hour clearly highlights a sustained anomalous period, making it the strongest anomaly signal.

---

Time-Based Feature Engineering

Transactions were aggregated by hour (step) to create behavioral features:

• Transaction count
• Average transaction amount
• Maximum transaction amount

Each hour is treated as a single data point representing system behavior during that time window.

---

Rule-Based Anomaly Detection

A statistical baseline was implemented using the following rule:

• Flag an hour as anomalous if
  max_amount > mean + 3 × standard deviation

This approach:

• Precisely detected the major anomalous period
• Produced very few false positives
• Missed low-value, distributed fraud

---

Unsupervised ML: Isolation Forest

An Isolation Forest model was trained on the hour-level features:

• Transaction count
• Average transaction amount
• Maximum transaction amount

The model learned normal system behavior and flagged anomalous hours without access to fraud labels.

---

Model Comparison & Evaluation

Detection results were evaluated at the hour level, where an hour is considered fraudulent if it contains at least one fraudulent transaction.

Key Findings

• Rule-based detection

  • Very high precision
  • Low recall
  • Effective at detecting large fraud campaigns

• Isolation Forest

  • Improved recall by identifying additional anomalous hours
  • Introduced minimal additional noise
  • Captured subtler deviations missed by rules

This highlights the classic precision–recall tradeoff in anomaly detection systems.

---

Key Takeaways

• Time aggregation strongly influences detection behavior
• Extreme-value features are effective for identifying fraud campaigns
• Rule-based methods are interpretable and precise
• Unsupervised ML adds value by improving coverage
• Not all fraud is detectable at coarse time granularity

---

Technologies Used

• Python
• pandas, NumPy
• matplotlib
• scikit-learn (Isolation Forest)
• Jupyter Notebook

---

Project Scope

This project focuses on exploratory analysis and model behavior, not production deployment.