Fraud Radar: Real-Time Transaction Fraud Detection Pipeline

A production-style, real-time transaction fraud detection system powered by an Isolation Forest anomaly model, built precisely for high-throughput streaming architectures.

Architecture

The system leverages three decoupled planes:

1. Machine Learning: An IsolationForest continuously isolates anomalous events trained natively in a semi-supervised fashion using legit-only transactions.
2. REST & WebSocket API: Exposing models over HTTP (FastAPI), validating schema configurations (Pydantic), and live streaming updates via WebSocket.
3. Streaming Pipeline: Kafka handling real-time high-velocity streams replay processing.

fraud-radar/
├── data/           # Configurable synthetic data generator module
├── ml/             # Isolation Forest model training routines and dynamic artifacts
├── api/            # FastAPI layer handling real-time push events & queries 
└── kafka/          # Message producer/consumer event-streaming layer

Running the Pipeline

This project is fully containerized. A simple Docker compose command sequentially orchestrates Zookeeper, Kafka, topic migrations, API startup (which sequentially trains the ML algorithms locally before starting), and spins up streaming producers and consumers.

Prerequisites

Ensure you have Docker and Docker Compose (v2) installed native to your local operating system.

Build and start

docker compose up --build -d

You can view the specific actions of the consumer scoring events in real time:

docker compose logs -f consumer

API Testing

With the containers running effectively, you can interact with the network natively from localhost:8000.

Check Health:

curl http://localhost:8000/health

Check System Analytics:

curl http://localhost:8000/stats

Manual Prediction via REST Request:

curl -s -X POST http://localhost:8000/score \
  -H "Content-Type: application/json" \
  -d '{
    "Amount": 8420.00,
    "Time": 86400,
    "V1": -3.5, "V2": 2.8,  "V3": -5.2, "V4": 4.1,
    "V5": -2.9, "V6": 1.7,  "V7": -4.3, "V8": 3.6,
    "V9":  2.1, "V10": -1.8,"V11": 3.3, "V12": -2.6,
    "V13": 4.7, "V14": -3.1,"V15": 2.4, "V16": -0.9,
    "V17": 1.2, "V18": -4.5,"V19": 3.8, "V20": -2.2,
    "V21": 4.0, "V22": -3.7,"V23": 2.7, "V24": -1.5,
    "V25": 3.1, "V26": -2.8,"V27": 1.9, "V28": -3.4,
    "merchant_id": "merch_0042",
    "payment_method": "CARD",
    "country": "US"
  }'

The Swagger Interface is available locally at: http://localhost:8000/docs

Streaming Live Metrics

Connect to the operational real-time feed utilizing the onboard WebSocket interface. The server sends back "pong" if you request "ping" to maintain lifecycles.

ws://localhost:8000/ws/live