Alert Queue
Top-scored transactions from the held-out test set, ranked by the XGBoost classifier. Click a row to see why it was flagged.
| Risk | TX ID | Orig | Dest | Amount | Type | Ring |
|---|
Ring neighborhood (if this transaction belongs to a recovered ring)
Ring Explorer
Collusion rings recovered by seeding a network from the model's riskiest transactions and running community detection, scored against the ground truth the simulator recorded.
Methodology
Why simulated data
Real transaction data can't legally be shared, and the standard public fraud dataset (Kaggle's creditcard.csv) has no account IDs, so it can't support network analysis. This project simulates a transaction network with 20 injected money-laundering rings running FATF-documented typologies (structuring/smurfing, layering, round-tripping), so ground truth exists and detection quality can be measured, not claimed.
Classifier
Features are computed causally (no peeking at the future). Train/test split is time-based, not a random shuffle. XGBoost vs. a logistic regression baseline, evaluated on precision/recall/PR-AUC, the honest metrics for a ~3% fraud rate, not raw accuracy.
Explainability
Every flagged transaction carries its top SHAP-contributing features, the same style of explanation a compliance audit trail requires.
Graph ring recovery
A subgraph is seeded from the top 5% riskiest transactions, expanded to direct counterparties, then clustered with Louvain community detection. Resolution was swept from 1 to 20 and chosen at 12: the default resolution recovers most of each ring (0.82 recall) but the communities are too coarse to act on (0.07 precision, mostly unrelated accounts pulled in via camouflage transactions). Resolution 12 trades a little recall for communities an investigator could plausibly use (0.77 recall / 0.76 precision).
Full write-up, citations and code: github.com/Jeevan-0508/risk-ring