V.E.C.T.O.R
Velocity-Enhanced Clustering for Transactional Outlier Recognition
Real-Time Fraud Detection | Behavioral AI | Streaming Systems
Overview
V.E.C.T.O.R is a real-time fraud detection engine that personalizes anomaly detection to each user's behavior profile. Instead of applying a single global fraud model to all users, it continuously learns individual behavior, clusters users into behavioral personas, assigns persona-specific anomaly models, and produces fraud risk scores in under 50 ms. The system handles cold-start users via an XGBoost fallback, manages ambiguous transactions through 2FA verification, and provides a live monitoring dashboard. It is designed as a production-grade multi-layer streaming pipeline.
Key Features
Real-Time Transaction Monitoring
Stream-based scoring <50 ms per transaction.
Dynamic User Profiling
Continuously updated behavior profiles: velocity, average spend, frequency, session behavior, time gaps, loan activity, channel usage.
Behavioral Clustering (Persona Engine)
Users grouped into clusters (low-spend/high-frequency, high-spend/low-frequency, loan-heavy, abnormal velocity). Fraud baselines differ per cluster.
Persona-Specific Fraud Models
Each cluster has its own Isolation Forest trained on that cluster's transaction distribution.
Cold-Start Handling
XGBoost fallback for users with <10 transactions.
Decision and Verification
Fraud score thresholds: <0.4 Approve, 0.4–0.8 2FA, >0.8 Block/Manual review.
Suspicion Buffer Mechanism
Logs suspicious but verified transactions to build trust-vs-suspicion history.
Live Dashboard
React frontend with real-time charts, Cloudflare Tunnel hosting.
Technology Stack
Algorithms & Methods
UMAP
Dimensionality reduction for high-dimensional behavior vectors before clustering.
HDBSCAN
Density-based clustering, auto-detects number of clusters, supports noise/outliers.
Isolation Forest
Per-cluster anomaly detection; unsupervised, no fraud labels required.
XGBoost
Supervised fallback for early-stage scoring when user history is insufficient.
System Architecture
Producer Module
CSV producer (batch) + custom UI producer (live) → JSON transaction events
Data Ingestion (Redis Streams)
High-velocity event ingestion, consumer groups
Stream Consumer / Processing
Pull events, validate schema, compute features
Dynamic Feature Engineering
Velocity, avg amount, transactions/day, high-value frequency, time gaps, loan activity, channel usage
Clustering Pipeline (UMAP+HDBSCAN)
Build user behavior vector → UMAP reduction → HDBSCAN clustering → cluster_id
Model Management
Select model by user history (XGBoost or Isolation Forest)
Fraud Scoring
Score 0–1 from selected model
Decision Engine
Threshold logic → APPROVE / VERIFY / BLOCK
2FA Verification
OTP/email for suspicious-but-not-blocked transactions
Persistence + Audit (MongoDB)
legit_transactions and fraud_transactions collections, full audit trail
Monitoring + Dashboard
React frontend, Node.js backend, ~1-second auto-refresh, Cloudflare Tunnel hosting
Results & Outcomes
- Real-time fraud scoring pipeline operational at <50 ms latency
- Behavioral clustering with persona-specific anomaly detection
- Cold-start handling via XGBoost fallback
- Live monitoring dashboard with Cloudflare-hosted HTTPS endpoint
- Full MongoDB audit trail for compliance
Patent
Velocity-Enhanced Clustering for Transactional Outlier Recognition
Published: 2025-10-03
Role: Primary Inventor
A patented real-time fraud detection engine that personalizes anomaly detection to each user's behavior profile using dynamic behavioral clustering, persona-specific anomaly models, and multi-layer streaming architecture with sub-50 ms scoring latency.