01 · Overview
FraudShield started as a single fraud model and grew into a full-stack, real-time fraud detection platform with streaming features, hybrid models, explainability, drift monitoring, and automated retraining.
Most fraud systems fail because they are either too slow (batch jobs and offline scoring), too opaque (no explainability or audit trail), or too fragile (no drift monitoring or retraining strategy). FraudShield is my response to that: a deliberately phased platform that evolves in three releases:
- V1: Baseline fraud classifier & feature engineering.
- V2: Full ML lifecycle with SHAP, drift detection, and automated retraining.
- V3: Real-time streaming features, hybrid ensemble, and schema-level multi-tenancy.
02 · Version Evolution (V1 → V3)
- Curated schema & dataset for fraud vs. non-fraud.
- Engineered behavioral features (amounts, frequency, device/account patterns).
- Trained XGBoost model with SHAP-based inspection.
- Simple batch-mode scoring API.
- Production-style FastAPI scoring service (sub-150ms typical latency).
- SHAP explanations for each prediction.
- Drift monitoring and metrics tracking.
- Automated weekly retraining and model promotion.
- Real-time streaming features via Dataflow + Feature Store.
- Hybrid XGBoost + Isolation Forest CPR ensemble.
- Schema-level multi-tenant design (tenant_id everywhere).
- Tight integration of streaming features into the scoring API.
03 · Architecture & System Design
End-to-End Flow
FraudShield spans ingestion, feature engineering, model training, online prediction, monitoring, and retraining. At a high level:
- Ingestion: Transactions flow into Pub/Sub with tenant_id, card_id, amount, and timestamps.
- Streaming Features (V3): Dataflow uses event-time semantics (10-minute sliding windows, 1-minute advance, 5-minute allowed lateness) to compute velocity features and write them into Vertex AI Feature Store.
- Model Training: XGBoost is trained on labeled fraud data; Isolation Forest is trained on normal transactions only.
- Hybrid CPR Model: A custom prediction routine (CPR) container loads both models, normalizes outputs, and combines them into a single fraud score.
- Online Scoring API: FastAPI fetches streaming features + base features, calls the CPR endpoint, and returns the fraud score + SHAP metadata.
- Monitoring & Retraining (V2+): Drift metrics and performance stats are logged; scheduled retraining jobs update models and endpoints.
POST /v3/score request with the hybrid model response,
including overall fraud score, component scores, and reconstructed velocity features.
Key Design Decisions
- Event-time correctness: Transactions are timestamped using their event time, not processing time, avoiding skewed windows and unreliable velocity metrics.
- Feature store integration: Velocity features are written to Vertex AI Feature Store keyed by tenant_id#card_id, ensuring consistent state across batch and online paths.
- Hybrid ensemble: XGBoost captures supervised patterns; Isolation Forest flags unusual behavior. The ensemble score balances precision and recall.
- Explainable by design: SHAP explanations are built into the scoring path so fraud analysts could audit “why” a transaction was flagged.
- Terraform-first: All core infrastructure (endpoints, feature store, Dataflow jobs, Pub/Sub, BigQuery, IAM) is defined as code.
04 · Results & Impact
Each version had specific goals. By V3, FraudShield behaves like a realistic real-time exception engine for operations: the same architecture that scores a suspect transaction scores a suspect shipment, work order, or supply event. Fintech and payments remain the proving-ground example.
What This Demonstrates About My Skillset
- Designing phased, realistic AI product roadmaps (V1 → V2 → V3).
- Building streaming feature engines that respect event-time semantics and windowing.
- Implementing hybrid fraud models that combine supervised and unsupervised techniques.
- Owning the full ML lifecycle: from data to deployment to monitoring and retraining.
- Thinking like a platform engineer: multi-tenancy, infra-as-code, and observability.
05 · Future Roadmap (V4+)
Although V3 is a complete, realistic fraud detection engine, I’ve already designed a V4 roadmap to push into network intelligence and richer governance.
- Graph-based features: GraphSAGE or similar GNN over customer–device–IP graphs to capture network-level fraud patterns.
- Active learning loop: Feedback endpoint for fraud analysts; labels flow into a governed training view for future models.
- Hard multi-tenancy: Resource-level isolation (RLS, per-tenant projects/datasets) for highly regulated environments.
- Advanced anomaly detection: Embedding-based anomaly scores layered onto the existing hybrid ensemble.
- Model governance workflows: Explicit promotion, approval, and rollback workflows for new models.
For the purposes of my portfolio and near-term job search, I intentionally stopped at V3: a fully implemented, credible platform, with V4 reserved as strategic future upside.