EN 
Українська
Polski
Español
Deutsch
日本語
Italiano
Português (BR)
Français
العربية
Nederlands
中文
한국어
हिन्दी
Türkçe
Tiếng Việt
Русский
Bahasa Indonesia
فارسی
বাংলা
ไทย
Filipino
Kiswahili
اردو
Bahasa Melayu
தமிழ்
עברית
Ελληνικά
ਪੰਜਾਬੀ
አማርኛ
မြန်မာဘာသာ
ខ្មែរ
ქართული
नेपाली
Монгол хэл
Հայերեն
සිංහල
ລາວ
Čeština
Română
Magyar
Български
Svenska
Dansk
Suomi
Norsk
Slovenčina
Hrvatski💳 Transaction Fraud Detector — Real-Time Anomaly Scoring
Watch an isolation-forest-style anomaly detector score a live stream of synthetic card transactions, isolating outliers by random partition depth and flagging fraud rings in real time.
About the Transaction Fraud Detector
Real card-fraud detection systems must catch a tiny minority of malicious transactions hidden inside a torrent of ordinary spending, usually without labeled examples of the newest fraud patterns to train on. The isolation forest algorithm (Liu, Ting & Zhou, 2008) approaches this as a geometry problem rather than a classification problem: instead of learning what fraud looks like, it learns what normal looks like by repeatedly partitioning feature space with random splits, and treats points that get isolated unusually quickly — in unusually few random cuts — as anomalies. This simulation builds a genuine ensemble of such random partition trees over a rolling window of synthetic transactions, each carrying four real numeric features (log-scaled amount, hour of day, merchant category, and card velocity), and computes each new transaction's isolation-depth-based anomaly score exactly as the published algorithm specifies.
A live scatter plot projects the transaction stream onto the amount/velocity plane with one representative tree's random splits drawn as partition lines, while a scrolling score chart plots every transaction's anomaly score against the threshold you control. Transactions crossing the threshold are flagged in red; the stats panel tracks true positives, false positives and false negatives against a hidden ground-truth label that the detector itself never sees. Adjust the tree count and subsample size to see the classic bias/variance trade-off of ensemble anomaly detection, or inject a synthetic fraud ring to watch a burst of correlated anomalies isolate almost instantly.
Frequently Asked Questions
What is an isolation forest and why does it work for fraud detection?
An isolation forest is an ensemble of random binary trees that isolate data points by repeatedly picking a random feature and a random split value between that feature's observed minimum and maximum, then recursing on the resulting partitions. Anomalies are, almost by definition, few and different: they sit in sparsely populated regions of feature space, so a random split is much more likely to separate them from the rest of the data in just a handful of cuts. Normal, densely-clustered points require many more random cuts before they end up alone in their own partition. This simulation builds a real ensemble of such trees over recent synthetic card transactions and uses the average number of cuts needed to isolate each new transaction as its anomaly score, exactly as Liu, Ting and Zhou's original 2008 isolation forest algorithm does.
How is the anomaly score actually computed from path length?
For each tree, the path length h(x) is the number of edges walked from the root to the leaf that isolates x. Because trees are stopped early once a partition holds very few points, an average path-length correction c(n) — derived from the expected depth of an unsuccessful search in a binary search tree of n items — is added at each leaf to account for the points that were not fully isolated down to size one. The final score is s(x) = 2^(−E[h(x)] / c(n)), where E[h(x)] is the average path length for x across every tree in the forest. Scores approach 1 for points isolated unusually quickly (short average path → anomalous), approach 0.5 for points with roughly average path length, and drop toward 0 for points that need unusually long paths to isolate (very normal, deeply embedded points).
What features does this simulation feed into the forest?
Each synthetic transaction carries four numeric features: a log-scaled purchase amount, the hour of day it occurred, a numeric merchant-category code, and a velocity figure approximating how many transactions that same card has made in the recent past. Real card-fraud systems use dozens to hundreds of engineered features (geolocation jumps, device fingerprints, merchant risk tiers, spending-pattern deviations), but these four are enough to demonstrate genuine multi-dimensional isolation: a transaction can be perfectly ordinary on any single feature and still be isolated quickly once the random splits combine several dimensions.
Why does the partition-tree view only show two of the four features?
The forest itself splits on all four features at random, exactly as isolation forest requires, but a partition diagram can only be drawn in two dimensions at once, so the visualization projects one representative tree onto the amount/velocity plane. Splits made on the hour-of-day or merchant-category features still happen inside that tree — they just don't draw a visible line in this 2D projection, because they don't cut the two displayed axes. The scatter of recent transactions and their color-coded anomaly scores, however, reflect the full four-feature scoring, not just the two plotted dimensions.
What do the tree-count and sample-size controls change?
The tree-count slider sets how many independently-randomized trees are averaged when scoring each transaction — more trees reduce the variance of the score at the cost of more computation, matching the real-world trade-off operational fraud systems make between latency and detection stability. The stream-speed slider controls how quickly new synthetic transactions arrive; the forest is periodically rebuilt from a fresh random subsample of the recent transaction window, matching how production isolation forests are retrained on rolling windows of recent data rather than a single fixed historical batch.
How is a transaction actually flagged as fraud here?
Every incoming transaction is scored against the current forest, and any transaction whose isolation score crosses the threshold slider is flagged. The simulation also tags a hidden ground-truth label on every synthetic transaction (whether it was generated by the normal-spending process or by one of the injected fraud/fraud-ring generators) purely so the stats panel can show live true-positive, false-positive and false-negative counts — the detector itself never sees this label, only the four numeric features, exactly like a real unsupervised anomaly detector operating on unlabeled live traffic.
How does this compare to real-world production fraud detection?
Production card-fraud systems typically combine unsupervised anomaly detectors like isolation forests with supervised gradient-boosted models trained on confirmed fraud labels, rule engines for known fraud patterns, and graph-based network analysis to catch coordinated fraud rings across many cards and merchants. This simulation demonstrates the unsupervised isolation-forest half of that pipeline with genuine random-partition trees and real path-length scoring, but on synthetic data with hand-tuned generators rather than billions of real historical transactions, so it should be read as a mechanism demonstration of how isolation forests isolate outliers, not a production-grade fraud engine.
Each new synthetic transaction is scored by walking it down every tree in a rolling-window isolation forest built from random feature/split partitions; average path length across the ensemble, corrected for unfinished partitions, converts into a 0–1 anomaly score that flags fraud when it crosses your threshold.
3D · Three.js / WebGL renderer · 60 FPS target · runs fully client-side, no install