Detector controls

Anomaly threshold: 0.62 Trees in forest: 80 Subsample size: 128 Stream speed: 3 tx/s

Stream

Last transaction

Amount—

Hour—

Merchant cat.—

Velocity—

Anomaly score—

Verdict—

Live stats

Processed0

Flagged0

True positives0

False positives0

False negatives0

Forest rebuilds0

Each transaction is walked down every tree of a real isolation forest built from random feature/split partitions of recent transactions. Short average isolation paths → high anomaly score → flagged. Ground truth is hidden from the detector; it only powers the TP/FP/FN counters above.