Suspicious Account Prediction System

A time-series deep learning system for detecting suspicious bank accounts using transaction history.

Overview

This system predicts potentially fraudulent E.SUN Bank accounts by analyzing transaction patterns using LSTM, GRU, and Transformer models.

Features

• Account-Level Filtering: Trains only on E.SUN Bank accounts
• Time-Series Analysis: Captures temporal patterns in transactions
• Class Imbalance Handling: Uses SMOTE/ADASYN oversampling
• Multiple Model Architectures: LSTM, GRU, and Transformer
• F1-Score Optimization: Focuses on recall and precision balance

Requirements

pip install -r requirements.txt

Data Structure

preliminary_data/
├── acct_transaction.csv      # Transaction records
├── acct_alert.csv             # Alert labels
└── acct_predict.csv           # Accounts to predict

Usage

1. Data Preprocessing

Process raw transaction data and create train/validation splits:

python data_preprocess.py \
    --data_dir ./preliminary_data \
    --output_dir ./data \
    --train_end_day 90 \
    --sequence_length 30

Parameters:

• --data_dir: Input data directory (default: ./preliminary_data)
• --output_dir: Output directory for processed data (default: ./data)
• --train_end_day: Last day for training set (default: 90)
• --sequence_length: Sequence length for time-series (default: 30)

Output:

• ./data/train.parquet: Training set (days 1-90)
• ./data/val.parquet: Validation set (days 91-121)

2. Model Training

Train a model with specified architecture:

LSTM:

python training.py \
    --model lstm \
    --hidden_size 128 \
    --num_layers 2 \
    --epochs 50 \
    --batch_size 32 \
    --lr 0.001

GRU:

python training.py \
    --model gru \
    --hidden_size 128 \
    --num_layers 2 \
    --epochs 50 \
    --batch_size 32 \
    --lr 0.001

Transformer:

python training.py \
    --model transformer \
    --hidden_size 128 \
    --num_layers 3 \
    --epochs 50 \
    --batch_size 32 \
    --lr 0.001

Training Parameters:

• --model: Model type (lstm/gru/transformer)
• --hidden_size: Hidden layer size (default: 128)
• --num_layers: Number of layers (default: 2)
• --max_seq_len: Maximum sequence length (default: 50)
• --batch_size: Batch size (default: 32)
• --epochs: Number of training epochs (default: 50)
• --lr: Learning rate (default: 0.001)
• --dropout: Dropout rate (default: 0.3)
• --loss: Loss function - focal/weighted_ce (default: focal)
• --balance_method: Oversampling method - smote/adasyn (default: smote)

Output:

• ./models/best_model_{model}.pth: Best model checkpoint
• ./models/training_history_{model}.json: Training metrics

3. Generate Predictions

Make predictions on new accounts:

python predict.py \
    --model_path ./models/best_model_lstm.pth \
    --data_dir ./preliminary_data \
    --output_file ./predictions.csv \
    --threshold 0.5

Parameters:

• --model_path: Path to trained model checkpoint (required)
• --data_dir: Data directory (default: ./preliminary_data)
• --output_file: Output CSV file (default: ./predictions.csv)
• --threshold: Classification threshold (default: 0.5)
• --batch_size: Batch size for inference (default: 32)

Output:

• predictions.csv: Account predictions with probabilities
• predictions_stats.json: Prediction statistics

Data Pipeline

1. Account Filtering

• Identifies E.SUN accounts (from_acct_type='01' OR to_acct_type='01')
• Keeps ALL transactions for these accounts (including cross-bank)

2. Feature Engineering

Features per transaction:

• txn_amt_normalized: Z-score normalized amount
• is_self_txn_{Y,N,UNK}: One-hot encoded self-transaction flag
• from_acct_type_binary: Binary encoding (01=0, 02=1)
• to_acct_type_binary: Binary encoding (01=0, 02=1)
• delta_time_seconds: Seconds since last transaction
• delta_days: Days since last transaction
• txn_time_seconds: Time of day in seconds

3. Time-Based Split

• Training: Days 1-90
• Validation: Days 91-121
• No temporal overlap to prevent data leakage

4. Class Balancing

• Alert ratio: ~0.0558% (extremely imbalanced)
• Applies SMOTE/ADASYN oversampling to training set only
• Validation set remains unbalanced (realistic distribution)

Model Architectures

LSTM

• Bidirectional LSTM layers
• Captures long-term dependencies
• Good for sequential patterns

GRU

• Gated Recurrent Units
• Faster than LSTM
• Similar performance with fewer parameters

Transformer

• Multi-head self-attention
• Parallel processing
• Best for long sequences

Loss Functions

Focal Loss (Recommended)

• Focuses on hard-to-classify examples
• Parameters: α=0.25, γ=2.0
• Better for extreme imbalance

Weighted Cross-Entropy

• Class-weighted loss
• Simpler alternative

Evaluation Metrics

Primary Metric: F1-Score

• Balances precision and recall
• More important than accuracy for imbalanced data

Secondary Metrics:

• Precision: % of predicted alerts that are correct
• Recall: % of actual alerts detected

Project Structure

DL_Time_based/
├── data_preprocess.py      # Data preprocessing script
├── training.py             # Model training script
├── predict.py              # Prediction script
├── requirements.txt        # Python dependencies
├── plan.md                 # Technical plan
├── data_schema.json        # Data schema
├── Record.md               # Project notes
├── preliminary_data/       # Raw data
├── data/                   # Processed data
└── models/                 # Trained models

Expected Results

• Training set alert ratio: ~0.0558%
• After balancing: ~50% (oversampled)
• Validation set: Original imbalanced distribution
• Target F1-Score: Optimized on validation set

Tips

1. Start with LSTM: Simplest and most reliable
2. Use Focal Loss: Better for extreme imbalance
3. Monitor F1-Score: More important than accuracy
4. Adjust threshold: Use 0.5 as baseline, tune on validation set
5. GPU Recommended: Significantly faster training

Troubleshooting

Out of Memory:

• Reduce --batch_size
• Reduce --max_seq_len
• Reduce --hidden_size

Poor F1-Score:

• Increase training epochs
• Try different model architecture
• Adjust class balancing method
• Tune classification threshold

Slow Training:

• Enable CUDA/GPU
• Reduce sequence length
• Use smaller model