AI Fraud Detection: Dolandırıcılık Tespiti

# Isolation Forest ile anomali tespiti
import pandas as pd
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler

# İşlem verileri
transactions = pd.DataFrame({
    'amount': [50, 45, 120, 3000, 55, 60, 15000, 40, 75],  # 3000 ve 15000 anormal
    'hour': [14, 15, 10, 3, 16, 18, 2, 12, 17],  # Gece 2-3 şüpheli
    'merchant_category': [1, 1, 2, 3, 1, 1, 5, 1, 2],
    'card_present': [1, 1, 1, 0, 1, 1, 0, 1, 1],  # 0: Online (riskli)
    'country_match': [1, 1, 1, 0, 1, 1, 0, 1, 1],  # Kart ülkesi != işlem ülkesi
    'velocity_1h': [1, 1, 2, 5, 1, 1, 8, 1, 2]  # Son 1 saatte işlem sayısı
})

# Feature engineering
features = ['amount', 'hour', 'merchant_category', 'card_present', 'country_match', 'velocity_1h']
X = transactions[features]

# Normalize et
scaler = StandardScaler()
X_scaled = scaler.fit_transform(X)

# Isolation Forest modeli
model = IsolationForest(
    contamination=0.1,  # %10 anomali bekliyoruz
    random_state=42,
    n_estimators=100
)

model.fit(X_scaled)

# Tahmin (-1: anomali, 1: normal)
predictions = model.predict(X_scaled)
anomaly_scores = model.decision_function(X_scaled)  # Negatif = anomali

transactions['is_fraud'] = predictions == -1
transactions['fraud_score'] = anomaly_scores

print(transactions[['amount', 'hour', 'is_fraud', 'fraud_score']])
#    amount  hour  is_fraud  fraud_score
# 0      50    14     False         0.15
# 1      45    15     False         0.18
# 2     120    10     False         0.12
# 3    3000     3      True        -0.23  ← ANOMALI
# 4      55    16     False         0.16
# 5      60    18     False         0.14
# 6   15000     2      True        -0.41  ← ANOMALI
# 7      40    12     False         0.19
# 8      75    17     False         0.11

# Gerçek zamanlı fraud check
def check_fraud(transaction):
    features_scaled = scaler.transform([[
        transaction['amount'],
        transaction['hour'],
        transaction['merchant_category'],
        transaction['card_present'],
        transaction['country_match'],
        transaction['velocity_1h']
    ]])

    prediction = model.predict(features_scaled)[0]
    score = model.decision_function(features_scaled)[0]

    return {
        'is_fraud': prediction == -1,
        'fraud_score': score,
        'risk_level': 'HIGH' if score < -0.3 else 'MEDIUM' if score < 0 else 'LOW'
    }

# Test
new_transaction = {
    'amount': 8000,
    'hour': 4,
    'merchant_category': 5,
    'card_present': 0,
    'country_match': 0,
    'velocity_1h': 6
}

result = check_fraud(new_transaction)
print(result)
# {'is_fraud': True, 'fraud_score': -0.35, 'risk_level': 'HIGH'}

# XGBoost ile supervised fraud detection
import xgboost as xgb
from sklearn.model_selection import train_test_split
from sklearn.metrics import classification_report, roc_auc_score, confusion_matrix

# Etiketli veri (fraud: 1, normal: 0)
df = pd.read_csv('transactions_labeled.csv')

# Features
feature_columns = [
    'amount', 'hour', 'day_of_week', 'merchant_id',
    'card_age_days', 'transaction_count_1h', 'transaction_count_24h',
    'avg_amount_7d', 'distance_from_home', 'is_international',
    'device_id_changes', 'billing_shipping_match'
]

X = df[feature_columns]
y = df['is_fraud']

# Train/test split (imbalanced data için stratify)
X_train, X_test, y_train, y_test = train_test_split(
    X, y, test_size=0.2, random_state=42, stratify=y
)

# Class imbalance handling (SMOTE veya class weights)
from imblearn.over_sampling import SMOTE
smote = SMOTE(random_state=42)
X_train_balanced, y_train_balanced = smote.fit_resample(X_train, y_train)

# XGBoost modeli
model = xgb.XGBClassifier(
    max_depth=6,
    learning_rate=0.1,
    n_estimators=200,
    subsample=0.8,
    colsample_bytree=0.8,
    scale_pos_weight=len(y_train[y_train==0]) / len(y_train[y_train==1]),  # Class weight
    eval_metric='auc',
    random_state=42
)

# Eğitim
model.fit(
    X_train_balanced, y_train_balanced,
    eval_set=[(X_test, y_test)],
    early_stopping_rounds=10,
    verbose=False
)

# Tahmin
y_pred = model.predict(X_test)
y_pred_proba = model.predict_proba(X_test)[:, 1]

# Performans
print(classification_report(y_test, y_pred))
#               precision    recall  f1-score   support
#
#            0       0.99      0.98      0.99     19500
#            1       0.87      0.91      0.89       500
#
#     accuracy                           0.98     20000

print(f"AUC-ROC: {roc_auc_score(y_test, y_pred_proba):.2%}")  # 96%

# Confusion matrix
cm = confusion_matrix(y_test, y_pred)
print(cm)
# [[19110   390]     True Negative: 19110, False Positive: 390
#  [   45   455]]    False Negative: 45,   True Positive: 455

# Feature importance
import matplotlib.pyplot as plt
xgb.plot_importance(model, max_num_features=10)
plt.title('En Önemli Fraud Göstergeleri')
plt.show()

# Gerçek zamanlı fraud scoring API
def fraud_risk_score(transaction_data):
    features = pd.DataFrame([transaction_data])
    fraud_probability = model.predict_proba(features)[0][1]

    # Risk seviyeleri
    if fraud_probability > 0.8:
        decision = 'BLOCK'
        action = 'Transaction blocked'
    elif fraud_probability > 0.5:
        decision = 'REVIEW'
        action = 'Manual review required'
    elif fraud_probability > 0.2:
        decision = 'CHALLENGE'
        action = '3D Secure / 2FA required'
    else:
        decision = 'APPROVE'
        action = 'Transaction approved'

    return {
        'fraud_probability': round(fraud_probability, 3),
        'decision': decision,
        'action': action,
        'reasons': get_fraud_reasons(transaction_data, model)
    }

def get_fraud_reasons(data, model):
    """Neden şüpheli olduğunu açıkla (SHAP)"""
    import shap
    explainer = shap.TreeExplainer(model)
    shap_values = explainer.shap_values(pd.DataFrame([data]))

    # En yüksek SHAP value'lara sahip özellikler
    feature_importance = dict(zip(feature_columns, shap_values[0]))
    top_reasons = sorted(feature_importance.items(), key=lambda x: abs(x[1]), reverse=True)[:3]

    return [f"{feature}: {value:.2f}" for feature, value in top_reasons]

# Örnek
transaction = {
    'amount': 5000,
    'hour': 3,
    'day_of_week': 2,
    'merchant_id': 12345,
    'card_age_days': 5,  # Yeni kart (şüpheli)
    'transaction_count_1h': 8,  # Hızlı işlemler (şüpheli)
    'transaction_count_24h': 15,
    'avg_amount_7d': 150,  # Normal tutar 150, şimdi 5000 (şüpheli)
    'distance_from_home': 500,  # 500km uzak
    'is_international': 1,
    'device_id_changes': 3,  # Farklı cihazlar
    'billing_shipping_match': 0  # Adres uyuşmazlığı
}

result = fraud_risk_score(transaction)
print(result)
# {
#   'fraud_probability': 0.87,
#   'decision': 'BLOCK',
#   'action': 'Transaction blocked',
#   'reasons': ['transaction_count_1h: 0.45', 'avg_amount_7d: 0.32', 'card_age_days: 0.28']
# }

# NetworkX ile fraud ring detection
import networkx as nx

# Transaction graph oluştur (kullanıcı → merchant)
G = nx.DiGraph()

transactions = [
    ('user_1', 'merchant_A', 100),
    ('user_2', 'merchant_A', 150),
    ('user_3', 'merchant_B', 200),
    ('user_1', 'merchant_C', 5000),  # Şüpheli
    ('user_4', 'merchant_C', 4800),  # Şüpheli (aynı merchant)
    ('user_5', 'merchant_C', 5200),  # Şüpheli (fraud ring?)
]

for user, merchant, amount in transactions:
    G.add_edge(user, merchant, weight=amount)

# Fraud ring detection (aynı merchant'a yüksek tutarlı işlemler)
def detect_fraud_ring(graph, min_amount=4000):
    fraud_rings = []

    for merchant in graph.nodes():
        # Merchant'a gelen tüm işlemler
        incoming = graph.in_edges(merchant, data=True)

        # Yüksek tutarlı işlemler
        high_value_users = [
            user for user, _, data in incoming
            if data['weight'] > min_amount
        ]

        if len(high_value_users) >= 2:  # 2+ kullanıcı = ring
            fraud_rings.append({
                'merchant': merchant,
                'suspicious_users': high_value_users,
                'total_amount': sum(data['weight'] for _, _, data in incoming if data['weight'] > min_amount)
            })

    return fraud_rings

rings = detect_fraud_ring(G)
print(rings)
# [{'merchant': 'merchant_C', 'suspicious_users': ['user_1', 'user_4', 'user_5'], 'total_amount': 15000}]

# Community detection (benzer davranış kümeleri)
import community  # python-louvain

# Undirected graph'a çevir
G_undirected = G.to_undirected()

# Community detection
communities = community.best_partition(G_undirected)

# Aynı community'deki kullanıcılar birbirine benzer
for user, comm_id in communities.items():
    print(f"{user} → Community {comm_id}")

# FastAPI ile real-time fraud detection API
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
import redis
import joblib

app = FastAPI()

# Model yükle
fraud_model = joblib.load('fraud_model.pkl')

# Redis cache (velocity tracking için)
redis_client = redis.Redis(host='localhost', port=6379, db=0)

class Transaction(BaseModel):
    user_id: str
    amount: float
    merchant_id: str
    card_id: str
    ip_address: str
    device_id: str
    country: str

@app.post("/check-fraud")
async def check_fraud(transaction: Transaction):
    # 1. Velocity check (Redis)
    velocity_key = f"user:{transaction.user_id}:transactions"
    transaction_count = redis_client.incr(velocity_key)
    redis_client.expire(velocity_key, 3600)  # 1 saat TTL

    # 2. Feature engineering
    features = {
        'amount': transaction.amount,
        'transaction_count_1h': transaction_count,
        'merchant_risk_score': get_merchant_risk(transaction.merchant_id),
        'card_age_days': get_card_age(transaction.card_id),
        'ip_reputation': get_ip_reputation(transaction.ip_address),
        'device_fingerprint_changes': count_device_changes(transaction.user_id),
        # ... diğer özellikler
    }

    # 3. ML prediction
    fraud_probability = fraud_model.predict_proba([list(features.values())])[0][1]

    # 4. Decision
    if fraud_probability > 0.8:
        # BLOCK - Fraud team'e bildirim gönder
        send_alert_to_fraud_team(transaction, fraud_probability)
        return {"decision": "BLOCK", "reason": "High fraud risk", "score": fraud_probability}

    elif fraud_probability > 0.5:
        # REVIEW - Manuel inceleme kuyruğuna ekle
        add_to_review_queue(transaction)
        return {"decision": "REVIEW", "reason": "Moderate risk", "score": fraud_probability}

    elif fraud_probability > 0.2:
        # CHALLENGE - 2FA/3D Secure
        return {"decision": "CHALLENGE", "reason": "Additional verification required", "score": fraud_probability}

    else:
        # APPROVE
        return {"decision": "APPROVE", "score": fraud_probability}

# Yardımcı fonksiyonlar
def get_merchant_risk(merchant_id):
    # Merchant'ın geçmiş fraud oranı
    # 0.0 (güvenli) - 1.0 (riskli)
    merchant_stats = db.query(f"SELECT fraud_rate FROM merchants WHERE id={merchant_id}")
    return merchant_stats['fraud_rate']

def get_ip_reputation(ip):
    # IP reputation servisi (MaxMind, IPQualityScore)
    response = requests.get(f"https://ipapi.co/{ip}/json/")
    data = response.json()
    return 1.0 if data.get('threat', {}).get('is_proxy') else 0.0