architecture — fraud-detection-sagemaker

Credit Card Fraud Detection — ML Pipeline on AWS SageMaker

End-to-end batch pipeline from a public Kaggle dataset to a tuned fraud-scoring model, built around a 7-step, script-driven workflow and AWS SageMaker training.

284,807 transactions 0.17% fraud rate V1–V28 PCA features + Amount, Time 70/15/15 stratified split AUC-PR primary metric

Source Dataset Public, anonymized, one-time pull

Kaggle — Credit Card Fraud Detection external

mlg-ulb/creditcardfraud · downloaded via Kaggle CLI into data/raw/. Anonymous, PCA-transformed features (no raw PII).

↓creditcardfraud.csv

Storage Data layer Raw / processed separation

S3 · data/raw/ AWS S3

Untouched source CSV. Referenced by scripts via S3_DATASET_PATH.

S3 · data/processed/ AWS S3

Cleaned, scaled, split train/val/test CSVs — label-first, SageMaker XGBoost convention.

↓01 → 04 sagemaker_workflows/*.py

Processing 7-step workflow Deterministic scripts, AI-guided

Initial assessment

Shape, quality, risks

→

Duplicate cleaning

Detect & remove

→

Missing values

Assess & treat

→

Feature engineering

RobustScaler, split, leakage check

→

Visualization & EDA

Patterns, correlations

→

Baseline modeling

Class weights, SMOTE, undersample

→

Threshold optimization

Business trade-off tuning

⌁ Automation layer — skills/ + prompts/

7 SKILL.md frameworks and 7 Claude prompts guide each step; scripts stay deterministic and parameterized via env vars (e.g. S3_DATASET_PATH).

feeds steps 01–07 →

↓train.csv / val.csv / test.csv

Modeling Training & notebooks SageMaker + local notebooks

src/train_xgboost.pySageMaker

Managed training job — gradient-boosted trees, primary production candidate.

src/train_rf.pySageMaker

Random Forest training job — comparison baseline vs. XGBoost.

04_anomaly_detection.ipynbunsupervised

Isolation Forest / outlier scoring — no-label fraud signal, cross-checked vs. supervised models.

01_eda.ipynb · 02_baseline.ipynblocal / Jupyter

Exploratory analysis and logistic-regression baseline preceding tree models.

03_tree_models.ipynblocal / Jupyter

Orchestrates SageMaker training jobs and pulls back evaluation artifacts.

src/preprocessing.pyshared util

Scaling, stratified splitting, SMOTE/undersampling, class-weight helpers — imported by notebooks & scripts alike.

↓trained model + predicted probabilities

Evaluation Threshold & explainability 05_threshold_tuning.ipynb

AUC-PR scoringmetric

Precision-recall curve — accuracy is misleading at 0.17% fraud rate.

Decision thresholdbusiness logic

Tuned for recall-heavy, precision-heavy, or balanced operating points.

SHAP analysisexplainability

Feature attribution — what drives each fraud prediction, for audit & trust.

↓experiment metadata + scored transactions

Operate Monitoring & output Tracking + downstream query

monitoring/SageMaker experiments

Run tracking and experiment comparison across model versions and thresholds.

AthenaAWS

Ad hoc SQL over scored transactions in S3 for analyst / stakeholder review.

Technology stack

Cloud	AWS SageMaker (training jobs, experiments), S3, Athena
Processing	pandas, numpy
ML frameworks	scikit-learn, XGBoost, imbalanced-learn (SMOTE)
Explainability	SHAP
Interface	Jupyter notebooks, parameterized Python scripts
Runtime	Python 3.13+

Legend

Data / storage — S3, raw ↔ processed movement

SageMaker-managed compute — training & experiment tracking

Local / notebook-driven work

Evaluation & business-facing metrics