ML-601: Building ML Fraud Detection Systems -- CyberSecAI

ML-601. The syllabus

Three days, from raw transactions to production fraud detection

Classes are custom built from the following learning modules. (Times are approximate.)

Fraud Landscape and Data Engineering

Understand the Problem Before You Model It

F1-00 The Fraud Landscape 1 hr

Card-not-present fraud, account takeover, synthetic identity, first-party fraud, money laundering typologies and emerging AI-powered fraud. Real loss numbers and why rule-based systems fail at scale. What ML adds and what it does not.

F1-01 Transaction Data Engineering with PySpark 2 hrs

Hands on: load raw transaction data into PySpark. Clean, transform and aggregate at scale. Build transaction velocity features (count, sum, average over 1h/24h/7d windows), merchant category features, geographic features and time-of-day features. Handle the volume that Pandas cannot.

F1-02 Feature Engineering for Fraud 2 hrs

The features that actually detect fraud: deviation from customer baseline, peer group comparison, velocity spikes, dormant account reactivation, round-amount transactions, cross-border patterns, device fingerprint changes and behavioural biometrics. Feature stores and real-time feature serving.

F1-03 Handling Imbalanced Data 1.5 hrs

Fraud is rare (0.1-0.3% of transactions). Naive models predict "not fraud" for everything and get 99.7% accuracy. Techniques that actually work: SMOTE, ADASYN, cost-sensitive learning, focal loss, stratified sampling, and why you must never oversample the test set. Evaluation metrics that matter: precision-recall AUC, F1, and the business cost matrix.

F1-04 Using Claude and GPT for Data Exploration 1 hr

Use AI to accelerate EDA: generate PySpark aggregation queries, identify anomalous patterns in transaction distributions, write feature engineering code and explain complex SQL joins. The ASVS Secure Coder Prompt Pack applied to data pipeline code.

Model Building with PyTorch

Train Models That Catch Fraud

F2-00 Classical ML Baselines 1.5 hrs

Start with what works: gradient boosted trees (XGBoost, LightGBM) on tabular transaction features. These are still the production standard at most banks. Train, tune hyperparameters and establish your baseline performance before moving to deep learning.

F2-01 Deep Learning for Fraud with PyTorch 2 hrs

Hands on: build a PyTorch fraud detection model. Feed-forward networks for tabular features, sequence models (LSTM, Transformer) for transaction sequences, and autoencoders for anomaly detection. Train on GPU, compare to the XGBoost baseline and understand when deep learning adds value vs when it does not.

F2-02 Graph Neural Networks for Fraud Rings 2 hrs

Fraud rings share accounts, devices, addresses and beneficiaries. Build a transaction graph, detect communities and train a GNN (PyTorch Geometric) that catches coordinated fraud that individual transaction models miss. This is the technique that catches what everything else misses.

F2-03 Real-Time Scoring Architecture 1.5 hrs

A model that takes 10 seconds to score is useless for card-present transactions. Build a real-time inference pipeline: feature store lookup, model inference under 50ms, score thresholding, and the feedback loop that captures analyst decisions for retraining. Architecture patterns for sub-100ms scoring at scale.

F2-04 Model Evaluation and the Business Cost Matrix 1 hr

A false positive costs the bank a customer. A false negative costs the bank money. Build a cost matrix that quantifies both. Optimize the score threshold for business cost, not just statistical metrics. Present results in language the fraud operations team and the CFO both understand.

AWS Bedrock and LLM Integration

LLMs in the Fraud Pipeline

F3-00 AWS Bedrock for Fraud Analysis 1.5 hrs

Hands on: connect to AWS Bedrock (Claude, Nova Lite, Titan). Use foundation models to analyse suspicious transaction narratives, generate investigation summaries, classify merchant descriptions and extract entities from free-text transaction notes. The LLM does not replace the fraud model. It augments the analyst.

F3-01 LLM-Powered Alert Triage 1.5 hrs

Fraud teams drown in alerts. Build an LLM-powered triage system that reads the alert context (transaction details, customer history, model score, matching rules), generates a risk summary and recommends an action (auto-approve, review, block). Reduces analyst workload by 40-60% on low-confidence alerts.

F3-02 SAR Narrative Generation 1 hr

Suspicious Activity Reports are legally required but time-consuming to write. Use Bedrock to generate SAR narrative drafts from structured case data. The analyst reviews and edits, not writes from scratch. Cover the regulatory requirements (BSA/AML, FCA, EU AMLD) and what the narrative must contain.

F3-03 Explainability and Regulatory Compliance 1.5 hrs

Regulators require model explainability. SHAP values, LIME, attention weights and counterfactual explanations applied to fraud models. What the FCA, OCC and ECB expect from AI-based fraud detection. Model risk management (SR 11-7, SS1/23) and how to document your model for regulatory review.

F3-04 Adversarial Robustness for Fraud Models 1 hr

Fraudsters adapt. They test transactions to find the boundary where the model switches from "fraud" to "not fraud" and stay just below it. Build adversarial tests that probe your model the way a fraudster would. Monitor for distribution drift that indicates the fraud population has shifted.

Production Deployment and Security

Ship It Securely

F4-00 Securing the ML Pipeline 1.5 hrs

The fraud model is a high-value target. Secure the training data (encryption at rest, access control, lineage), the model artifacts (signed, versioned, integrity-checked), the feature store (tenant isolation, PII handling) and the inference endpoint (authentication, rate limiting, input validation). Mapped to EAIS controls.

F4-01 Model Deployment on AWS 1.5 hrs

Hands on: deploy the fraud model to SageMaker endpoints with auto-scaling. Set up A/B testing between model versions. Configure CloudWatch alarms for latency, error rate and score distribution drift. Blue-green deployment for zero-downtime model updates.

F4-02 Monitoring and Retraining 1 hr

Fraud models degrade. Build monitoring for: prediction distribution shift, feature drift, false positive rate trend, false negative rate trend and concept drift. Automated retraining triggers when performance drops below threshold. The feedback loop from analyst decisions to training data.

F4-03 PII and Data Protection 1 hr

Transaction data is PII. Tokenization, pseudonymization and differential privacy applied to fraud detection pipelines. GDPR right to explanation for automated fraud decisions. Data retention for SAR obligations vs data minimization under GDPR. The tension between regulatory retention and privacy requirements.

F4-04 Capstone: End-to-End Fraud System 3 hrs

Build the complete system end to end: PySpark feature engineering, PyTorch model training, SageMaker deployment, Bedrock-powered alert triage, SHAP explainability, monitoring dashboard. Score a held-out test set. Present your system architecture, model performance and security controls to the room.

~30 hrs
Total instructional hours

20
Individual modules across 4 sections

3 days
Hands-on with real data