Real-Time ML Fraud Detection with IP Intelligence: Architecture & Implementation

// IP enrichment service (Node.js/TypeScript)
async function enrichIP(ipAddress: string): Promise<IPFeatures> {
  const startTime = Date.now();

  // Parallel fetch of all IP data
  const [geoData, securityData] = await Promise.all([
    ipInfoClient.geolocation(ip),
    ipInfoClient.security(ip)
  ]);

  // Feature engineering
  const features: IPFeatures = {
    // Raw features
    country: geoData.country_code,
    timezone: geoData.timezone,
    isProxy: securityData.is_proxy,
    isVPN: securityData.is_vpn,
    isTor: securityData.is_tor,
    isHosting: securityData.is_hosting,

    // Engineered features
    distanceFromBilling: calculateDistance(
      geoData.coordinates,
      user.billingAddress
    ),
    timezoneMismatch: detectTimezoneMismatch(
      geoData.timezone,
      user.profile.timezone
    ),
    networkReputationScore: getHistoricalFraudRate(
      securityData.asn
    ),

    // Metadata
    lookupTime: Date.now() - startTime
  };

  return features;
}

// Model serving with caching layer
class FraudModelServer {
  private model: XGBoostModel;
  private cache: LRUCache<string, number>;

  async scoreTransaction(
    features: TransactionFeatures
  ): Promise<FraudScore> {
    // Cache key for identical feature vectors
    const cacheKey = this.hashFeatures(features);

    // Check cache for identical transactions
    const cached = await this.cache.get(cacheKey);
    if (cached) {
      return { score: cached, cached: true };
    }

    // Feature vector preparation
    const X = this.prepareFeatureVector(features);

    // Model inference
    const startTime = performance.now();
    const fraudProbability = await this.model.predict(X);
    const inferenceTime = performance.now() - startTime;

    // Cache result (TTL: 5 minutes)
    await this.cache.set(cacheKey, fraudProbability, 300);

    return {
      score: fraudProbability,
      inferenceTime,
      modelVersion: this.model.version
    };
  }

  private prepareFeatureVector(
    f: TransactionFeatures
  ): Float32Array {
    return new Float32Array([
      f.ip.isProxy ? 1 : 0,
      f.ip.isVPN ? 1 : 0,
      f.ip.isTor ? 1 : 0,
      f.ip.distanceFromBilling / 1000, // km
      f.ip.timezoneMismatch ? 1 : 0,
      f.ip.networkReputationScore,
      f.amount,
      f.hourOfDay,
      // ... additional features
    ]);
  }
}

// Decision engine with rule-based override
interface FraudDecision {
  action: 'block' | 'allow' | 'challenge';
  reason: string;
  confidence: number;
}

function makeDecision(
  mlScore: number,
  features: TransactionFeatures
): FraudDecision {
  // Hard blocks (regulatory or known fraud)
  if (features.ip.isSanctionedCountry) {
    return {
      action: 'block',
      reason: 'sanctioned_jurisdiction',
      confidence: 1.0
    };
  }

  if (features.ip.isTor && features.amount > 1000) {
    return {
      action: 'block',
      reason: 'tor_high_value',
      confidence: 0.95
    };
  }

  // ML-based decisions
  if (mlScore > 0.85) {
    return {
      action: 'block',
      reason: 'ml_high_risk',
      confidence: mlScore
    };
  }

  if (mlScore > 0.6) {
    return {
      action: 'challenge',
      reason: 'ml_medium_risk',
      confidence: mlScore
    };
  }

  // Allow with monitoring
  return {
    action: 'allow',
    reason: 'ml_low_risk',
    confidence: 1 - mlScore
  };
}