ENTERPRISE PIPELINE TOPOLOGY • HIGH-THROUGHPUT ENGINE

FraudGuard System Architecture

Comprehensive technical overview of the autonomous risk scoring pipeline, modular strategy heuristics, ACID transaction pools, and multi-tier security engineered by TeamRootOps at Galgotias University.

< 24ms Pipeline Latency SLA

7 Heuristics Strategy Pattern Rules

ACID Strict MySQL 8.0 Dual-Phase

Zero-Trust Role-Based RBAC

End-to-End Pipeline 7 Fraud Rules Design Patterns Database Schema Deployment Topology View Full Docs →

EXECUTION LIFECYCLE

Autonomous Fraud Triage & Scoring Pipeline

Every transaction undergoes an end-to-end multi-phase evaluation before funds are debited or alerts are triggered.

Stage 01 ∼ 2ms

Ingestion & Gateway

Client submits POST /transaction via secure HTTPS. Captures amount, recipient IBAN, IP address, geo-location coordinates, and device fingerprint.

Stage 02 ∼ 1ms

Validation & Boundaries

Ensures sender balance adequacy, positive currency limits, non-empty recipient, and invokes SQL injection & XSS sanitization filters.

Stage 03 ∼ 4ms

Context Hydration

Constructs TransactionContext by querying user history: sliding 5-minute velocity, 24h cumulative volume, known devices list, and historical baseline.

Stage 04 ∼ 6ms

Rule Matrix (Strategy Engine)

Executes 7 registered FraudRule implementations concurrently in thread-safe CopyOnWriteArrayList, generating structured evaluations.

Stage 05 ∼ 2ms

Risk Score Synthesis

Synthesizes weighted evaluations via RiskCalculator. Classifies into 4 risk tiers: LOW (<30), MEDIUM (30-59), HIGH (60-84), CRITICAL (85-100).

Stage 06 ∼ 7ms

ACID Commit & Telemetry

Atomically persists transaction in MySQL 8.0, dispatches incident alerts for HIGH/CRITICAL scores, and streams updates to the live executive dashboard.

BEHAVIORAL RULES

The 7 Autonomous Fraud Detection Rules

Each rule encapsulates isolated heuristics, dynamic weights, and specific failure triggers under the Strategy Pattern.

CRITICAL • BLOCK Score: +100

BlacklistAccountRule

Detects if recipient account or IBAN matches global sanctions lists, known mule rings, or previously flagged malicious entities.

Condition: Matches sanction database

Action: Instant Auto-Block & Account Quarantine

HIGH RISK Score: +35

HighAmountRule

Triggers when transfer amount exceeds predefined maximum limits (₹50,000+) or deviates more than 300% from sender's 30-day historical mean.

Condition: Amount > ₹50,000 or > 3x baseline

Action: Step-up challenge / Analyst review

HIGH RISK Score: +40

VelocityRule

Flags micro-burst payment activity where more than 3 transactions occur within a sliding 5-minute window from the same account.

Condition: > 3 transfers in 5 minutes

Action: Velocity throttle & Rate-limit alert

HIGH RISK Score: +50

GeographicAnomalyRule

Calculates Haversine distance and elapsed time between subsequent transactions to flag physical impossibility (velocity > 800 km/h).

Condition: Impossible travel speed

Action: Geographic alert & Session freeze

MEDIUM RISK Score: +20

UnusualHourRule

Applies risk multiplier to transactions initiated during high-risk off-peak time windows (01:00 AM to 05:00 AM local time).

Condition: 01:00 – 05:00 local time

Action: Secondary verification prompt

MEDIUM RISK Score: +25

NewDeviceRule

Detects novel browser fingerprints, unknown OS signatures, or unverified hardware configurations not seen on account in past 90 days.

Condition: Unrecognized hardware hash

Action: Device trust challenge

CRITICAL Score: +45

RapidBalanceDrainRule

Detects sudden catastrophic balance depletion exceeding 80% of total liquid wallet holdings within a compressed time frame.

Condition: Depletes > 80% total balance

Action: Auto-Hold & Critical incident notification

ENGINEERING PRINCIPLES

Object-Oriented Design Patterns in FraudGuard

Adhering to strict SOLID design principles, modularity, and enterprise separation of concerns.

Behavioral Pattern

Strategy Pattern

The FraudRule interface defines the evaluation contract. Every detection heuristic inherits from AbstractFraudRule, allowing dynamic runtime rule additions, removals, and hot-swaps without touching core engine logic.

public interface FraudRule {
    String getRuleName();
    boolean isEnabled();
    RuleEvaluation evaluate(Transaction tx, User u, TransactionContext ctx);
}

Structural Pattern

Facade Pattern

FraudDetector and TransactionProcessor provide simplified, high-level facades over complex sub-systems including database pools, context builders, scoring formulas, and alert dispatchers.

public class TransactionProcessor {
    public TransactionResult process(Transaction tx, User u) {
        // Hydrates context, evaluates rules, commits ACID tx
    }
}

Creational Pattern

Singleton & Connection Pool

DatabaseConnection maintains a single instance managing an active pool of pre-warmed JDBC connections, ensuring maximum throughput and minimal socket connection overhead on high-load bursts.

public class DatabaseConnection {
    private static volatile DatabaseConnection instance;
    public Connection getConnection() throws SQLException { ... }
}

Architectural Pattern

Data Access Object (DAO)

Persistence operations are strictly decoupled via interfaces: UserDAO, TransactionDAO, and FraudAlertDAO. All SQL statements use parameterized prepared statements to eliminate SQL injection vulnerabilities.

public interface TransactionDAO {
    Optional<Transaction> findByRef(String ref);
    void save(Transaction tx) throws SQLException;
}

DATA TOPOLOGY

Relational Database Schema & Entities

Normalized schema implemented in MySQL 8.0 with InnoDB engine, B-Tree indexes on high-cardinality fields, and foreign key integrity.

TABLE: users InnoDB • UTF8MB4

Field	Type	Key / Constraint
`id`	BIGINT AUTO_INCREMENT	PRIMARY KEY
`username`	VARCHAR(64)	UNIQUE NOT NULL
`password_hash`	VARCHAR(255)	NOT NULL (PBKDF2)
`full_name`	VARCHAR(100)	NOT NULL
`email`	VARCHAR(128)	NOT NULL (Internal)
`role`	ENUM('ADMIN','ANALYST','CUSTOMER')	NOT NULL
`balance`	DECIMAL(12,2)	DEFAULT 10000.00
`status`	ENUM('ACTIVE','SUSPENDED','LOCKED')	DEFAULT 'ACTIVE'

TABLE: transactions InnoDB • UTF8MB4

Field	Type	Key / Constraint
`id`	BIGINT AUTO_INCREMENT	PRIMARY KEY
`transaction_ref`	VARCHAR(40)	UNIQUE INDEX
`user_id`	BIGINT	FOREIGN KEY → users(id)
`amount`	DECIMAL(12,2)	NOT NULL
`recipient_account`	VARCHAR(64)	NOT NULL
`risk_score`	INT	CHECK (0-100)
`risk_level`	ENUM('LOW','MEDIUM','HIGH','CRITICAL')	NOT NULL
`status`	ENUM('APPROVED','FLAGGED','BLOCKED')	NOT NULL
`created_at`	TIMESTAMP	INDEX (Recent Tx)

TABLE: fraud_alerts InnoDB • UTF8MB4

Field	Type	Key / Constraint
`id`	BIGINT AUTO_INCREMENT	PRIMARY KEY
`transaction_id`	BIGINT	FOREIGN KEY → transactions(id)
`user_id`	BIGINT	FOREIGN KEY → users(id)
`risk_score`	INT	NOT NULL
`triggered_rules`	TEXT	JSON Array of rules
`status`	ENUM('PENDING','INVESTIGATING','RESOLVED','DISMISSED')	INDEX
`analyst_notes`	TEXT	NULLABLE

INFRASTRUCTURE & ENVIRONMENT

Deployment Topology & Runtime Environment

High-availability enterprise architecture configuration running on Tomcat 10.1 and JVM 17+.

Application Tier (Jakarta EE)

Runtime: Apache Tomcat 10.1.x
Servlet Spec: Jakarta Servlet 6.0
Java Version: OpenJDK 17 LTS / 21 LTS
Session Manager: StandardManager with HTTP-Only Cookie Protection
Thread Pool: Default Executor (200 worker threads)

Data Persistence Tier

RDBMS: MySQL 8.0 Enterprise / Community
Storage Engine: InnoDB with ACID Strict Guarantees
Connection Pool: Managed JDBC Connection Pool
Transaction Isolation: READ COMMITTED
Encoding: UTF-8 (utf8mb4_unicode_ci)

Security & Boundary Protections

Filter Chain: AuthenticationFilter with RBAC enforcement
Cryptographic Salting: PBKDF2 with SHA-256 for credentials
Header Policies: nosniff, DENY frame options, XSS blocking
Data Privacy: Zero PII / email exposure in user-facing views
Engineering Team: Engineered by TeamRootOps