FraudGuard Documentation

1. Overview & Purpose

FraudGuard is a real-time, low-latency transaction processing engine designed to autonomously detect and intercept fraudulent financial activity. Operating with an evaluation latency under 25 milliseconds, FraudGuard inspects transactions through stateful heuristic pipelines, behavioral anomaly detection, and composite scoring algorithms before committing balance mutations to persistent ACID storage.

Core System Capabilities

• Stateful Velocity Tracking: Micro-burst monitoring preventing carding attacks and account takeover attempts.
• Dynamic Risk Tiering: Automatic division into LOW, MEDIUM, HIGH, and CRITICAL risk tiers with adaptive enforcement.
• Autonomous Triage & Alerting: Real-time incident dispatching notifying security analysts with full rule audit trails.
• Enterprise RBAC: Role-based access control protecting executive dashboards, transaction telemetry, and account management.

2. Quickstart & Setup Guide

Follow these steps to deploy and run FraudGuard on your local development or staging environment.

Prerequisites

Step 1: Database Initialization

Create the database schema and seed default administrative and test customer accounts:

# Connect to MySQL 8.0 CLI
mysql -u root -p

# Execute initialization scripts from repository root
mysql> source database/schema.sql;
mysql> source database/seed.sql;

Step 2: Compile & Package via Maven

# Clean and compile war package (skips unit tests for quick packaging)
mvn clean package -DskipTests

Step 3: Deploy to Apache Tomcat

# Copy generated WAR to Tomcat webapps directory
cp target/fraudguard.war $CATALINA_HOME/webapps/

# Start Tomcat server
$CATALINA_HOME/bin/startup.sh   # Linux/macOS
$CATALINA_HOME\bin\catalina.bat run   # Windows

Navigate to http://localhost:8080/fraudguard/ to access the system.

3. Portal User Guides

FraudGuard features dedicated, role-tailored interfaces:

Default System Credentials (Testing)

4. Fraud Rules Specification

The detection engine orchestrates 7 autonomous heuristic rules implementing the Strategy Pattern. Each rule evaluates the transaction independently:

Composite Risk Scoring Formula

The total risk score is calculated via the formula:

Score = Min(100, Sum(Evaluations[i].Weight * Evaluations[i].SeverityFactor))

If any rule triggers a critical hard-block condition (such as BlacklistAccountRule), the score instantly saturates at 100.

5. REST API & Payload Specification

FraudGuard provides REST-compatible servlet endpoints for automated transaction intake and scoring.

Endpoint: Initiate Transaction

Headers

Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=...

Form Parameters

Sample JSON Response (Result Object)

{
  "status": "FLAGGED",
  "transactionRef": "TXN-8F92A14D",
  "amount": 7500.00,
  "riskScore": 75,
  "riskLevel": "HIGH",
  "triggeredRules": [
    "HighAmountRule (+35)",
    "VelocityRule (+40)"
  ],
  "requiresAnalystReview": true,
  "timestamp": "2026-10-05T18:30:00Z"
}

6. Security & Privacy Model

• Cryptographic Password Salting: Passwords hashed with PBKDF2 / SHA-256 with cryptographically secure salts.
• SQL Injection Immunity: 100% of database queries use JDBC PreparedStatement with strict parameter binding.
• Session & Cookie Protection: HttpOnly cookies preventing cross-site scripting token theft, session rotation upon login.
• HTTP Defense Headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and X-XSS-Protection injected on all responses.

7. Troubleshooting & FAQ

8. TeamRootOps Engineering Credits

FraudGuard was engineered as a core security research initiative by TeamRootOps at the School of Computing Science and Engineering (SCSE), Galgotias University.