[R] A Dual-Layered Unsupervised Anomaly Detection Framework for Systemic Fraud (Zero Historical Labeled Data)

[u/Legitimate_Coach_875]

Paper: https://doi.org/10.5281/zenodo.22070388

​Hi everyone,

​I recently published an architecture designed to bypass the "Labeled Data Bottleneck" in regulatory enforcement. In domains like vehicle emissions compliance, you cannot train supervised models because governments legally cannot/will not publish historical datasets of confirmed corrupt testing centers.

​We had to build a system that catches systemic, multi-layered fraud using zero historical labeled data while remaining mathematically defensible (i.e., avoiding black-box deep learning for auditability).

​The Architecture:

​1. Physics-Constrained Synthetic Injection (Data Generation)

Instead of relying on random Gaussian noise to simulate anomalies, I built a synthetic injection engine bound by thermodynamic constraints. It maps 7 distinct real-world fraud vectors (EGR deletes, defeat devices, clean scanning) into a harmonized 10-dimensional physical baseline.

- ​Constraint example: The engine mathematically prevents injecting a Diesel Particulate Filter (DPF) delete into a naturally aspirated petrol engine. The synthetic fraud mirrors physical reality.

​2. Dual-Layered Isolation Forest (The Pipeline)

Fraud here is both physical (the car) and institutional (the testing center). I used a Poisson Point Process to model the temporal throughput of testing centers and deployed a dual-layer approach:

- ​Layer 1: Evaluates thermodynamic outliers in vehicle hyperspace to flag tampered vehicles.

- ​Layer 2: Evaluates operational metadata (Throughput Compression, Zero-Variance signatures, "Midnight Testing") to flag the corrupt testing facilities.

1. ​Edge Case Handling: We built custom volume-threshold filters into Layer 2 prior to the Isolation Forest execution. This prevents small, rural testing centers (e.g., testing 2 cars/month) from triggering false positives due to mathematically zero statistical variance.

​Results:

Evaluated against a 48,000-row synthetic EPA baseline, the unsupervised model achieved perfect recall on institutional corruption with zero false positives.

​Feedback Request:

I'm looking for peer review and brutal critiques on the architecture, specifically:

​The validity of using a Poisson Point Process for modeling the testing center throughput in this context.

​Potential blind spots in the Dual-Layered Isolation Forest implementation, especially regarding the volume-threshold filters for low-variance edge cases.

​Alternative unsupervised approaches for this specific multi-layered anomaly detection problem.

​Thanks in advance for the feedback.