{"paper_id":"49cd9b43-036b-4e82-b7e7-d7536c1a0ef6","body_text":"Unified Real-Time Anomaly Detection Across Retail Fraud and Network Intrusion Streams Using Dependency-Aware Feature Extraction | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Unified Real-Time Anomaly Detection Across Retail Fraud and Network Intrusion Streams Using Dependency-Aware Feature Extraction Naeem Akhtar, Anurag Rana This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9010341/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Real-time monitoring requires detecting rare, high-impact anomalies across heterogeneous streams such as retail transactions and network traffic, under severe class imbalance and strict latency budgets. We propose a unified, domain-aware anomaly detection pipeline that maps both domains to a common event schema with domain masking, and fulfills two goals: (i) efficient feature extraction that captures temporal and contextual dependencies and (ii) real-time deployability. Temporal features are computed in a past-only manner per entity (time since last event and capped recent-activity counts), while contextual typicality is encoded via a train-derived entity-frequency feature mapped to validation/test without leakage. Using time-aware splits, we train gradient-boosted decision trees (LightGBM; XGBoost for comparison) and evaluate AUROC/AUPRC with validation-selected operating thresholds. On the unified test stream, the full LightGBM configuration (base+temporal+context) achieves AUROC = 0.9546 and AUPRC = 0.9042, improving over base-only (AUPRC = 0.8366) and temporal-only (AUPRC = 0.8925). Additional baselines (Logistic Regression, Isolation Forest, Random Forest, and an LSTM sequence model with seq_len = 10) confirm the competitiveness of the proposed approach, with LightGBM remaining best overall. Micro-batched inference benchmarking demonstrates operational feasibility, sustaining 55k–62k events/s with p99 latency < 0.026 ms/event. These results show that dependency-aware feature extraction combined with efficient tree ensembles enables accurate and practical unified detection for retail and network monitoring. anomaly detection fraud detection intrusion detection gradient-boosted decision trees LightGBM XGBoost streaming analytics temporal features contextual features real-time monitoring Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {\"props\":{\"pageProps\":{\"initialData\":{\"identity\":\"rs-9010341\",\"acceptedTermsAndConditions\":true,\"allowDirectSubmit\":true,\"archivedVersions\":[],\"articleType\":\"Research Article\",\"associatedPublications\":[],\"authors\":[{\"id\":604347164,\"identity\":\"24ed02f5-6c87-40d3-82ce-23c3d47f6b06\",\"order_by\":0,\"name\":\"Naeem Akhtar\",\"email\":\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABF0lEQVRIiWNgGAWjYDACHh4QKSHHz94A5suBiAMP8GthBKq1MJbsOQDmG4O1JBDWUpG44QZEWSLYMnxa+HvOHn/wc49E4oYDuQc/fKjYlj4/7PBDoC12croN2LVInO1LbOx5JmE888C5ZMkZZ27nbrydZgDUkmxsdgCHNed5DBt4DkjI9h3sMZDmbQNqmZ0A0nIgcRsOLfJALY1/DkgwNhzmMf7999/tdMPZ6R/wajE422PYDLRFccIxHjNpxobbCfLSOfhtMTxzxnC2zAEJYCDzmFn2HLttuEE6p+BAggFuv8idyTH4+OZAnRy//BvjGz9qbsvLz07fDAw6Ozmc3sd0KlilAbHKQUC+gRTVo2AUjIJRMBIAACKea/uFTRvvAAAAAElFTkSuQmCC\",\"orcid\":\"\",\"institution\":\"Shoolini University\",\"correspondingAuthor\":true,\"prefix\":\"\",\"firstName\":\"Naeem\",\"middleName\":\"\",\"lastName\":\"Akhtar\",\"suffix\":\"\"},{\"id\":604347165,\"identity\":\"da7714c4-fbab-4108-9366-6817e5079501\",\"order_by\":1,\"name\":\"Anurag Rana\",\"email\":\"\",\"orcid\":\"\",\"institution\":\"Shoolini University\",\"correspondingAuthor\":false,\"prefix\":\"\",\"firstName\":\"Anurag\",\"middleName\":\"\",\"lastName\":\"Rana\",\"suffix\":\"\"}],\"badges\":[],\"createdAt\":\"2026-03-02 12:53:28\",\"currentVersionCode\":1,\"declarations\":\"\",\"doi\":\"10.21203/rs.3.rs-9010341/v1\",\"doiUrl\":\"https://doi.org/10.21203/rs.3.rs-9010341/v1\",\"draftVersion\":[],\"editorialEvents\":[],\"editorialNote\":\"\",\"failedWorkflow\":false,\"files\":[{\"id\":104473403,\"identity\":\"9b181fd9-757d-482e-a7cc-25d6fe3039dc\",\"added_by\":\"auto\",\"created_at\":\"2026-03-12 07:42:50\",\"extension\":\"pdf\",\"order_by\":1,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"manuscript-pdf\",\"size\":667834,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"PAAA1.pdf\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-9010341/v1_covered_b7e2c826-2853-4ebd-ad8c-2088709239f8.pdf\"}],\"financialInterests\":\"No competing interests reported.\",\"formattedTitle\":\"Unified Real-Time Anomaly Detection Across Retail Fraud and Network Intrusion Streams Using Dependency-Aware Feature Extraction\",\"fulltext\":[],\"fulltextSource\":\"\",\"fullText\":\"\",\"funders\":[],\"hasAdminPriorityOnWorkflow\":false,\"hasManuscriptDocX\":false,\"hasOptedInToPreprint\":true,\"hasPassedJournalQc\":\"\",\"hasAnyPriority\":true,\"hideJournal\":true,\"highlight\":\"\",\"institution\":\"\",\"isAcceptedByJournal\":false,\"isAuthorSuppliedPdf\":true,\"isDeskRejected\":\"\",\"isHiddenFromSearch\":false,\"isInQc\":false,\"isInWorkflow\":false,\"isPdf\":true,\"isPdfUpToDate\":true,\"isWithdrawnOrRetracted\":false,\"journal\":{\"display\":true,\"email\":\"info@researchsquare.com\",\"identity\":\"researchsquare\",\"isNatureJournal\":false,\"hasQc\":true,\"allowDirectSubmit\":true,\"externalIdentity\":\"\",\"sideBox\":\"\",\"snPcode\":\"\",\"submissionUrl\":\"/submission\",\"title\":\"Research Square\",\"twitterHandle\":\"researchsquare\",\"acdcEnabled\":true,\"dfaEnabled\":false,\"editorialSystem\":\"\",\"reportingPortfolio\":\"\",\"inReviewEnabled\":false,\"inReviewRevisionsEnabled\":true},\"keywords\":\"anomaly detection, fraud detection, intrusion detection, gradient-boosted decision trees, LightGBM, XGBoost, streaming analytics, temporal features, contextual features, real-time monitoring\",\"lastPublishedDoi\":\"10.21203/rs.3.rs-9010341/v1\",\"lastPublishedDoiUrl\":\"https://doi.org/10.21203/rs.3.rs-9010341/v1\",\"license\":{\"name\":\"CC BY 4.0\",\"url\":\"https://creativecommons.org/licenses/by/4.0/\"},\"manuscriptAbstract\":\"\\u003cp\\u003eReal-time monitoring requires detecting rare, high-impact anomalies across heterogeneous streams such as retail transactions and network traffic, under severe class imbalance and strict latency budgets. We propose a unified, domain-aware anomaly detection pipeline that maps both domains to a common event schema with domain masking, and fulfills two goals: (i) efficient feature extraction that captures temporal and contextual dependencies and (ii) real-time deployability. Temporal features are computed in a past-only manner per entity (time since last event and capped recent-activity counts), while contextual typicality is encoded via a train-derived entity-frequency feature mapped to validation/test without leakage. Using time-aware splits, we train gradient-boosted decision trees (LightGBM; XGBoost for comparison) and evaluate AUROC/AUPRC with validation-selected operating thresholds. On the unified test stream, the full LightGBM configuration (base+temporal+context) achieves AUROC\\u0026thinsp;=\\u0026thinsp;0.9546 and AUPRC\\u0026thinsp;=\\u0026thinsp;0.9042, improving over base-only (AUPRC\\u0026thinsp;=\\u0026thinsp;0.8366) and temporal-only (AUPRC\\u0026thinsp;=\\u0026thinsp;0.8925). Additional baselines (Logistic Regression, Isolation Forest, Random Forest, and an LSTM sequence model with seq_len\\u0026thinsp;=\\u0026thinsp;10) confirm the competitiveness of the proposed approach, with LightGBM remaining best overall. Micro-batched inference benchmarking demonstrates operational feasibility, sustaining 55k\\u0026ndash;62k events/s with p99 latency\\u0026thinsp;\\u0026lt;\\u0026thinsp;0.026 ms/event. These results show that dependency-aware feature extraction combined with efficient tree ensembles enables accurate and practical unified detection for retail and network monitoring.\\u003c/p\\u003e\",\"manuscriptTitle\":\"Unified Real-Time Anomaly Detection Across Retail Fraud and Network Intrusion Streams Using Dependency-Aware Feature Extraction\",\"msid\":\"\",\"msnumber\":\"\",\"nonDraftVersions\":[{\"code\":1,\"date\":\"2026-03-12 07:42:13\",\"doi\":\"10.21203/rs.3.rs-9010341/v1\",\"editorialEvents\":[{\"type\":\"communityComments\",\"content\":0}],\"status\":\"published\",\"journal\":{\"display\":true,\"email\":\"info@researchsquare.com\",\"identity\":\"researchsquare\",\"isNatureJournal\":false,\"hasQc\":true,\"allowDirectSubmit\":true,\"externalIdentity\":\"\",\"sideBox\":\"\",\"snPcode\":\"\",\"submissionUrl\":\"/submission\",\"title\":\"Research Square\",\"twitterHandle\":\"researchsquare\",\"acdcEnabled\":true,\"dfaEnabled\":false,\"editorialSystem\":\"\",\"reportingPortfolio\":\"\",\"inReviewEnabled\":false,\"inReviewRevisionsEnabled\":true}}],\"origin\":\"\",\"ownerIdentity\":\"58e2ebef-5387-43bc-b2f9-9f31a806d87c\",\"owner\":[],\"postedDate\":\"March 12th, 2026\",\"published\":true,\"recentEditorialEvents\":[],\"rejectedJournal\":[],\"revision\":\"\",\"amendment\":\"\",\"status\":\"posted\",\"subjectAreas\":[],\"tags\":[],\"updatedAt\":\"2026-03-12T07:42:13+00:00\",\"versionOfRecord\":[],\"versionCreatedAt\":\"2026-03-12 07:42:13\",\"video\":\"\",\"vorDoi\":\"\",\"vorDoiUrl\":\"\",\"workflowStages\":[]},\"version\":\"v1\",\"identity\":\"rs-9010341\",\"journalConfig\":\"researchsquare\"},\"__N_SSP\":true},\"page\":\"/article/[identity]/[[...version]]\",\"query\":{\"redirect\":\"/article/rs-9010341\",\"identity\":\"rs-9010341\",\"version\":[\"v1\"]},\"buildId\":\"XKTyCvWXoU3ODBz1xrDgd\",\"isFallback\":false,\"isExperimentalCompile\":false,\"dynamicIds\":[84888],\"gssp\":true,\"scriptLoader\":[]}","source_license":"CC-BY-4.0","license_restricted":false}