Deploying a Complete Machine Learning Fraud Detection Solution Using Amazon SageMaker : AWS Project

Introduction

This project leverages Amazon SageMaker and key AWS services to build a scalable, real-time fraud detection solution. By utilizing Amazon SageMaker’s machine learning capabilities, combined with services such as AWS Lambda, S3, and API Gateway, this setup processes transaction data to identify fraudulent patterns efficiently. It provides a robust framework for secure, automated, and reliable fraud detection, designed for seamless integration into production environments where real-time insights are essential.

Tech Stack

This solution leverages a range of AWS services, each playing a crucial role in creating a scalable, secure, and responsive machine learning infrastructure:

• Amazon SageMaker: Core platform for model training, deployment, and hosting.




• AWS Lambda: Automates resource creation, orchestrates SageMaker integrations, and handles infrastructure setup.




• Amazon S3: Stores training data, model artifacts, and log files.




• AWS IAM: Manages access control with defined roles and policies.




• Amazon EC2 and VPC: Provides network isolation and backend processing capabilities.




• Amazon CloudWatch: Enables monitoring and alerting for various system components.




• Amazon SQS: Manages asynchronous task queues for inter-service communication.

Additional Services:

• AWS Secrets Manager: Safeguards sensitive information such as API keys.




• AWS CloudTrail: Tracks account activity and resource changes.




• Amazon Route 53: Manages domain name resolution for the API endpoint.




• AWS Systems Manager (SSM): Provides parameter management and infrastructure automation.




• Amazon API Gateway: Exposes model predictions as RESTful APIs.




• Amazon SNS: Sends alerts and notifications based on specific events.




• Amazon CloudFormation: Automates infrastructure provisioning.

Prerequisites

Before beginning, ensure you have:

1. Basic AWS Knowledge: Familiarity with Amazon SageMaker, IAM, Lambda, and S3.




2. Python and ML Basics: Knowledge of Python for model training and AWS SDK integration.




3. AWS CLI and SDKs: Installed and configured for seamless AWS service management.




4. IAM Permissions: Appropriate permissions to interact with SageMaker, S3, Lambda, and other services used in the project.

Problem Statement or Use Case

Detecting fraudulent transactions is a challenge for financial institutions due to the high volume and complexity of real-time data. Fraud detection models need to be scalable, secure, and capable of integrating seamlessly with backend systems to process transactions in real-time. This project addresses these needs by developing a machine learning-based fraud detection model that:

• Learns and Identifies Fraud Patterns: Uses machine learning to analyze transaction data and classify transactions as legitimate or suspicious.




• Ensures Scalability and Efficiency: Deploys a highly scalable, serverless architecture using SageMaker and Lambda.




• Enables Real-Time Monitoring and Notifications: Implements CloudWatch, CloudTrail, and SNS for tracking and alerting on model performance and anomalies.

The solution is ideal for large-scale fraud detection in production environments, enabling real-time insights with minimal manual intervention.

Architecture Diagram

The architecture diagram below shows the interaction between various AWS services, highlighting the flow of data from transaction storage to model inference and result distribution.

Download the CloudFormation template to your local computer:

curl 'https://static.us-east-1.prod.workshops.aws/public/aed5dc57-f15e-4afa-bbf4-9ff167491648/static/fraud-detection-workshop-selfpaced.yaml' --output fraud-detection-workshop-selfpaced.yaml

(AWS Console) to create a new stack.

On Create stack screen, under the Specify a template section, select Upload a template file option and navigate to select fraud-detection-workshop-selfpaced.yml file you downloaded earlier. Click Next.

1. On the Configure stack options screen, leave default parameters unchanged, scroll to the bottom of the page, and click Next




2. On the Review fraud-detection-workshop screen, scroll to the bottom of the page and check off the box “I acknowledge that AWS CloudFormation might create IAM resources.”. Click Create Stack.

1. Navigate to service page in the AWS console.




2. Click on the Studio link in the left navigation pane under Control Panel.

1. This will open SageMaker Studio UI in new browser window.

Attention

Amazon SageMaker Studio and Amazon SageMaker Studio Classic are two of the machine learning environments that you can use to interact with SageMaker. In this workshop, we will use SageMaker Studio Classic experience.

The Amazon SageMaker Studio UI extends the SageMaker Studio Classic interface. Click on “Studio Classic” icon under Applications.

Now let’s walk through the various files and resources pre-provisioned for you.

There are seven helper scripts in scripts directory:

steps. Resources created during the workshop may incur minor charges. It is best practice to spin down resources when they’re not in use.

Congratulations! You have successfully completed the Overview of the Environment.

Click “Next” to go to the next section.

Running Jupyter Notebooks

Note

If you already know how to execute Jupyter notebooks, skip this section.

Note: If for some reason, you see an error on capacity for this particular instance type, it’s okay to scale up and choose the next available instance type.

1. If you haven’t worked with Jupyter notebooks before, the following screenshots explains how to execute and run different cells.

Congratulations! You have successfully completed the steps of how to run Jupyter Notebooks.

Click “Next” to go to the next section.

Data Preparation

1 — Ingest, Transform And Preprocess Data

Note

The following material provides contextual information about this lab. Please read through this information before you refer jupyter notebook for step-by-step code block instructions.

• 
  
  
  

  Exploratory Data Analysis (EDA) is an unavoidable step in the Machine Learning process. Raw data cannot be consumed directly to create a model. Data stakeholders understand, visualize and manipulate data before using it. Common transforms include (but aren’t limited to): removing symbols, one-hot encoding, removing outliers, and normalization.

  
  

  
  
  
  
  

  
  
  

  For our use case we have been provided with two datasets claims.csv and customers.csv containing the auto-insurance claims and customers' information respectively. This dataset was generated synthetically. However, the raw dataset can be non-numeric which is hard to visualize and cannot be used for the Machine Learning process.

  
  
  

  Consider the columns driver_relationship or incident_type in claims.csv. The data type for values under these columns is known as an Object. It's a string that represents a feature. It's hard to use this kind of data directly since machines don't understand strings or what they represent. Instead, it would be a lot easier to just mark a feature as a one or zero.

  
  
  
  
  

  Similarly, many transformations are required before the data can be used for Machine Learning. Data stakeholders often iterate over datasets multiple times before they can be used. In this case, transformations are created using Amazon SageMaker Data Wrangler (see the hint below). With this context in mind the following files are available:

  
  
  
  
  

  1. The .flow templates named customer_flow_template and claims_flow_template. These templates contain the transformations on customer and claims dataset created through SageMaker Data Wrangler. These files are in the standard JSON format and can be read in using the python json module.

  
  

  2. These transformations are applied to the raw datasets. The final processed datasets are claims_preprocessed.csv and customers_preprocessed.csv. The notebook starts off with these preprocessed datasets.

  
  
  
  
  

  Hint

  
  
  

  If you wish to learn how to make these transformations yourself, you can go through the
  
  
  

  At this point, let’s head over to the first notebook. Navigate to the SageMaker Studio UI and click on the folder icon on the left navigation panel. Open the folder FraudDetectionWorkshop. Finally, open the first notebook titled Lab_1_and_2-Data-Exploration-and-Features.ipynb.

  
  
  

  
  
  
  

  Congratulations! You’ve successfully learned how to visualize and pre-process the data and gather insights.

  
  
  

  In this lab we learned how to transform data easily using Amazon SageMaker Studio Notebooks.

  
  
  

  Click “Next” to go to the next section.

  
  
  

  
  
  
  2 — Feature Engineering
  

  
  
  

  Note

  
  
  

  The following material provides contextual information about this lab. Please read through this information before you refer jupyter notebook for step-by-step code block instructions.

  
  
  

  Prerequisite

  
  
  

  Please make sure Lab 1 is executed successfully before you proceed with this lab.

  
  
  
  
  
  
  
  
  

  • 
    
    
    

    , an interactive query service.

    
    
    

    In this lab, you will learn how to use Amazon SageMaker Feature Store to store and retrieve machine learning (ML) features.

    
    
    

    
    
    
    
    

    
    
    

    The collected data, we refer to it as raw data is typically not ready to be consumed by ML Models, The data needs to transformed e.g. encoding, dealing with missing values, outliers, aggregations. This process is known as feature engineering and the signals that are extracted as part of this data prep are referred to as features.

    
    
    

    A feature group is a logical grouping of features and these groups consist of features that are computed together, related by common parameters, or are all related to the same business domain entity.

    
    
    

    In this step, you are going to create two feature groups: customer and claims.

    
    
    

    . This API can handle high TPS (Transactions Per Second) and is designed to be called concurrently by different streams. The data from PUT requests is written to the offline store within few minutes of ingestion.

    
    
    

    Hint

    
    
    

    It is possible to verify that the data is available offline by navigating to the S3 Bucket.

    
    
    

    
    
    
    table (this is done by default, but can be turned off). In order to build our training and test datasets, you will submit a SQL query to join the Claims and Customers tables created in Athena.

    
    
    

    The last step in this notebook is to upload newly created datasets into S3.

    
    
    

    At this point, let’s navigate back to the first notebook (Lab_1_and_2-Data-Exploration-and-Features.ipynb) and scroll down to Lab 2: Feature Engineering

    
    
    

    Note

    
    
    

    Follow the jupyter notebook instructions till you complete Lab 2 and navigate back here when done.

    
    
    

    
    
    
    
    

    
    
    

    In this section, you will learn about the following highlighted step of the Machine Learning process.

    
    
    
  
  
  
  
  
  
  
  
  

  
  
  
  to build, and train the ML model.

  
  
  

  To train a model using SageMaker, you create a training job. The training job includes the following information:

  
  
  

  
  

  • The URL of the Amazon Simple Storage Service (Amazon S3) bucket where you’ve stored the training data.

  
  

  • The compute resources that you want SageMaker to use for model training. Compute resources are ML compute instances that are managed by SageMaker.

  
  

  • The URL of the S3 bucket where you want to store the output of the job.

  
  

  • The Amazon Elastic Container Registry path where the docker container image is stored.

  
  

  
  
  

  For this tutorial, you will use the . Any functionality provided by the XGBoost Python package can be implemented in your training script. XGBoost is an extremely popular, open-source package for gradient boosted trees. It is computationally powerful, fully featured, and has been successfully used in many machine learning competitions.

  
  
  

  
  
  
  
  

  
  
  

  There are two ways to obtain the dataset:

  
  
  
  
  

  1. Use the dataset you uploaded to Amazon S3 bucket in the previous Lab (Lab 2 — Feature Engineering).

  
  

  2. Upload the following datasets from data folder to Amazon S3: train.csv, test.csv

  
  
  
  
  

  The following code upload the datasets from data folder to Amazon S3:

  
  
  

  
  
  
  

  You will define SageMaker Estimator using

  
  
  

  For this example, we will use the following parameters for the XGBoost estimator:

  
  
  
  
  

  • entry_point - Path to the Python source file which should be executed as the entry point to training.

  
  

  • hyperparameters - Hyperparameters that will be used for training. The hyperparameters are made accessible as a dict[str, str] to the training code on SageMaker.

  
  

  • output_path - S3 location for saving the training result (model artifacts and output files).

  
  

  • framework_version - XGBoost version you want to use for executing your model training code.

  
  

  • instance_type - Type of EC2 instance to use for training.

  
  
  
  
  

  If you want to explore the breadth of functionality offered by the SageMaker XGBoost Framework you can read about all the configuration parameters by referencing the inheriting classes. The XGBoost class inherits from the Framework class and Framework inherits from the EstimatorBase class:

  
  
  
  
  
  
  
  • 
    
    

    
    
    
    . SageMaker’s Model Registry is a metadata store for your machine learning models. Within the model registry, models are versioned and registered as model packages within model groups. Each model package contains an Amazon S3 URI to the model files associated with the trained model and an Amazon ECR URI that points to the container used while serving the model.

    
    
    

    At this point, let’s navigate back to the training notebook (Lab_3_and_4-Training_and_Deployment.ipynb) and scroll down to Lab 3: Prerequisites

    
    
    

    Note

    
    
    

    Follow the jupyter notebook instructions till you complete Lab 3 and navigate back here when done.

    
    
    

    
    
    
    

  
  
  
  
  
  
  

  
  
  
  

  
  
  

  
  
  
  
  

  
  
  

  After you create a model version, you typically want to evaluate its performance before you deploy the model in production. If it performs to your requirements, you can update the approval status of the model version to Approved. In the real-life MLOps lifecycle, a model package gets approved after evaluation by data scientists, subject matter experts, and auditors.

  
  
  

  For the purpose of this lab, we will evaluate the model with test dataset that was created during training process. The lab contains evaluate.py script that calculates AUC (Area under the ROC Curve) on the test dataset. The AUC threshold is set at 0.7. If the test dataset AUC is below the threshold, then the approval status should be “Rejected” for that model version.

  
  
  

  
  
  
  documentation.




• Define the endpoint configuration: Specify the name of one or more models in production (variants) and the ML compute instances that you want SageMaker to launch to host each production variant.

Once you have your model and endpoint configuration, use the .

Congratulations! You have successfully deployed an endpoint to get predictions from your model.

In this lab, you created a low latency Endpoint using Amazon SageMaker and deployed your model to get predictions. In the next lab, you will learn how to integrate all of the steps you’ve learnt so far using SageMaker Pipelines.

Click “Next” to go to the next section.

Machine Learning Workflow

5 — Pipelines

Note

The following material provides contextual information about this lab. Please read through this information before you refer jupyter notebook for step-by-step code block instructions.

Attention

This lab demonstrates how to build an end-to-end machine learning workflow using Sagemaker Pipeline. This is a stand-alone lab and can be run independently of the previous labs.

If you have already executed the previous labs (Lab 1 and Lab 2) then you don’t need to run the Step 0 on juypter notebook.

SageMaker Pipelines service is composed of following steps. These steps define the actions that the pipeline takes and the relationships between steps using properties.

Next you will create an instance of a SKLearnProcessor processor. You can split the dataset without using SKLearnProcessor as well, but if the dataset is larger than the one provided, it will takes more time and requires local compute resources. Hence it is recommended to use manage processing job.

interface. A typical training script loads data from the input channels, configures training with hyperparameters, trains a model, and saves the model to “model_dir”.

Typically, customers can create a ModelPackageGroup for SageMaker Pipelines so that model package versions are added for every iteration.

and copy Lambda ARN of the lambda function (under the Outputs tab).

. This Pipelines definition encodes a pipeline using a directed acyclic graph (DAG) that can be exported as a JSON definition.

Next, you will see the executions listed on the next page. Double-click on the Status executing to be taken to the graph representation.

Note

Follow the jupyter notebook instructions till you complete Lab 5 and navigate back here when done.

In this workshop, you have learned how to:

• Inspect, analyze and transform an auto insurance fraud dataset




• Ingest transformed data into SageMaker Feature Store using the SageMaker Python SDK




• Train an XGBoost model using SageMaker Training Jobs




• Create a realtime endpoint for low latency requests using SageMaker




• Integrate all previous steps into an MLOps workflow with SageMaker Pipelines

home page, click Stacks **under the left hand side menu, select stack **fraud-detection-workshop **stack, and click **Delete button to delete the stack.

home page and expand Inference **in SageMaker dashboard section on left hand side menu. Click **Models, and select fraud-detect-model-xxxxxxxxxxxx. Click Action **button and select **Delete option to delete the model.

1. Delete the lifecycle configuration.




2. In SageMaker home page left hand side menu, click on Lifecycle configurations. Select git-clone-step lifecycle configuration and click Delete button to delete the lifecycle configuration.

. To delete the bucket, you need to first delete the objects inside the bucket. Click on sagemaker — xxxxxxxxxxxx bucket and select checkbox on the top of the object table to select all objects.

Congratulations! You have successfully cleaned up the environment.

This brings us to the end of this workshop.

Thank you.

Challenges Faced and Solutions

Challenge 1: Real-Time Model Inference and Latency Optimization

• 
  Solution: Leveraged API Gateway and Lambda to manage requests, reducing latency by preprocessing data in Lambda and only sending necessary data to SageMaker.

Challenge 2: Managing Security for Sensitive Data

• 
  Solution: Used AWS Secrets Manager to secure sensitive information such as database credentials, API keys, and integrated with IAM to enforce role-based access control.

Challenge 3: Monitoring and Troubleshooting Complex Workflows

• 
  Solution: Integrated CloudWatch, CloudTrail, and X-Ray to gain visibility into all workflow steps, allowing for efficient troubleshooting and resource optimization.

Conclusion

This end-to-end solution highlights the power of Amazon SageMaker in handling real-time fraud detection and anomaly classification. By integrating AWS tools for automation, monitoring, and security, this project demonstrates an adaptable, high-performance architecture that can scale to meet growing data demands. The setup is versatile and supports businesses in proactive fraud management, ensuring fast, accurate, and secure anomaly detection for production-grade applications.

Explore my ,