Dual-layer anomaly detection for digital fulfilment

Context

Digital fulfilment generates a high volume of transactions, and a small fraction of them look wrong — unusual patterns of timing, value, or sequence that warrant a human check. The review team had no systematic way to prioritise which transactions to look at.

Problem

Rules alone miss novel patterns and produce too many false positives when tuned tightly. An unsupervised model alone is hard for reviewers to trust because it cannot say why something is anomalous. Neither approach on its own was going to be adopted.

What I did

I built two layers. The first is a set of weighted business rules encoding the patterns reviewers already knew mattered, producing an interpretable score. The second is an Isolation Forest over the same features, catching structure the rules do not describe. The two scores are combined and surfaced in Power BI, so a reviewer sees a ranked queue plus the rule contributions behind each case.

Result

Reviewers got a ranked queue instead of a flat list, with the rule contributions behind each case shown alongside the model score, so they could see why a case was at the top before deciding what to do with it.

What I learned

The combination worked because each layer covered the other’s weakness — the rules gave reviewers a reason to trust the queue, and the model gave the queue coverage the rules alone did not have. Delivering into a tool people already used mattered as much as the model itself.