PixelAndPotion/siren

A real-time fraud detection simulator built in pure Python. SIREN generates a continuous stream of synthetic South African banking transactions, scores each one through a custom rule-based engine, and fires a full-screen alert when a high-risk transaction is detected. # SIREN — Real-Time Transaction Fraud Detection A real-time fraud detection simulator built in pure Python. SIREN generates a continuous stream of synthetic South African banking transactions, scores each one through a custom rule-based engine, and fires a full-screen alert when a high-risk transaction is detected. ## How it works Transactions scroll across the bottom of the screen as a live ticker. When the fraud engine flags a HIGH-risk transaction, the entire interface transforms — the screen turns red and a detailed alert card appears showing exactly why the transaction was flagged. The operator dismisses it and monitoring continues. ## The fraud engine Seven independent rules. Each fires independently and scores are additive: | Rule | Trigger | Score | |---|---|---| | Unusual hour | Transaction between 01:00–05:00 | +25 | | High amount | Over R15,000 | +20 | | Velocity | 3+ transactions in 60 seconds | +30 | | Merchant mismatch | Luxury purchase after everyday spending | +15 | | Round amount | Exactly R500, R1000, R5000 etc | +10 | | High-risk category | Gambling, Crypto, Wire Transfer | +35 | | ATM sequence | Multiple consecutive ATM withdrawals | +20 | Score 0–39 = LOW · 40–69 = MEDIUM · 70+ = HIGH → alert fires ## Controls | Key / Action | What it does | |---|---| | `L` | Toggle flagged transaction log | | `Esc` | Dismiss active fraud alert | | `DISMISS` button | Dismiss active fraud alert | ## Stack - Python 3.10+ - Tkinter — UI and canvas animation - SQLite — persistent audit trail of all flagged transactions - Threading — non-blocking transaction generator - No external packages ## Run it ```bash python siren.py ``` ## File structure ``` siren/ ├── siren.py # Main application and UI ├── fraud_engine.py # Rule-based scoring engine ├── database.py # SQLite audit trail ├── requirements.txt └── README.md ```