feat(rules): behavioral POST-rule pack — turn PAA signals into verdicts - #105
Merged
Conversation
Two POST-stage REVIEW rules on PAA-derived features that the ML model misses on trusted, authenticated traffic: - velocity spike: features.velocity_1h >= 15 (individual accounts) - fan-out spray: features.unique_receivers_24h >= 12 (individual accounts) Both exclude agents and corporates (legitimately high-velocity / high-fan-out). Every PAA signal read defaults to 0 on a Redis miss, so the pack is cold-start-safe — silent until PAA accumulates real state. Measured against efficacy-validation: velocity-anomaly recall 0.00 -> 0.80 with zero added false positives across agent-network, payroll, airtime, and remittance legitimate traffic. Mule/ring detection stays model-territory (behavioral-over-time, not a single-feature threshold). Addresses the efficacy validation's 'PAA computes features but nothing consumes them on the decision path' finding.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Turns PAA's velocity/graph signals into actual verdicts — addresses the efficacy validation's finding (#99) that "PAA computes features but no decision pathway consumes them."
What
Two POST-stage REVIEW rules in a new seed (
04_behavioral_rule_pack.ts), keyed on PAA-derived snapshot features:features.velocity_1h ≥ 15, individual accountfeatures.unique_receivers_24h ≥ 12, individual accountBoth guard on
is_agent_assisted == 0andcustomer_is_corporate == 0— agents and payroll accounts are legitimately high-velocity/high-fan-out. Every PAA feature these rules read defaults to 0 on a Redis cache miss, so the pack is cold-start-safe: silent until PAA has accumulated real state, no day-1 false positives. REVIEW (not DECLINE) routes to the analyst queue and feeds the label loop.Measured (efficacy-validation harness, before → after)
Baseline = FATF pack only. Each scenario re-run with identical seeds; the tuning history (a corporate-guard fix after payroll spiked to 20% under an unguarded velocity rule) is in the commit trail.
¹ The delta is ML noise (2 vs 1 AMOUNT_HIGH flags) — no behavioral rule fired on any legitimate scenario.
² Pre-existing FATF VPN-rule flags, unrelated to this pack.
Honest scope
Mule networks and rings stay at ~0 recall and this pack deliberately does not chase them: their signal is behavioral-over-time (received-then-forwarded, community cycling), which PAA's graph-degree features express too laggily/noisily for a reliable single-feature threshold. Two candidate rules targeting those (graph in/out-degree, pair round-trips) were built, measured, and dropped because they never fired on their target topologies — every shipped rule is one the harness validates. Mule/ring detection is the cold-start model retrain's job (next).
🤖 Generated with Claude Code