The problem
A fraud flag that is wrong freezes a real account. A score by itself is a poor reason to act. The person looking at the case needs a short, evidence-backed explanation, and they need it without running every expensive detector on every transaction.
What it does
SPYDRWEB is a transaction analysis pipeline with a live dashboard. Before the detectors run, a planning call produces a structured plan: likely issue types, which of the middle layers are worth running, and how each should be weighted. Low-risk, well-established cases take a fast path with no model calls.
The layers, in order:
- A deterministic rules engine — a handful of hard-coded checks, always on.
- Statistical behavioral baselining against a per-account history.
- Graph topology over accounts, devices, and merchants with NetworkX: fan-in, fan-out, shared identity, hub detection.
- An LLM that reads case context, including support chat.
- An LLM that turns the rest into a plain-language explanation rather than a raw score.
State lives in an append-only event store. Every layer reads the same log, so components cannot silently disagree about what happened. A React dashboard consumes a WebSocket feed and shows per-case traces, not just a number.
The LLM layers output a recommendation with supporting evidence. Nothing acts on its own.
Scoring is multiplicative: several weak signals can compound into a strong one, instead of waiting for a single dominant flag. Vulnerability scoring uses behavioral factors and deliberately leaves age out of the numeric score.
Three decisions
A person keeps the final call. A false positive has an asymmetric cost. The model’s job is to make the human faster and better informed.
The fast path is for cost and latency. Running every layer, including model calls, on every case does not scale. Most routine cases never touch a model.
One shared event log. Each layer reading its own copy of the world is how systems drift. They all read the same append-only stream.
What’s unfinished
This was a hackathon build for two people. Orchestration is hand-rolled against the LLM APIs, not a framework. Automated tests are thin. It is a working pipeline and a dashboard, not a production fraud system, and demo scenarios are not live statistics.