A drift adaptive framework for detecting and tracking evolving anomalies in financial transaction streams

Abstract Financial fraud detection is increasingly challenged by concept drift, evolving transaction behaviour, and adversarial adaptation, which can degrade conventional anomaly-detection methods under distributional change. Although unsupervised anomaly detection is widely used because labelled fraud data are scarce, most approaches identify anomalous transactions without preserving structural and temporal continuity of anomaly populations. This paper proposes HADA+ (Hybrid Anomaly Detection Architecture Plus), a sequential evolution-aware framework comprising Adaptive Anomaly Prioritization (AAP), Score-Aware Clustering (SAC), Optimal Transport Lifecycle Alignment (OTLA), and Lifecycle Evolution Modeling (LEM). Together, these components extend point-wise anomaly detection through drift-responsive prioritization, score-aware structural representation, cross-window alignment, and lifecycle analysis. HADA + was evaluated using the Credit Card Fraud dataset, a proprietary Mobile Banking transaction stream, a Synthetic Financial dataset with controlled concept drift, and a Controlled Lifecycle Validation Dataset with ground-truth lifecycle events. On the Credit Card Fraud dataset, HADA+ produced stable results across five random-seed executions, attaining ROC-AUC = 0.915219 ± 0.000954, PR-AUC = 0.068736 ± 0.000436, Precision@100 = 0.041943 ± 0.000180, F1@100 = 0.068992 ± 0.000337, and Evolution Continuity Score (ECS) = 0.755973 ± 0.000886. Similar stability was observed on the Synthetic Financial dataset. On the held-out Controlled Lifecycle Validation Dataset, HADA+ achieved a five-event macro-F1 of 0.9673, compared with 0.3674 for nearest-centroid matching, demonstrating stronger reconstruction across the five lifecycle-event classes. Progressive framework integration, continuity analysis, lifecycle validation, scalability evaluation, and statistical analysis demonstrate that HADA+ provides a reproducible, continuity-preserving, lifecycle-aware framework for analysing evolving anomaly populations under changing financial transaction distributions.