Billing Anomaly Detection

A review queue for billing: the system learns what normal invoices look like, flags the odd ones, and explains why, so people only check what needs checking.

Machine learning that spots unusual invoices for review before they go out, without needing past examples of errors.

Billing errors were caught either by checking everything by hand or by fixed rules that missed new kinds of mistakes. There were no labeled examples of bad invoices to train on.

There were no labeled examples of bad invoices. Reviewers either checked everything by hand or relied on fixed rules that missed new kinds of mistakes.

• •Flag unusual invoices without needing labeled data.
• •Compare each invoice with others like it, not with the whole business.
• •Explain every flag so reviewers can act quickly.

I designed and built the unsupervised pipeline in Python with Pandas and scikit-learn, the scoring Lambda on AWS, and the review queue integration in Laravel backed by MySQL.

Built an unsupervised pipeline in Python: features per invoice, k-means to segment normal billing behavior, and a per-cluster Gaussian anomaly score with a threshold tuned on a small reviewed sample. A Lambda scores new invoices and Laravel shows flagged ones in a review queue.

1. 01

   Feature extraction

   Per-invoice features such as line counts, amounts, codes used and timing, scaled consistently.

2. 02

   k-means segmentation

   Groups invoices into segments of normal behavior so different practices are compared fairly.

3. 03

   Gaussian density score

   A per-segment Gaussian model scores how unusual each invoice is; scores below a threshold are flagged.

4. 04

   Scoring Lambda and review queue

   New invoices are scored on AWS Lambda; flagged ones appear in a Laravel review queue with the features that stood out.

• •Applies k-means clustering and Gaussian anomaly detection from Unsupervised Learning, Recommenders, Reinforcement Learning.
• •Built with the Python, Pandas and scikit-learn workflow from Machine Learning with Python.
• •Explanations that point reviewers to the unusual features.

segments = KMeans(n_clusters=k, n_init=10, random_state=7).fit(X_scaled)
scores = np.empty(len(X_scaled))
for c in range(k):
    members = X_scaled[segments.labels_ == c]
    mu, var = members.mean(axis=0), members.var(axis=0) + 1e-6
    idx = segments.labels_ == c
    scores[idx] = multivariate_normal(mu, np.diag(var)).logpdf(X_scaled[idx])
flagged = scores < epsilon

1. 01

   With no labels, the threshold was set against a small set of invoices reviewers had already checked, then revisited as feedback came in.

   The threshold was set against a small reviewed sample and is revisited as reviewer feedback accumulates.

2. 02

   Different practices bill very differently, so one global model flagged whole segments; clustering first kept comparisons fair.

   Segmenting with k-means before density scoring keeps comparisons within similar billing patterns.

3. 03

   Every flag needed an explanation, so the queue shows which features were furthest from the cluster norm.

   Each flag lists the features furthest from its segment’s norm.

Security

Scoring uses invoice features, not patient notes, and the review queue follows the same billing permissions as the rest of the system.

Speed & growth

Scoring runs per invoice in a Lambda, so the review queue fills as invoices are created without batch delays.

Synthetic anomalies injected into historical data to check they are flagged, plus stability checks on clusters between training runs.

These are design targets and approach choices for the system, not reported production figures.