MIRAGE

MIRAGE is an advanced fraud prevention platform designed for digital payment systems. It combines behavioral analytics, machine learning, and graph-based detection to identify and prevent fraudulent transactions in real-time.

Overview

Modern payment fraud has evolved beyond simple rule-based detection. Attackers employ sophisticated techniques including man-in-the-middle attacks, account takeovers, synthetic identities, and coordinated fraud rings. MIRAGE addresses these threats through a multi-layered defense architecture that operates transparently within the payment flow.

The platform is built around three core principles:

1. Proactive Deception - Rather than simply blocking suspicious activity, MIRAGE deploys decoy transactions and honeypot credentials to expose attackers before they can cause harm.

2. Behavioral Intelligence - Every user action, from typing patterns to transaction timing, contributes to a dynamic behavioral profile used for continuous authentication.

3. Federated Learning - Fraud patterns detected at one institution are anonymized and shared across the network, creating collective defense without exposing sensitive data.

Architecture

                                    +-------------------+
                                    |   Admin Dashboard |
                                    |    (Port 9000)    |
                                    +--------+----------+
                                             |
+------------------+    +-------------------+|+-------------------+
|   Mobile App     |--->|   MITM Detector   |||   Backend API     |
|   (Port 3000)    |    |   (Port 5000)     |||   (Port 8000)     |
+------------------+    +-------------------+|+-------------------+
                                             |
                        +--------------------+--------------------+
                        |                    |                    |
               +--------+-------+   +--------+-------+   +--------+-------+
               |  Fraud Scorer  |   | Graph Analyzer |   | Synapse Sync   |
               |  (ML + Rules)  |   |  (NetworkX)    |   | (Federated)    |
               +----------------+   +----------------+   +----------------+
                        |                    |                    |
                        +--------------------+--------------------+
                                             |
                                    +--------+--------+
                                    |   PostgreSQL    |
                                    |   (Database)    |
                                    +-----------------+

Core Features

Fraud Scoring Engine

The fraud scoring engine evaluates every transaction against multiple risk factors:

• Amount Analysis - Compares transaction value against user history and population norms
• Velocity Detection - Tracks transaction frequency to identify automated attacks
• Geographic Verification - Validates location consistency and detects impossible travel
• Device Fingerprinting - Identifies device changes, emulators, and virtual machines
• Behavioral Biometrics - Analyzes typing speed, interaction patterns, and session behavior
• Network Analysis - Detects VPN usage, proxy connections, and suspicious IP addresses
• Recipient Risk - Evaluates the receiving party's risk profile and relationship history

Each factor produces a weighted score. The final risk assessment determines whether a transaction proceeds immediately, requires additional verification, or is blocked.

Shadow Transaction Layer

Shadow transactions are invisible decoy payments embedded within legitimate transaction flows. When an attacker intercepts communications between the app and backend, they cannot distinguish real transactions from shadows.

If a shadow transaction is triggered (meaning an attacker attempted to modify or redirect it), the system immediately:

• Captures the attacker's session data and device fingerprint
• Blocks the associated real transaction
• Alerts the user with details of the prevented attack
• Stores forensic data for investigation

Credential Poisoning

The credential poisoning system generates fake but trackable credentials that appear legitimate:

• Poisoned Emails - Functional email addresses that trigger alerts when used
• Poisoned Phone Numbers - Phone numbers that route to monitoring systems
• Poisoned UPI IDs - Payment identifiers that flag any transaction attempt
• Poisoned Bank Accounts - Account numbers with built-in detection watermarks

When stolen credentials are used in phishing attacks or sold on dark markets, their usage immediately identifies the attacker and compromised system.

Phantom Password Authentication

Phantom passwords are secondary credentials that appear to authenticate successfully but actually trigger security protocols:

• User enters phantom password under duress or during suspected account takeover
• System displays normal login success to the attacker
• All subsequent transactions are logged but not executed
• Real funds remain protected while evidence is gathered

Transaction Time-Lock

High-risk transactions are placed in a time-locked state requiring additional verification:

• OTP Verification - One-time password sent to registered mobile
• Biometric Confirmation - Fingerprint or face verification on device
• Cooling Period - Mandatory delay allowing user to cancel if unintended

Time-lock duration scales with risk level, from 5 minutes for moderate concerns to 24 hours for suspected account takeover.

Dynamic Spend Limits

Rather than static daily limits, MIRAGE calculates personalized spending thresholds:

• Base Limit - Established from account tier and verification level
• Risk Multiplier - Adjusts based on current risk assessment
• Velocity Factor - Reduces available limit as daily transactions accumulate
• Recovery Rate - Gradual restoration of limits with consistent safe behavior

Graph-Based Fraud Ring Detection

The graph analyzer constructs relationship networks from transaction data:

• User Nodes - Represent individual accounts
• Device Nodes - Represent unique device fingerprints
• Transaction Edges - Connect senders to receivers with metadata

Analysis identifies:

• Shared Device Patterns - Multiple accounts accessing from identical devices
• Unusual Connectivity - Accounts with abnormally high transaction diversity
• Ring Structures - Circular transaction flows indicating money laundering
• Bridge Accounts - Nodes connecting otherwise separate networks

Federated Pattern Sharing (Synapse)

Synapse enables secure fraud pattern sharing across institutions:

1. Local fraud patterns are extracted and anonymized
2. Pattern embeddings are created without exposing transaction details
3. Patterns are cryptographically signed and broadcast to peer nodes
4. Receiving institutions validate signatures and integrate relevant patterns
5. New patterns improve local detection without centralized data storage

Directory Structure

mirage/
├── backend/           # FastAPI backend server
│   ├── ai/            # Machine learning models and scoring
│   ├── routers/       # API route handlers
│   └── models.py      # Database models
├── payapp/            # React Native mobile application
│   └── src/
│       ├── components/  # UI components
│       ├── pages/       # Screen definitions
│       └── utils/       # Helper functions
├── admin/             # Admin monitoring dashboard
│   └── src/
│       └── pages/     # Dashboard views
├── mitm/              # MITM attack interceptor
├── scripts/           # Utility and demo scripts
├── docs/              # Documentation
└── data/              # Sample data and models

Screenshots

incase of MITM attacks:

if no spyware/malicious software or MITM present:

Terminal logs:

Getting Started

Prerequisites

• Python 3.10 or higher
• Node.js 18 or higher
• PostgreSQL 14 or higher

Installation

1. Clone the repository:

git clone https://github.com/TSKVenkat/mirage.git
cd mirage

2. Run the setup script:

chmod +x start_local.sh
./start_local.sh

The script automatically:

• Creates Python virtual environments
• Installs backend dependencies
• Installs frontend dependencies
• Configures the database
• Seeds test data
• Starts all services

Accessing the System

After startup, the following services are available:

Service	URL	Description
Mobile App	http://localhost:3000	Main payment application
API Documentation	http://localhost:8000/docs	Interactive API explorer
Admin Dashboard	http://localhost:9000	Fraud monitoring interface

Test Credentials

User	Email	Password
Alice	alice@mirage.com	password123
Bob	bob@mirage.com	password123

API Reference

Complete API documentation is available at /docs when the backend is running. Key endpoints include:

• POST /auth/login - User authentication
• POST /transfer - Initiate payment
• GET /fraud/score/{transaction_id} - Retrieve fraud analysis
• GET /admin/stats - Dashboard statistics
• POST /admin/sandbox/simulate - Test fraud scoring

Configuration

Environment variables are managed through .env files:

Variable	Description	Default
DATABASE_URL	PostgreSQL connection string	postgresql://mirage:mirage_password@localhost:5432/mirage_db
SECRET_KEY	JWT signing key	(generated)
NEO4J_URI	Graph database connection	bolt://localhost:7687
ML_MODEL_PATH	Path to trained models	./ai/models

Documentation

Detailed documentation for each component is available in the docs/ directory:

• Fraud Scoring Engine
• Shadow Transactions
• Credential Poisoning
• Time-Lock Verification
• Graph Analysis
• Synapse Federated Learning
• Admin Dashboard