Which alerts are likely to be escalated?

The research question

Can the history available before an alert help estimate whether a specialist will escalate it?

An alert is a case for review. Dismissed = 0; escalated = 1. Escalation means further investigation; it is not proof of wrongdoing.

What we worked with

2,405 alerts were escalated (17.18%); 11,595 were dismissed (82.82%). This imbalance makes raw accuracy alone a poor way to describe performance.

Data preparation

1. Link transactions to alerts using signal_id.
2. Treat the date-only alert timestamp as midnight; remove later transactions.
3. Summarize each alert's remaining history into one feature row.

The time filter removed 840 training and 51 test transactions. It retained 6,986,823 training and 3,027,524 test transactions. Every alert still had history.

miqdor_indeksi is a standardized size indicator, not an amount in UZS. Negative values are valid; adding them does not measure monetary turnover.

What separated the two groups?

Each number below is an average of per-alert summaries, so alerts with many transactions do not receive extra weight.

Three observations to remember

Activity is a weak clue. Escalated alerts had slightly more transactions, but the groups overlap substantially.

Size patterns matter in unexpected ways. The lowest fifth of historical mean size had a 20.61% escalation rate, compared with 14.57% for the highest fifth. This is an association in synthetic data, not a causal rule.

A recent burst is not a simple escalation rule. Across increasing fifths of the seven-day versus preceding-83-day activity ratio, escalation rates were 18.14%, 17.00%, 16.25%, 17.61%, and 16.89%. Rates did not steadily rise.

What we can conclude

Several patterns together may help the model. A rule such as “international transactions always mean escalation” is unsupported. Across 11 selected features, train/test standardized mean differences were below 0.025; that limited check does not establish that all distributions are identical.

Descriptive findings use all training rows after the model recipe was frozen. They were not used to retune after holdout evaluation.

From transaction rows to model inputs

We summarize 1, 3, 7, 14, 30, 60, 90, and 180 days, plus all available history.

The same feature code handles train and test data. The target, raw alert ID and absolute alert date are excluded from predictors. Empty-window counts are zero; unavailable statistics stay missing. Logistic regression preprocessing is fitted within each fold.

Comparing models

11,200 development alerts were used in three folds for selection and early stopping. 2,800 holdout alerts were reserved for the final assessment.

The blend averages LightGBM and CatBoost probabilities. Its development AUC gain over LightGBM was only 0.0018; no statistical significance is claimed. The fixed recipe uses 110 LightGBM rounds and 399 CatBoost rounds.

The main result: untouched holdout

ROC-AUC in plain language: for a randomly chosen escalated and dismissed alert from the holdout, the model ranks the escalated alert higher about 64.16% of the time, with half credit for ties. It does not mean 64.16% classification accuracy.

A 1,000-resample bootstrap gives a 95% interval of 0.6138–0.6690. This is conditional on the fitted recipe and does not capture every source of uncertainty.

Are the probabilities exact?

No. In the highest holdout probability bin, the average prediction was 27.34%, while 29.71% actually escalated. Calibration remains imperfect. No post-hoc calibrator was fitted on the untouched holdout.

Does the result hold across time?

A chronological sensitivity check, split at 6 June 2026, gave 0.6521 ROC-AUC. It is not independent confirmation: model selection had already used some of those later rows.

Final output

The report describes six final models: LightGBM and CatBoost at seeds 42, 137 and 2026, refitted on all 14,000 training alerts. Their probabilities were averaged for 6,000 test alerts.

The reported submission uses signal_id,ehtimollik, matching the supplied template. eskalatsiya is the training target. Reported probabilities range from 0.0662062425 to 0.3776646370.

What remains unknown

• The final six-model ensemble has no independent labeled test score; only organizers can evaluate hidden-test outcomes.
• We cannot verify customer independence because no customer identifier is available.
• No feature-family ablation study or dedicated calibration comparison was completed.
• These synthetic findings do not establish performance on real banking data.

Conclusion: the approach provides a reproducible estimate with modest ranking power. Better calibration and independent validation are sensible next research steps.

Our working plan

Closing statement

Transaction history contains some useful signal for escalation. Our selected recipe achieved 0.6416 holdout ROC-AUC. We treat it as a research result with limitations, and we do not claim that every estimated probability is exact.

Source and scope

Method references cited by the report:

• scikit-learn: model evaluation
• scikit-learn: probability calibration