Explainable Hybrid AI for Detecting Ledger Manipulation in SME Accounting Systems: A Cyber-Forensic Framework Using Deep Autoencoders, XGBoost and SHAP
Abstract
This working paper develops and evaluates an explainable hybrid artificial-intelligence framework for detecting anomalous general-ledger transactions in small and medium-sized enterprise (SME) accounting systems. A synthetic SME general ledger comprising 50,000 transactions across 400 accounts and 80 users was generated over the period 2022–2024, with approximately 2% controlled behavioural anomalies representing amount spikes, unusual posting hours, rare debit-credit account relationships and suspiciously round amounts.The framework combines Isolation Forest, a Deep Autoencoder, supervised XGBoost refinement and SHAP-based explainability. Ground-truth anomaly variables, anomaly categories, transaction descriptions, transaction identifiers and transaction-type labels were excluded from predictive model inputs. The models therefore operated on behavioural characteristics rather than descriptive anomaly indicators. Experimental evaluation used a chronological 70/15/15 training-validation-test design.On the held-out test set, the Hybrid Autoencoder–XGBoost model achieved precision of 0.646, recall of 0.329, F1 of 0.436 and PR-AUC of 0.359, with a final alert rate of 1.09%. Compared with the standalone Autoencoder, hybrid refinement reduced false-positive alerts from 118 to 29 while retaining 53 of 61 Autoencoder-detected anomalies.SHAP analysis identified credit-account frequency, debit-credit pair rarity, debit-account frequency and Autoencoder reconstruction error among the strongest contributors to model decisions. The study positions explainable hybrid AI as an auditor decision-support mechanism rather than as an autonomous determination of fraud.Supporting materials include synthetic data, experimental results, transaction-level test predictions, feature documentation, run metadata and explainability outputs. No real organisational records, confidential financial information or personal data were used.
