Related Experiment Videos
Explainable ensemble learning using SHAP for ERP anomaly detection
Adiah Qazi1, Ammad Ali Khan Jadoon2
1Department of Information Security, Military College of Signals, National University of Sciences and Technology (NUST), Islamabad, Pakistan. adiaqazi@yahoo.com.
Scientific Reports
|June 14, 2026
Summary
This study introduces an explainable ensemble learning framework for detecting anomalies in Enterprise Resource Planning (ERP) systems. The framework balances detection accuracy with crucial interpretability for regulatory compliance, significantly reducing false positives in manufacturing fraud detection.
Area of Science:
- Computer Science
- Data Science
- Machine Learning
Background:
- Enterprise Resource Planning (ERP) systems generate vast transaction volumes, making anomaly detection challenging with manual audits.
- Existing neural network models offer high accuracy but lack the explainability required for regulatory compliance in production environments.
- There is a need for anomaly detection methods that are both accurate and interpretable for critical financial and operational systems.
Purpose of the Study:
- To develop an explainable ensemble learning framework for detecting anomalies in multidimensional ERP transactions.
- To combine diverse anomaly detection models to achieve a balance between performance and interpretability.
- To validate the framework's effectiveness and generalizability in real-world manufacturing and diverse ERP scenarios.
Main Methods:
- An ensemble framework combining six heterogeneous anomaly detection models: Isolation Forest, Local Outlier Factor, One-Class SVM, Elliptic Envelope, Gradient Boosting, and a Robust Autoencoder.
- Evaluation on a large dataset of 209,666 real-world procurement transactions.
- Implementation of a three-layer interpretability stack: gradient-boosting feature importance, interpretable decision rules, and SHAP-based instance-level attribution.
Main Results:
- The ensemble achieved an F-score of 0.8437 on real-world ERP transactions, demonstrating robust performance.
- The framework provides significant cross-validation stability (0.49% CV) and a 19.4% reduction in false-positive rates compared to constituent models.
- Generalizability analyses across five ERP scenarios confirmed consistent performance (F-scores [0.794, 0.862]), and deployment yielded $4.1 million in fraud prevention.
Conclusions:
- The explainable ensemble learning framework effectively detects anomalies in ERP systems while meeting regulatory compliance and audit requirements.
- The deliberate trade-off for interpretability enhances model stability and reduces false positives, crucial for operational deployment.
- The framework demonstrates significant value in fraud prevention and regulatory compliance (SOX 404, COSO, ISO 27001) in manufacturing environments.