Research question
Which unusual recharge and identity patterns warrant further examination when confirmed theft labels are unavailable?
Approach
Engineer behavioral and integrity features, combine Isolation Forest and Local Outlier Factor signals, and apply a separate rule-based identity and tariff consistency layer.
Contribution
An interpretable screening framework that can guide subsequent record review and field verification.
Evidence & limitations
An anomaly is not proof of theft, meter bypass or a cyberattack. Risk tiers need inspection-based validation; recharge-only records cannot diagnose a physical mechanism.
Next step
Link authorized inspection outcomes to model flags and evaluate precision, false positives and stability.
Methodology stages
01 / Behavioral features
02 / IF + LOF ensemble
03 / Integrity checks
04 / Verification priority