Explainable ensemble learning using SHAP for ERP anomaly detection
摘要
Enterprise Resource Planning (ERP) systems in manufacturing environments process hundreds of thousands of daily transactions, yet anomalies evade detection in the majority of cases under routine manual audit regimes. Although neural network approaches achieve F-scores exceeding 0.90 on synthetic benchmarks, they sacrifice the explainability that regulatory compliance and audit requirements demand for production deployment. Here we present an explainable ensemble learning framework combining six heterogeneous anomaly detection models—Isolation Forest, Local Outlier Factor, One-Class SVM, Elliptic Envelope, Gradient Boosting, and a Robust Autoencoder—for multidimensional ERP transaction analysis. Evaluated on 209,666 real-world procurement transactions, the ensemble achieves an F-score of 0.8437 (95 % CI on held-out test set of 41,933 transactions: [0.8305, 0.8569]) while providing a three-layer interpretability stack: gradient-boosting feature importance rankings, interpretable decision rules with 87.3 % logic coverage, and SHAP-based instance-level attribution. This F-score is lower than those of the highest-performing individual constituent models (Gradient Boosting: 0.9321; Robust Autoencoder: 0.9254), a trade-off that is deliberate: the ensemble provides significantly improved cross-validation stability (coefficient of variation: 0.49 % vs. 1.4–2.1 % for top individual models) and a 19.4 % reduction in false-positive rate (relative to the unweighted arithmetic mean constituent FP rate of 14.1 %), as demonstrated through Pareto-front analysis over all 63 non-trivial model subsets. Statistical validation through 5-fold stratified cross-validation, paired t-tests (