Cluster Centroids

The algorithm applies K-means clustering to the majority class, setting K equal to the number of minority class samples. Each cluster is then replaced by its centroid—the arithmetic mean of all points in that cluster. This transforms the majority class from raw, potentially redundant instances into a set of synthetic prototypes that capture the underlying data distribution. Unlike random under-sampling, which discards information, this method retains the topological structure of the majority class by preserving its natural groupings.

The quality of the generated centroids depends heavily on the chosen distance metric. Euclidean distance is the default but may perform poorly on high-dimensional or categorical financial data. Alternatives include:

• Manhattan distance for grid-like feature spaces
• Cosine similarity for directional transaction vectors
• Mahalanobis distance when features are correlated Poor metric selection can produce centroids that misrepresent the true cluster structure, degrading downstream classifier performance.

In fraud detection, transaction features often span hundreds of dimensions. K-means suffers from the curse of dimensionality, where distance measures become less meaningful. To mitigate this:

• Apply PCA or t-SNE for dimensionality reduction before clustering
• Use feature selection to retain only high-information attributes
• Consider bisecting K-means for more stable cluster assignments Without preprocessing, centroids may converge to poor local optima, failing to represent the majority class distribution accurately.

The standard K-means implementation has a time complexity of O(n * K * d * i), where n is the number of majority samples, K is the number of clusters, d is dimensionality, and i is iterations. For large-scale payment networks with millions of legitimate transactions, this becomes computationally expensive. Optimizations include:

• Mini-batch K-means for stochastic gradient descent updates
• K-means++ initialization for faster convergence
• Parallelized implementations on distributed computing frameworks These techniques make Cluster Centroids viable for production fraud pipelines.

By replacing dense clusters of majority samples with single centroids, the method effectively shrinks the majority class region in feature space. This can:

• Clarify the decision boundary by removing overlapping majority instances
• Increase minority class recall as the classifier is less overwhelmed
• Risk information loss if clusters are heterogeneous or contain critical boundary examples Pairing Cluster Centroids with Tomek Links cleaning can further refine the boundary by removing centroids that sit too close to minority class instances.

Cluster Centroids can be embedded within ensemble frameworks to recover information lost during under-sampling. EasyEnsemble and BalanceCascade are two architectures that train multiple classifiers on different centroid-based under-sampled subsets. Each iteration can use a different random seed for K-means initialization, producing diverse views of the majority class. The ensemble aggregates predictions, often outperforming a single centroid-based model while maintaining the computational benefits of reduced training data.

A combined under-sampling strategy that first removes redundant majority class examples using Tomek Links, then applies Condensed Nearest Neighbors to eliminate instances far from the decision boundary.

• Step 1: Identify and remove majority samples that form Tomek Links with minority samples, cleaning class overlap.
• Step 2: Apply CNN to retain only those majority samples necessary for correct classification.

This method contrasts with Cluster Centroids by focusing on boundary preservation rather than global data reduction through clustering.

An under-sampling algorithm that uses Edited Nearest Neighbors to remove majority class examples and then removes minority class examples that are misclassified by three nearest neighbors.

• Focus: Cleans both classes, not just the majority.
• Mechanism: If a minority sample is misclassified by its three nearest neighbors, it is considered noise and removed.

This dual-cleaning approach differs from Cluster Centroids, which only reduces the majority class and assumes minority samples are valid.