Abstract: Apparatus and associated methods relate to a pattern recognition system configured to classify a transaction as anomalous or not anomalous as a function of a predictive analytic model configured to detect anomalies, generate a rule based on expert analysis of a limited number of data samples to classify as anomalous a transaction erroneously classified as not anomalous, augment the predictive analytic model with the generated rule, and deploy the augmented predictive analytic model to automatically identify an attack early in a live transaction stream. In some examples, the transaction may be a bank card purchase. Some transactions may be classified anomalous due to fraud, compliance violation such as money laundering, or terrorist funding. The predictive analytic model may be, for example, a decision tree followed by a regression model.