AML surveillance over streaming behavioural signals
Watching seven million live rooms for the wrong kind of money
TikTok Live (ByteDance) · Dec 2022 — Dec 2023
Risk-detection models applied to live behavioural streams, plus the creator analytics platform underneath it, served at 350K+ QPS.
- live rooms monitored daily
7M+
live rooms monitored daily
- QPS served
350K+
QPS served
- read-latency reduction
65%
read-latency reduction
The problem
Money movement inside a live-streaming product does not look like money movement in a bank. The signal is behavioural — gifting patterns, account relationships, timing — and it only makes sense in motion.
Batch scoring was too late to matter. By the time a nightly job flagged a pattern, the rooms were closed.
The same infrastructure had to serve creator-facing analytics dashboards at high QPS without the surveillance workload starving them.
Constraints that shaped it
- Detection runs on the stream, not on a warehouse snapshot.
- Analytics reads and risk scoring share ingest but never share a latency budget.
- False positives cost human review time, so precision is a product constraint, not a metric to admire.
Architecture
Select any box for the design decision behind it.
What I owned
- 01Architecture of the AML surveillance system over streaming behavioural signals.
- 02Backend of the creator observability pipelines feeding real-time dashboards.
- 03The Redis migration for the high-concurrency serving path.
What I would do differently
Risk systems are judged on recall in the design review and on precision in production, because precision is what the review team feels every morning. Designing the queue before the model was the decision that aged best.
This system is employer-internal, so there is no repository to link. Everything above describes system shape, trade-offs, and results already stated on my résumé — no proprietary implementation detail.