TITLE:
Machine-Learning Fraud Detection and Cyber Stress Testing in RTGS and SWIFT Networks: An AI-Augmented Resilience Framework
AUTHORS:
Raghunandan G. Ramakrishna
KEYWORDS:
High-Value Payment Systems, SWIFT Cyber Security, Machine-Learning Fraud Detection, Cyber Stress Testing, AI-Augmented Resilience, Hybrid ML Pipelines, Basel Operational Risk Capital, ISO 20022 Analytics
JOURNAL NAME:
Journal of Information Security,
Vol.17 No.4,
October
30,
2026
ABSTRACT: High-value payment systems (HVPS) and SWIFT-linked wholesale payment networks are systemically important infrastructures in which operational disruption can propagate rapidly through liquidity and settlement interdependencies. Quantitative analyses of interbank networks indicate that the impairment of major nodes can generate broad spillovers affecting a substantial share of the network, and that delayed recovery can amplify system-wide liquidity shortfalls by an order of magnitude. International guidance for financial market infrastructures increasingly emphasizes pre-empting cyber-attacks, responding effectively, and resuming critical operations within strict recovery-time objectives. This paper proposes and evaluates a four-layer AI-augmented cyber-resilience framework for HVPS and SWIFT environments spanning 1) data aggregation and enrichment, 2) multi-model machine-learning analytics, 3) automated control and response, and 4) governance and continuous improvement. The empirical evaluation combines scenario-based cyber stress-testing simulations with machine-learning experiments on synthetic payment data, motivated by the well-documented scarcity of legitimate transaction datasets for fraud research. Across the scenario assumptions, simulations indicate that AI-augmented controls can reduce unsettled payment value by approximately 34% - 78%, with the magnitude varying by attack type and recovery dynamics. On the detection side, every figure reported here is generated directly from the released, seeded pipeline. A well-tuned XGBoost baseline reaches near-ceiling discrimination on the synthetic benchmark (AUC 0.9998). The hybrid supervised-unsupervised pipeline does not improve ranking performance; its measured value shows up at the operating point instead, where a second-pass anomaly filter strips out 12% - 26% of false alerts across replications while keeping ≈97.5% of true positives. A graph-approximation model built on k-nearest-neighbor similarity in feature space reaches AUC 0.9917 with a false-positive rate nine times lower than the boosting baseline, yet it misses every injected coordinated fraud ring (0 of 33), a documented negative result indicating that feature-similarity graphs cannot stand in for detection grounded in counterparty topology. SHAP inspection adds a further caveat: the top-ranked features line up with the generator’s fraud-injection signatures, so the absolute discrimination levels partly reflect benchmark leakage. This is disclosed and analyzed as a limitation, and the inspection procedure itself is put forward as a routine leakage diagnostic for synthetic data fraud studies. A repeated-run study spanning five random seeds and ten simulated network topologies characterizes how much the headline estimates move. The Basel capital-efficiency argument is explicitly scoped to jurisdictions retaining a loss-sensitive Internal Loss Multiplier, acknowledging that national discretion can materially alter this channel. By integrating technical detection, automated controls, governance, and regulatory alignment within a single framework, this study addresses a gap at the intersection of computer security, financial stability, and regulatory policy-bridging disciplinary boundaries that are central to the journal’s interdisciplinary mission.