When nothing looks wrong, but something is

A workstation in the finance department runs a command that looks like routine administration. A few minutes later, the same machine connects to a server it rarely talks to, a user account quietly gains new privileges, and an outbound connection carries slightly more data than usual. Each event on its own is unremarkable, and each one appears in a different security tool. Taken together, they may describe an attack in progress.

This is the core challenge of anomaly detection in a financial institution. The signals exist, but they are scattered across heterogeneous systems, buried among millions of legitimate events and rarely labelled. Rules catch what has been seen before, while everything else depends on an analyst connecting the dots in time.

What we are developing

Within CyberAId, the University of Piraeus Research Center (UPRC) leads the work on data protection and anomaly detection and, in collaboration with CaixaBank, is developing an AI agent for anomaly detection in banking environments. The agent is designed to work on the security telemetry that financial institutions already collect (e.g. endpoint, network, web, email and access logs) and to learn what normal looks like for the users, hosts and services of an organisation, so that meaningful deviations can be surfaced early and explained.

Since such telemetry is sensitive, the approach is designed with privacy in mind: it operates on anonymised data, it can run within the boundaries of each institution, and it does not depend on large volumes of labelled attacks, which are rarely available in practice.

An ensemble of models and agents

Rather than relying on a single model, we are building an ensemble in which machine learning models and LLM agents each do what they are good at (Figure 1).

• Machine learning detectors learn behavioural baselines for users, hosts and services and score deviations from them, such as unusual connection patterns, rare process activity or atypical access behaviour. Unsupervised and semi-supervised methods keep the approach usable where labels are scarce.
• LLM agents read what numbers alone cannot capture, such as commands, alert descriptions and messages. They recognise intent (e.g. obfuscated scripts, credential access or the staging of data for exfiltration) and map it to MITRE ATT&CK techniques, producing structured, evidence-backed signals rather than free text.
• An ensemble layer fuses these signals across sources and over time, linking activity that belongs to the same user or device, so that a weak signal in one place becomes meaningful when it is corroborated elsewhere.

On top of the ensemble sits an LLM analyst agent that turns scores into findings. It assembles the correlated evidence into an incident narrative along the attack chain, explains why the behaviour is anomalous, attaches the supporting events and the ATT&CK mapping, and recommends next steps. In line with the CyberAId design, the agent operates within strict access and audit boundaries and never acts on its own: its findings feed the platform’s log correlation and are reviewed by security analysts through the human-in-the-loop conversational interface.

How it connects with email threat detection

The same philosophy drives EMTD, the email threat detection agent presented in our previous post. Since then, EMTD has grown into a catalogue of 69 detection components, including a dedicated family of financial process checks such as changed IBANs and wire instructions. It is now integrated into the CyberAId platform and produces explainable findings, in which quarantine and block recommendations require an analyst’s approval. Email is one of the channels the anomaly detection agent observes, which makes the two agents natural companions: a suspicious message and unusual activity on a workstation can be read as parts of the same story.

Where we are and what’s next

We are currently building the detectors and the ensemble layer, and, together with CaixaBank, designing an evaluation based on realistic attack scenarios that measures how early an attack is detected and how many alerts an analyst would actually need to review. Next, the LLM analyst agent will be connected to the CyberAId platform. Looking further ahead, we plan to explore privacy-preserving and federated learning, so that financial institutions can benefit from each other’s detection models without sharing their data.