AI-Driven Cross-Platform Anomaly Detection and Trust-Aware Cyber Recovery for Mission-Critical Banking Data Infrastructure

Abstract

Ransomware and other destructive cyber events increasingly threaten the availability and integrity of mission-critical financial information systems. Modern banking infrastructures are no longer confined to a single storage or compute platform. Enterprise applications increasingly span virtual machines, containerized workloads, object-storage platforms, block and file storage, backup repositories, replication systems, and geographically separated recovery environments. This heterogeneity creates an important security limitation: platform-specific monitoring can identify local anomalies while failing to recognize a coordinated attack whose evidence is distributed across multiple infrastructure layers. This paper proposes CART, a Cross-platform Anomaly and Recovery Trust framework for mission-critical banking data infrastructure. CART combines heterogeneous telemetry from container orchestration platforms, virtualization environments, enterprise storage, object storage, backup systems, replication services, and recovery repositories. A context-aware temporal anomaly-detection layer identifies deviations from workload-specific behavioral baselines and a cross-platform correlation engine combines weak signals across infrastructure domains. Following detection, a Recovery Trust Score (RTS) evaluates candidate recovery points according to integrity evidence, temporal consistency, behavioral exposure, provenance, protection status, and observed anomaly propagation. The framework therefore extends ransomware detection from a binary classification problem— “attack or no attack” —to a detection-to-recovery decision problem: detect the attack, estimate its cross-platform exposure, and identify the most trustworthy recovery state. The proposed methodology addresses several limitations in existing ransomware research, including dependence on single-layer telemetry, insufficient consideration of legitimate high-volume enterprise workloads, concept drift, severe class imbalance, and the assumption that the latest available backup is necessarily the safest recovery point. The study defines a reproducible evaluation protocol using public ransomware datasets, container-security datasets, and controlled synthetic enterprise-storage telemetry. Evaluation will compare conventional threshold detection, individual machine-learning models, platform-specific models, and the proposed cross-platform framework using precision, recall, F1-score, PR-AUC, false-positive rate, mean time to detection, recovery-point selection accuracy, false-safe recovery rate, and estimated recovery-point and recovery-time objectives. The intended contribution is a platform-independent architecture for AI-assisted cyber resilience in heterogeneous financial data infrastructure. Rather than claiming that artificial intelligence can eliminate ransomware, the framework aims to provide measurable improvements in early anomaly detection and evidence-based recovery-point selection.