Data Engineering Architectures for AI-Based Digital Repair Twins in Financial Cybersecurity

Abstract

Financial institutions face a growing volume of cyber threats — credential-stuffing attacks, account-takeover attempts, insider misuse, and infrastructure intrusions — that must be detected and contained within tight operational windows to prevent financial and reputational harm. This paper examines the data engineering architectures required to support AI-based Digital Repair Twins (DRTs): live, diagnostic, and action-capable virtual models that detect security anomalies, localize root causes, and initiate bounded remediation within financial infrastructure. We present a five-layer reference architecture spanning ingestion and streaming, feature and twin-state storage, AI/ML model serving, reasoning and policy, and action and remediation, and we describe the data pipeline design decisions specific to financial cybersecurity, including entity-graph modeling of accounts and sessions, lineage tracking for regulatory audit, and strict data governance for sensitive financial and personally identifiable information. A table-based comparison of pipeline layers, technologies, and data artifacts is provided, alongside a second table of evaluation metrics for operational assessment. Two figures illustrate the layered architecture and the closed-loop detection-to-repair workflow. A simulated case study involving a credential-stuffing attack against an online banking portal demonstrates how the architecture supports rapid detection, root-cause correlation, and automated session-level containment. The paper closes with a discussion of governance, explainability, and open data engineering challenges for AI-driven self-healing in financial cybersecurity.