A 12-month deployment at a Bangladeshi bank reduced the reported average response time from 45 minutes to five.
Researchers described a security system used for 12 months on the core banking system of Midland Bank Plc in Dhaka, Bangladesh, which serves more than one million customers. The system combined several machine-learning methods to detect unusual activity, analyze patterns over time and make final threat decisions.
Across 4,286,530 anonymized events, the system had a reported production detection accuracy of 98.0% plus or minus 0.7%, a 2% false-positive rate and an area under the curve of 0.98. The researchers also estimated that the system reduced deployment costs by three- to sevenfold and inference latency by two- to threefold compared with the approaches they considered.
What the system found
During deployment, the system identified 1,100 incidents. Phishing and malware accounted for 30.9% of them, distributed denial-of-service attacks for 18.2%, and advanced persistent threats for 16.4%.
Before-and-after measures from the bank showed the false-positive rate falling from 32% to 2%, average response time falling from 45 minutes to five minutes, and a composite resilience score rising from 55 to 94. The study reports that the system maintained competitive accuracy compared with newer approaches based on graph networks, transformers and federated learning, while requiring less inference time and an estimated lower deployment cost.
Why faster detection matters
Security systems used in banks must operate within live transaction pipelines and meet requirements from multiple regulatory frameworks, not simply perform well on a benchmark dataset. This deployment provides a reported example of how a machine-learning system performed under those operational and compliance conditions.
The results also point to practical measures that matter to bank security teams: fewer false alarms, faster responses and lower estimated operating costs. The paper includes guidance for banks implementing machine-learning security systems across jurisdictions, although the results come from one bank's deployment.
Evidence and caveats
The evidence combines a 12-month deployment at one bank with analysis of 4,286,530 anonymized events, a stratified 70/15/15 data partition and five-fold cross-validation. The researchers also used ablation analysis to assess the contributions of the system's components and compared its reported performance with other recent approaches.
The findings are based on a single institution and its core banking environment, so they may not apply directly to other banks or transaction systems. The before-and-after comparisons do not include a separate control bank, and the cost figures are estimates. The abstract does not provide enough detail to assess how the system would perform across other countries, threat patterns or longer periods of operation.
