ARTIFICIAL INTELLIGENCE–DRIVEN PREDICTIVE CYBER THREAT INTELLIGENCE IN SAUDI BANKING SYSTEMS: AN INTEGRATED FRAMEWORK FOR FINANCIAL FRAUD DETECTION, NETWORK SECURITY ANALYTICS AND TRANSACTION BEHAVIOUR MODELING

Abstract

The rapid digitalization of banking services in Saudi Arabia has increased operational efficiency and financial accessibility while simultaneously expanding exposure to financial fraud, cyber intrusions, account compromise, and anomalous transaction activities. This study proposes an Artificial Intelligence–Driven Predictive Cyber Threat Intelligence framework for Saudi banking systems that integrates financial fraud detection, network security analytics, and transaction behaviour modeling within a unified predictive environment. A multi-source dataset was constructed using publicly available Saudi banking indicators, institutional financial and cybersecurity disclosures, regulatory statistics, and synthetically generated anonymized transaction and network-security records. The final experimental dataset comprised 85,000 transaction and security observations characterized by 42 predictive features, including transaction amount and frequency, login behaviour, device and location anomalies, failed authentication attempts, unusual fund transfers, IP reputation indicators, network traffic patterns, account activity, and historical fraud signals. Following missing-value treatment, feature normalization, categorical encoding, class balancing, and feature selection, four benchmark algorithms Logistic Regression (LR), Support Vector Machine (SVM), Random Forest (RF), and XGBoost were developed and comparatively evaluated. Stratified 80:20 training–testing partitioning with five-fold cross-validation was employed to improve evaluation reliability. Experimental results demonstrated that XGBoost achieved the strongest overall predictive performance, with 96.8% accuracy, 96.2% precision, 95.7% recall, 95.9% F1-score, and 0.984 ROC-AUC, compared with accuracies of 84.6%, 89.3%, and 94.1% for LR, SVM, and RF, respectively. The proposed intelligence framework detected 97.1% of high-risk fraudulent transactions and 95.4% of network-security anomalies, while reducing the false-positive rate to 3.8%. Behavioural transaction analytics further improved early identification of abnormal account activities by 11.6% compared with conventional rule-based screening. Explainable AI analysis identified transaction velocity, authentication failures, device inconsistency, unusual transfer patterns, and network anomalies as the most influential risk indicators. These findings demonstrate that integrated AI-based cyber threat intelligence can substantially strengthen proactive risk detection, support real-time security decision-making, and enhance the cyber resilience of Saudi banking systems. The proposed framework provides a scalable foundation for intelligent fraud prevention, continuous network monitoring, and data-driven cybersecurity governance within rapidly evolving digital banking environments.