// THESIS GUIDANCE PORTAL · Computer Science

Cybersecurity Threat Detection for Nepali Banking Systems

Level: MasterDifficulty: Advanced

1. Introduction & Problem Statement

Overview: Intrusion-detection model tuned to phishing/fraud patterns seen in Nepal's mobile-wallet ecosystem (eSewa, Khalti).

Background Context (Nepal): The rapid expansion of digital wallets and mobile banking in Nepal has been accompanied by SMS phishing, credential harvesting, and SIM-swap fraud. Machine learning intrusion detection strengthens financial cybersecurity.

2. Research Objectives

›Analyze cyber threat vectors and fraud patterns targeting Nepali mobile wallet API endpoints
›Build synthetic log dataset reflecting authentic HTTP traffic, API request anomalies, and phishing triggers
›Train anomaly detection models (Isolation Forest, XGBoost, Autoencoders) for real-time risk scoring
›Evaluate model precision, false positive rate, and detection latency
›Propose integration framework for commercial bank Security Operations Centers (SOC)

3. Proposed Methodology

Threat modeling based on Nepal Rastra Bank Cyber Security Guidelines and Incident Reports
Feature engineering from HTTP header fields, IP geographic velocity, transaction frequency, and payload structure
Supervised and unsupervised ML model training in Python using Scikit-Learn and PyTorch
Real-time streaming pipeline simulation using Apache Kafka and FastAPI middleware
Performance testing under high-throughput request floods to evaluate false alarm rates

$ Worked Example / Sample Scenario

Sample Scenario: An attacker attempts high-frequency wallet logins across multiple regional IP addresses within 2 minutes. The XGBoost model flags the velocity anomaly with a 0.96 threat score, automatically triggering SMS OTP re-verification and alerting the SOC.

4. Thesis Chapter-by-Chapter Outline

Chapter 1: IntroductionTU/KU standard

Background, problem statement, research questions, objectives, scope, limitations, and significance of the study

Chapter 2: Literature ReviewTU/KU standard

Theoretical framework, conceptual models, previous empirical studies in Nepal and developing nations, API threat modeling and financial intrusion detection architectures, and gap analysis

Chapter 3: Research MethodologyTU/KU standard

Research design, population/sampling framework, data collection instruments, analytical tools, and ethical considerations

Chapter 4: Data Analysis & ResultsTU/KU standard

Empirical findings, statistical testing, model estimations, ROC-AUC curves and false alarm rate under stress loads, and detailed discussion

Chapter 5: Conclusion & RecommendationsTU/KU standard

Summary of key findings, theoretical contributions, policy recommendations, and future research directions

5. Recommended Tools & Technologies

To implement the practical, technical, or analytical portions of this thesis topic, the following software tools, libraries, or APIs are recommended:

PythonScikit-LearnXGBoostPyTorchApache KafkaFastAPIDocker

6. Core References & Academic Sources

[1]Nepal Rastra Bank — Information Technology & Cyber Security Guidelines
[2]Nepal Police Cyber Bureau — Cyber Crime Trends & Incident Statistics
[3]IEEE Transactions on Information Forensics and Security / Google Scholar

7. Frequently Asked Questions (FAQs)

Q: How can I obtain banking log data in Nepal for research?

Due to confidentiality, banks do not share live raw logs; researchers construct realistic synthetic datasets based on NRB threat vectors or use benchmark datasets like PaySim.

Q: What is the acceptable false positive rate for banking fraud detection?

In financial security, false positive rates should ideally remain under 0.1% to avoid blocking legitimate user transactions.

Q: Is Isolation Forest or Autoencoders better for fraud detection?

Isolation Forests work exceptionally well on tabular transaction data, whereas Deep Autoencoders excel at capturing complex non-linear API payload anomalies.

Q: Does NRB require specific cybersecurity compliance?

Yes, Nepal Rastra Bank mandates strict IT Security Guidelines including regular vulnerability assessments, encryption, and multi-factor authentication.