Transaction Intent Graph: Semantic Cross-LayerDefense Orchestration for Microservices PaymentSystem
This paper introduces TIG-CDO, a semantic cross-layer defense orchestration framework that constructs transaction intent graphs to detect and mitigate Composite Slow-Degradation Attacks (CSDA) in microservices payment systems by shifting analysis from individual HTTP requests to causally ordered multi-step transactions, achieving 99.9% SLA compliance and significantly reduced false positives compared to traditional layered defenses.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Modern payment systems are the invisible nervous system of the global economy, moving money from a customer's card to a merchant's account in a fraction of a second. To keep this flow uninterrupted, banks and processors rely on a series of digital checkpoints. These checkpoints act like security guards at different doors: one checks if a computer is sending too many requests too fast, another inspects the content of the message for known bad patterns, and a third watches for suspicious behavior in how a user interacts with a site. For years, this layered approach worked well. However, a new kind of threat has emerged that slips right through these guards. This threat, known as a composite slow-degradation attack, does not try to break down the doors with a battering ram. Instead, it sends a massive number of tiny, polite requests, each one perfectly legal and small enough to pass every single guard's individual check. Alone, none of these requests is dangerous. But when thousands of them arrive together, coordinated to exploit the gaps between the guards, they overwhelm the system without ever triggering a single alarm.
The problem is that these security guards are looking at the wrong thing. They are watching individual requests, like a bouncer checking one person's ID at a time. But a real payment is not a single request; it is a complex, multi-step conversation that follows a strict script. A legitimate transaction involves a specific sequence of events: a request to start, a challenge to prove identity, a confirmation of funds, and a final receipt. Each step must happen in the right order and within a specific time limit. The new research shows that while an attacker can make each individual step look normal, they cannot easily make the entire sequence of steps look like a genuine conversation. The attacker can send the first message, but they cannot consistently send the correct follow-up messages without actually completing real transactions, which costs them money. This creates a fundamental weakness for the attacker: to stay hidden, they must act like a legitimate customer, which defeats the purpose of the attack.
To solve this, researchers at JPMorgan Chase and their colleague developed a new defense system called TIG-CDO. Instead of watching individual requests, this system builds a map of the entire conversation. It connects the dots between the different steps of a payment, creating a "transaction intent graph." This map allows the system to see the whole story, not just isolated sentences. If a request starts a conversation but never finishes it, or if the steps happen in the wrong order, the map reveals the incoherence. The system calculates a score for how well a group of transactions follows the rules of a real payment. When the score drops, it means the system is seeing a pattern that looks like an attack, even if every single request inside it looks harmless on its own.
The researchers tested this system in a simulated environment that mimicked a real payment network handling thousands of transactions per second. They pitted the new system against the old, layered defenses using a variety of attack scenarios, including the tricky composite attacks that had previously gone undetected. The results were clear. The old defenses, which looked at requests one by one, allowed the attack to succeed, causing the system to slow down or fail. The new system, by looking at the connections between requests, detected the attack almost immediately. In the simulations, the new system maintained a success rate of 99.9 percent for legitimate transactions, while the old systems failed to protect the network in nearly half of the attack scenarios. It also kept false alarms very low, ensuring that real customers were not blocked by mistake.
A key part of this success is how the system handles the "baseline" of normal behavior. Attackers often try to slowly change the system's understanding of what is normal, a tactic called baseline poisoning. They might send a few slightly odd requests every day to train the security software into thinking these oddities are acceptable. The new system includes a monitor that watches for these slow shifts. It compares the current traffic patterns against a reference of what the network looked like a week ago, accounting for the fact that traffic naturally changes between weekdays and weekends. If the system detects a slow drift that doesn't match the usual weekly rhythm, it flags the change and resets the security settings before the attacker can take advantage of them.
The researcher also addressed a practical hurdle in deploying such a system. In the financial world, turning on a new security measure usually requires a long approval process to ensure it won't break anything. By the time the approval comes, an attack might already be over. The new system solves this by using a "pre-authorized" approach. Before any attack happens, the security team and regulators agree on a set of defense actions. If the system detects an attack, it can instantly activate these pre-approved defenses without waiting for new permission. This allows the system to react in real-time, stopping the attack before it causes damage.
The study also explored a specific type of attack where bots use thousands of different merchant accounts to test stolen credit card numbers. This is a fraud problem that also looks like a denial-of-service attack because it clogs the system with failed transactions. The new system caught this specific threat with high accuracy, blocking the vast majority of the fraudulent attempts while letting legitimate business continue. The researcher found that the system worked by noticing that the failed transactions were all using the same specific error codes, a pattern that real customers rarely produce.
While the results are promising, the researcher is careful to note that their findings come from a highly realistic simulation, not a live production system. They acknowledge that real-world attacks might behave differently, and that the system needs to be tested in a live environment before it is fully trusted. They also identified a few ways a clever attacker might try to bypass the system, such as by using a specific type of transaction reversal that looks legitimate but doesn't cost the attacker money. These are not failures of the system, but rather known boundaries that need to be watched.
The work represents a shift in how we think about security. Instead of trying to build higher walls to keep out bigger attackers, the researcher built a smarter way to see the attackers. By understanding the story behind the data, rather than just the data itself, the system can spot the subtle signs of a coordinated attack that would otherwise go unnoticed. This approach offers a new path forward for protecting the critical infrastructure that keeps money moving in the modern world.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.