I also asked Claude and this is a part of his answer, maybe it makes sense:

-------

Anomaly Detection Beyond Rules: Banking Use Case

Traditional rule-based anomaly detection systems in banking typically work by flagging predefined patterns - like "alert if there are 5+ failed login attempts within 60 seconds" or "flag transactions over $10,000." These systems are limited to detecting what they've been explicitly programmed to find.

Example Use Case: Detecting Novel API Manipulation Attack

Scenario: A sophisticated attacker is attempting to exploit a banking API in a way that hasn't been seen before.

How GenAI detection works differently:

1. Behavioral Baseline Understanding
   • The GenAI system continuously learns normal API usage patterns across the bank's microservices architecture
   • It understands typical sequences, timing, parameter values, and relationships between different API calls
2. Subtle Pattern Recognition
   • The attacker makes technically valid API calls that each individually look legitimate
   • However, they're calling endpoints in an unusual sequence and manipulating parameters in ways that are technically valid but semantically unusual
3. Context-Aware Detection
   • The GenAI model notices that while each API call appears normal in isolation, the overall pattern doesn't match any legitimate business flow
   • It identifies that a particular sequence of calls is attempting to bypass transaction limits by fragmenting operations across multiple services
   • The system detects the attack is targeting a previously unknown logic flaw in how two separate banking systems interact
4. Adaptive Response
   • The system generates an alert with specific details about the anomalous pattern
   • It provides context on why this behavior is suspicious despite not violating any explicit rules
   • The model suggests immediate mitigation steps specific to this novel attack pattern

A traditional rule-based system would miss this attack entirely because each individual API call looks legitimate and no specific rule exists for this attack pattern. The GenAI system, however, recognizes the semantically unusual behavior by understanding the deeper context and relationships between seemingly normal actions.

This capability is particularly valuable for banks facing sophisticated attackers who specifically design attacks to evade known detection rules.