SECURE Framework for Detecting Integrity Attacks in High-Frequency Trading Systems

Abstract Cybersecurity is commonly based on the CIA triad (confidentiality, integrity, and availability). Among these, integrity attacks are harder to detect because they manipulate data without interrupting system operations. These attacks are especially difficult to identify in high-frequency data environments, where small changes in data can lead to major consequences. However, most existing cybersecurity solutions mainly focus on confidentiality and availability threats, while integrity attack detection in real-time capable systems remains limited. To address this issue, this paper proposes SECURE, a domain-independent sequential cybersecurity framework for detecting integrity attacks in high-frequency data streams. The SECURE framework consists of six stages: Surveillance, Examination, Control, Understanding, Response, and Enhancement. An Intrusion Detection System (IDS) based on the Random Forest algorithm is used to detect abnormal patterns related to integrity attacks. In addition, SHAP-based Explainable Artificial Intelligence (XAI) is integrated to provide clear explanations for model decisions and improve transparency. The proposed framework is evaluated using a Level-2 stock market order book dataset, where spoofing and layering are treated as integrity attack scenarios. Experimental results show that the SECURE-IDS framework effectively detects integrity attacks and provides interpretable insights. The proposed framework is domain-independent and can be applied to other high-frequency data environments requiring integrity protection.