Sentinel-Fin: A Knowledge-Graph-Enhanced Neuro-Symbolic Framework for Explainable Threat Hunting in Real-Time Payments

Real-time payment systems like India's Unified Payments Interface (UPI) have made multi-stage attacks on financial platforms more common. Most Security Operations Centers (SOCs) still triage alerts with static rules or black-box machine learning models. This leads to many false positives, alert fatigue, and sending the data to an outside service to get one raises privacy problems. We present Sentinel-Fin, a local-first threat-hunting framework that scores payment requests as they arrive. It combines two models: a Random Forest trained on labeled fraud, and an Isolation Forest that catches unfamiliar, zero-day behavior. A local Neo4j knowledge graph adds a layer of fixed rules on top. When a payment is blocked, Gemini 2.5 Flash turns the backend's feature flags into a one-sentence alert for the analyst. On 20,000 transactions, the Random Forest reached 96.17% accuracy, and query validity ranged from 91.4% to 100%, well above the 58.97% baseline. In our tests, the gateway responded in under a second and we observed no hallucinated explanations.