Securing Open Banking APIs Against Automated Credential Stuffing Attacks
Аннотация
Third-party services can access customers’ financial details because of the Open Banking APIs. At the same time, more API attacks happen, with specific bots using sets of reused credentials to gain access. Because of such attacks, both the safety and confidentiality of financial users, as well as the security of economic organisations, are endangered. The paper outlines a security design that includes intelligent threat detection, behaviour recognition, and AI-based rate limiting for Open Banking APIs.The framework relies on three main elements. TIL helps block malicious sources by providing real-time updates from IP addresses. Incorporating BFE (Behavioural Fingerprinting Engine) and Rate-Limiting Received layers into the system enables it to detect real users, as both methods assess human behaviour and automatically reduce false-positive errors caused by bots. A model has been developed to evaluate the system using data for 7,000 logins (5,000 fake and 2,000 accurate). With 96.2% accuracy and a 2.8% error in reporting non-malicious activities as suspicious, the presented method demonstrated its usefulness. Further, using this technique did not affect how services operated for legitimate users, as it made them smoother. The paper demonstrates that using intelligence-driven security is vital in Open Banking and suggests a solution that can be combined with current systems to handle credential stuffing attacks.