Abstract:System-to-system communication via Application Programming Interfaces (APIs) plays a pivotal role in the seamless interaction among software applications and systems for efficient and automated service delivery. APIs facilitate the exchange of data and functionalities across diverse platforms, enhancing operational efficiency and user experience. However, this also introduces potential vulnerabilities that attackers can exploit to compromise system security, highlighting the importance of identifying and mitigating associated security risks. By examining the weaknesses inherent in these APIs using security open-intelligence catalogues like CWE and CAPEC and implementing controls from NIST SP 800-53, organizations can significantly enhance their security posture, safeguarding their data and systems against potential threats. However, this task is challenging due to evolving threats and vulnerabilities. Additionally, it is challenging to analyse threats given the large volume of traffic generated from API calls. This work contributes to tackling this challenge and makes a novel contribution to managing threats within system-to-system communication through API calls. It introduces an integrated architecture that combines deep-learning models, i.e., ANN and MLP, for effective threat detection from large API call datasets. The identified threats are analysed to determine suitable mitigations for improving overall resilience. Furthermore, this work introduces transparency obligation practices for the entire AI life cycle, from dataset preprocessing to model performance evaluation, including data and methodological transparency and SHapley Additive exPlanations (SHAP) analysis, so that AI models are understandable by all user groups. The proposed methodology was validated through an experiment using the Windows PE Malware API dataset, achieving an average detection accuracy of 88%. The outcomes from the experiments are summarized to provide a list of key features, such as FindResourceExA and NtClose, which are linked with potential weaknesses and related threats, in order to identify accurate control actions to manage the threats.

FastAPI vs. The Competition: A Security Feature Showdown with a Proposed Model for Enhanced Protection

OpenAPI Specification Extended Security Scheme: A method to reduce the prevalence of Broken Object Level Authorization

Overview of the capabilities of the FastAPI web framework for implementing the backend of web systems

An Extensive Formal Security Analysis of the OpenID Financial-grade API

Applying Spring Security Framework with KeyCloak-Based OAuth2 to Protect Microservice Architecture APIs: A Case Study

An Application Programming Interface (API) Sensitive Data Identification Method Based on the Federated Large Language Model

Web Application Security Education Platform Based on OWASP API Security Project

Securing Open Source Clouds Using Models

DJANGO AS SECURE WEB-FRAMEWORK IN PRACTICE

Analyzing OpenAPI Specifications for Security Design Issues

A JSON Token-Based Authentication and Access Management Schema for Cloud SaaS Applications

Fast Authentication and Progressive Authorization in Large-Scale IoT: How to Leverage AI for Security Enhancement?

Enterprise API Security and GDPR Compliance: Design and Implementation Perspective

Automatic detection of access control vulnerabilities via API specification processing

Adoption of Deep-Learning Models for Managing Threat in API Calls with Transparency Obligation Practice for Overall Resilience

Voteroid Secure API Gateway Based on Spring boot Microservices Architecture

Functional Augmented State Transfer (FAST) Architecture for Computationally Intensive Network Applications

A Study of Apache-Based Web Application Security and Protection

A Novel Approach to Implement Message Level Security in RESTful Web Services

A Survey for Cloud Application Programming Interface Security: Threats and Protection br

Security Analysis of OAuth 2.0 Implementation