Protection against bots and DDoS attacks was implemented according to the scheme — with no SSL disclosure

The antibot system analyzed metadata and learned the traffic patterns of protected mobile applications within 3 days

Malicious bots were blocked from the very first API request in real time

Manual log analysis was no longer required

API protection scheme

4-stage traffic filtering to protect the customer’s financial application APIs — without disclosing the SSL private key

— Log analysis of incoming API requests enabled attack filtering within minutes

— Traffic must be processed without SSL decryption to ensure compliance with PCI DSS standards

— No detection or filtering of advanced bots targeting mobile app APIs

Use case: protecting APIs of financial applications

To combat unauthorized automation, including malicious API interactions, we've developed a 4-stage traffic filtering system.

— WAFs: often inadequate in detecting illegitimate API traffic or attacks on business logic

— API gateways: primarily handle authentication, authorization, and basic rate limiting

— Log Analysis: time-consuming and resource-intensive

As mobile traffic increases and applications become more complex, the volume of API calls rises, rendering traditional protection methods insufficient.​

— Account takeovers & credential stuffing: attacks targeting login endpoints to gain unauthorized access

— DDoS attacks: overwhelming APIs with excessive requests, leading to service denial

— SMS leaks: exploitation of business logic to access SMS balances

— Shadow APIs: undocumented APIs unknown to current developers

— Zombie APIs: outdated APIs that are no longer maintained but remain accessible

— Approximately 20% of traffic to our clients' APIs originates from unauthorized sources

— Over 80% of today's web traffic consists of API calls

— Access to user accounts, payment cards, and loyalty programs​. This makes them attractive targets for cybercriminals

— Personal data

However, APIs also expose:

They facilitate business logic operations and, consequently, are critical components of modern digital infrastructure.​

APIs are the primary entry points for most online services and mobile applications

API security: protecting your digital front door

Anna Nigmati

Business Development Manager at Secwell

Leave your contact details, and we’ll provide demo materials, battle cards, or arrange a brief call

Want to Learn More?

Products

Contact

Medium

Industries