Open Banking Security Architecture:

┌─────────────────────────────────────────────────────────────────────┐
│                      Open Banking Security Stack                    │
│                                                                   │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │                 Layer 7: Application Security               │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Input Validation │ Output Encoding │ CSRF Tokens   │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                 Layer 6: API Security                       │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  OAuth 2.0 │ OpenID Connect │ JWT │ Rate Limiting  │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                 Layer 5: Transport Security                 │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  TLS 1.3 │ Mutual TLS (mTLS) │ Certificate Pinning │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                 Layer 4: Network Security                   │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  WAF │ DDoS Protection │ Firewall │ Network Seg     │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                 Layer 3: Data Security                      │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Encryption at Rest │ Tokenization │ Data Masking   │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                 Layer 2: Identity Security                  │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  IAM │ MFA │ Biometrics │ Password Policy            │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                 Layer 1: Physical Security                  │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Data Centers │ Access Control │ Surveillance         │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

OAuth 2.0 Token Lifecycle:

┌─────────────────────────────────────────────────────────────────────┐
│                         Token Lifecycle                             │
│                                                                   │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │                   1. Token Issuance                          │   │
│  │  Authorization Server issues Access Token + Refresh Token   │   │
│  │  ┌──────────────┐  ┌──────────────┐                       │   │
│  │  │ Access Token │  │ Refresh Token│                       │   │
│  │  │ Exp: 1 hour  │  │ Exp: 24 hours│                       │   │
│  │  └──────────────┘  └──────────────┘                       │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                   2. Token Usage                             │   │
│  │  Client sends Access Token with every API request           │   │
│  │  Authorization: Bearer {access_token}                       │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                   3. Token Validation                        │   │
│  │  Resource Server validates Access Token:                    │   │
│  │  ✓ Signature verification                                   │   │
│  │  ✓ Expiration check                                         │   │
│  │  ✓ Scope verification                                       │   │
│  │  ✓ Revocation status                                        │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                   4. Token Expiration                        │   │
│  │  Access Token expired after 1 hour                          │   │
│  │  Client uses Refresh Token to get new Access Token          │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                   5. Token Revocation                        │   │
│  │  User revokes consent → Token immediately invalid           │   │
│  │  Security breach → All tokens revoked                       │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

import jwt
import json
import time
from datetime import datetime, timedelta
from functools import wraps

class OAuthTokenValidator:
    """
    OAuth 2.0 Token Validation and Introspection
    """
    def __init__(self, auth_server_url, client_id, client_secret):
        self.auth_server_url = auth_server_url
        self.client_id = client_id
        self.client_secret = client_secret
        self.jwt_secret = None
        self.token_cache = {}  # Cache for token validation
        self.revoked_tokens = set()  # Track revoked tokens
    
    def validate_token(self, access_token, required_scopes=None):
        """
        Validate OAuth 2.0 Access Token
        
        Parameters:
        - access_token: The token to validate
        - required_scopes: List of scopes that must be present
        
        Returns:
        - Validation result with token data
        """
        # Check cache first
        if access_token in self.token_cache:
            cached = self.token_cache[access_token]
            if cached['expires_at'] > time.time():
                return cached
        
        try:
            # Decode JWT (if token is JWT)
            payload = self.decode_jwt(access_token)
            
            # Validate signature
            if not self.verify_signature(access_token):
                return self.invalid_token("Invalid signature")
            
            # Check expiration
            if payload.get('exp', 0) < time.time():
                return self.invalid_token("Token expired")
            
            # Check revocation
            if access_token in self.revoked_tokens:
                return self.invalid_token("Token revoked")
            
            # Check scopes
            if required_scopes:
                token_scopes = set(payload.get('scope', '').split())
                required_set = set(required_scopes)
                if not required_set.issubset(token_scopes):
                    return self.invalid_token(f"Missing required scopes: {required_set - token_scopes}")
            
            # Build validation result
            result = {
                'valid': True,
                'client_id': payload.get('client_id'),
                'user_id': payload.get('user_id'),
                'scopes': payload.get('scope', '').split(),
                'expires_at': payload.get('exp', 0),
                'issued_at': payload.get('iat', 0),
                'token_type': payload.get('token_type', 'bearer')
            }
            
            # Cache result
            self.token_cache[access_token] = {
                **result,
                'cached_at': time.time()
            }
            
            return result
            
        except jwt.ExpiredSignatureError:
            return self.invalid_token("Token expired")
        except jwt.InvalidTokenError as e:
            return self.invalid_token(f"Invalid token: {str(e)}")
        except Exception as e:
            return self.invalid_token(f"Validation error: {str(e)}")
    
    def decode_jwt(self, token):
        """
        Decode JWT without verification (for inspection)
        """
        try:
            # Get JWT secret from authorization server
            if not self.jwt_secret:
                self.fetch_jwt_secret()
            
            # Decode and verify
            payload = jwt.decode(
                token,
                self.jwt_secret,
                algorithms=['RS256', 'HS256']
            )
            return payload
        except:
            # Try without verification (for introspection)
            return jwt.decode(token, options={"verify_signature": False})
    
    def verify_signature(self, token):
        """
        Verify JWT signature
        """
        try:
            jwt.decode(token, self.jwt_secret, algorithms=['RS256', 'HS256'])
            return True
        except:
            return False
    
    def fetch_jwt_secret(self):
        """
        Fetch JWT secret from authorization server
        """
        # In production, fetch from well-known endpoint
        # For demo, use a test secret
        self.jwt_secret = 'your-256-bit-secret'
    
    def introspect_token(self, access_token):
        """
        Introspect token with authorization server (RFC 7662)
        """
        # Call OAuth 2.0 introspection endpoint
        introspection_endpoint = f"{self.auth_server_url}/introspect"
        
        # In production, make HTTP request
        # For demo, simulate response
        return {
            'active': True,
            'client_id': 'client_123',
            'scope': 'accounts:read payments:write',
            'exp': int(time.time()) + 3600,
            'iat': int(time.time()),
            'sub': 'user_456',
            'token_type': 'bearer'
        }
    
    def revoke_token(self, access_token, refresh_token=None):
        """
        Revoke token (RFC 7009)
        """
        # Add to revoked set
        self.revoked_tokens.add(access_token)
        if refresh_token:
            self.revoked_tokens.add(refresh_token)
        
        # Remove from cache
        if access_token in self.token_cache:
            del self.token_cache[access_token]
        
        # Call revocation endpoint
        revocation_endpoint = f"{self.auth_server_url}/revoke"
        
        # In production, make HTTP request
        return {'status': 'revoked'}
    
    def invalid_token(self, reason):
        """
        Return invalid token response
        """
        return {
            'valid': False,
            'error': reason,
            'error_description': reason
        }
    
    def clean_cache(self, max_age=3600):
        """
        Clean expired entries from cache
        """
        current_time = time.time()
        to_delete = []
        for token, data in self.token_cache.items():
            if current_time - data['cached_at'] > max_age:
                to_delete.append(token)
        
        for token in to_delete:
            del self.token_cache[token]
        
        return len(to_delete)

SCA Authentication Flow:

┌─────────────────────────────────────────────────────────────────────┐
│                      SCA Authentication Process                    │
│                                                                   │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │                    Step 1: Knowledge Factor                 │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  User enters: Password, PIN, or Security Answer     │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                    Step 2: Possession Factor                │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  User verifies via:                                 │   │   │
│  │  │  • Registered smartphone (push notification)        │   │   │
│  │  │  • Hardware token (OTP generator)                   │   │   │
│  │  │  • Card reader (chip authentication)                │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                    Step 3: Inherence Factor                 │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  User authenticates via:                            │   │   │
│  │  │  • Fingerprint scan                                │   │   │
│  │  │  • Facial recognition                               │   │   │
│  │  │  • Voice recognition                                │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                    Step 4: Verification                     │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  • All factors verified                            │   │   │
│  │  │  • Transaction risk assessed                       │   │   │
│  │  │  • Dynamic linking check                           │   │   │
│  │  │  • Authorization granted                           │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

class StrongCustomerAuthentication:
    """
    Strong Customer Authentication (SCA) Implementation
    """
    def __init__(self):
        self.user_factors = {}  # User registered factors
        self.authentication_sessions = {}
        self.transaction_risk_engine = TransactionRiskEngine()
    
    def register_factor(self, user_id, factor_type, factor_data):
        """
        Register authentication factor for user
        """
        if user_id not in self.user_factors:
            self.user_factors[user_id] = []
        
        factor = {
            'type': factor_type,  # 'knowledge', 'possession', 'inherence'
            'data': factor_data,
            'registered_at': datetime.now().isoformat(),
            'verified': factor_data.get('verified', False)
        }
        
        self.user_factors[user_id].append(factor)
        
        return {'status': 'registered', 'factor': factor}
    
    def initiate_authentication(self, user_id, transaction_data):
        """
        Initiate SCA authentication
        """
        # Check if SCA is required
        sca_required = self.is_sca_required(transaction_data)
        
        if not sca_required:
            return {
                'status': 'approved',
                'message': 'SCA not required for this transaction',
                'factors_used': []
            }
        
        # Get user's registered factors
        factors = self.user_factors.get(user_id, [])
        available_factors = [f for f in factors if f['verified']]
        
        if len(available_factors) < 2:
            return {
                'status': 'failed',
                'message': 'Insufficient authentication factors registered'
            }
        
        # Create authentication session
        session_id = str(uuid.uuid4())
        self.authentication_sessions[session_id] = {
            'user_id': user_id,
            'transaction_data': transaction_data,
            'factors_used': [],
            'status': 'pending',
            'created_at': datetime.now().isoformat(),
            'expires_at': (datetime.now() + timedelta(minutes=10)).isoformat()
        }
        
        return {
            'status': 'pending',
            'session_id': session_id,
            'message': 'SCA authentication required',
            'available_factors': [f['type'] for f in available_factors]
        }
    
    def verify_factor(self, session_id, factor_type, factor_value):
        """
        Verify an authentication factor
        """
        if session_id not in self.authentication_sessions:
            return {'status': 'error', 'message': 'Invalid session'}
        
        session = self.authentication_sessions[session_id]
        user_id = session['user_id']
        
        # Check if factor is already used
        if factor_type in session['factors_used']:
            return {'status': 'error', 'message': 'Factor already used'}
        
        # Get user's factors
        factors = self.user_factors.get(user_id, [])
        factor = next((f for f in factors if f['type'] == factor_type), None)
        
        if not factor:
            return {'status': 'error', 'message': 'Factor not registered'}
        
        # Verify factor
        verification = self.verify_factor_data(factor, factor_value)
        
        if verification['verified']:
            session['factors_used'].append(factor_type)
            
            # Check if SCA is complete
            if self.is_sca_complete(session):
                session['status'] = 'completed'
                session['completed_at'] = datetime.now().isoformat()
                return {
                    'status': 'completed',
                    'message': 'SCA authentication completed',
                    'factors_used': session['factors_used']
                }
            
            return {
                'status': 'pending',
                'message': f'Factor {factor_type} verified',
                'factors_used': session['factors_used']
            }
        else:
            return {
                'status': 'failed',
                'message': f'Factor {factor_type} verification failed'
            }
    
    def verify_factor_data(self, factor, factor_value):
        """
        Verify factor-specific data
        """
        if factor['type'] == 'knowledge':
            # Verify password/PIN
            return {'verified': factor['data']['hash'] == self.hash_value(factor_value)}
        elif factor['type'] == 'possession':
            # Verify OTP or hardware token
            return {'verified': self.verify_otp(factor['data'], factor_value)}
        elif factor['type'] == 'inherence':
            # Verify biometric
            return {'verified': self.verify_biometric(factor['data'], factor_value)}
        else:
            return {'verified': False}
    
    def is_sca_required(self, transaction_data):
        """
        Determine if SCA is required for transaction
        """
        # Thresholds
        transaction_threshold = 100  # EUR
        
        # Check if amount exceeds threshold
        if transaction_data.get('amount', 0) > transaction_threshold:
            return True
        
        # Check if transaction is high-risk
        risk_score = self.transaction_risk_engine.assess_risk(transaction_data)
        if risk_score > 0.7:
            return True
        
        # Check if merchant is in high-risk category
        high_risk_merchants = ['gambling', 'crypto', 'adult']
        if transaction_data.get('merchant_category') in high_risk_merchants:
            return True
        
        return False
    
    def is_sca_complete(self, session):
        """
        Check if SCA is complete (2 factors minimum)
        """
        return len(session['factors_used']) >= 2
    
    def hash_value(self, value):
        """
        Hash a value for verification
        """
        import hashlib
        return hashlib.sha256(value.encode()).hexdigest()
    
    def verify_otp(self, otp_data, otp_value):
        """
        Verify OTP
        """
        # In production, use TOTP or HOTP
        import pyotp
        totp = pyotp.TOTP(otp_data['secret'])
        return totp.verify(otp_value)
    
    def verify_biometric(self, biometric_data, biometric_value):
        """
        Verify biometric
        """
        # In production, use biometric matching
        # For demo, simple comparison
        return biometric_data['template'] == biometric_value

class TransactionRiskEngine:
    """
    Transaction risk assessment engine
    """
    def __init__(self):
        self.risk_rules = []
        self.register_default_rules()
    
    def register_default_rules(self):
        """
        Register default risk rules
        """
        self.risk_rules = [
            {
                'name': 'amount_threshold',
                'condition': lambda tx: tx.get('amount', 0) > 10000,
                'weight': 0.3
            },
            {
                'name': 'new_beneficiary',
                'condition': lambda tx: tx.get('is_new_beneficiary', False),
                'weight': 0.2
            },
            {
                'name': 'unusual_location',
                'condition': lambda tx: tx.get('location_risk', 0) > 0.5,
                'weight': 0.2
            },
            {
                'name': 'unusual_time',
                'condition': lambda tx: tx.get('time_risk', 0) > 0.5,
                'weight': 0.1
            },
            {
                'name': 'device_unknown',
                'condition': lambda tx: tx.get('device_risk', 0) > 0.5,
                'weight': 0.2
            }
        ]
    
    def assess_risk(self, transaction_data):
        """
        Assess transaction risk score
        """
        risk_score = 0
        
        for rule in self.risk_rules:
            if rule['condition'](transaction_data):
                risk_score += rule['weight']
        
        return min(risk_score, 1.0)

Open Banking Attack Vectors:

┌─────────────────────────────────────────────────────────────────────┐
│                          Attack Vectors                            │
│                                                                   │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │                   1. Credential Stuffing                     │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Attack: Automated login attempts with stolen       │   │   │
│  │  │          credentials from data breaches             │   │   │
│  │  │  Mitigation: Rate limiting, MFA, CAPTCHA           │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                   2. Broken Object Level Authorization      │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Attack: Manipulate IDs in URL to access other      │   │   │
│  │  │          users' accounts (/accounts/123 → 999)      │   │   │
│  │  │  Mitigation: Verify ownership of accessed resources │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                   3. Man-in-the-Middle (MITM)              │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Attack: Intercept communication between client     │   │   │
│  │  │          and server to capture credentials          │   │   │
│  │  │  Mitigation: TLS 1.3, Certificate Pinning, mTLS     │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                   4. Injection Attacks                      │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Attack: Inject malicious SQL/NoSQL/OS commands     │   │   │
│  │  │          into API requests                          │   │   │
│  │  │  Mitigation: Input validation, parameterization     │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                   5. DDoS and Rate Attacks                  │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Attack: Flood API with requests to cause downtime  │   │   │
│  │  │  Mitigation: Rate limiting, WAF, Auto-scaling      │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

class AttackMitigation:
    """
    Open Banking Attack Mitigation Framework
    """
    def __init__(self):
        self.rate_limiter = RateLimiter()
        self.input_validator = InputValidator()
        self.auth_enforcer = AuthEnforcer()
        self.waf = WebApplicationFirewall()
    
    def process_request(self, request):
        """
        Process request through all mitigation layers
        """
        # Layer 1: Rate limiting
        rate_result = self.rate_limiter.check(request)
        if not rate_result['allowed']:
            return self.rate_limit_response(rate_result)
        
        # Layer 2: Input validation
        input_result = self.input_validator.validate(request)
        if not input_result['valid']:
            return self.validation_error_response(input_result)
        
        # Layer 3: Authentication enforcement
        auth_result = self.auth_enforcer.enforce(request)
        if not auth_result['authorized']:
            return self.auth_error_response(auth_result)
        
        # Layer 4: Web Application Firewall
        waf_result = self.waf.inspect(request)
        if not waf_result['allowed']:
            return self.waf_block_response(waf_result)
        
        return {'allowed': True}

class RateLimiter:
    """
    Rate limiting implementation
    """
    def __init__(self):
        self.limits = {
            'default': {'requests': 100, 'window': 60},  # 100 per minute
            'premium': {'requests': 1000, 'window': 60},
            'enterprise': {'requests': 10000, 'window': 60}
        }
        self.request_log = {}
    
    def check(self, request):
        """
        Check if request exceeds rate limit
        """
        client_id = request.get('client_id', 'default')
        
        # Get limit for client
        limit = self.limits.get(client_id, self.limits['default'])
        
        # Get request count for current window
        current_time = time.time()
        window_start = current_time - limit['window']
        
        # Clean old entries
        self.clean_old_entries(client_id, window_start)
        
        # Get count
        count = len(self.request_log.get(client_id, []))
        
        if count >= limit['requests']:
            return {
                'allowed': False,
                'limit': limit['requests'],
                'window': limit['window'],
                'remaining': 0
            }
        
        # Log request
        if client_id not in self.request_log:
            self.request_log[client_id] = []
        self.request_log[client_id].append(current_time)
        
        return {
            'allowed': True,
            'limit': limit['requests'],
            'window': limit['window'],
            'remaining': limit['requests'] - count - 1
        }
    
    def clean_old_entries(self, client_id, window_start):
        """
        Remove entries older than window
        """
        if client_id in self.request_log:
            self.request_log[client_id] = [
                t for t in self.request_log[client_id]
                if t > window_start
            ]

class InputValidator:
    """
    Input validation to prevent injection attacks
    """
    def __init__(self):
        self.sql_patterns = [
            r'\bSELECT\b.*\bFROM\b',
            r'\bINSERT\b.*\bINTO\b',
            r'\bUPDATE\b.*\bSET\b',
            r'\bDELETE\b.*\bFROM\b',
            r'\bDROP\b.*\bTABLE\b',
            r'\bUNION\b.*\bSELECT\b'
        ]
        self.xss_patterns = [
            r'<script.*?>.*?</script>',
            r'javascript:.*',
            r'on\w+=".*?"',
            r'<.*?on\w+='
        ]
    
    def validate(self, request):
        """
        Validate request data
        """
        # Check for SQL injection
        for pattern in self.sql_patterns:
            if self.search_pattern(request, pattern):
                return {
                    'valid': False,
                    'error': 'SQL injection detected',
                    'pattern': pattern
                }
        
        # Check for XSS
        for pattern in self.xss_patterns:
            if self.search_pattern(request, pattern):
                return {
                    'valid': False,
                    'error': 'XSS injection detected',
                    'pattern': pattern
                }
        
        # Check for command injection
        command_patterns = [r';.*\b(ls|dir|cat|echo|rm|wget|curl)\b']
        for pattern in command_patterns:
            if self.search_pattern(request, pattern):
                return {
                    'valid': False,
                    'error': 'Command injection detected',
                    'pattern': pattern
                }
        
        return {'valid': True}
    
    def search_pattern(self, obj, pattern):
        """
        Search pattern in object
        """
        import re
        if isinstance(obj, dict):
            for value in obj.values():
                if self.search_pattern(value, pattern):
                    return True
        elif isinstance(obj, list):
            for item in obj:
                if self.search_pattern(item, pattern):
                    return True
        elif isinstance(obj, str):
            if re.search(pattern, obj, re.IGNORECASE):
                return True
        return False

class FraudDetection:
    """
    Real-time fraud detection for open banking
    """
    def __init__(self):
        self.rules_engine = FraudRulesEngine()
        self.ml_model = FraudMLModel()
        self.behavioral_analyzer = BehavioralAnalyzer()
        self.alerts = []
    
    def analyze_transaction(self, transaction, user_history):
        """
        Analyze transaction for fraud
        """
        fraud_score = 0
        risk_factors = []
        
        # Rule-based scoring
        rule_score = self.rules_engine.score(transaction)
        if rule_score > 0:
            fraud_score += rule_score * 0.3
            risk_factors.append('rule_violation')
        
        # ML-based scoring
        ml_score = self.ml_model.predict(transaction, user_history)
        fraud_score += ml_score * 0.5
        if ml_score > 0.7:
            risk_factors.append('ml_detected')
        
        # Behavioral analysis
        behavior_score = self.behavioral_analyzer.analyze(transaction, user_history)
        fraud_score += behavior_score * 0.2
        if behavior_score > 0.6:
            risk_factors.append('behavioral_anomaly')
        
        return {
            'fraud_score': fraud_score,
            'risk_factors': risk_factors,
            'risk_level': self.get_risk_level(fraud_score),
            'recommended_action': self.get_recommended_action(fraud_score)
        }
    
    def get_risk_level(self, score):
        """
        Get risk level from score
        """
        if score < 0.2:
            return 'low'
        elif score < 0.5:
            return 'medium'
        elif score < 0.8:
            return 'high'
        else:
            return 'critical'
    
    def get_recommended_action(self, score):
        """
        Get recommended action based on score
        """
        if score < 0.2:
            return 'allow'
        elif score < 0.5:
            return 'review'
        elif score < 0.8:
            return 'challenge'
        else:
            return 'block'

class FraudRulesEngine:
    """
    Rule-based fraud detection
    """
    def __init__(self):
        self.rules = []
        self.register_rules()
    
    def register_rules(self):
        """
        Register fraud detection rules
        """
        self.rules = [
            {
                'name': 'amount_threshold',
                'condition': lambda tx: tx['amount'] > 10000,
                'weight': 0.3
            },
            {
                'name': 'unusual_device',
                'condition': lambda tx: tx.get('device_risk', 0) > 0.8,
                'weight': 0.4
            },
            {
                'name': 'unusual_location',
                'condition': lambda tx: tx.get('location_risk', 0) > 0.8,
                'weight': 0.3
            },
            {
                'name': 'new_beneficiary',
                'condition': lambda tx: tx.get('is_new_beneficiary', False),
                'weight': 0.2
            }
        ]
    
    def score(self, transaction):
        """
        Score transaction using rules
        """
        total_score = 0
        for rule in self.rules:
            if rule['condition'](transaction):
                total_score += rule['weight']
        return min(total_score, 1.0)

class BehavioralAnalyzer:
    """
    Behavioral analysis for fraud detection
    """
    def __init__(self):
        self.user_patterns = {}
    
    def analyze(self, transaction, user_history):
        """
        Analyze user behavior patterns
        """
        user_id = transaction.get('user_id')
        
        # Get user's normal patterns
        patterns = self.user_patterns.get(user_id, self.get_default_patterns())
        
        # Check for anomalies
        anomaly_score = 0
        
        # Amount anomaly
        avg_amount = patterns.get('avg_amount', 100)
        if transaction['amount'] > avg_amount * 3:
            anomaly_score += 0.3
        
        # Time anomaly
        normal_hours = patterns.get('normal_hours', [9, 17])
        hour = datetime.fromisoformat(transaction['timestamp']).hour
        if hour < normal_hours[0] or hour > normal_hours[1]:
            anomaly_score += 0.3
        
        # Frequency anomaly
        recent_transactions = user_history.get('recent', [])
        if len(recent_transactions) > 10:
            anomaly_score += 0.2
        
        return min(anomaly_score, 1.0)
    
    def get_default_patterns(self):
        """
        Get default behavioral patterns
        """
        return {
            'avg_amount': 100,
            'normal_hours': [9, 17]
        }