Data format drift protection for application programming interfaces

Abstract

Data format drift protection for application programming interfaces is disclosed. Aspects discussed herein can involve methods and techniques for scanning application programming interface requests and responses to more easily identify data issues. A system can aggregate one or more data requests and / or responses according to related data transactions between devices. The system can then analyze traffic associated with those requests to determine whether responses comply with data policies. If responses do not comply with such policies, systems are described for reporting and correction.

Description

[0001] Technical Field and Background Art of the Invention

[0002] Modern computer architectures, such as those of servers and networked nodes in large networks, can be extremely complex and difficult to analyze. This poses significant problems for computing systems designed to be subject to policies regarding data encryption and security for external communications. For example, external and internal actors may have different access levels, and encryption of data transmission may not occur at every link (e.g., data may be encrypted externally but not internally).

[0003] Identifying unprotected sensitive data exchanged at runtime (such as during program calls that jump from one system to another) is a challenging task, and it becomes even more complex when it has to be done on a scale of billions of transactions per day, or thousands of transactions per second.

[0004] The aspects described herein can address these and other problems and, overall, improve the ability to determine whether data transmission strategies are being followed. The aspects of this disclosure generally involve machine learning, such as determining whether a given response is authorized given an aggregation request for information by analyzing the response. Summary of the Invention

[0005] The following is a brief overview of the various aspects described herein. This overview is not an extensive review and is not intended to identify key or important elements or define the scope of the claims. The overview below presents some concepts in a simplified form as an introductory prelude to the more detailed descriptions provided below.

[0006] A system of one or more computers can be configured to perform specific operations or actions by installing software, firmware, hardware, or combinations thereof on the system, wherein the software, firmware, hardware, or combinations thereof cause the system to perform actions. One or more computer programs can be configured to perform specific operations or actions by including instructions that, when executed by a data processing device, cause that device to perform actions. For example, a computer-implemented method may include receiving a request for information from an application programming interface (API) gateway, wherein the request for information may include an API request for a second device. The method may also include receiving a response from the API gateway from the second device for the request for information. The method may further include determining that the response corresponds to the request for information. The method may also include aggregating one or more responses that include the request for the response in a transitive memory.

[0007] The method may further include using a scanner and analyzing the response based on one or more responses received by the scanner to determine whether the first device is authorized to receive the requested information. The method may include using a scanner to analyze the response to determine if the response contains sensitive information. The method may include using a machine learning model to analyze the response to determine if the response is authorized. The method may include using a scanner to analyze the response to determine if the format of the response has drifted from one or more acceptable formats. The method may include using a scanner to analyze the response to determine if the format of the response conforms to one or more policies or protocols. The method may include providing the response to the first device.

[0008] The corresponding devices, systems and computer-readable media are also within the scope of this disclosure.

[0009] These features, along with many other features, will be discussed in more detail below. Attached Figure Description

[0010] This disclosure is illustrated by way of example but is not limited to the accompanying drawings, in which the same reference numerals denote similar elements and wherein:

[0011] Figure 1 Examples of computing devices that can be used to implement one or more of the illustrative aspects discussed herein are shown;

[0012] Figure 2 An example deep neural network architecture is shown;

[0013] Figure 3 An example traffic analysis system is shown; and

[0014] Figure 4 An example method for analyzing data traffic requests and responses is shown. Detailed Implementation

[0015] In the following detailed description of various embodiments, reference is made to the accompanying drawings, which form part of this invention, and various embodiments in which this disclosure can be practiced are shown by way of illustration. It should be understood that other embodiments may be utilized and structural and functional modifications may be made without departing from the scope of this disclosure. Aspects of this disclosure can be other embodiments and can be practiced or performed in various ways. Moreover, it should be understood that the wording and terminology used herein are for descriptive purposes and should not be considered limiting. Rather, the phrases and terms used herein are to be given the broadest interpretation and meaning. The use of “comprising” and “including” and variations thereof is intended to include items listed herein and their equivalents, as well as additional items and their equivalents.

[0016] By way of description, aspects of this disclosure can allow for the monitoring of information both internally and externally through a computer architecture. For example, a system can utilize one or more application programming interface (API) gateways to monitor traffic. In an ideal embodiment, all traffic will pass through the gateway, although in many cases only some traffic will pass through (e.g., due to hardware bandwidth or latency issues). This provides an opportunity to centrally manage and control what data is shared, how data is shared, and with whom data is shared.

[0017] The system can opportunistically scan for requests (e.g., HTTP or REST API requests) asynchronously on filtered traffic. For example, some or all traffic can be scanned. In doing so, the system can operate by using one or more proxies to relay data to be processed to the gateway as requests are sent to the receiver. This has the advantage of avoiding gateway performance or client experience degradation caused by latency that might be imposed by certain large-scale payload inspection services (e.g., certain packet sniffing methods that could inject latency into the system).

[0018] In some instances, filtered traffic can be relayed via a dedicated component that efficiently captures request and response payloads in memory. Captured payloads can be periodically flushed to the scanner to prevent memory overload. Captured payloads can be non-persistent, allowing them to be discarded once the scan is complete, reducing the likelihood of future data breaches. Captured API payloads can be sent to the scanner from the node that captured them via an authenticated channel, using techniques such as unique payload protection and proprietary binary message formatting to prevent network overload. The same API payload can be sent to the scanner, which can perform differential analysis, including detecting unprotected sensitive data, deviations from the API payload schema from the published Open API 3.0 design specifications, data elements shared with different third parties or systems without customer consent, or data that ideally should be edited based on risk profiles.

[0019] Deviation analysis can be accomplished by using machine learning systems to analyze aggregated traffic and identify deviations from expected behavior and / or established strategies. This can have the advantage of providing automated systems for automatically identifying risky instances. In some instances, some degree of human oversight may be present. For example, risky instances flagged by a machine learning system can be sent to humans for analysis. Given that billions of data transactions may occur daily in large systems, this allows for an efficient scanning of all data in a way that would be impossible if the system relied on direct manual analysis of data transmissions. In other instances, rule-based approaches can send data that meets specific risk thresholds to humans for batch analysis.

[0020] However, before discussing these concepts in more detail, we will first refer to... Figure 1 Several examples of computing devices that can be used to implement and / or otherwise provide various aspects of this disclosure are discussed.

[0021] Figure 1 A computing environment 100 is illustrated as an example of a computing device 101 that can be used to implement one or more illustrative aspects discussed herein. For example, in some embodiments, the computing device 101 may implement one or more aspects of this disclosure by reading and / or executing instructions and performing one or more actions based on those instructions. In some embodiments, the computing device 101 may represent, be incorporated into, and / or include various devices, such as desktop computers, computer servers, mobile devices (e.g., laptop computers, tablet computers, smartphones, any other type of mobile computing device, etc.), and / or any other type of data processing device.

[0022] In some embodiments, computing device 101 may operate in a stand-alone environment. In other embodiments, computing device 101 may operate in a networked environment. Figure 1 As shown, various network nodes 101, 105, 107, and 109 can be interconnected via network 103 (such as the Internet). Other networks can also be used, including private intranets, corporate networks, LANs, wireless networks, personal networks (PANs), etc. Network 103 is for illustrative purposes and can be replaced by fewer or additional computer networks. A local area network (LAN) can have one or more of any known LAN topology and can use one or more of a variety of different protocols, such as Ethernet. Devices 101, 105, 107, 109, and other devices (not shown) can be connected to one or more of the network via twisted-pair cables, coaxial cables, fiber optic cables, radio waves, or other communication media.

[0023] like Figure 1 As shown, computing device 101 may include processor 111, RAM 113, ROM 115, network interface 117, input / output interface 119 (e.g., keyboard, mouse, display, printer, etc.), and memory 121. Processor 111 may include one or more computer processing units (CPU), graphics processing units (GPUs), and / or other processing units, such as processors adapted to perform computations associated with machine learning. I / O 119 may include various interface units and drivers for reading, writing, displaying, and / or printing data or files. I / O 119 may be coupled to a display (such as display 120). Memory 121 may store software for configuring computing device 101 as a special-purpose computing device to perform one or more of the various functions discussed herein. Memory 121 may store operating system software 123 for controlling the overall operation of computing device 101, control logic 125 for instructing computing device 101 to perform the aspects discussed herein, machine learning software 127, training data 129, and other applications 129. Control logic 125 may be incorporated into machine learning software 127 and may be a part of machine learning software 127. In other embodiments, computing device 101 may include two or more of any and / or all of these components (e.g., two or more processors, two or more memories, etc.) and / or other components and / or subsystems not shown herein.

[0024] Devices 105, 107, and 109 may have architectures similar to or different from those described with respect to computing device 101. Those skilled in the art will understand that the functionality of computing device 101 (or devices 105, 107, and 109) as described herein can be distributed across multiple data processing devices, for example, across multiple computers to distribute processing loads to separate transactions based on geographic location, user access level, quality of service (QoS), etc. For example, devices 101, 105, 107, 109, and other devices can operate collaboratively to provide parallel computing features supporting the operation of control logic 125 and / or software 127.

[0025] One or more aspects discussed herein may be embodied in computer-usable or readable data and / or computer-executable instructions, such as in one or more program modules executed by one or more computers or other devices described herein. Typically, program modules include routines, programs, objects, components, data structures, etc., which, when executed by a processor in a computer or other device, perform a specific task or implement a specific abstract data type. Modules may be written in a source code programming language subsequently compiled for execution, or they may be written in a scripting language such as (but not limited to) HTML or XML. Computer-executable instructions may be stored on computer-readable media such as hard disks, optical disks, removable storage media, solid-state storage, RAM, etc. As those skilled in the art will understand, the functionality of program modules may be combined or distributed as desired in various embodiments. Furthermore, functionality may be wholly or partially embodied in firmware or hardware equivalents such as integrated circuits, field-programmable gate arrays (FPGAs), and the like. Specific data structures may be used to more effectively implement one or more aspects discussed herein, and such data structures are contemplated within the scope of the computer-executable instructions and computer-usable data described herein. The various aspects discussed in this article can be embodied in methods, computing devices, data processing systems, or computer program products.

[0026] Having discussed several examples of computing devices that can be used to implement certain aspects discussed further below, the discussion will now turn to systems and methods for architecture detection and predictive self-healing.

[0027] Figure 2 An example deep neural network architecture 200 is shown. This type of deep neural network architecture can be... Figure 1 All or part of the machine learning software 127 shown. That is to say, Figure 2 The architecture described does not need to be executed on a single computing device and can be executed by, for example, multiple computers (e.g., one or more of devices 101, 105, 107, and 109). An artificial neural network can be a collection of connected nodes, where each node and connection has assigned weights for generating predictions. Each node in an artificial neural network can receive input and generate an output signal. The output of a node in an artificial neural network can be a function of its input and the weights associated with the edges. Ultimately, the trained model can be provided with inputs beyond the training set and used to generate predictions about possible outcomes. Artificial neural networks can have many applications, including object classification, image recognition, speech recognition, natural language processing (NLP), text recognition, regression analysis, behavior modeling, and more.

[0028] Artificial neural networks can have an input layer 210, one or more hidden layers 220, and an output layer 230. Deep neural networks, as used herein, can be artificial networks with more than one hidden layer. The network architecture 200 shown is depicted with three hidden layers and can therefore be considered a deep neural network. The number of hidden layers employed in the deep neural network 200 can vary based on a specific application and / or problem domain. For example, a network model for image recognition can have a different number of hidden layers than a network for speech recognition. Similarly, the number of input and / or output nodes can vary based on the application. Many types of deep neural networks are used in practice, such as convolutional neural networks, recurrent neural networks, feedforward neural networks, combinations thereof, and so on.

[0029] During model training, the weights of each connection and / or node can be adjusted as the model adapts to generate more accurate predictions on the training set. The weights assigned to each connection and / or node are referred to as model parameters. The model can be initialized using a random or white noise set of initial model parameters. The model parameters can then be iteratively tuned using, for example, a stochastic gradient descent algorithm that seeks to minimize the error in the model.

[0030] Figure 3 This illustrates an exemplary high-level overview of the traffic analysis system 300, as it can be compared with... Figure 4 Consistent. The equipment of the traffic analysis system may include a computing environment 100, and the equipment may be implemented as described above. Figure 1The traffic analysis system may represent one or more devices (e.g., computing device 101) described herein. It may also represent one or more servers within a larger server architecture (e.g., a server network within an enterprise IT infrastructure). For example, it may represent multiple servers connected to multiple clients 305 (e.g., external clients, such as customers, other enterprises, data providers, etc.). Clients 305 may connect to the system via one or more API gateways 310. API gateways 310 may include one or more intermediaries, such as those for HTTP traffic. API gateways 310 may be responsible for interfacing with client traffic, such as by enforcing authentication, authorization, and routing traffic to one or more API backends 330 within the server architecture. API gateways 310 may verify device and / or information authentication upon receiving client traffic. API gateways 310 may further verify whether the API associated with the endpoint in the API backend 330 has a policy that mandates scanning traffic payloads, headers, or query parameters. The configured policy can be highly flexible. For example, the policy may include the percentage of API endpoint traffic to be scanned, the time window in which API endpoint traffic should be scanned, the size of the data traffic to be scanned, the amount of traffic to be scanned within a time period, or any other such parameters that may be appropriate. Note that the system can handle requests and responses that can come from either the client 305 or the API backend 330. For example, the API backend 330 endpoint can make an API request to another endpoint within the API backend 330.

[0031] If traffic needs to be analyzed, it can be captured by scanning system 315. Scanning system 315 can be responsible for performing traffic analysis. For example, the scanner system can be responsible for processing requests to determine whether the uniform resource identifier (URI), request headers, request payload, etc., meet the expected results. Upon receiving a request (e.g., from API gateway 310), scanning system 315 may include data capture agent 320, such that the request is forwarded to the target destination (e.g., a backend endpoint) but additionally mirrored to scanner 325.

[0032] Data capture agent 320 can be responsible for mirroring data to and from scanner 325. Data capture agent 320 can coordinate with API gateway 310 to capture traffic for analysis. For example, if received traffic satisfies one or more policies for analysis, a data traffic request can be proxied from API gateway 310 to scanner 325 (e.g., the entire response and / or extracted portion can be sent to scanner 325). Furthermore, when a response to the request is sent, that response can also be mirrored by data capture agent 320. This is advantageous by reducing resource contention on one or more API gateways 310 regarding unscanned remaining traffic.

[0033] Scanner 325 can be one or more devices configured to perform traffic analysis. For example, scanner 325 can be configured to perform deep packet inspection, header inspection, or other techniques for analyzing packets. In some examples, scanner 325 can analyze data traffic to determine whether the data is encrypted. For example, scanner 325 can determine whether a data packet includes an encrypted payload, such as by analyzing the payload or header flags to determine the presence of encryption.

[0034] The scanner 325 can use specialized algorithms, such as regular expressions, to detect specific types of sensitive data, including SSNs, names, phone numbers, addresses, bank account information, passwords, or other similar information. The scanner 325 can also employ machine learning models (e.g., using a neural network architecture 200), which is beneficial for reducing false positive rates. Furthermore, the scanner 325 can not only detect sensitive data but also compile other information, such as API ownership, API version number, data size and format, and data request frequency, to allow for easier management and tracking.

[0035] The scanner 325 can use machine learning models to improve the confidence level of detected sensitive data. For example, machine learning models can improve the accuracy of detection of various highly sensitive human data elements. In some instances, character CNN models can be used because they may be more tolerant of spelling errors, words outside the vocabulary, and are specifically designed for other such use cases involving highly sensitive data. The input to the model can be text as sequences of numbers and / or words and associated context, while the output can be multiple classes or binary classes. Furthermore, other natural language processing models can be used, such as Bag of Words, N-grams, TF-IDF variants, and other deep learning word-based models, such as ConvNets and RNNs.

[0036] Scanner 325 may include one or more detectors 335. Detector 335 may include hardware and / or software for performing the scanning functions of scanner 325. For example, sensitive data sensor 340 may be responsible for using regular expressions to determine whether sensitive data is in a request or response. For example, sensitive data sensor 340 may determine whether a set of 9-digit numbers indicating an SSN exists. Machine learning sensor 345 may employ neural network architecture 200 and may be configured to detect any number of restricted requests or responses. For example, machine learning sensor 345 may be trained to detect sensitive data based on the above. In another example, machine learning sensor 345 may be trained to detect data formatting, such as whether the data conforms to API standards or whether the data is encrypted. External data sharing sensor 350 may be configured to determine whether a data request or response is being sent between authorized devices. For example, given an API request from client 305, external data sharing sensor 350 may determine whether the data policy for the given request permits client 305 to access the request. In some instances, one client 305 may be permitted access to all information in a database, while another client 305 may be permitted access to only some of that information. For example, auto financiers may be allowed to request all personal information about their customers, including sensitive financial information, while auto dealers may only be allowed access to publicly available information and credit scores.

[0037] API drift sensor 355 can determine whether an API request or response is consistent with an API standard. For example, a policy can be prepared for a system to use a specific format for API calls, such as a specific version of the OpenAPI. API drift sensor 355 can analyze the call to determine whether the call is consistent with one or more standards specified for the API call. If they are inconsistent, this may indicate that the API is inconsistent with the OpenAPI, and / or that the requester and responder are inconsistent with their API usage. Compliance sensor 360 can determine whether data compliance has been followed. For example, compliance sensor 360 can determine whether the responding device or the requesting device within the backend is authorized to access a specific database containing sensitive data.

[0038] The machine learning sensor 345 can operate in combination with or in conjunction with other sensors. For example, the machine learning sensor 345 can be used in conjunction with an external data sharing sensor 350 to determine whether a client 305 or API backend 330 endpoint is accessing sensitive information at a rate inconsistent with previous behavior. In another example, the machine learning sensor 345 can work in conjunction with an API drift sensor 355 to determine whether an API call is inconsistent with the expected call for a given API format pattern.

[0039] Traffic analysis system 300 may also include reporting system 365. Information collected by scanner 325 can be forwarded to reporting system 365 via streaming platform 370. Examples of streaming platforms could be services from AWS, Azure, Apache, or other known data streaming services that support real-time data analysis and / or parsing. This data can be forwarded to data publisher 375, which can publish it to one or more databases or dashboards for consumption. For example, network and risk (cybersecurity) dashboard 380 can present to administrators the ability to monitor data interactions as they occur. Example dashboards can present a list of issues (or other data) in various formats, including spreadsheets, architecture diagrams, database files, or any other suitable format for display in a dashboard application. Network and risk dashboard 380 can present information about issues that require oversight from people, such as IT managers. For example, network and risk dashboard 380 can present issues in reports at threshold times (e.g., daily) for IT managers to review and ensure no data breaches occur. In another example, a large deviation from expected behavior would trigger an immediate alert in the dashboard. For example, a series of activities requesting sensitive information (e.g., exceeding a threshold amount within a threshold time period) can trigger an alert for IT managers to review. Machine learning, such as using a machine learning sensor 345, can facilitate this process. For instance, the machine learning sensor 345 can operate to compare data requests for a given API backend endpoint 330 with historical requests. If those requests deviate (e.g., by an unusual number of requests, requests from unusual external entities, requests from unusual internal entities, etc.), the machine learning sensor 345 can cause the deviation to be flagged in the network and risk dashboard 380 for review. In some instances, if the deviation exceeds a threshold (e.g., a further threshold, such as additional attempts or requests, or a weighted risk threshold that can be determined by the machine learning sensor 345), the system can pause the request until a human confirms that the request will not cause harm by data breach or exposure of sensitive information.

[0040] Information can also be compiled into a database associated with a data finder 385, which can be a program used to search the database for the compiled data. For example, the data finder can enable a user on a data viewer 390. The data viewer 390 can be an interface for users to view current or historical data. For example, a user can be allowed to view the rate or type of data requests made to a specific API backend endpoint 330 over time. This allows users to track data usage and identify areas of interest.

[0041] If a problem is detected, the case management system 393 can be configured to allow correction of that problem. Upon detection, the case opening system 396 can allow a case to be opened for inspection. Consistent with the above discussion, if a problem is detected, the system can optionally pause data transactions to prevent data breaches or exposure of sensitive information. At this stage, a ticket can be opened for human intervention and correction of any flagged issues. For example, the system may have detected API drift, which can refer to deviations from API formatting and execution standards. This can trigger a ticket to inspect the relevant API and correct any coding errors to ensure any endpoints conform to API standards and eliminate drift. In some instances, the user can close the ticket using the case closing system 399 after the problem is resolved. In other instances, the case closing system 399 can further automate monitoring of data transactions to determine if errors have been resolved. This can have the benefit of ensuring quality control of problems and facilitating the resolution of potentially intermittent problems (e.g., by monitoring for errors for a period of time before allowing the ticket to be closed).

[0042] Based on the detailed description above, the aspects described herein can provide computer-implemented methods for analyzing data traffic requests and responses. Exemplary steps of such methods are as follows: Figure 4 As shown. The system for implementing the steps can be one or more computing devices, such as... Figure 1 One or more computing devices 101 can be depicted in the diagram. This system can be configured to be consistent with the flow analysis system 300, such as... Figure 3 The descriptions of those systems and their functionality are consistent with the discussion below. A system may include one or more machine learning models, such as those described in [the original text]. Figure 2 and Figure 3 Those discussed in the text.

[0043] At step 402, the system may receive an information request from the first device to the second device. Both devices can be any devices, such as client 305 or API backend 330 endpoints within the network architecture. The request for information may include data requests, such as API calls, which may have a specific format and request. For example, a data request could be a request from client 305 in OpenAPI format requesting certain encrypted or sensitive information stored on a server associated with API backend 330. In another example, a data request could be a request from one endpoint in API backend 330 to another endpoint within the backend.

[0044] At step 404, the system may receive a response to the request. The response may be a data response and / or an API response. For example, the response may include data, which may include encrypted and / or sensitive information. An API response may include an indication that data will be returned or will not be returned, a request for further information, confirmation of the request, or any other such administrative response from the system.

[0045] At step 406, the system can associate the response with the request. In some instances, both the response and the request can include HTTP API calls. HTTP API calls can include destination and sender addresses (e.g., IP or MAC addresses) or other such addresses that can identify the participants. The system can associate the response with the request based on the address. In other instances, the system can use methods such as appending flags to a specific request to track which request is associated with which response. In still other instances, the system can proactively facilitate responses to requests (e.g., by facilitating responses to API calls to requests routed to a specific device) and can associate requests with responses by managing data transactions.

[0046] At step 408, the system may aggregate one or more instances of traffic. For example, the system may utilize data capture agent 320 to capture responses and requests (e.g., related as in step 406) and aggregate those requests for scanner 325. Aggregation of requests may include storing the requests in the memory of scanning system 315 for batch processing. In some instances, requests and / or responses may be stored in short-term or temporary memory, such that the data may not be retained. For example, once analysis is performed and results are sent, the data may be discarded. This can have the advantage of reducing the risk that encrypted or sensitive data captured by data capture agent 320 may be exposed if the device associated with scanning system 315 is compromised. Furthermore, by aggregating responses and / or requests, the system may have the advantage of reducing ongoing overhead through batch transmission or processing.

[0047] In some instances, a system can aggregate only certain responses or requests based on one or more rules. For example, a rule might trigger aggregation if a certain threshold for responses and / or requests is reached. In another example, a rule might trigger aggregation if certain sensitive or encrypted data is requested. In yet another example, a rule might trigger aggregation only at a certain frequency, such as a certain percentage of requests and / or a specific request within a specified time period. In yet another example, manual rules can be set, such as capturing all responses and / or requests corresponding to a specific API format version, to prevent API drift. API drift can refer to, for example, the tendency of devices and / or software in a system to deviate from the expected format and / or behavior regarding an API standard. For example, a system might specify a particular OpenAPI standard to be utilized, and API drift can refer to the extent to which the system deviates from that OpenAPI standard in its requests and / or responses.

[0048] In steps 410-416, the system may analyze the traffic to determine its characteristics and perform any necessary analysis. The system may employ a scanner 325 and / or one or more detectors 335 (which may form part of the scanner 325) when performing this analysis. For example, a machine learning sensor 345 may be utilized to determine whether the data meets one of the tests described herein. In another example, a detector may be used to perform regular expression tests to determine the presence of sensitive information (e.g., a 9-digit number associated with an SSN, medical information, an address, etc.) in the data. It should be understood that, as stated elsewhere, the analysis to be performed is configurable, such that the analysis to be performed is optional under the discretion of one or more rules and / or the discretion of the operator.

[0049] At step 410, the system may analyze the traffic to determine whether it is authorized. For example, the system (e.g., scanning system 315) may analyze a data request to determine the permission associated with the request (e.g., by identifying the sender and / or determining the permission associated with a set of credentials associated with the request). The system may further determine whether the response is consistent with the authorization. For example, a general request for information might be responded to using data that includes sensitive information, even if the requester is not authorized to receive such information (or may not have requested such information).

[0050] At step 412, the system can analyze the traffic to determine whether the response includes sensitive information. For example, an API call to customer information might respond using customer data entries that include both personal and financial information, even if the request should only respond with some personal information rather than financial information.

[0051] At step 414, the system can analyze the traffic to determine if API drift has occurred. Examples such as those described above in steps 410 and 412 can be examples of API drift. For instance, a given API request may be designed to retrieve limited information based on the client's authorization, but poor design causes the responding device to provide information regardless. In another example, the API response may provide correctly authorized information, but may be formatted or otherwise provided in a way inconsistent with API standards and policies.

[0052] At step 416, the system can analyze traffic for policy compliance. Data traffic policies can be set for the system regarding data volume, data encryption, data path, data recipients, data access frequency, or any other such policies. For example, as a policy issue, end-to-end encryption of financial information may be required. However, the system can determine whether sensitive information is properly encrypted. For example, the system can determine that sensitive information is sent internally as plaintext to the enterprise server architecture associated with the API backend endpoint 330, and is only encrypted when sent externally. If the network is compromised (such as through a man-in-the-middle attack), this policy violation increases the risk of sensitive information being exposed. By tracking policy compliance across the entire network, the system can mitigate the risk of such data breaches by detecting deficiencies in policy compliance, even if such deviations are not apparent externally (e.g., receiving information via an encrypted file, but that information is improperly prepared and sent unencrypted over the internal network).

[0053] At step 418, the system can determine whether to forward the traffic. In instances where a problem is identified, the system can block the transmission of a response to client 305. For example, data can be restricted from being sent to API gateway 310, or a command can be sent to API gateway 310 instructing it not to send the data. In other instances, the system can determine to forward the data to reporting system 365 for analysis. For example, unencrypted data that appears incorrect can be sent to reporting system 365 to determine if it should be encrypted. In another example, evidence of API drift can be sent to reporting system 365. In some instances, a description of the data can be sent instead of the data itself. For example, a report indicating that encrypted data was sent from a first device to a second device can be sent to reporting system 365 without sending the actual encrypted data.

[0054] Although the subject matter has been described in language specific to structural features and / or methodological actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are disclosed as exemplary forms for implementing the claims.

Claims

1. A computer-implemented method, comprising: Receive a request for information from a first device from an application programming interface (API) gateway, wherein the request for information includes an API request for a second device; Receive a response from the second device to the request for the information from the API gateway; The response is determined to correspond to the request for information; Aggregate one or more responses, including requests for responses, in the transitive memory; The scanner is used and the responses received by the scanner are analyzed to determine whether the first device is authorized to receive the requested information. The scanner is used to analyze the response to determine whether the response contains sensitive information; The response is analyzed using a machine learning model to determine whether the response is authorized. The scanner is used to analyze the response to determine whether the format of the response has drifted from one or more acceptable formats; The scanner is used to analyze the response to determine whether the format of the response conforms to one or more policies or protocols; and The response is provided to the first device.

2. The computer-implemented method according to claim 1, further comprising: Analyze the request for information to determine whether the first device is authorized to access the requested information; as well as Based on the determination that the first device is authorized to access the requested information, the request for the information is transmitted to the second device.

3. The computer-implemented method according to claim 1, further comprising: Receive a second request for information from the first device, wherein the second request for information includes a second API request; Determine whether the first device is authorized to access the information requested in the second request; and Based on the determination that the first device is not authorized to access the information requested in the second request, the second request for the information is blocked.

4. The computer-implemented method according to claim 3, further comprising: In response to blocking the second request for information, an alert is sent to the cybersecurity dashboard.

5. The computer-implemented method according to claim 1, further comprising: Receive a second request for information from the first device, wherein the second request for information includes a second API request; Transmit the second request for information to the second device; Receive a second response from the second device in response to the second request for the information; The scanner is used to analyze the response to determine whether the second response includes second sensitive information; Based on the determination that the second response includes second sensitive information, determine whether the second sensitive information is encrypted; Based on the determination that the second sensitive information is not encrypted, encrypt the second sensitive information; and The second response, which includes encrypted second sensitive information, is transmitted to the first device.

6. The computer-implemented method according to claim 1, further comprising: Before the request for information is transmitted to the second device, the request for information is analyzed to determine whether the request for information conforms to one or more data loss prevention strategies or data management strategies. as well as Based on the determination that the request for information conforms to one or more data loss prevention strategies or data management strategies, the request for information is transmitted to the second device.

7. The computer-implemented method according to claim 1, further comprising: Receive a second request for information from the first device, wherein the second request for information includes a second API request; Determine whether the second request for information conforms to one or more data loss prevention policies or data management policies; and The second request for information is blocked if it does not conform to one or more data loss prevention policies or data management policies.

8. The computer-implemented method according to claim 1, further comprising: The machine learning model is trained to identify one or more sensitive pieces of information in API calls and API responses.

9. The computer-implemented method according to claim 1, wherein, The machine learning model includes a natural language processing (NLP) model.

10. The computer-implemented method according to claim 1, wherein, The machine learning model includes a convolutional neural network.

11. The computer-implemented method according to claim 1, wherein, The first device and the second device are associated with the same entity.

12. The computer-implemented method according to claim 1, wherein, The first device and the second device are associated with different entities.

13. A computer-implemented method, comprising: Requests for information are received from a first device and via an application programming interface (API) gateway, wherein the requests for information include API requests; The requests for information, along with one or more other requests for information, are aggregated in local storage for bulk transmission to the scanner. Using the scanner and analyzing the request for information after receiving it by the scanner, to determine whether the first device is authorized to access the requested information; Based on the determination that the first device is authorized to access the requested information, the scanner is used to analyze the request for information to determine whether the format of the request for information has drifted from one or more acceptable formats; Based on the determination that the format of the requested information has drifted from one or more acceptable formats, an indication is output that the requested information is not in an acceptable format.

14. The computer-implemented method according to claim 13, further comprising: Analyze the request for information to determine whether the first device is authorized to access the requested information; as well as Based on the determination that the first device is authorized to access the requested information, the request for the information is transmitted to the second device.

15. The computer-implemented method according to claim 13, further comprising: Receive a second request for information from the first device, wherein the second request for information includes a second API request; Determine whether the first device is authorized to access the information requested in the second request; and Based on the determination that the first device is not authorized to access the information requested in the second request, the second request for the information is blocked.

16. The computer-implemented method according to claim 15, further comprising: In response to blocking the second request for information, an alert is sent to the cybersecurity dashboard.

17. The computer-implemented method according to claim 13, wherein, The analysis includes analysis using one or more machine learning models, including convolutional neural networks or natural language processing (NLP) models.

18. An apparatus comprising: Scanner; Temporary storage; One or more processors; as well as A non-transitory memory storing instructions that, when executed by the one or more processors, cause the device to: Requests for information are received from a first device and via an application programming interface (API) gateway, wherein the requests for information include API requests; The requests for information, along with one or more other requests for information, are aggregated in a temporary storage device for bulk transmission to the scanner. After receiving the request for information by the scanner, the scanner is used to analyze the request for information to determine whether the first device is authorized to access the requested information; Based on the determination that the first device is authorized to access the requested information, the scanner is used to analyze the request for information to determine whether the format of the requested information has drifted from an acceptable format; and Based on the determination that the format of the requested information has drifted from an acceptable format, an indication is output that the requested information is not in an acceptable format.

19. The apparatus according to claim 18, wherein, When executed by the one or more processors, the instructions also cause the device to transmit the request for information to the second device based on the determination that the first device is authorized to access the requested information.

20. The apparatus according to claim 18, wherein, When executed by the one or more processors, the instructions also cause the device to use a machine learning model, including one or more convolutional neural networks or natural language processing (NLP) models, to analyze the request for information.

Images