API Call Attack Detection Through Multi-Phase Sequence Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to detect sophisticated volumetric attacks that exploit multiple phases of API interactions, as attackers use diverse IP addresses and distribute attacks over time, evading traditional rate-limiting and reputation-based defenses.
Innovation Solution
A multi-phase analysis system that includes a time-series anomaly detector, behavior anomaly detector, and cross-actor correlator to identify suspicious time windows, cluster user behaviors, and extract attack signatures, using models like ARIMA, LSTM, and Prophet for predictive analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional rate-limiting and reputation-based detection systems are used, then simple volumetric attacks can be detected, but sophisticated multi-phase attacks using diverse IP addresses and distributed timing evade detection
Solution Approach 1:
The detection system is segmented into three distinct phases: time-series anomaly detection for volume spikes, behavior anomaly detection for pattern recognition, and cross-actor correlation for linking activities. This segmentation allows each phase to specialize in detecting specific attack characteristics, improving overall detection reliability while adapting to sophisticated attack patterns.
Solution Approach 2:
The system transitions from traditional two-dimensional monitoring (volume and reputation) to three-dimensional multi-phase analysis by adding temporal behavior patterns and cross-actor relationships as additional dimensions. This dimensional expansion enables detection of attacks that evade traditional single-dimension approaches.
2Productivity
If static detection policies are implemented, then easy-to-detect attacks can be blocked, but sophisticated attacks distributed over time with random IPs cannot be captured
Solution Approach 1:
The system replaces static detection policies with dynamic, multi-phase analysis that adapts to attack patterns in real-time. The time-series anomaly detector continuously monitors volume changes, the behavior anomaly detector tracks pattern evolution, and the cross-actor correlator dynamically links activities across different actors and time periods, enabling precise detection of distributed attacks.
Solution Approach 2:
The system performs preliminary detection in the first phase by identifying time windows with suspicious volume spikes before fully analyzing behavior patterns. This preliminary action filters out normal traffic early, improving detection efficiency while maintaining precision through subsequent phases of behavior and correlation analysis.
3Device complexity
If independent detection logic is used for each attack phase, then simple attacks can be detected, but distributed attacks with thousands of actors and long time periods cannot be captured
Solution Approach 1:
The system merges three detection phases into a unified multi-phase analysis framework where time-series anomaly detection, behavior anomaly detection, and cross-actor correlation work together. The output of each phase feeds into the next, creating a cohesive detection narrative that captures distributed attacks across thousands of actors and long time periods with high reliability.
Data Source
AI summary
A method for detecting volumetric attacks using multi-phase analysis of API calls is disclosed. The method includes collecting API calls data having API calls to and from protected actors. The method also includes identifying a triggering suspicious time window during which a first set of actors indicate suspicious volume spikes. Further, the method includes performing an API-sequence-based user behavior clustering to identify a subset of the API attack sequence and a second set of actors. Thereafter, the method includes correlating the activities of the second set of actors over a large period of time to identify the complete API attack sequence to extract an attack signature of the complete API attack sequence for detecting potential attacks.