API Behavior Clustering for Attack Path Context
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat detection systems for network services lack context information about how attackers reach vulnerable points, making it difficult to analyze and strengthen the system effectively.
Innovation Solution
The system groups users by clustering similar behaviors and tracks their API sequences or sessions to identify attack points and the paths attackers take, using clustering algorithms and statistical analysis to categorize user types such as attackers, bots, and outliers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional threat detection systems are used to detect threat events at specific points in time and nodes, then threat events can be detected, but no context information is provided about how attackers reached vulnerable points
Solution Approach 1:
The system segments user behavior into discrete API calls and groups them into sequences. Each API call is treated as a separate observable unit, and sequences are formed by chaining related calls together. This segmentation enables detailed analysis of attack paths without requiring the entire system to process all data at once, thus providing context information while managing complexity.
Solution Approach 2:
The patent introduces a temporal and contextual dimension to threat detection by analyzing sequences of API calls rather than isolated events. By ordering and analyzing API calls in the sequence they occur, the system adds the dimension of temporal context and behavioral pattern, enabling detection of attack paths while maintaining manageable system architecture.
2Reliability
If clustering algorithms are applied to analyze user behavior sequences, then attack paths and user types can be identified, but computational resources and processing time increase
Solution Approach 1:
The system performs preliminary processing by pre-defining API call sequences and patterns before actual threat detection occurs. Common and suspicious API sequences are pre-identified and stored as reference patterns, allowing the clustering algorithm to compare new behavior against these pre-established patterns rather than analyzing everything from scratch, thus reducing real-time processing time while maintaining detection accuracy.
Solution Approach 2:
The patent applies partial clustering by focusing the analysis on specific subsets of API calls that are most indicative of attack behavior, rather than clustering all user behavior data uniformly. By selecting and analyzing only the most relevant API sequences (such as those involving authentication, data access, or administrative operations), the system achieves reliable attack detection with reduced computational overhead.
Data Source
AI summary
Behaviors in the form of API strings for each of a plurality of users are determined for each user interacting with an API for a particular time. The behavior strings are converted to a numerical format, and clustering algorithms are applied to the numerical format data. The type of cluster is then determined for each cluster. Types of clusters can include an attacking user, bots, speed of access, and outlier type. The results of clustering and a statistical analysis can be reported to a user through a dashboard. The dashboard may provide graphical information, for example in the form of a sankey diagram, as well as statistical analysis data for each cluster.