API Call Pattern Detection for Command-and-Control Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing API security methods fail to detect malicious command and control (C2) attacks by threat actors with legitimate access, as they rely solely on authentication techniques and do not consider patterns of API usage indicative of malicious activity.
Innovation Solution
A collaborative content management system uses a machine learning model to analyze API call features, such as timestamps and request patterns, to identify potential malware C2 attacks and take security actions like adding applications to a deny list.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication techniques are used to prevent unauthorized access to APIs, then access security is improved, but detection capability for malicious activities with legitimate access deteriorates
Solution Approach 1:
The security approach is segmented into two independent layers: authentication layer (verifying legitimacy) and detection layer (identifying malicious patterns). The detection system separately analyzes API call patterns, timestamps, frequencies, and sequences without interfering with authentication, allowing simultaneous improvement of both access security and detection capability.
Solution Approach 2:
An intermediary detection system is introduced between the authentication mechanism and the API execution. This intermediary layer receives authenticated API calls, extracts features (timestamps, frequencies, patterns), feeds them to machine learning models, and generates detection alerts without blocking legitimate authenticated access.
2Measurement precision
If machine learning models analyze API call patterns to detect malware C2, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The complex machine learning detection logic is extracted and isolated into a separate detection module. This module independently processes API call features (timestamps, frequencies, patterns) through trained models, separating the complexity of pattern recognition from the core authentication and execution functions.
Solution Approach 2:
Instead of implementing complex real-time analysis in every API call handler, the system creates simplified copies of detection logic that process features in batches. The machine learning models are pre-trained and deployed as inference services, reducing the complexity burden on individual API request handlers.
Data Source
AI summary
A collaborative content management system identifies an application installed on one or more client devices that is susceptible to an attack by using the API calls of the application. The collaborative content management system obtains API calls made by the application and derives API call features. The collaborative content management system inputs the API call features into a machine learning model and receives, as output from the model, a determination of whether the set of API calls represents a C2 attack. In some embodiments, the collaborative content management system, responsive to determining that the set of API calls represents a C2 attack, may take a security action.