API Call Clustering for Accurate Anomaly Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cybersecurity solutions for APIs are inadequate in identifying and clustering API calls due to variations in parameter structures, leading to inefficient resource usage and inaccurate anomaly detection, particularly when dealing with instance-specific or user-specific parameters.

Innovation Solution

A probabilistic modeling approach is used to cluster API calls by generalizing instance-specific parameters, reducing the number of clusters and improving baseline behavior establishment, thereby enhancing anomaly detection and resource efficiency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If dictionary-based approaches are used to identify API parameters, then implementation is simple, but accuracy in distinguishing parameters is poor

Engineering Contradiction:

Improveease of implementationVSAvoidparameter distinction accuracy

Core Design Contradiction:

Ease of manufactureVSMeasurement precision

Solution Approach 1:

The patent replaces dictionary-based mechanical matching with probabilistic clustering algorithms that statistically analyze parameter patterns. The system uses clustering techniques to group similar API calls and identify parameters based on probabilistic models rather than fixed dictionaries, enabling accurate distinction even for concatenated strings and mixed data types.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent changes the approach from static dictionary matching to dynamic probabilistic modeling. By analyzing the distribution and patterns of parameter values across multiple API calls, the system adapts its understanding of parameters in real-time, allowing it to handle variations in data types and concatenated strings that dictionary-based approaches cannot accommodate.

Inventive Principle:

Principle #35Parameter changes

2Measurement precision

If clustering is performed to improve anomaly detection, then detection accuracy improves, but computational complexity increases

Engineering Contradiction:

Improveanomaly detection accuracyVSAvoidcomputational complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent applies partial clustering by focusing computational resources on identifying and analyzing only the most suspicious or anomalous API calls rather than processing all calls uniformly. The system uses probabilistic models to prioritize clustering operations on calls that deviate from established patterns, reducing overall computational complexity while maintaining high detection accuracy for threats.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12619650B2Techniques for securing computing interfaces using clustering

Publication Date: 2026.05.05 AKAMAI TECHNOLOGIES INC

AI summary

A system and method for clustering computing interface calls. A method includes: determining a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings; and clustering a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings.