API Deception Proxy for Distributed Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security solutions for API security focus on lower network layers and are ineffective in detecting sophisticated or distributed attacks, as they do not account for multiple connections from various sources over time, leading to missed threats.
Innovation Solution
Implementing a proxy system capable of handling diverse client types and API traffic patterns, which analyzes client and server parameters to identify anomalies and malicious attempts, and employs decoy APIs to detect and mitigate attacks by routing suspicious traffic to isolated decoy servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing network security solutions monitor Ethernet frames and IP packets at lower network layers, then flow control between specific end network devices can be achieved, but sophisticated attacks and distributed attacks from multiple sources cannot be detected or identified
Solution Approach 1:
The patent transitions security monitoring from lower network layers (L2-L4) to the application layer (L7) where API interactions occur. This dimensional shift enables detection of sophisticated attacks by analyzing actual application-level traffic patterns, user behaviors, and API call sequences rather than just packet headers and network flows.
Solution Approach 2:
The system segments security monitoring into multiple independent analysis components: network layer monitoring, application layer monitoring, user behavior analysis, and attack pattern recognition. Each segment handles specific aspects of traffic analysis, allowing the system to detect distributed attacks from multiple sources by correlating patterns across different segmentation levels.
2Reliability
If current API security implementations focus on one particular attack at a time using user entered policies, then specific attack types can be addressed, but complete attacks and distributed attacks over time are not identified
Solution Approach 1:
The system implements self-service security through automated policy generation and adaptation. Instead of requiring manual user-entered policies for each attack type, the system automatically learns normal user behaviors and attack patterns from observed traffic, dynamically generates security policies, and adapts to new threats without human intervention, thereby identifying complete attacks over time.
Solution Approach 2:
The system incorporates continuous feedback loops where security policies are automatically adjusted based on observed attack patterns and user behaviors. The system monitors the effectiveness of existing policies, learns from detected attacks, and dynamically refines security rules to address evolving threats, enabling identification of distributed attacks that span multiple time periods.
3Productivity
If proxies route all client messages to API servers, then system functionality is maintained, but unauthorized access and malicious attempts cannot be detected or blocked
Solution Approach 1:
The system performs preliminary security analysis of client messages before routing them to API servers. By examining message content, user authentication, behavior patterns, and threat indicators upfront, the system can identify and block malicious attempts before they reach the servers, maintaining productivity for legitimate traffic while preventing harmful factors.
Solution Approach 2:
The proxy acts as an intelligent intermediary between clients and API servers, mediating all traffic through security analysis. This intermediary layer inspects messages, validates user behaviors, detects anomalies, and makes routing decisions based on security assessments, thereby blocking unauthorized access while allowing legitimate productivity-maintaining traffic to pass through.
Data Source
AI summary
The present invention relates to the field of networking and API/application security. In particular, the invention is directed towards methods, systems and computer program products for Application Programming Interface (API) based flow control and API based security at the application layer of the networking protocol stack. The invention additionally provides an API deception environment to protect a server backend from threats, attacks and unauthorized access.