API Endpoint Profiling for Data Leakage Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations lack visibility and security insights into data flowing through their web applications and APIs, particularly when these are on the perimeter, leading to a risk of data leakage.
Innovation Solution
Generating enriched audit logs for API traffic by analyzing API responses to create endpoint profiles that determine expected data structures and types, allowing for better detection of suspicious data leakage through the use of an application layer proxy with components like API endpoint profiler, data type detection, user detection, and enriched log generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If organizations expose web APIs publicly to enable external client access and business growth, then adaptability and business opportunities improve, but security risk and data leakage vulnerability worsen
Solution Approach 1:
The patent introduces an application layer proxy as an intermediary component between API clients and API servers. This proxy intercepts, analyzes, and monitors API traffic, providing security inspection and data leakage prevention without blocking legitimate external access. The proxy acts as a mediator that enables public API exposure while mitigating security risks through enriched audit logging and anomaly detection.
2Device complexity
If conventional security monitoring methods are used without API-specific analysis, then device complexity is reduced, but measurement precision and security insight quality worsen
Solution Approach 1:
The patent segments the security monitoring function into specialized components: an API endpoint profiler that analyzes API response structures, a data type detection component that identifies sensitive data patterns, and an enriched log generator that creates detailed audit records. This segmentation enables precise API-specific monitoring while keeping each component's complexity manageable through focused functionality.
Solution Approach 2:
The system performs preliminary action by generating API endpoint profiles in advance through analyzing API responses. These profiles contain expected data structures and types for each endpoint, which are stored and used for subsequent traffic analysis. This pre-computed knowledge base enables faster and more accurate real-time detection without requiring complex analysis during traffic inspection.
3Measurement precision
If multiple sensors are deployed to monitor API traffic comprehensively, then measurement precision improves, but device complexity and deployment difficulty worsen
Solution Approach 1:
The application layer proxy performs multiple security functions within a single device: it profiles API endpoints, detects data types, generates enriched audit logs, and monitors for data leakage patterns. This multi-functional approach consolidates what would traditionally require multiple separate sensors into one unified system, maintaining comprehensive monitoring coverage while reducing deployment complexity.
Data Source
AI summary
A method by a network device for assigning data types to data values included in application programming interface (API) responses sent by an API server to one or more API clients via an API. The method includes obtaining a first set of API responses from an endpoint of the API, generating a profile for the endpoint of the API based on analyzing the first set of API responses, where the profile of the endpoint indicates an expected structure of API responses and expected data types associated with data fields included in API responses, obtaining a second set of API responses, and using the profile of the endpoint of the API to assign data types to data values included in API responses in the second set of API responses.