API Data Exfiltration Detection via Semantic Embeddings

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Detecting data exfiltration via API calls is challenging due to slight perturbations in data, which can evade traditional security mechanisms that scan for exact matches of sensitive data.

Innovation Solution

The implementation intercepts return data from API calls, converts it into language model embeddings, and compares these embeddings to those in a database of sensitive documents. If a similarity match is found, the system blocks the return data from being sent, thereby preventing data exfiltration.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional security mechanisms scan for exact matches of sensitive data, then they can detect unmodified sensitive data, but they fail to detect perturbed or modified sensitive data

Engineering Contradiction:

Improvedetection accuracyVSAvoidability to detect modified data

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent transforms the detection approach by changing the parameter representation of data from exact text matching to semantic embeddings. By converting both sensitive data and return data into embedding vectors, the system can detect similarities even when the text content has been perturbed or modified, thus resolving the contradiction between exact match precision and adaptability to modifications.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent replaces the mechanical exact-string-matching mechanism with a semantic similarity comparison mechanism using language model embeddings. This substitution allows the system to understand semantic equivalence rather than requiring character-level identity, enabling detection of modified sensitive data while maintaining high detection accuracy.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Ease of operation

If employees modify sensitive data before external sharing, then they can avoid exact-match security mechanisms, but this creates undetected data exfiltration

Engineering Contradiction:

Improvedata sharing capabilityVSAvoiddata exfiltration risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

By changing from exact text matching to embedding-based semantic comparison, the system maintains the ability to detect sensitive data even when employees modify it for sharing. The embedding representation captures semantic meaning, so modifications that preserve meaning still trigger detection, thus reducing data exfiltration risk while allowing legitimate data sharing operations.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent introduces language model embeddings as an intermediary layer between the sensitive data and the detection mechanism. This intermediary transforms the data into a representation space where semantic similarity can be measured, allowing the system to distinguish between legitimate modifications and malicious exfiltration attempts while permitting normal data sharing workflows.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250097226A1Detecting data exfiltration via API calls using language model embeddings

Publication Date: 2025.03.20 CISCO TECHNOLOGY INC

AI summary

In one implementation, a device intercepts return data for an application programming interface call to be sent to a requester via a network. The device converts the return data into an embedding. The device determines a similarity between the embedding and one or more embeddings in a database that were generated from one or more documents deemed sensitive. The device blocks, based on the similarity, the return data from being sent via the network to the requester.