API Intent Summarization Pipeline for SaaS Visibility

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Detecting malicious behavior from API calls is challenging due to high network traffic volume and the dynamic nature of APIs, making it difficult to identify and respond to cyberattacks and data leakage.

Innovation Solution

A generative AI pipeline employing natural language processing (NLP) to detect intents of web API calls, summarize behavior, and enhance visibility and control of user behavior, particularly in Software-as-a-Service (SaaS) environments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If traditional methods are used to monitor API calls, then network traffic volume must be fully analyzed, but detection efficiency decreases and response time increases

Engineering Contradiction:

Improvedetection efficiencyVSAvoidresponse time

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The system extracts only the essential elements from API call data - specifically the intent classification and key metadata - rather than analyzing complete network traffic. This extraction approach maintains detection accuracy while dramatically reducing processing time and resource requirements.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The monitoring system is divided into specialized components: an intent classifier that categorizes API call purposes, a metadata extractor that retrieves relevant attributes, and a summarization module that synthesizes findings. This segmentation allows parallel processing and improves overall detection efficiency.

Inventive Principle:

Principle #1Segmentation

2Measurement precision

If comprehensive analysis of all API calls is performed, then detection accuracy improves, but system complexity increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The intent classifier serves as an intermediary that bridges raw API call data and security analysis. It translates diverse API interactions into standardized intent categories, simplifying subsequent analysis while maintaining comprehensive detection coverage through structured output.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system transforms the analysis focus from examining all API call parameters to concentrating on intent classification and selected metadata parameters. This parameter transformation reduces complexity by filtering out irrelevant details while preserving critical security indicators.

Inventive Principle:

Principle #35Parameter changes

3Loss of information

If detailed monitoring of each API call is implemented, then visibility into user behavior improves, but processing overhead increases

Engineering Contradiction:

Improvevisibility of user behaviorVSAvoidprocessing overhead

Core Design Contradiction:

Loss of informationVSUse of energy by moving object

Solution Approach 1:

The system performs partial analysis by focusing only on the most relevant aspects of API calls - intent classification and key metadata - rather than examining every detail. This selective approach maintains comprehensive behavioral visibility while significantly reducing processing overhead and resource consumption.

Inventive Principle:

Principle #16Partial or excessive action

4Adaptability or versatility

If the system adapts to new and dynamic APIs, then detection capability improves, but classification accuracy may decrease

Engineering Contradiction:

Improvedetection capability for new APIsVSAvoidintent classification accuracy

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The intent classifier is pre-trained on diverse API patterns and behaviors, establishing a foundation of classification accuracy before deployment. This preliminary training enables the system to handle new and dynamic APIs effectively by applying learned patterns while maintaining high classification accuracy through robust feature extraction.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250173367A1Application programming interface intent based behavior summarization

Publication Date: 2025.05.29 PALO ALTO NETWORKS INC

AI summary

A generative artificial intelligence (AI) pipeline has been created that employs aspects of natural language processing (NLP) to detect intents of web API calls and then summarizes the behavior expressed by the collective of intents. The pipeline uses a lightweight language model for intent classification of URLs corresponding to API calls in a time interval. The pipeline associates the intent classifications with metadata corresponding to the URLs and feeds this into another lightweight language model that summarizes the intent classifications and metadata. The natural language summarization describes exhibited behavior that can be understood by a wider audience than security experts. The capability to detect intents of API calls occurring in network traffic increases visibility and control of user behavior, particularly in Software-as-a-Service (Saas) environments. Furthermore, the enhanced visibility of user behavior with the created pipeline recognizes new and previously unseen API calls from live network traffic at enterprise scale.