API Security Feedback Loop for Cloud Anomaly Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud security approaches lack insight into how external API calls affect the underlying application layer or cloud operations, leading to inadequate protection against anomalous activities in container orchestration platforms.
Innovation Solution
Combine the views of external and internal APIs to correlate external API calls with potential anomalies in the cluster, using network security deployments like NIPS and WAF to enhance filtering by adding offending hosts, users, or payloads to deny lists based on feedback from cluster monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional cloud security controls are used, then basic security filtering is provided, but insight into how external API calls affect the underlying application layer is lost
Solution Approach 1:
The patent combines external API gateway security controls with internal cluster monitoring systems into a unified security framework. The API gateway and cluster monitoring are merged to share security information, allowing the system to maintain both basic filtering and deep insight into API call effects without proportionally increasing complexity.
Solution Approach 2:
The patent introduces a security information exchange mechanism that acts as an intermediary between the API gateway and cluster monitoring systems. This mediator enables information sharing about API call effects while maintaining system modularity, thus preserving insight without requiring direct complex integration between all security components.
2Reliability
If comprehensive monitoring of internal API activities is implemented, then detection of anomalous behaviors is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent implements pre-configured security policies and anomaly detection rules at the API gateway level before requests reach internal services. By performing preliminary security checks and anomaly pattern matching upfront, the system achieves reliable anomaly detection without requiring complex real-time analysis throughout the entire system.
Solution Approach 2:
The patent applies monitoring and analysis at selective critical points in the API call flow rather than uniformly across all internal services. By focusing monitoring resources on high-risk operations and key services, the system achieves effective anomaly detection while avoiding the complexity and resource consumption of comprehensive end-to-end monitoring.
3Reliability
If real-time security actions are taken based on anomaly detection, then protection against security threats is enhanced, but response time and system performance may be impacted
Solution Approach 1:
The patent pre-estimates the impact of potential security actions before they are executed. By calculating expected outcomes and selecting optimal actions in advance, the system can implement security responses quickly without extensive real-time computation, thus maintaining both protection effectiveness and system performance.
Solution Approach 2:
The patent dynamically adjusts security action parameters based on the severity and type of detected anomalies. By changing parameters such as blocking duration, filtering strictness, or response intensity according to threat levels, the system achieves effective protection while minimizing performance impact on normal operations.
Data Source
AI summary
Systems and methods for enhancing API security by identifying anomalous activities in a cloud environment are provided. In one embodiment, the lack of awareness of an external API with respect to how calls to the external API may affect a cluster of a container orchestration platform is addressed. For instance, the views of the external and internal APIs may be combined to achieve better API security by correlating external API calls with undesirable behavior or other anomalies arising in the internal API. Responsive to identifying such undesirable behavior, information (e.g., a host, a source IP, a user, a specific payload) associated with the offending external API call may be added to a network security feature (e.g., a deny list, an IPS, or a WAF) utilized by the external API to facilitate performance of enhanced filtering of subsequent external API calls by the external API on behalf of the internal API.