API Session Anomaly Detection via Sequence Embedding Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional API security models fail to detect abnormal sequences of API requests, leaving organizations vulnerable to certain types of API attacks.
Innovation Solution
An API security model that operates in both training and inference phases, using sequence embedding techniques to generate vector representations of API sessions, applying dimensionality reduction, and clustering to identify patterns of permissible sessions, thereby detecting abnormal sequences by comparing incoming API sessions against these patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional API security models are used to detect abnormal volume of API requests, then detection of high-volume attacks is improved, but detection of abnormal sequence attacks deteriorates (not detected)
Solution Approach 1:
The patent segments API security monitoring into two distinct detection dimensions: (1) volume-based detection for high-volume attacks, and (2) sequence-based detection for abnormal pattern attacks. By dividing the detection function into separate analysis streams, the system can simultaneously maintain high reliability for volume detection while adding versatility for sequence pattern detection without interference between the two detection modes.
Solution Approach 2:
The patent transitions from single-dimension volume-based detection to multi-dimensional detection by adding sequence analysis as a new dimension. The system embeds API request sequences into vector representations and performs clustering in this new dimensional space, enabling detection of attacks that manifest as abnormal sequences rather than abnormal volumes, thereby expanding attack type coverage while maintaining existing volume detection capabilities.
2Reliability
If sequence embedding and clustering techniques are applied to detect abnormal API sessions, then detection capability for sequence attacks is improved, but computational complexity increases
Solution Approach 1:
The patent applies dimensionality reduction techniques as a preliminary action before clustering to compress high-dimensional sequence embeddings into lower-dimensional representations. This preprocessing step retains the essential characteristics needed for attack detection while significantly reducing the computational complexity of subsequent clustering operations, making the system feasible for production deployment.
Solution Approach 2:
The system performs self-training by automatically learning normal API session patterns from historical data without requiring manual rule configuration. The unsupervised clustering algorithm autonomously identifies patterns and anomalies, reducing the need for complex manual setup and maintenance while achieving reliable sequence attack detection.
3Reliability
If comprehensive API session analysis is performed to detect all attack types, then security coverage is improved, but processing time increases
Solution Approach 1:
The patent segments the API security analysis into parallel processing streams: volume-based analysis and sequence-based analysis operate independently and simultaneously. This segmentation allows the system to maintain comprehensive security coverage by analyzing both dimensions while avoiding the sequential processing bottleneck that would increase overall processing time.
Solution Approach 2:
The system performs partial sequence analysis by focusing clustering computations only on sessions that exhibit potentially abnormal characteristics or by sampling a subset of sessions for detailed sequence analysis. This approach maintains high security coverage for critical threats while reducing overall processing time by avoiding exhaustive analysis of every single API session.
Data Source
AI summary
A computer-implemented method includes receiving data comprising a plurality of application programming interface (API) requests from a plurality of client devices. The method includes generating a plurality of API sessions based on the data, wherein each of the API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device. The method includes determining one or more API sessions of the plurality of API sessions generated based on the data are abnormal. Finally, the method includes performing one or more actions based on determining the one or more API sessions are abnormal.