API Session Anomaly Detection via Space Partitioning Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional API security models fail to detect abnormal sequences of API requests, leaving organizations vulnerable to certain types of API attacks.
Innovation Solution
The implementation of a computer-implemented method using space partitioning data structures to detect abnormal API sessions by generating embeddings of permissible API sessions, applying dimensionality reduction techniques, and storing them in a searchable data structure to identify anomalies in future API sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional API security models are used to detect API attacks, then API request volume anomalies can be detected, but abnormal sequences of API requests cannot be detected
Solution Approach 1:
The patent transforms API session sequences into embedding vectors that capture sequential patterns, transitioning from traditional volume-based detection to pattern-based detection in a new dimensional space. This allows the system to detect abnormal sequences by comparing embeddings against learned patterns from training data, thereby expanding detection capabilities beyond simple request volume analysis.
2Reliability
If sequence embedding techniques are applied to API sessions, then abnormal sequences can be detected, but computational complexity increases
Solution Approach 1:
The system pre-computes embeddings for API sessions during a training phase and stores them in a searchable data structure. When detecting anomalies in production, the system retrieves pre-computed embeddings and compares them against new session embeddings, avoiding the need to re-process entire training datasets and significantly reducing online computational complexity.
Solution Approach 2:
The patent replaces traditional mechanical comparison methods with vector space operations. Instead of comparing raw API request sequences directly, the system uses embedding vectors and similarity metrics (such as cosine similarity) to efficiently determine whether new sessions match abnormal patterns learned during training.
3Productivity
If embeddings are stored in a searchable data structure, then comparison efficiency is improved, but storage requirements increase
Solution Approach 1:
The system transforms high-dimensional API session data into fixed-size embedding vectors with controlled dimensions. By adjusting the embedding dimensionality parameter, the system can balance between preserving sufficient sequence information for accurate anomaly detection and reducing storage requirements for the searchable data structure.
Data Source
AI summary
A computer-implemented method includes receiving training data that includes a plurality of API requests from a plurality of client devices. The method includes generating a plurality of permissible API sessions based on the training data. Each of the permissible API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device. The method includes applying a sequence embedding technique to the plurality of permissible API sessions to generate a plurality of embeddings and applying a dimensionality reduction technique to the plurality of embedding to generate a plurality of compact embeddings. The method includes storing each of the compact embeddings in a space partitioning data structure at storage locations within the space partitioning data structure that are determined based on similarities between the compact embeddings.