API Traffic Anomaly Detection via Session Correlation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security solutions for web-based applications are inadequate in detecting anomalies in application program interfaces (APIs), as they often rely on pattern recognition rather than understanding the specifics of API operations, similar to outdated antivirus solutions based on file signatures, and fail to identify modern targeted attacks.
Innovation Solution
The system intercepts and analyzes API traffic, identifies correlations between API components, and uses these correlations to detect anomalous behaviors by generating and comparing correlation data across user sessions, enabling real-time anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern recognition methods are used for security detection, then the system is simple to implement, but it cannot detect modern targeted API attacks
Solution Approach 1:
The system performs preliminary analysis of API traffic to establish baseline correlation data before detecting anomalies. By pre-processing and storing correlation patterns from normal API interactions, the system prepares detection rules in advance, enabling reliable anomaly detection without requiring complex real-time analysis during actual security events.
Solution Approach 2:
The patent introduces correlation data as an intermediary layer between raw API traffic and anomaly detection. This intermediary structure captures relationships between API calls, parameters, and user sessions, allowing the system to detect sophisticated attacks by comparing against established correlation patterns without directly analyzing complex attack signatures.
2Measurement precision
If correlation data is collected and stored for anomaly detection, then detection accuracy improves, but data storage requirements increase
Solution Approach 1:
The system extracts only the essential correlation elements from API traffic, such as relationships between specific API calls, parameter patterns, and user session behaviors. By selectively extracting and storing only these critical correlation data points rather than complete traffic logs, the system achieves high detection precision while minimizing storage requirements.
Solution Approach 2:
The patent transforms raw API traffic data into condensed correlation parameters that represent the essential relationships in a compact form. By changing the data representation from detailed traffic logs to abstracted correlation patterns, the system maintains detection precision while significantly reducing the quantity of stored data.
3Speed
If real-time API traffic analysis is performed, then anomaly detection speed improves, but processing load increases
Solution Approach 1:
The system performs preliminary processing to establish correlation baselines from historical API traffic before real-time detection begins. This pre-computation of correlation patterns allows the system to operate efficiently during real-time analysis, comparing incoming traffic against pre-established rules rather than performing complex analysis on every request, thus reducing processing energy while maintaining detection speed.
Solution Approach 2:
The patent applies partial analysis by focusing computational resources only on identifying and analyzing correlation patterns that deviate from the baseline, rather than processing every aspect of each API request. This selective analysis approach maintains fast detection speed while significantly reducing overall processing energy consumption by avoiding exhaustive examination of normal, non-suspicious traffic.
Data Source
AI summary
A system that intercepts and analyzes application program interface (API) traffic, identifies correlations between components of API traffic, and uses those correlations to detect anomalous behaviors. API traffic, including requests and responses, is intercepted and analyzed to identify correlations in the API traffic. The correlations may be based on API traffic and can include a sequence of APIs, parameters passed between earlier and subsequent APIs, user roles within a user session and APIs accessed by the user roles, and other correlations. Correlation data for user sessions is generated and stored, and later compared to subsequent user session traffic. If the subsequent user session traffic does not comply with the correlations detected in earlier user sessions, an anomaly may be triggered.