Dynamic API Specification Trees for Malicious Request Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing software APIs are prone to malicious attacks due to discrepancies between software developers and security personnel, leading to insecure request formats that can overload or compromise web servers, and existing solutions lack efficient, automated methods for generating and updating API specifications to filter out malicious and incorrect requests.

Innovation Solution

An automated framework that generates, compacts, prunes, and merges API trees from application traffic to create dynamic API specifications, using heuristics tailored to known behavior for efficient filtering of malicious and incorrect requests, maintaining high-quality trees with low overhead.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If automated methods are used to generate and update API specifications from application traffic, then the efficiency and accuracy of filtering malicious requests is improved, but the device complexity and computational overhead increase

Engineering Contradiction:

Improveefficiency of filtering malicious requestsVSAvoidcomplexity of automated framework

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system segments the API specification into a tree structure with nodes representing API endpoints, parameters, and request formats. This segmentation allows the complex task of analyzing application traffic to be divided into manageable units, where each node can be independently generated and updated from observed traffic patterns, reducing the overall computational complexity while maintaining filtering efficiency

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary actions by pre-generating API specification trees from historical application traffic before malicious attacks occur. These pre-generated trees serve as baseline specifications that can quickly filter suspicious requests in real-time, improving the efficiency of malicious request detection without requiring complex real-time analysis of every incoming request

Inventive Principle:

Principle #10Preliminary action

2Manufacturing precision

If manual methods are used to create API specifications, then the device complexity is reduced, but the manufacturing precision and reliability of security filtering deteriorate

Engineering Contradiction:

Improveaccuracy of API specificationVSAvoidcomplexity of automated generation system

Core Design Contradiction:

Manufacturing precisionVSDevice complexity

Solution Approach 1:

The system implements feedback mechanisms where the generated API specification trees are continuously validated against actual application traffic. Discrepancies between the specification and observed traffic patterns trigger automated updates to the tree structure, ensuring high manufacturing precision of the API specification while using feedback loops to manage the complexity of the automated generation process

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system enables self-service by allowing the API specification to automatically generate and update itself from observed application traffic without requiring manual intervention. The tree structure autonomously adapts to changes in API behavior by learning from traffic patterns, achieving high accuracy while the self-organizing nature of the system manages its own complexity

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If existing API specifications are used without dynamic updates, then the ease of operation is maintained, but the adaptability to new attack vectors and API changes deteriorates

Engineering Contradiction:

Improveability to detect new malicious requestsVSAvoidsimplicity of specification maintenance

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The system applies dynamics by making the API specification tree adaptive and mutable rather than static. The tree structure dynamically evolves by adding, removing, or modifying nodes based on changes in application traffic patterns, enabling the system to adapt to new attack vectors and API changes while the automated nature of these updates maintains ease of operation

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS12470568B2Tree-based learning of application programming interface specification

Publication Date: 2025.11.11 PALO ALTO NETWORKS INC

AI summary

A cybersecurity appliance monitoring application traffic to a web application programming interface (API) dynamically updates tree structures for the web API using the application traffic. An API tree generator generates batches of API trees from paths indicated in the application traffic. An API tree merger/pruner updates the generated batches of API trees with various merging, pruning, compacting, and malicious detection operations on the generated batches of API trees. The cybersecurity appliance implements the updated API trees with an API agent that filters the application traffic prior to processing by the web API.