API Attack Surface Detection Using DNS and Targeted Crawling

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security systems struggle to effectively defend against malicious actors exploiting Application Programming Interface (API) attack surfaces due to the large and increasing number of APIs, making it difficult to identify and secure these entry points.

Innovation Solution

A method and apparatus that process Domain Name System (DNS) data to determine possible API servers and Uniform Resource Identifier (URI) paths, perform an API-specific crawl to identify actual API endpoints, and analyze responses to uncover API attack surfaces, generating a dashboard to visualize and alert on security risks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If security systems employ traditional monitoring methods, then they can detect known threats, but they cannot effectively identify the large and increasing number of APIs and their attack surfaces

Engineering Contradiction:

ImproveAPI attack surface detection capabilityVSAvoidsecurity system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent introduces DNS data as an intermediary to indirectly identify API servers and endpoints. Instead of directly monitoring APIs, the system uses DNS query and response data to infer the existence and locations of API servers, URIs, and endpoints. This intermediary approach enables detection of unknown APIs without requiring direct API interaction or complex analysis of API traffic patterns.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical security monitoring approaches (direct traffic analysis, endpoint scanning) with an information-processing system that analyzes DNS data. By substituting DNS data analysis for direct API probing and monitoring, the system achieves comprehensive API attack surface detection with reduced operational complexity and resource requirements.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If security systems attempt to monitor all possible API endpoints, then they may identify actual API attack surfaces, but the process becomes inefficient and resource-intensive

Engineering Contradiction:

ImproveAPI security coverageVSAvoidsecurity detection efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent performs preliminary actions by collecting and processing DNS data before conducting API security analysis. By pre-identifying potential API servers, URIs, and endpoints through DNS query analysis, the system creates a targeted list of candidates for security assessment. This preliminary filtering eliminates the need to monitor all possible endpoints, significantly improving detection efficiency while maintaining comprehensive security coverage.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent segments the API attack surface detection process into distinct phases: DNS data collection, API server identification, URI path determination, and endpoint validation. This segmentation allows each phase to focus on specific tasks using appropriate methods, improving overall efficiency. The segmented approach enables parallel processing and reduces resource requirements compared to monolithic scanning approaches.

Inventive Principle:

Principle #1Segmentation

3Loss of information

If security systems lack knowledge of API existence, then they cannot defend against API-based attacks, but traditional methods fail to discover hidden or undocumented APIs

Engineering Contradiction:

ImproveAPI visibilityVSAvoidAPI discovery difficulty

Core Design Contradiction:

Loss of informationVSDifficulty of detecting and measuring

Solution Approach 1:

The patent uses DNS data as an intermediary to reveal hidden API servers and endpoints that would be invisible to traditional monitoring systems. DNS queries and responses contain information about domain names, subdomains, and resource locations that indirectly expose the existence of APIs without requiring direct interaction with the APIs themselves. This intermediary approach uncovers both documented and undocumented APIs.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements feedback loops where DNS data analysis results feed into API endpoint identification, which then informs security assessment priorities. The system continuously refines its understanding of the API attack surface by processing new DNS data and validating findings through targeted API requests. This feedback mechanism ensures comprehensive API visibility while adapting to changing infrastructure.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12476995B2Automatic detection of application programming interface (API) attack surfaces

Publication Date: 2025.11.18 CEQUENCE SECURITY INC

AI summary

Various embodiments facilitate uncovering an Application Programming Interface (API) attack surface for an organization. In some examples, an apparatus comprises storage media, a processing system, and program instructions stored on the storage media. The apparatus processes Domain Name System (DNS) data to determine a set of possible API servers. The apparatus determines a set of possible Uniform Resource Identifier (URI) paths that may lead to one or more actual API endpoints. The apparatus joins the set of possible API servers with the set of possible URI paths to generate a set of possible API Uniform Resource Locators (URLs). The apparatus performs an API-specific crawl of the set of possible API URLs by submitting API requests to the set of possible API URLs and analyzing responses to determine the one or more actual API endpoints and one or more actual API servers of the set of possible API servers.