API Transaction Risk Assessment Using Call Stacks and SBOMs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional API risk assessment methods are not granular enough and often result in false positives, as they primarily focus on network layers without sufficient visibility into the software components involved, and host/port information does not accurately represent individual APIs, especially when applications are behind a load balancer.
Innovation Solution
Analyze API transactions by mapping them to call stacks and using Software Bills of Materials (SBOMs) to identify and assess the risk associated with specific software components, incorporating risk metadata to determine if the transaction should be permitted or denied.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional API risk assessment methods focus on network layers (host/port information), then the assessment process is simple and fast, but the precision and granularity of risk assessment deteriorates leading to false positives
Solution Approach 1:
The patent segments the risk assessment process into multiple layers: network layer (host/port), application layer (API endpoints), and component layer (software bills of materials). This segmentation allows precise identification of specific software components involved in API transactions while maintaining a structured assessment framework that doesn't overwhelm system complexity.
Solution Approach 2:
The patent adds a new dimension to traditional API risk assessment by incorporating Software Bills of Materials (SBOMs) as a third assessment layer beyond the conventional network and application layers. This dimensional addition enables granular component-level risk assessment without requiring complete redesign of the existing assessment infrastructure.
2Reliability
If host and port information are used to represent APIs, then the assessment process is straightforward, but the accuracy deteriorates when applications are behind load balancers
Solution Approach 1:
The patent introduces Software Bills of Materials (SBOMs) as an intermediary that bridges the gap between network-level observations and application-component identification. SBOMs serve as a reference database that maps software components to their characteristics, enabling accurate API identification even when traditional host/port mapping fails due to load balancers or other network abstractions.
3Loss of information
If conventional penetration testing and payload analysis are used, then the assessment can be performed without detailed software component information, but the false positive rate increases
Solution Approach 1:
The patent performs preliminary action by obtaining and analyzing Software Bills of Materials (SBOMs) before conducting API risk assessment. This advance preparation creates a baseline understanding of the software components involved, their dependencies, and their security characteristics, enabling more accurate risk evaluation and reducing false positives during the actual assessment.
Data Source
AI summary
A method, computer system, and computer program product are provided for analyzing application programming interface (API) transactions for risk. A call stack is analyzed in relation to an incoming API request to identify one or more application components of the call stack that relate to the API request. A software bill of materials is obtained for each of the one or more application components. Risk metadata associated with each software bill of materials is analyzed to determine that the API request satisfies one or more risk criteria. A response to the API request is provided.