API Tree Learning for Low-Overhead Malicious Request Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing software APIs are prone to malicious attacks due to discrepancies between software developers and security personnel, leading to insecure request formats that overload or compromise web servers, and existing solutions lack efficient, automated methods for generating and updating API trees to filter malicious and incorrect requests.

Innovation Solution

An automated framework generates, compacts, prunes, and merges API trees from application traffic using an API agent and tree generator, employing heuristics to create high-quality trees that filter malicious requests with low overhead, updating dynamically to maintain API security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If API specifications are manually created and maintained by security personnel, then API security can be enforced, but the process is error-prone and difficult to keep updated

Engineering Contradiction:

ImproveAPI security enforcementVSAvoidSpecification maintenance complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system automatically generates API specifications by monitoring and analyzing actual API traffic patterns. The specification maintenance is performed autonomously through continuous traffic analysis, eliminating the need for manual updates by security personnel while keeping the specifications current and accurate.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system continuously monitors API traffic and uses this feedback to automatically update and refine API specifications. This closed-loop approach ensures that specifications remain synchronized with actual usage patterns, improving reliability while reducing manual intervention.

Inventive Principle:

Principle #23Feedback

2Reliability

If comprehensive API filtering is implemented to block malicious requests, then server security is improved, but computational overhead increases

Engineering Contradiction:

ImproveServer securityVSAvoidComputational overhead

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system pre-generates API specifications from observed traffic patterns before filtering requests. By having specifications ready in advance based on historical data, the filtering process can operate efficiently without performing complex analysis on each incoming request, thus reducing computational overhead while maintaining security.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If API specifications are updated frequently to reflect new usage patterns, then adaptability improves, but system stability may be compromised

Engineering Contradiction:

ImproveSpecification adaptabilityVSAvoidSystem stability

Core Design Contradiction:

Adaptability or versatilityVSStability of the object's composition

Solution Approach 1:

The system updates API specifications at periodic intervals by analyzing accumulated traffic data. This periodic update mechanism allows the system to adapt to new usage patterns while maintaining stability during intervals between updates, balancing adaptability with system stability.

Inventive Principle:

Principle #19Periodic action

Data Source

PatentUS20260052160A1Tree-based learning of application programming interface specification

Publication Date: 2026.02.19 PALO ALTO NETWORKS INC

AI summary

A cybersecurity appliance monitoring application traffic to a web application programming interface (API) dynamically updates tree structures for the web API using the application traffic. An API tree generator generates batches of API trees from paths indicated in the application traffic. An API tree merger/pruner updates the generated batches of API trees with various merging, pruning, compacting, and malicious detection operations on the generated batches of API trees. The cybersecurity appliance implements the updated API trees with an API agent that filters the application traffic prior to processing by the web API.