API Tree Learning From Traffic for Malicious Request Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software developers often lack explicit documentation of API specifications, leading to error-prone APIs that can be exploited by malicious actors, resulting in attacks and overloads on web servers.
Innovation Solution
An automated framework generates and updates API trees from application traffic using tree merging, pruning, and compacting to create high-quality trees that filter out malicious and incorrect requests, leveraging cybersecurity appliances and efficient heuristics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If API specifications are not explicitly documented, then developers have flexibility in implementation, but security is compromised and APIs become error-prone
Solution Approach 1:
The system performs preliminary actions by automatically generating API specifications from observed traffic patterns before malicious attacks occur. The API tree is constructed in advance by analyzing legitimate application traffic, establishing a baseline of correct API usage that can be used to filter and block malicious requests.
Solution Approach 2:
The system implements feedback by continuously monitoring application traffic and using this information to update and refine the API specification. The generated API tree is not static but evolves based on observed traffic patterns, allowing the system to adapt to legitimate usage changes while maintaining security against known attack patterns.
2Reliability
If traditional API filtering methods are used, then security is improved, but resource overhead increases
Solution Approach 1:
The system performs the computationally intensive work of API specification analysis in advance, generating the API tree structure before traffic filtering begins. This preliminary generation phase captures the computational cost, while subsequent filtering operations simply match incoming requests against the pre-built tree structure, significantly reducing real-time resource overhead.
3Measurement precision
If API specifications are manually documented, then accuracy is improved, but time consumption increases
Solution Approach 1:
The system performs self-service by automatically generating API specifications from observed traffic patterns without requiring manual documentation. The API tree is constructed by analyzing actual application behavior, ensuring accuracy reflects real usage while eliminating the time-consuming manual documentation process entirely.
4Measurement precision
If API trees are continuously updated from traffic, then specification quality is improved, but processing overhead increases
Solution Approach 1:
The system segments the API tree into hierarchical levels and uses selective updating mechanisms. Instead of completely regenerating the entire API tree from scratch, the system updates only specific portions of the tree structure based on observed traffic patterns, reducing processing complexity while maintaining specification quality.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A cybersecurity appliance monitoring application traffic to a web application programming interface (API) dynamically updates tree structures for the web API using the application traffic. An API tree generator generates batches of API trees from paths indicated in the application traffic. An API tree merger/pruner updates the generated batches of API trees with various merging, pruning, compacting, and malicious detection operations on the generated batches of API trees. The cybersecurity appliance implements the updated API trees with an API agent that filters the application traffic prior to processing by the web API.