Edge API Sequence Detection for Cloud Abuse Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to differentiate between legitimate and malicious API sequences, as the boundaries of sequential patterns are not readily defined, and sampling at the HTTP level is ineffective in detecting API abuse.
Innovation Solution
A method to identify and score API sequences by analyzing API request information across multiple edge compute servers in a distributed cloud computing network, using a sliding window approach and probabilistic suffix trees to rank sequences based on correlation scores, and enforce API sequence rules at the edge of the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rate limiting is applied to control API request volume, then volumetric abuse is prevented, but sequence-based attacks bypass protection
Solution Approach 1:
The system dynamically adapts protection mechanisms from static rate limiting to dynamic sequence analysis. It learns legitimate API usage patterns and adapts to detect deviations, enabling protection against both volumetric and sequence-based attacks without false positives from normal behavior variations
Solution Approach 2:
The invention changes the protection parameter from request volume (rate limiting) to request sequence patterns. By analyzing the temporal and contextual parameters of API call sequences rather than just counting requests, the system detects malicious patterns that maintain legitimate-looking volumes
2Productivity
If HTTP level sampling is used to reduce processing load, then throughput is maintained, but sequence detection accuracy is lost
Solution Approach 1:
The system moves analysis from the HTTP request level to the session/API sequence dimension. By aggregating individual requests into session-level sequences and analyzing patterns across multiple dimensions (temporal, contextual, behavioral), it achieves both throughput efficiency and detection accuracy
3Adaptability or versatility
If sequential pattern boundaries are not defined, then all API streams are analyzed, but detection precision decreases
Solution Approach 1:
The system performs preliminary learning of legitimate API sequence patterns during normal operation. By establishing baseline patterns of authorized usage sequences in advance, it can then precisely identify deviations that indicate malicious behavior without needing pre-defined boundaries for all possible patterns
Data Source
AI summary
A first compute server of a distributed cloud computing network that includes multiple compute servers receives an API request that is directed to an API endpoint. The first compute server determines an identifier that uniquely identifies a session that is associated with the API request. Based on the determined identifier, the first compute server determines which of the compute servers of the distributed cloud computing network is responsible for storing information about previous API operations associated with the determined identifier. The first compute server transmits an API sequence request to the determined compute server. In response, the first compute server receives information that specifies a time-ordered sequence of API operations associated with the determined identifier most recently observed. The first compute server may enforce a rule based at least on a sequence of at least two of the latest API operations.