Machine Learning API Security Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying compromised or potentially compromised application programming interfaces (APIs) in large software architectures are laborious and manual, making it difficult to detect security threats in complex systems with millions of APIs, and existing automatic scanning techniques rely on human-marked-up APIs, which is time-consuming and error-prone.
Innovation Solution
A computer-implemented method using machine learning to automatically identify potentially problematic APIs, their sinks, sources, and taints, and to mark up APIs for consumption by static analysis security testing (SAST) software, improving security by analyzing complex software quickly and accurately, even for new or unanalyzed APIs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual review of APIs is performed by human experts, then security analysis accuracy is improved, but time consumption and cost increase significantly
Solution Approach 1:
The patent uses machine learning models to create virtual copies of human expert analysis capabilities. The ML models are trained on securely marked-up API data and can automatically perform security analysis, replicating the expertise of human analysts without requiring their direct involvement for each analysis task.
Solution Approach 2:
The patent replaces the manual mechanical process of human experts reviewing APIs with an automated machine learning-based system. The ML models process API data automatically, substituting human cognitive work with computational algorithms that can scale efficiently.
2Productivity
If automatic scanning of APIs is implemented, then productivity is improved, but accuracy and reliability deteriorate due to lack of expert marking
Solution Approach 1:
The patent performs preliminary action by having security experts mark-up a subset of APIs to create training data for the machine learning models. This preliminary marking of representative APIs enables the automated system to achieve high accuracy without requiring continuous expert intervention for each API analyzed.
Solution Approach 2:
The patent incorporates feedback mechanisms where the ML model's security analysis results can be reviewed and corrected by experts for a subset of cases. This feedback loop allows the model to learn from corrections and improve its accuracy over time, maintaining high reliability while scaling productivity.
3Loss of information
If all APIs are manually analyzed to understand security posture, then completeness is improved, but complexity and resource requirements increase exponentially
Solution Approach 1:
The patent segments the security analysis task by using machine learning models to handle the bulk of API analysis automatically, while reserving manual expert review for only a subset of APIs that require specialized attention. This segmentation allows comprehensive security posture understanding without requiring manual analysis of every single API.
Solution Approach 2:
The patent creates a universal machine learning-based security analysis system that can process all APIs in the software architecture. The ML models serve multiple functions including security analysis, pattern recognition, and risk assessment, replacing the need for specialized manual review processes.
Data Source
AI summary
A computer-implemented method includes obtaining, by a processor, existing security information for static application security testing (SAST). The method also includes using, by the processor, the existing security information to discover, by a machine capable of learning, new security information. The method also includes improving, by the processor, security of a computer using the new security information.