Source Code Repository API Discovery for Inactive API Risk Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing API discovery and management systems are inadequate in identifying and securing neglected APIs due to their lack of traffic flow, leading to potential security vulnerabilities, and existing platforms rely on outdated information that may not account for newly added APIs.
Innovation Solution
An AI-based system that detects both active and inactive APIs by analyzing metadata from source code repositories, continuously updates information, and performs threat evaluations, using AI models to generate reports and provide mitigation strategies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traffic analysis is used to identify active APIs, then active APIs can be detected, but neglected and forgotten APIs cannot be identified due to lack of traffic flow
Solution Approach 1:
The patent introduces source code repository metadata as an intermediary data source to detect inactive APIs. Instead of relying solely on network traffic (which only shows active APIs), the system queries source code repositories to find API definitions, descriptions, and metadata. This intermediary approach allows detection of both active and inactive APIs by comparing repository data with actual traffic patterns.
Solution Approach 2:
The patent adds a new dimension to API detection by incorporating source code repository information alongside network traffic analysis. This multi-dimensional approach combines dynamic traffic data with static code repository metadata, enabling comprehensive detection of APIs across different states (active, inactive, deprecated) that single-dimension traffic analysis cannot detect.
2Ease of operation
If API management platforms rely on developer-provided information, then they can maintain API lists, but newly added APIs remain invisible and insufficiently secure
Solution Approach 1:
The patent implements continuous feedback loops where the system periodically queries source code repositories to detect changes, new APIs, and modifications. This automated feedback mechanism ensures API information remains current without relying on manual developer updates, addressing the currency problem while reducing manual operational burden through automation.
Solution Approach 2:
The system performs self-service by automatically querying source code repositories to discover and update API information without requiring manual developer input. The automated discovery process continuously monitors repository changes, identifies new APIs, and updates the API inventory, making the system self-maintaining and reducing reliance on developer-provided information.
3Reliability
If comprehensive API scanning is performed to identify all APIs, then security coverage is improved, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by prioritizing security assessments based on API risk categories. Instead of uniformly scanning all APIs with equal depth, the system performs comprehensive analysis on high-risk APIs (those with known vulnerabilities, deprecated status, or sensitive data access) while using lighter-weight detection methods for lower-risk APIs, optimizing the balance between security coverage and processing time.
Solution Approach 2:
The system performs preliminary filtering by first querying source code repositories to identify API definitions and metadata, then pre-categorizing APIs based on their risk profiles before conducting detailed security assessments. This preliminary action reduces the overall processing time by focusing intensive analysis only on APIs that require it, rather than uniformly scanning all APIs.
Data Source
AI summary
A system, method, and apparatus for Application Programming Interface (API) discovery that is configured to detect APIs, both active and inactive, and perform risk assessments and threat evaluations for the detected APIs. Furthermore, the system is configured to extract metadata information from a source code repository to detect APIs. In some examples, the source code repository (SCR) data can include API-specific data, non-API related data (i.e., data not related to any APIs), and metadata. The system can then assess the extracted information (e.g., API-related information) to identify vulnerabilities and conduct a threat evaluation (or threat eval). Additionally, the system is also configured to continuously and automatically update the extracted API-related information, repository metadata, etc., which can help obviate the need for manual intervention as a code base changes and APIs are created and destroyed over time.