Method and system for protection of cloud-based infrastructure
Methods, systems, devices, and computer-readable media for a quarantining system are provided. A message comprising an application programming interface (API) request may be sent by a client device to a service provider system for access to a first application. The message may be received at a gateway of the service provider system. The gateway may determine that the API request is associated with potentially harmful, malicious, or otherwise unexpected activity. The message may be routed to a quarantine environment and a decoy API configured to interface with a decoy application that uses decoy information to emulate the requested first application may be identified. The API request may be modified to call the decoy API. The decoy application may be executed and a decoy response generated. The decoy response may be sent to the client device in response to the API request.
1 . A method comprising:
receiving, by a first computing device and from a second computing device, a first Application Programming Interface (API) request that complies with a first API for a first application;
determining, based on data elements extracted from the first API comprising an API request count, whether the first API request is associated with a harmful activity;
identifying, based on determining that the first API request is associated with the harmful activity, a plurality of decoy APIs for a decoy application configured to use decoy information to emulate the first application, wherein a requested API by the first API request maps to the plurality of decoy APIs corresponding to a plurality of quarantine functions;
determining, based on an API method indicating a type of action to be performed and an amount of data to be accessed, a level of risk associated with the harmful activity;
after determining the level of risk associated with the harmful activity:
based on a determination that the level of risk is a first level of risk associated with the harmful activity, selecting, from the plurality of decoy APIs, a first decoy API associated with a first quarantine function; and
based on a determination that the level of risk is a second level of risk, different from the first level of risk, associated with the harmful activity, selecting, from the plurality of decoy APIs, a second decoy API, different from the first decoy API, associated with a second quarantine function, wherein the first quarantine function is different from the second quarantine function;
modifying the first API request to invoke a decoy API selected from the first decoy API or the second decoy API, wherein the decoy API is associated with the determined one or more quarantining functions;
determining a response message output by the decoy API, wherein the response message is associated with the one or more quarantining functions that cause subsequent API requests received from the second computing device and via the first API to be quarantined; and
sending, to the second computing device, the response message.
2 . The method of claim 1 , wherein the first API request comprises an access token identifying a client account, and
wherein determining whether the first API request is associated with the harmful activity comprises:
determining that the first API request is associated with the harmful activity based on receiving information identifying one or more suspicious client accounts, wherein the one or more suspicious client accounts includes the client account.
3 . The method of claim 1 , wherein determining whether the first API request is associated with the harmful activity comprises:
providing, as input to one or more trained machine learning models, information associated with the first API request, wherein the information comprises an authentication token issued by an identity provider;
receiving, as output from the one or more trained machine learning models, an indication of a probability that the first API request is associated with the harmful activity; and
based on the probability satisfying a threshold, determining that the first API request is associated with the harmful activity.
4 . The method of claim 3 , further comprising:
training, using training data comprising a history of harmful activity associated with a plurality of different client accounts, the one or more trained machine learning models to output an indication of a probability that a particular API request is associated with the harmful activity.
5 . The method of claim 1 ,
wherein the plurality of decoy APIs are executed in a sandbox environment separate from an environment in which the first API is executed.
6 . The method of claim 1 , wherein the one or more quarantining functions comprise one or more of:
a first function configured to generate the response message comprising instructions to redirect to a decoy page associated with a request for second authentication information; or
a second function configured to generate the response message including fake data associated with the first API request.
7 . The method of claim 1 , wherein the response message output by the decoy API comprises instructions to redirect to a decoy page associated with a request for second authentication information, and
wherein the method further comprises:
receiving one or more second API requests requesting access to the decoy page and the second authentication information; and
storing information associated with the first API request and the one or more second API requests.
8 . The method of claim 1 , wherein the response message output by the decoy API is in accordance with a format specified by the first API.
9 . The method of claim 1 , further comprising blocking the first API from receiving the first API request.
10 . The method of claim 1 , wherein the data elements extracted from the first API request comprise an identification of an API called by the first API request, a time that the API is called by the first API request and the API request count associated with the API.
11 . The method of claim 1 , wherein the API method indicating the type of action to be performed comprises a data retrieval, a data creation, an update and a delete.
12 . A first computing device comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the first computing device to:
receive, from a second computing device, a first Application Programming Interface (API) request that complies with a first API for a first application;
determine, based on data elements extracted from the first API request comprising an API request count, whether the first API request is associated with a harmful activity;
identify, based on determining that the first API request is associated with the harmful activity, a plurality of decoy APIs for a decoy application configured to use decoy information to emulate the first application, wherein a requested API by the first API request maps to the plurality of decoy APIs corresponding to a plurality of quarantine functions;
determine, based on an API method indicating a type of action to be performed and an amount of data to be accessed, a level of risk associated with the harmful activity;
after determining the level of risk associated with the harmful activity:
based on a determination that the level of risk is a first level of risk associated with the harmful activity, selecting, from the plurality of decoy APIs, a first decoy API associated with a first quarantine function; and
based on a determination that the level of risk is a second level of risk, different from the first level of risk, associated with the harmful activity, selecting, from the plurality of decoy APIs, a second decoy API, different from the first decoy API, associated with a second quarantine function, wherein the first quarantine function is different from the second quarantine function;
modify the first API request to invoke a decoy API selected from the first decoy API or the second decoy API, wherein the decoy API is associated with the determined one or more quarantining functions;
determine a response message output by the decoy API, wherein the response message is associated with the one or more quarantining functions that cause subsequent API requests received from the second computing device and via the first API to be quarantined; and
send, to the second computing device, the response message.
13 . The first computing device of claim 12 , wherein the first API request comprises an access token identifying a client account, and
wherein the instructions, when executed by the at least one processor, cause the first computing device to determine whether the first API request is associated with the harmful activity by causing the first computing device to:
determine that the first API request is associated with the harmful activity based on receiving information identifying one or more suspicious client accounts, wherein the one or more suspicious client accounts includes the client account.
14 . The first computing device of claim 12 , wherein the instructions, when executed by the at least one processor, cause the first computing device to determine whether the first API request is associated with the harmful activity by causing the first computing device to:
provide, as input to one or more trained machine learning models, information associated with the first API request, wherein the information comprises an authentication token issued by an identity provider;
receive, as output from the one or more trained machine learning models, an indication of a probability that the first API request is associated with the harmful activity; and
based on the probability satisfying a threshold, determine that the first API request is associated with the harmful activity.
15 . The first computing device of claim 12 ,
wherein the plurality of decoy APIs are executed in a sandbox environment separate from an environment in which the first API is executed.
16 . The first computing device of claim 12 , wherein the one or more quarantining functions comprise one or more of:
a first function configured to generate the response message comprising a command to redirect to a decoy page associated with a request for second authentication information; or
a second function configured to generate the response message including fake data associated with the first API request.
17 . A non-transitory, computer-readable medium storing instructions that, when executed by a first computing device, cause:
receiving, from a second computing device, a first Application Programming Interface (API) request that complies with a first API for a first application;
determining based on data elements extracted from the first API request comprising an API request count, whether the first API request is associated with a harmful activity;
identifying, based on determining that the first API request is associated with the harmful activity, a plurality of decoy APIs for a decoy application configured to use decoy information to emulate the first application, wherein a requested API by the first API request maps to the plurality of decoy APIs corresponding to a plurality of quarantine functions;
determining, based on an API method indicating a type of action to be performed and an amount of data to be accessed, a level of risk associated with the harmful activity;
after determining the level of risk associated with the harmful activity:
based on a determination that the level of risk is a first level of risk associated with the harmful activity, select, from the plurality of decoy APIs, a first decoy API associated with a first quarantine function; and
based on a determination that the level of risk is a second level of risk, different from the first level of risk, associated with the harmful activity, select, from the plurality of decoy APIs, second decoy API, different from the first decoy API, associated with a second quarantine function, wherein the first quarantine function is different from the second quarantine function;
modifying the first API request to invoke a decoy API selected from the first decoy API or the second decoy API, wherein the decoy API is associated with the determined one or more quarantining functions;
determining a response message output by the decoy API, wherein the response message is associated with the one or more quarantining functions that cause subsequent API requests received from the second computing device and via the first API to be quarantined; and
sending, to the second computing device, the response message.
18 . The non-transitory, computer-readable medium of claim 17 , wherein the first API request comprises an access token identifying a client account, and
wherein the instructions, when executed by the first computing device, cause determining that the first API request is associated with the harmful activity by:
determining that the first API request is associated with the harmful activity based on receiving information identifying one or more suspicious client accounts, wherein the one or more suspicious client accounts includes the client account.
19 . The non-transitory, computer-readable medium of claim 17 , wherein the instructions, when executed by the first computing device, cause determining whether the first API request is associated with the harmful activity by:
providing, as input to one or more trained machine learning models, information associated with the first API request, wherein the information comprises an authentication token issued by an identity provider;
receiving, as output from the one or more trained machine learning models, an indication of a probability that the first API request is associated with the harmful activity; and
based on the probability satisfying a threshold, determining that the first API request is associated with the harmful activity.
20 . The non-transitory, computer-readable medium of claim 17 ,
wherein the plurality of decoy APIs are executed in a sandbox environment separate from an environment in which the first API is executed.