Using individualized APIs to block automated attacks on native apps and/or purposely exposed APIs with forced user interaction

1. A method comprising:

storing data regarding a plurality of unique end-point identifiers (UEINs) associated with a plurality of computing devices, wherein the plurality of UEINs includes a UEIN associated with a particular computing device;

receiving, from a computing device, a request comprising the UEIN and a challenge response;

based on the challenge response and the UEIN, verifying that the computing device is the particular computing device associated with the UEIN;

determining whether the UEIN is associated with a high volume of requests;

based on determining that the UEIN is associated with a high volume of requests, determining that the request is from an unauthorized user;

in response to determining that the request is from an unauthorized user, adding the UEIN to a plurality of unauthorized UEINs and blocking the request;

wherein requests received with a UEIN in the plurality of unauthorized UEINs are blocked;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 ,

wherein the request is an application programming interface (API) call corresponding to an API service;

wherein one or more requests that are not blocked are forwarded to the API service.

3. The method of claim 1 , further comprising:

prior to receiving the request, receiving a set of data from the particular computing device indicating successful performance of a non-automatable step;

in response to the set of data indicating the successful performance of the non-automatable step, associating the UEIN with the particular computing device.

4. The method of claim 1 , wherein the UEIN is generated by the particular computing device.

5. The method of claim 1 , wherein determining whether the UEIN is associated with a high volume of requests includes applying a rule for distinguishing excessive request volumes from ordinary request volumes.

6. The method of claim 1 , wherein determining whether the UEIN is associated with a high volume of requests includes determining whether requests associated with the UEIN exceed a threshold.

7. The method of claim 1 , wherein the UEIN uniquely identifies a particular instance of an application running on the particular computing device.

8. The method of claim 7 , wherein the request comprises a modified API call, generated by the particular instance of the application, that uniquely identifies the particular instance of the application running on the particular computing device.

9. The method of claim 1 , further comprising:

receiving, from a second computing device, a second request, a second UEIN, and a second challenge response, wherein the second UEIN is associated with a second specific computing device prior to receiving the second request;

based on second challenge response, verifying that the second computing device is not the second specific computing device associated with the second UEIN;

blocking the second API call associated with the second UEIN.

10. A system for identifying and blocking unauthorized requests based on request volume comprising:

one or more hardware processors;

memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to:

store data regarding a plurality of unique end-point identifiers (UEINs) associated with a plurality of computing devices, wherein the plurality of UEINs includes a UEIN associated with a particular computing device;

receive, from a computing device, a request comprising the UEIN and a challenge response;

based on the challenge response, verify that the computing device is the particular computing device associated with the UEIN;

determine whether the UEIN is associated with a high volume of requests;

based on determining that the UEIN is associated with a high volume of requests, determine that the request is from an unauthorized user;

in response to determining that the request is from an unauthorized user, add the UEIN to a plurality of unauthorized UEINs and block the request;

wherein requests received with a UEIN in the plurality of unauthorized UEINs are blocked.

11. The system of claim 10 ,

wherein the request is an application programming interface (API) call corresponding to an API service;

wherein one or more requests that are not blocked are forwarded to the API service.

12. The system of claim 10 , wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more processors to:

prior to receiving the request, receive a set of data from the particular computing device indicating successful performance of a non-automatable step;

in response to the set of data indicating the successful performance of the non-automatable step, associating the UEIN with the particular computing device.

13. The system of claim 10 , wherein the UEIN is generated by the particular computing device.

14. The system of claim 10 , wherein determining whether the UEIN is associated with a high volume of requests includes applying a rule for distinguishing excessive request volumes from ordinary request volumes.

15. The system of claim 10 , wherein determining whether the UEIN is associated with a high volume of requests includes determining whether requests associated with the UEIN exceed a threshold.

16. The system of claim 10 , wherein the UEIN uniquely identifies a particular instance of an application running on the particular computing device.

17. The system of claim 16 , wherein the request comprises a modified API call, generated by the particular instance of the application, that uniquely identifies the particular instance of the application running on the particular computing device.