Determining permissible activity based on permissible activity rules

1. A method comprising:

monitoring, by a runtime agent executing on a server, a plurality of application programming interfaces (APIs) of an application executing on the server;

providing, by the runtime agent executing on the server, usage information over a period of time of the APIs to a rules engine;

receiving, by the runtime agent executing on the server, from the rules engine, a set of rules describing permissible activity to allow based on the usage information;

determining, by the runtime agent executing on the server, that one of the APIs has been called; and

determining, by the server, whether activity associated with the one API is permissible based on the set of rules.

2. The method of claim 1 , wherein the usage information includes API data for each time a monitored API is called, the method further comprising:

at the rules engine, partitioning respective API data into a cluster of a plurality of clusters, wherein the set of rules are based on the respective clusters.

3. The method of claim 2 , further comprising:

using density estimation on the plurality of clusters to create regular expressions,

wherein the set of rules include the respective regular expressions.

4. The method of claim 3 , further comprising:

determining whether the activity is an anomaly based on the regular expressions; and

performing a security action based on the determination of the anomaly.

5. The method of claim 2 , wherein the usage information includes queries to at least one database and the activity includes another query.

6. The method of claim 5 , wherein the clusters are partitioned using k-means clustering and are partitioned based, at least in part, on at least one of: a length of the respective query, a type of characters used in the respective query, time information associated with the respective query, and complexity of syntax in the respective query.

7. The method of claim 2 , wherein the rules engine further receives additional usage information of the APIs of the application executing at other servers via respective runtime agents and wherein the additional usage information is used to determine the set of rules.

8. The method of claim 1 , wherein the activity includes reading a file from a database.

9. The method of claim 1 , wherein the usage information includes data to be rendered to a browser and the activity includes other data to be rendered in a browser.

10. A computing system comprising:

a rules engine;

a server; and

an application to execute on the server,

wherein the server comprises at least one processor and a memory, and the memory to store instructions that, when executed by the at least one processor, cause the at least one processor to:

monitor a plurality of application programming interfaces (APIs) of the application to generate usage information of the APIs;

provide the respective usage information to the rules engine over a period of time;

receive, from the rules engine, a set of rules describing permissible activity based on the provided usage information;

determine another use of one of the APIs; and

perform a security action based on whether the other use meets the set of rules.

11. The computing system of claim 10 , wherein the rules engine further partitions the usage information into a plurality of clusters, wherein the respective rules are based on the respective clusters.

12. The computing system of claim 11 , wherein the rules engine further uses density estimation on the respective clusters to create respective regular expressions included in the respective rules.

13. The computing system of claim 12 , wherein the instructions, when executed by the at least one processor, further cause the at least one processor to determine whether the other use is an anomaly based on the respective regular expressions.

14. The computing system of claim 11 , wherein the usage information includes queries to at least one database and the other use includes another query, wherein the clusters are partitioned using k-means clustering based, at least in part, on at least one of: a length of the respective query, a type of characters used in the respective query, time information associated with the respective query, and complexity of syntax in the respective query.

15. A non-transitory machine-readable storage media storing instructions that, if executed by at least one processor of a system, cause the system to:

execute a web application;

monitor a plurality of application programming interfaces (APIs) of the application using a runtime agent to determine associated queries to a database;

provide the respective queries to a rules engine over a period of time;

receive, from the rules engine, a set of rules describing permissible activity to allow to query based, at least in part, on the queries;

determine, at the runtime agent, another query to the database; and

perform a security action based on whether the query to the database meets the set of rules,

wherein the set of rules are based on k-means clustering of the respective queries into a plurality of clusters and determining respective regular expressions from the respective clusters, wherein the set of rules include the regular expressions, and

wherein the clusters are clustered based, at least in part, on at least one of: a length of the respective queries, a type of characters used in the respective queries, time information associated with the respective queries, and complexity of syntax in the respective queries.