Apparatus for detecting anomaly and operating method for the same

1. An apparatus for detecting an anomaly, the apparatus comprising:

a communication interface;

a memory including one or more instructions; and

a processor configured to execute the one or more instructions to:

receive, through the communication interface, one or more application programming interface (API) calls corresponding to one or more applications from a terminal device,

identify whether the anomaly has occurred in a first pattern of data acquired from the received API calls, by using a second pattern of data stored in a database, and

based on identifying that the anomaly has occurred, transmit, through the communication interface, a notification indicating that the anomaly has occurred to the terminal device,

wherein the first pattern of data comprises a first relative entropy matrix of API call data, and the second pattern of data comprises a second relative entropy matrix of API call data, and

wherein the processor identifies whether the anomaly has occurred in the first pattern of data, based on a statistical comparison of the first relative entropy matrix and the second relative entropy matrix.

2. The apparatus of claim 1 , wherein the processor is further configured to:

identify whether the first pattern of the data acquired from the received API calls deviates from the second pattern of the data stored in the database; and

identify that the anomaly has occurred based on identifying that the first pattern of the data acquired from the received API calls deviates from the second pattern of the data stored in the database.

3. The apparatus of claim 1 , wherein the processor is further configured to:

perform preprocessing;

extract a feature;

perform learning through a learning model; and

make a prediction to determine whether the anomaly has occurred.

4. The apparatus of claim 1 , wherein the processor is further configured to:

receive the one or more API calls generated by a transactional application from the terminal device; and

identify whether the anomaly has occurred, by using the first pattern of the data acquired from the received API calls and a transactional data pattern stored in the database.

5. The apparatus of claim 4 , wherein the transactional application is at least one of an e-commerce application, a bank transaction application, and a coupon reward application.

6. The apparatus of claim 1 , wherein the processor is further configured to:

receive the one or more API calls generated by a sensing application from the terminal device; and

identify whether the anomaly has occurred, by using the first pattern of the data acquired from the received API calls and a sensing data pattern stored in the database.

7. The apparatus of claim 6 , wherein the sensing application is at least one of an Internet of things (IoT) application, a healthcare application, and a location information detection application.

8. The apparatus of claim 1 , wherein, when the one or more applications are transactional applications, the data acquired from the API calls is the API calls; and

wherein, when the one or more applications are sensing applications, the data acquired from the API calls is signal data transferred through the API calls.

9. An operating method of an apparatus for detecting an anomaly, the operating method comprising:

receiving, through a communication interface of the apparatus, one or more application programming interface (API) calls corresponding to one or more applications from a terminal device;

identifying whether the anomaly has occurred in a first pattern of data acquired from the received API calls, by using a second pattern of data stored in a database; and

transmitting, through the communication interface, a notification indicating that the anomaly has occurred to the terminal device based on identifying that the anomaly has occurred,

wherein the first pattern of data includes a first relative entropy matrix of API call data, and the second pattern of data includes a second relative entropy matrix of API call data, and

wherein the identifying comprises identifying whether the anomaly has occurred in the first pattern of data, based on a statistical comparison of the first relative entropy matrix and the second relative entropy matrix.

10. The operating method of claim 9 , wherein the identifying whether the anomaly has occurred comprises:

identifying whether the first pattern of the data acquired from the received API calls deviates from the second pattern of the data stored in the database; and

identifying that the first pattern of the data acquired from the received API calls deviates from the second pattern of the data stored in the database, identifying that the anomaly has occurred.

11. The operating method of claim 9 , wherein the identifying whether the anomaly has occurred comprises performing preprocessing, extracting a feature, performing learning through a learning model, and making a prediction to identify whether the anomaly has occurred.

12. The operating method of claim 9 , wherein the notification is transmitted via at least one of e-mail and short message service (SMS).

13. The operating method of claim 9 , wherein the one or more API calls are generated by a transactional application; and

wherein the identifying of whether the anomaly has occurred comprises identifying whether the anomaly has occurred, by using the first pattern of the data acquired from the received API calls and a transactional data pattern stored in the database.

14. The operating method of claim 13 , wherein the transactional application is at least one of an e-commerce application, a bank transaction application, and a coupon reward application.

15. The operating method of claim 9 , wherein the one or more API calls are generated by a sensing application from the terminal device, and

wherein the identifying whether the anomaly has occurred comprises identifying whether the anomaly has occurred, by using the first pattern of the data acquired from the received API calls and a sensing data pattern stored in the database.

16. The operating method of claim 15 , wherein the sensing application is at least one of an Internet of things (IoT) application, a healthcare application, and a location information detection application.

17. The operating method of claim 9 , wherein, when the one or more applications are transactional applications, the data acquired from the API calls is the API calls; and

wherein, when the one or more applications are sensing applications, the data acquired from the API calls is signal data transferred through the API calls.

18. A non-transitory computer-readable recording medium having recorded thereon a program, which, when executed by a computer, performs operations for detecting an anomaly comprising:

receiving, through a communication interface of the computer, one or more application programming interface (API) calls corresponding to one or more applications from a terminal device;

identifying whether the anomaly has occurred in a first pattern of data acquired from the received API calls, by using a second pattern of data stored in a database; and

transmitting, through the communication interface, a notification indicating that the anomaly has occurred to the terminal device based on identifying that the anomaly has occurred,

wherein the first pattern of data includes a first relative entropy matrix of API call data, and the second pattern of data includes a second relative entropy matrix of API call data, and

wherein the identifying comprises identifying whether the anomaly has occurred in the first pattern of data, based on a statistical comparison of the first relative entropy matrix and the second relative entropy matrix.

19. The apparatus of claim 1 , wherein the processor is further configured to generate an anomaly detection report for a plurality of users indicating a probability of an activity of each user being anomalous.