System, computer program product and method for risk evaluation of API login and use
A method, system and computer program product assess risk of an unauthorized API login and mitigate damage from an unauthorized API login. The method includes collecting in a database license attributes of a user license, user profile attributes, and database content change attributes; receiving an API login request; comparing features of the API login request to at least one of the database license attributes, user profile attributes, and database content change attributes against a predetermined threshold; assessing a risk of the an unauthorized API login request based on a result of the comparison; and based on a level of the assessed risk, implemented protective action to mitigate harm that may result from an unauthorized user from accessing information or services from a computer system by way of an API.
1. A method to mitigate data from being compromised via
an unauthorized API login event, comprising: storing in a database license attributes of a user license, user profile attributes, historical login attributes, and database content change attributes; receiving an API login request;
comparing features of the API login request to at least one of the database license attributes, user profile attributes, historical login attributes, and database content change attributes against a predetermined threshold;
detecting whether the API login request is an unauthorized API login request based on a result of the comparison; and in response to the API login request being detected as an unauthorized API login request, limiting unauthorized retrieval of data from the database wherein the historical login attributes include, for a particular licensed device that makes the API login request, a client application fingerprint, the client application fingerprint includes at least one of a historical timing between API request activity, a historical order of requests, and
a combination of API request activity and order of requests, and the detecting includes calculating a historical distribution of at least one attribute of the client application fingerprint, comparing the API login request to the historical distribution to determine whether attributes of the API login request are more different than a predetermined amount from a standard statistical behavior of client application footprint, and in response to a determination that the API login request is more different than the predetermined amount, generating an alert that the API login request requires mitigation activity to avoid a potential compromise of data in the database to an unauthorized device.
2. The method of claim 1 , wherein in response to the determination that the API login request is more different than the predetermined amount, performing at least one additional step of determining that the detecting resulted in a false positive and placing an account associated with login credentials for the API login request on watch; determining that an API breach likely occurred and generating an alter message to database administrators to implement enhanced API risk mitigation steps; and locking down the account.
3. The method of claim 1 , wherein the historical login attributes include, for a particular licensed device that is making the API login request, a cadence of past data requests performed via API activity.
4. The method of claim 3 , wherein the cadence includes a recognized pattern of requested volumes over time.
5. A method to mitigate data from being compromised via an unauthorized API login event, comprising:
storing in a database license attributes of a user license, user profile attributes, historical login attributes, and database content change attributes; receiving an API login request; comparing features of the API login request to at least one of the database license attributes, user profile attributes, historical login attributes, and database content change attributes against a predetermined threshold; detecting whether the API login request is an unauthorized API login request based on a result of the comparison; and
in response to the API login request being detected as an unauthorized API login request, limiting unauthorized retrieval of data from the database, wherein the historical login attributes include, for a particular licensed device that is making the API login request, a cadence of past data requests performed via API activity, the cadence includes a recognized pattern of requested volumes over time, the detecting includes calculating a historical distribution of the cadence, comparing the API login request to the historical distribution to determine whether the API login request is more different than a predetermined amount from a standard statistical behavior of cadence, and in response to a determination that the API login request is more different than the predetermined amount, generating an alert that the API login request requires mitigation activity to avoid a potential compromise of data in the database to an unauthorized device.
6. The method of claim 5 , wherein in response to the determination that the API login request is more different than the predetermined amount, performing at least one additional step of determining that the detecting resulted in a false positive and placing an account associated with login credentials for the API login request on watch; determining that an API breach likely occurred and generating an alter message to database administrators to implement enhanced API risk mitigation steps; and locking down the account.
7. The method of claim 1 , wherein the database license attributes include, for a particular licensed device that is making the API login request, a volume of requests performed via API activity.
8. The method of claim 7 , wherein the detecting includes comparing the number of requests in the API login request to a threshold, and in response to a determination that the API login request is more different than the threshold, generating an alert that the API login request requires mitigation activity to avoid a potential compromise of data in the database to an unauthorized device.
9. The method of claim 8 , wherein the limiting includes at least one of determining that the detecting resulted in a false positive and placing an account associated with login credentials for the API login request on watch; determining that an API breach likely occurred and generating an alert message to database administrators to implement enhanced API risk mitigation steps; and locking down the account.
10. A method to mitigate data from being compromised via an unauthorized API login event, comprising: storing in a database license attributes of a user license, user profile attributes, historical login attributes, and database content change attributes;
receiving an API login request; comparing features of the API login request to at least one of the database license attributes, user profile attributes, historical login attributes, and database content change attributes against a predetermined threshold; detecting whether the API login request is an unauthorized API login request based on a result of the comparison; and in response to the API login request being detected as an unauthorized API login request, limiting unauthorized retrieval of data from the database, wherein the comparing includes comparing a number of replication requests within a predetermined period of time, the detecting includes counting a number of database unlock events triggered by API login requests, and the detecting includes detecting that the API login request is the unauthorized API login request in response to the number being exceeded within a predetermined time period or above a predetermined amount.
11. The method of claim 1 , wherein the attributes of the user license include at least one of a licensed device category, and a licensed IP address range.
12. The method of claim 1 , wherein the attributes of the user license include a licensed geography of a device that makes the API login request.
13. The method of claim 1 , wherein the attributes of the user license include a usage type for a device that makes the API login request, the usage type being one of a replication usage, proxy usage, or direct usage.
14. The method of claim 1 , wherein the attributes of the user license include a restriction on at least one of a number of data records requested, or a period of time between data requests.
15. The method of claim 1 , wherein the historical login attributes include for a particular licensed device that makes the API login request include an identification of the particular licensed device in the API login request.
16. The method of claim 5 , wherein the attributes of the user license include at least one of a licensed device category, and a licensed IP address range.
17. The method of claim 5 , wherein the attributes of the user license include a licensed geography of a device that makes the API login request.
18. The method of claim 5 , wherein the attributes of the user license include a usage type for a device that makes the API login request, the usage type being one of a replication usage, proxy usage, or direct usage.
19. The method of claim 5 , wherein the attributes of the user license include a restriction on at least one of a number of data records requested, or a period of time between data requests.
20. The method of claim 5 , wherein the historical login attributes include for a particular licensed device that makes the API login request include
an identification of the particular licensed device in the API login request.