Automatic generation of an API interface description
A system analyzes APIs and automatically generates an API description for the system. The APIs each have an API behavior, which can include a request and a response. Each request and response can have different components. The present system automatically learns characteristics and patterns in the request and response components. As clients engage an API, the component data in the requests and responses for the API are monitored and distributions for various characteristics are determined. Once the API description is automatically generated by the system, the API description can be compared to incoming API requests to identify anomalies that can be associated with users without proper credentials.
1. A method for automatically determining a description of interfaces to APIs for a web service, the method comprising:
receiving, by a server from an agent stored on a remote server, API requests sent from a plurality of users to server APIs, the requests intercepted by the agent on the remote server;
automatically detecting components of the API requests by an application on the server, the components including URL parameters, API request header data, and API request body data;
automatically learning a correct set of request components by the application based on the API components detected by the application; and
detecting anomaly requests to the server API based on comparing subsequent server API requests to the learned correct set of request components,
wherein detecting anomaly requests includes:
detecting a set of multiple API requests having request components that differs from the learned correct set of request components,
detecting that the set of multiple API requests is received from a number of users that does not satisfy a threshold, and
determining that the set of multiple API requests is an anomaly based on the difference from the learned correct set of request components and the number of users not satisfying the threshold.
2. The method of claim 1 , wherein automatically learning includes determine the occurrences of each component, wherein the correct set of request components is based on the highest number of occurrences for a particular component.
3. The method of claim 2 , further including generating a histogram based on the occurrences of each request component.
4. The method of claim 1 , further comprising identifying an API description based on the learned correct set of components.
5. The method of claim 4 , further comprising:
receiving, by the server from the agent stored on the remote server, subsequent API requests sent from a plurality of users to server APIs, the requests intercepted by the agent on the remote server; and
updating the learned correct set of request components by the application based on the API components detected in the in the subsequent API requests by the application.
6. The method of claim 1 , wherein the automatically detected components include a special character distribution in an API path parameter.
7. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for automatically determining a description of interfaces to APIs for a web service, the method comprising:
receiving, by a server from an agent stored on a remote server, API requests sent from a plurality of users to server APIs, the requests intercepted by the agent on the remote server;
automatically detecting components of the API requests by an application on the server, the components including URL parameters, API request header data, and API request body data;
automatically learning a correct set of request components by the application based on the API components detected by the application; and
detecting anomaly requests to the server API based on comparing subsequent server API requests to the learned correct set of request components,
wherein detecting anomaly requests includes:
detecting a set of multiple API requests having request components that differs from the learned correct set of request components,
detecting that the set of multiple API requests is received from a number of users that does not satisfy a threshold, and
determining that the set of multiple API requests is an anomaly based on the difference from the learned correct set of request components and the number of users not satisfying the threshold.
8. The non-transitory computer readable storage medium of claim of claim 7 , wherein automatically learning includes determine the occurrences of each component, wherein the correct set of request components is based on the highest number of occurrences for a particular component.
9. The non-transitory computer readable storage medium of claim of claim 8 , further including generating a histogram based on the occurrences of each request component.
10. The non-transitory computer readable storage medium of claim of claim 7 , further comprising identifying an API description based on the learned correct set of components.
11. The non-transitory computer readable storage medium of claim of claim 10 , further comprising:
receiving, by the server from the agent stored on the remote server, subsequent API requests sent from a plurality of users to server APIs, the requests intercepted by the agent on the remote server; and
updating the learned correct set of request components by the application based on the API components detected in the subsequent API requests by the application.
12. The non-transitory computer readable storage medium of claim of claim 7 , wherein the automatically detected components include a special character distribution in an API path parameter.
13. A system for generating application program interfaces (APIs) from uniform resource locator (URL) information, comprising:
a server including a memory and a processor; and
one or more modules stored in the memory and executed by the processor to receive, by a server from an agent stored on a remote server, API requests sent from a plurality of users to server APIs, the requests intercepted by the agent on the remote server, automatically detect components of the API requests by an application on the server, the components including URL parameters, API request header data, and API request body data, automatically learn a correct set of request components by the application based on the API components detected by the application, and detect anomaly requests to the server API based on comparing subsequent server API requests to the learned correct set of request components, wherein the one or more modules are further executable to detect a set of multiple API requests having request components that differs from the learned correct set of request components, detect that the set of multiple API requests is received from a number of users that does not satisfy a threshold, and determine that the set of multiple API requests is an anomaly based on the difference from the learned correct set of request components and the number of users not satisfying the threshold.
14. The system of claim 13 , wherein automatically learning includes determine the occurrences of each component, wherein the correct set of request components is based on the highest number of occurrences for a particular component.
15. The method of claim 14 , further including generating a histogram based on the occurrences of each request component.
16. The method of claim 13 , further comprising identifying an API description based on the learned correct set of components.
17. The method of claim 16 , further comprising:
receiving, by the server from the agent stored on the remote server, subsequent API requests sent from a plurality of users to server APIs, the requests intercepted by the agent on the remote server; and
updating the learned correct set of request components by the application based on the API components detected in the subsequent API requests by the application.
18. The method of claim 13 , wherein the automatically detected components include a special character distribution in an API path parameter.