AUTOMATIC ANOMALY DETECTION BASED ON API SESSIONS
A system identifies sessions of API behavior and uses the identified behavior to detect anomalous API requests. A session of API behavior is detected as two or more API requests that are typically received in a chronological order. The APIs in a session occur in a particular order, and have a particular API request or response that follows and/or precedes each other API request or response. Once APIs in a session are learned, incoming API requests typically associated with a session can be compared to the session to determine if they appear in an expected sequence based on the session. If an API request is not received in the sequence or chronological order according to an API session, the received request can be tagged as an anomaly. Similarly, if the received request does not include information from a previous response or request, the received API request may be an anomaly.
1 . A method for automatically detecting an anomaly based on a session of APIs received for a web service, the method comprising:
receiving, by a server from an agent stored on a remote server, an API request sent from a user device to a server API, the requests intercepted by the agent on the remote server;
comparing the received API request to a set of APIs having a preset chronological order;
detecting that the received API request is not received in an expected chronological order defined by the present chronological order; and
identifying the received API request as an anomaly based on the unexpected chronological order of the receive API request.
2 . The method of claim 1 , wherein detecting that the received API request is not received in an expected chronological order includes detecting that the received API request is not preceded by an expected preceding API request as specified in the preset chronological order.
3 . The method of claim 1 , further comprising:
receiving, by a server from an agent stored on a remote server, a subsequent API request sent from a user device to a server API; and
detecting that the received API request and the subsequent API request are not received in an expected chronological order defined by the present chronological order.
4 . The method of claim 3 , wherein the expected chronological order includes an API request that differs from the subsequent API request.
5 . The method of claim 1 , wherein the set of APIs having a preset chronological order have a first API with an output that is taken as the input of subsequent API in the set of APIs.
6 . A method for automatically detecting an anomaly based on a session of APIs received for a web service, the method comprising:
receiving, by a remote server from an agent on a server, API requests received from a remote device to the server and API responses sent to the remote devices from the server;
receiving, by the remote server from the agent on the server, subsequent API requests received from a remote device to the server;
determining, by an application on the remote server, that the subsequent API requests are related to the API responses sent to the remote devices from the server;
storing the subsequent API request and the API response as a set of APIs having a preset chronological order; and
automatically identifying subsequent requests as anomalies based on a comparison of the subsequent requests with the set of APIs having a preset chronological order.
7 . The method of claim 6 , wherein determining includes detecting that the input of the subsequent API request is based on output of the API response.
8 . The method of claim 7 , wherein a query in the input of the subsequent API request matches a parameter in the output of the API response.
9 . The method of claim 6 , wherein the set of APIs having a preset chronological order form a business transaction provided by a web service.
10 . A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for automatically detecting an anomaly based on a session of APIs received for a web service, the method comprising:
receiving, by a server from an agent stored on a remote server, an API request sent from a user device to a server API, the requests intercepted by the agent on the remote server;
comparing the received API request to a set of APIs having a preset chronological order;
detecting that the received API request is not received in an expected chronological order defined by the present chronological order; and
identifying the received API request as an anomaly based on the unexpected chronological order of the receive API request.
11 . The non-transitory computer readable storage medium of claim 10 , wherein detecting that the received API request is not received in an expected chronological order includes detecting that the received API request is not preceded by an expected preceding API request as specified in the preset chronological order.
12 . The non-transitory computer readable storage medium of claim 10 , the method further comprising:
receiving, by a server from an agent stored on a remote server, a subsequent API request sent from a user device to a server API; and
detecting that the received API request and the subsequent API request are not received in an expected chronological order defined by the present chronological order.
13 . The non-transitory computer readable storage medium of claim 12 , wherein the expected chronological order includes an API request that differs from the subsequent API request.
14 . The non-transitory computer readable storage medium of claim 10 , wherein the set of APIs having a preset chronological order have a first API with an output that is taken as the input of subsequent API in the set of APIs.
15 . A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for automatically detecting an anomaly based on a session of APIs received for a web service, the method comprising
receiving, by a remote server from an agent on a server, API requests received from a remote device to the server and API responses sent to the remote devices from the server;
receiving, by the remote server from the agent on the server, subsequent API requests received from a remote device to the server;
determining, by an application on the remote server, that the subsequent API requests are related to the API responses sent to the remote devices from the server;
storing the subsequent API request and the API response as a set of APIs having a preset chronological order; and
automatically identifying subsequent requests as anomalies based on a comparison of the subsequent requests with the set of APIs having a preset chronological order.
16 . The non-transitory computer readable storage medium of claim 15 , wherein determining includes detecting that the input of the subsequent API request is based on output of the API response.
17 . The non-transitory computer readable storage medium of claim 16 , wherein a query in the input of the subsequent API request matches a parameter in the output of the API response.
18 . The non-transitory computer readable storage medium of claim 15 , wherein the set of APIs having a preset chronological order form a business transaction provided by a web service.
19 . A system for automatically detecting an anomaly based on a session of APIs received for a web service, comprising:
a server including a memory and a processor; and
one or more modules stored in the memory and executed by the processor to receive, by a server from an agent stored on a remote server, an API request sent from a user device to a server API, the requests intercepted by the agent on the remote server, compare the received API request to a set of APIs having a preset chronological order, detect that the received API request is not received in an expected chronological order defined by the present chronological order, and identify the received API request as an anomaly based on the unexpected chronological order of the receive API request.
20 . A system for automatically detecting an anomaly based on a session of APIs received for a web service, comprising:
a server including a memory and a processor; and
one or more modules stored in the memory and executed by the processor to receive, by a remote server from an agent on a server, API requests received from a remote device to the server and API responses sent to the remote devices from the server. receive, by the remote server from the agent on the server, subsequent API requests received from a remote device to the server. determine, by an application on the remote server, that the subsequent API requests are related to the API responses sent to the remote devices from the server, store the subsequent API request and the API response as a set of APIs having a preset chronological order, and automatically identify subsequent requests as anomalies based on a comparison of the subsequent requests with the set of APIs having a preset chronological order.