Methods and apparatus for analyzing sequences of application programming interface traffic to identify potential malicious actions

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive, at a first time, a first application programming interface (API) call in a sequence of API calls, the first API call addressed to an API;

receive, at a second time, a second API call in the sequence of API calls;

predict a predicted time period between the first API call and the second API call;

compare the predicted time period with an actual time period between the first time and the second time to generate a consistency score; and

perform a remedial action associated with the sequence of API calls when the consistency score does not meet a criterion.

2. The non-transitory processor-readable medium of claim 1 , further comprising code to cause the processor to:

route the first API call to a server associated with the API when the consistency score meets the criterion.

3. The non-transitory processor-readable medium of claim 1 , wherein the code to cause the processor to predict includes code to cause the processor to predict the predicted time period by providing a representation of at least one of the first API call or the second API call as an input to a machine learning model to identify the predicted time period.

4. The non-transitory processor-readable medium of claim 1 , wherein the second API call in the sequence of API calls is addressed to the API.

5. The non-transitory processor-readable medium of claim 1 , wherein the API is a first API and the second API call in the sequence of API calls is addressed to a second API different from the first API.

6. The non-transitory processor-readable medium of claim 1 , wherein the remedial action includes at least one of preventing the first API call from being sent to a server associated with the API, blocking API calls associated with a source of the first API call, setting restrictive filters associated with the source of the first API call, sending an alert to the server associated with the API, or storing activity patterns associated with the source of the first API call.

7. The non-transitory processor-readable medium of claim 1 , wherein the first API call is received from a first client device and the second API call is received from a second client device different from the first client device.

8. A method, comprising:

receiving, at an application programming interface (API) gateway and from a client device, a set of API calls having a sequence and addressed to an API from a plurality of APIs associated with the API gateway;

predicting a predicted proximity between a first API call from the set of API calls and a second API call from the set of API calls;

generating a consistency score by comparing the predicted proximity with an actual proximity in the sequence between the first API call and the second API call; and

sending the set of API calls to a server associated with the API when the consistency score meets a criterion.

9. The method of claim 8 , wherein the predicting includes:

providing as an input to a machine learning model a representation of the first API call; and

receiving, as an output from the machine learning model, an indication of the predicted proximity between the first API call and the second API call.

10. The method of claim 8 , further comprising:

preventing the set of API calls from being sent to the server when the consistency score does not meet the criterion.

11. The method of claim 8 , wherein the actual proximity is a number of API calls in the sequence between the first API call and the second API call.

12. The method of claim 8 , wherein the actual proximity is a time period in the sequence between the first API call and the second API call.

13. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive, at a proxy server and from a client device, a set of instructions having a sequence and addressed to a destination server from a plurality of destination servers associated with the proxy server;

provide as an input to a machine learning model a representation of a first instruction from the set of instructions;

receive, as an output from the machine learning model, an indication of a predicted proximity between the first instruction and a second instruction from the set of instructions;

compare the predicted proximity with an actual proximity in the sequence between the first instruction and the second instruction to generate a consistency score; and

perform a remedial action associated with the set of instructions when the consistency score does not meet a criterion.

14. The non-transitory processor-readable medium of claim 13 , further comprising code to cause the processor to:

send the set of instructions to the destination server when the consistency score meets the criterion.

15. The non-transitory processor-readable medium of claim 13 , wherein the remedial action includes at least one of preventing the set of instructions from being sent to the destination server, blocking instructions associated with the client device, setting restrictive filters associated with the client device, sending an alert to the destination server, or storing activity patterns associated with the client device.

16. The non-transitory processor-readable medium of claim 13 , wherein the actual proximity is a number of instructions in the sequence between the first instruction and the second instruction.

17. The non-transitory processor-readable medium of claim 13 , wherein the actual proximity is a time period in the sequence between the first instruction and the second instruction.

18. The non-transitory processor-readable medium of claim 13 , further comprising code to cause the processor to:

generate an n-gram representation of the first instruction to define the representation of the first instruction.

19. The non-transitory processor-readable medium of claim 13 , wherein the machine learning model includes at least one of a neural network, a decision tree model, a random forest model, a Bayesian network or a clustering model.

20. The non-transitory processor-readable medium of claim 13 , wherein the first instruction is a first application programming interface (API) call and the second instruction is a second API call.