Method and system for detecting volumetric attacks using multi-phase analysis of application programming interface calls
A method for detecting volumetric attacks using multi-phase analysis of API calls is disclosed. The method includes collecting API calls data having API calls to and from protected actors. The method also includes identifying a triggering suspicious time window during which a first set of actors indicate suspicious volume spikes. Further, the method includes performing an API-sequence-based user behavior clustering to identify a subset of the API attack sequence and a second set of actors. Thereafter, the method includes correlating the activities of the second set of actors over a large period of time to identify the complete API attack sequence to extract an attack signature of the complete API attack sequence for detecting potential attacks.
1 . A system for detecting volumetric attacks using multi-phase analysis of Application Programming Interface (API) calls, the system comprises:
one or more processor devices;
a receiver, using the one or more processor devices, to collect the API calls data having the collected API calls to and from protected actors;
a time-series anomaly detector, employing one or more time-series prediction models of a trend analysis, to identify a triggering suspicious time window during which a first set of actors indicate suspicious time windows of volume spikes by using an endpoint-level anomaly detection analysis;
a behavior anomaly detector to perform an API-sequence-based user behavior clustering, once the suspicious time window is identified, to identify a subset of an API attack sequence and a second set of actors; and
a cross-actor correlator to:
correlate activities of the second set of actors by zooming out to a large period of time window to identify a complete API attack sequence; and
extract an attack signature of the identified complete API attack sequence based on correlated activities from the cross-actor correlator, such that the attack signature can be utilized for detecting potential attacks at an early attack phase.
2 . The system as claimed in claim 1 , wherein the first set of actors includes at least one of: a user device, a network service, a network device, and an API endpoint.
3 . The system as claimed in claim 1 , wherein the second set of actors are larger than the first set of actors and have similar behavior as the first set of actors.
4 . The system as claimed in claim 1 , wherein the suspicious volume may be associated with at least one of: number of calls, number of users, number of failures, and number of data access requests.
5 . The system as claimed in claim 1 , wherein the API calls data further includes at least one of: a total number of API calls, total number of successful vs failed API calls, total number of unique source users, and total number of unique sources countries.
6 . The system as claimed in claim 1 , wherein the triggering suspicious time window is identified by at least one of: historical data analysis, prediction of future values, residual analysis, threshold-based analysis, statistical analysis, seasonality and trend analysis, and ensemble analysis.
7 . The system as claimed in claim 1 , wherein the one or more time-series prediction models utilize feedback loops for retraining, such that anomalies detected in real-time are provided as input for retraining to evolve data patterns and reducing false alarms over time.
8 . The system as claimed in claim 1 , wherein the one or more time-series prediction models further remove anomalies pertaining to business context of a user that are determined by capturing one or more user feedback and manually excluding them from baseline to avoid generating similar detections.
9 . The system as claimed in claim 1 , wherein the triggering suspicious time window identified based on a minimal baseline window size that is selected based at least on one of: stability of baseline patterns and API endpoint access patterns.
10 . The system as claimed in claim 1 , wherein the one or more time-series prediction models include at least one of: Autoregressive Integrated Moving Average (ARIMA), Long Term Short Memory (LTSM), and Prophet Forecasting Model.
11 . The system as claimed in claim 1 , wherein the subset of the API attack sequence and the second set of actors are identified by utilizing a volume and frequency-based peer anomaly detection technique.
12 . The system as claimed in claim 1 , wherein the cross-actor correlator correlates the activities of the second set of actors by using different dimensions of behavior along with the API calls.
13 . A method for detecting volumetric attacks using multi-phase analysis of Application Programming Interface (API) calls, the method comprises:
collecting the API calls data having collected API calls to and from protected actors;
identifying, by employing one or more time-series prediction models of a trend analysis, a triggering suspicious time window during which a first set of actors indicate suspicious time windows of volume spikes by using an endpoint-level anomaly detection analysis;
performing an API-sequence-based user behavior clustering, once the suspicious time window is identified, to identify a subset of the API attack sequence and a second set of actors;
correlating activities of the second set of actors by zooming out to a large period of time window to identify a complete API attack sequence; and
extracting an attack signature of the identified complete API attack sequence based on correlated activities from the cross-actor correlator, such that the attack signature can be utilized for detecting potential attacks at an early attack phase.
14 . The method as claimed in claim 13 ,
wherein the first set of actors includes at least one of: a user device, a network service, a network device, and an API endpoint;
wherein the second set of actors are larger than the first set of actors and have similar behavior as the first set of actors;
wherein the suspicious volume may be associated with at least one of: number of calls, number of users, number of failures, and number of data access requests;
wherein the API calls data further includes at least one of: a total number of API calls, total number of successful vs failed API calls, total number of unique source users, and total number of unique sources countries.
15 . The method as claimed in claim 13 , wherein the triggering suspicious time window is identified by at least one of: historical data analysis, prediction of future values, residual analysis, threshold-based analysis, statistical analysis, seasonality and trend analysis, and ensemble analysis.
16 . The method as claimed in claim 13 , further comprises utilizing feedback loops for retraining, such that anomalies detected in real-time are provided as input for retraining to evolve data patterns and reducing false alarms over time.
17 . The method as claimed in claim 13 , further comprises removing anomalies pertaining to business context of a user that are determined by capturing one or more user feedback and manually excluding them from baseline to avoid generating similar detections.
18 . The method as claimed in claim 13 , wherein the triggering suspicious time window identified based on a minimal baseline window size that is selected based at least on one of: stability of baseline patterns and API endpoint access patterns.
19 . The method as claimed in claim 13 , wherein the one or more time-series prediction models include at least one of: Autoregressive Integrated Moving Average (ARIMA), Long Term Short Memory (LTSM), and Prophet Forecasting Model.
20 . The method as claimed in claim 13 , further comprises correlating the activities of the second set of actors by using different dimensions of behavior along with the API calls.