DYNAMIC, RUNTIME APPLICATION PROGRAMMING INTERFACE PARAMETER LABELING, FLOW PARAMETER TRACKING AND SECURITY POLICY ENFORCEMENT USING API CALL GRAPH
A multi-API security policy that covers multiple API calls of a transaction is dynamically enforced at runtime, without access to the specification or code of the APIs. Calls made to APIs of the transaction are logged, and the logs are read. Data objects used by the APIs are identified. Specific data labels are assigned to specific fields of the data objects, consistently identifying data fields of specific types. Linkages are identified between specific ones of the multiple APIs, based on the consistent identification of specific types of data fields. An API call graph is constructed, identifying a sequence of API calls made during the transaction. The call graph is used to enforce the security policy, by tracking the flow of execution of the multi-API transaction at runtime, and detecting actions that violate the security policy. Security actions are taken responsive to the detected actions that violate the policy.
1 . A method comprising:
reading a plurality of application program interface (API) call logs generated during a transaction involving a plurality of APIs to identify a set of data objects used by the plurality of APIs;
assigning a particular data label to each data field among the set of data objects to provide consistent identification of a specific data type for each data field among the set of data objects;
generating, based on the plurality of API call logs, a candidate superset graph;
growing the candidate superset graph by an iterative edge elimination process to generate an API call graph identifying a sequence in which the plurality of APIs were called and linkages between the plurality of APIs; and
using the API call graph to enforce a multi-API security policy that covers the plurality of API calls of the transaction, the multi-API security policy using the particular data labels to consistently identify the specific data type for each of the data fields among the set of data objects.
2 . The method of claim 1 , wherein generating the API call graph comprises:
identifying a set of endpoints corresponding to API services in the plurality of API call logs; and
for each of the set of endpoints, generating a linear regression model that expresses the number of API calls observed for the endpoint as a function of a number of API calls observed for all neighbors of the endpoint that are observed in the candidate superset graph.
3 . The method of claim 2 , wherein generating the API call graph further comprises:
applying parameter tracing to one or more of the set of endpoints to identify the linkages between the plurality of APIs.
4 . The method of claim 3 , wherein applying the parameter tracing comprises:
applying the parameter tracing to input/output parameters of an endpoint of the set of endpoints; or
applying the parameter tracing to input/output parameters of a chain of endpoints among the set of endpoints, wherein the input/output parameters of each of the chain of endpoints are correlated.
5 . The method of claim 1 , wherein assigning a particular data label to each of the data field among the set of data objects comprises:
programmatically analyzing the set of data objects to identify each of the data fields among the set of data objects; and
automatically assigning a particular data label to each of the identified data fields, each assigned particular data label identifying a corresponding specific data type.
6 . The method of claim 5 , wherein programmatically identifying each of the data fields among the set of data objects comprises:
programmatically identifying each of the data fields among the set of data objects using heuristics.
7 . The method of claim 5 , wherein programmatically identifying each of the data fields among the set of data objects comprises:
programmatically identifying each of the data fields among the set of data objects using a trained machine learning model.
8 . A system comprising:
a memory; and
a processor operatively coupled to the memory, the processor to:
read a plurality of application program interface (API) call logs generated during a transaction involving a plurality of APIs to identify a set of data objects used by the plurality of APIs;
assign a particular data label to each data field among the set of data objects to provide consistent identification of a specific data type for each data field among the set of data objects;
generate, based on the plurality of API call logs, a candidate superset graph;
grow the candidate superset graph by an iterative edge elimination process to generate an API call graph identifying a sequence in which the plurality of APIs were called and linkages between the plurality of APIs; and
use the API call graph to enforce a multi-API security policy that covers the plurality of API calls of the transaction, the multi-API security policy using the particular data labels to consistently identify the specific data type for each of the data fields among the set of data objects.
9 . The system of claim 8 , wherein to generate the API call graph, the processor is to:
identify a set of endpoints corresponding to API services in the plurality of API call logs; and
for each of the set of endpoints, generate a linear regression model that expresses the number of API calls observed for the endpoint as a function of a number of API calls observed for all neighbors of the endpoint that are observed in the candidate superset graph.
10 . The system of claim 9 , wherein to generate the API call graph, the processor is further to:
apply parameter tracing to one or more of the set of endpoints to identify the linkages between the plurality of APIs.
11 . The system of claim 10 , wherein to apply the parameter tracing, the processor is to:
apply the parameter tracing to input/output parameters of an endpoint of the set of endpoints; or
apply the parameter tracing to input/output parameters of a chain of endpoints among the set of endpoints, wherein the input/output parameters of each of the chain of endpoints are correlated.
12 . The system of claim 8 , wherein to assign a particular data label to each of the data field among the set of data objects, the processor is to:
programmatically analyze the set of data objects to identify each of the data fields among the set of data objects; and
automatically assign a particular data label to each of the identified data fields, each assigned particular data label identifying a corresponding specific data type.
13 . The system of claim 12 , wherein to programmatically identify each of the data fields among the set of data objects, the processor is to:
programmatically identify each of the data fields among the set of data objects using heuristics.
14 . The system of claim 12 , wherein to programmatically identify each of the data fields among the set of data objects, the processor is to:
programmatically identify each of the data fields among the set of data objects using a trained machine learning model.
15 . A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processor, cause the processor to:
read a plurality of application program interface (API) call logs generated during a transaction involving a plurality of APIs to identify a set of data objects used by the plurality of APIs;
assign a particular data label to each data field among the set of data objects to provide consistent identification of a specific data type for each data field among the set of data objects;
generate, based on the plurality of API call logs, a candidate superset graph;
grow the candidate superset graph by an iterative edge elimination process to generate an API call graph identifying a sequence in which the plurality of APIs were called and linkages between the plurality of APIs; and
use the API call graph to enforce a multi-API security policy that covers the plurality of API calls of the transaction, the multi-API security policy using the particular data labels to consistently identify the specific data type for each of the data fields among the set of data objects.
16 . The non-transitory computer-readable medium of claim 15 , wherein to generate the API call graph, the processor is to:
identify a set of endpoints corresponding to API services in the plurality of API call logs; and
for each of the set of endpoints, generate a linear regression model that expresses the number of API calls observed for the endpoint as a function of a number of API calls observed for all neighbors of the endpoint that are observed in the candidate superset graph.
17 . The non-transitory computer-readable medium of claim 16 , wherein to generate the API call graph, the processor is further to:
apply parameter tracing to one or more of the set of endpoints to identify the linkages between the plurality of APIs.
18 . The non-transitory computer-readable medium of claim 17 , wherein to apply the parameter tracing, the processor is to:
apply the parameter tracing to input/output parameters of an endpoint of the set of endpoints; or
apply the parameter tracing to input/output parameters of a chain of endpoints among the set of endpoints, wherein the input/output parameters of each of the chain of endpoints are correlated.
19 . The non-transitory computer-readable medium of claim 15 , wherein to assign a particular data label to each of the data field among the set of data objects, the processor is to:
programmatically analyze the set of data objects to identify each of the data fields among the set of data objects; and
automatically assign a particular data label to each of the identified data fields, each assigned particular data label identifying a corresponding specific data type.
20 . The non-transitory computer-readable medium of claim 19 , wherein to programmatically identify each of the data fields among the set of data objects, the processor is to:
programmatically identify each of the data fields among the set of data objects using heuristics.