PREVENTING SENSITIVE DATA SHARING BY USERS BASED ON API CALL ANALYSIS
A behavior analytics method for detecting and preventing different types of API based threats and attacks is disclosed. The method includes receiving one or more API calls along with associated data between the client device and the application. The API calls may be associated with the interaction of the user with the API of the application and may include information being shared. Further, the method includes classifying the data associated with the API calls by employing a LLM that may be pre-trained on general data from various public sources and may be fined-tuned based on the sensitive data to learn the specific patterns, terminologies, and context associated with the organization's proprietary information. The method also includes identifying sensitive data based on pre-defined criteria. Further, the method includes generating a report of the identified sensitive data and communicating the report to an administrator.
1 . A system for detecting and preventing sensitive data sharing by users based on Application Programming Interface (API) call analysis, the system comprising:
a receiver engine to receive one or more API calls between a client device and an application, wherein the API calls include data transmitted during user interactions with the application;
a classification engine to:
classify the data included in the API calls into one or more categories of information by employing a customized Large-Language Model (LLM), and
identify sensitive data from the classified data based on pre-defined criteria;
a report and response engine to generate a report of the identified sensitive data and communicate the generated report to an administrator; and
a solution engine to execute one or more actions based on the generated report to prevent the sharing of the identified sensitive data with the application.
2 . The system of claim 1 , wherein the customized Large-Language Model (LLM) is pre-trained on publicly available data and fine-tuned using proprietary data specific to an organization.
3 . The system of claim 2 , wherein the customized LLM is fine-tuned to recognize and classify sensitive data and proprietary information specific to the organization, including at least one of: trade secrets, business strategies and plans, financial information, customer and vendor lists, product formulas and recipes, new technologies and inventions, software and databases, internal correspondence and communications, marketing tactics and materials, negotiation strategies and pricing models, and employee information and HR records.
4 . The system of claim 1 , wherein the sensitive data identified by the classification engine includes Personal Identifiable Information (PII).
5 . The system of claim 4 , wherein the PII is further categorized into:
a common PII that is identified based on a global set of rules and regular expressions stored in the classification engine;
an industry-specific PII that is identified using industry-specific rules and a machine learning model trained on industry-specific data; and
a customer-specific PII that is identified using customer-defined rules and a machine learning model trained on customer-specific data.
6 . The system of claim 1 , wherein the classification engine is further configured to analyze fragments of information from multiple API calls to detect potential sensitive data leaks through data aggregation.
7 . The system of claim 1 , wherein the classification engine is further configured to include a customized LLM model training services for both the cloud and on-premise deployments by fine tuning one or more selected foundational LLM models with at least one of: customer specific and proprietary data, wherein the customized LLM model is further utilized inside classification engine for sensitive data detection.
8 . The system of claim 1 , wherein the solution engine is further configured to block the client device from accessing at least one of: the application and the network upon detection of sensitive data within the API calls.
9 . The system of claim 1 , wherein the solution engine is further configured to perform actions including at least one of: blocking, filtering, and altering the data before it is transmitted to the application.
10 . The system of claim 1 , wherein the administrator corresponds to authorized personnel within the organization including at least one of: a designated security manager and a system administrator.
11 . A method for detecting and preventing sensitive data sharing by users based on Application Programming Interface (API) call analysis, the method comprising:
receiving one or more API calls between a client device and an application, wherein the API calls include data transmitted during user interactions with the application;
classifying the data included in the API calls into one or more categories of information by employing a customized Large-Language Model (LLM);
identifying sensitive data from the classified data based on pre-defined criteria;
generating a report of the identified sensitive data and communicating the generated report to an administrator; and
executing one or more actions based on the generated report to prevent the sharing of the identified sensitive data with the application.
12 . The method of claim 11 , wherein the customized Large-Language Model (LLM) is pre-trained on publicly available data and fine-tuned using proprietary data specific to an organization.
13 . The method of claim 11 , wherein the customized LLM is fine-tuned to recognize and classify sensitive data and proprietary information specific to the organization, including at least one of: trade secrets, business strategies and plans, financial information, customer and vendor lists, product formulas and recipes, new technologies and inventions, software and databases, internal correspondence and communications, marketing tactics and materials, negotiation strategies and pricing models, and employee information and HR records.
14 . The method of claim 11 , wherein the sensitive data identified by the classification engine includes Personal Identifiable Information (PII).
15 . The system of claim 14 , wherein the PII is further categorized into:
a common PII that is identified based on a global set of rules and regular expressions stored in the classification engine;
an industry-specific PII that is identified using industry-specific rules and a machine learning model trained on industry-specific data; and
a customer-specific PII that is identified using customer-defined rules and a machine learning model trained on customer-specific data.
16 . The method of claim 11 , further comprises analyzing fragments of information from multiple API calls to detect potential sensitive data leaks through data aggregation.
17 . The method of claim 11 , further comprises including a customized LLM model training services for both the cloud and on-premise deployments by fine tuning one or more selected foundational LLM models with at least one of: customer specific and proprietary data, wherein the customized LLM model is further utilized inside classification engine for sensitive data detection.
18 . The method of claim 11 , further comprises blocking the client device from accessing at least one of: the application and the network upon detection of sensitive data within the API calls.
19 . The method of claim 11 , further comprises performing actions including at least one of: blocking, filtering, and altering the data before it is transmitted to the application.
20 . The method of claim 11 , wherein the administrator corresponds to authorized personnel within the organization including at least one of: a designated security manager and a system administrator.