Detecting device masquerading in application programming interface (API) transactions
This disclosure describes a technique to determine whether a client computing device accessing an API is masquerading its device type (i.e., pretending to be a device that it is not). To this end, and according to this disclosure, the client performs certain processing requested by the server to reveal its actual processing capabilities and thereby its true device type, whereupon—once the server learns the true nature of the client device—it can take appropriate actions to mitigate or prevent further damage. To this end, during the API transaction the server returns information to the client device that causes the client device to perform certain computations or actions. The resulting activity is captured on the client computing and then transmitted back to the server, which then analyzes the data to inform its decision about the true client device type. Thus, when the server detects the true client device type (as opposed to the device type that the device is masquerading to be), it can take appropriate action to defend the site.
1. An apparatus, comprising:
one or more hardware processors;
computer memory holding computer program code executed by the one or more hardware processors, wherein the computer program code is configured to:
responsive to receipt of a request associated with an automated interaction initiated by a requesting client and directed to a server, return to the requesting client information that manipulates the client to perform client-side computations;
responsive to receipt of data collected by the requesting client as a result of performing the client-side computations, t-e-analyze the data to determine whether the data represents an expected behavior of the requesting client, the data being analyzed by applying one of: machine learning, a probabilistic computation, and a statistical computation; and
based on a determination that the data does not represent an expected behavior of the requesting client, take a blocking or mitigation action with respect to the request.
2. The apparatus as described in claim 1 wherein the automated interaction is one of: an application programming interface (API) transaction, an operation triggered by client-side scripting code, an operation associated with an HTTP request for a particular resource, and an Asynchronous JavaScript and XML (AJAX) request-response interaction.
3. The apparatus as described in claim 1 wherein the computer program code is further configured to receive a device type, the device type being received in a Hypertext Transfer Protocol (HTTP) request header.
4. The apparatus as described in claim 3 wherein the computer program code is further configured to determine whether the client is masquerading the device type.
5. The apparatus as described in claim 1 wherein the apparatus is configured in association with an overlay network.
6. The apparatus as described in claim 1 wherein the client-side computations comprise one of: a time taken by a central processing unit (CPU) to run a given mathematical operation or combination of operations, and a time taken by a graphics processing unit (GPU) computation.
7. The apparatus as described in claim 1 wherein the client-side computations comprise a number of operations carried out by a processing unit within a given time budget as specified in the information.
8. The apparatus as described in claim 1 wherein the apparatus is associated with a bot detection system.
9. The apparatus as described in claim 1 wherein the server is one of: a web server, and a mobile application server.