US 11,900,179 B1Granted

Detection of abnormal application programming interface (API) sessions including a sequence of API requests

AssigneeIntuit Inc.

InventorsItsik Yizhak Mantin, Laetitia Kahn, Sapir Porat, Yaron Sheffer

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computer-implemented method includes receiving training data including a plurality of API requests from a plurality of client devices. The method includes generating a plurality of permissible API sessions based on the training data. The method includes applying a sequence embedding technique to the plurality of permissible API sessions to generate a plurality of embeddings. The method includes applying a dimensionality reduction technique to the plurality of embeddings to generate a plurality of compact embeddings. The method includes applying a clustering technique to the plurality of compact embeddings to determine a plurality of different clusters of the compact embeddings. The method includes generating a plurality of patterns based on the plurality of different clusters. Each of the plurality of patterns is descriptive of permissible API sessions associated with a corresponding cluster of the plurality of different clusters.

Claims17

Dependent claims

A computer-implemented method comprising:

receiving training data comprising a plurality of application programming interface (API) requests from a plurality of client devices;
generating a plurality of permissible API sessions based on the training data, wherein each of the plurality of permissible API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device;
applying a sequence embedding technique to the plurality of permissible API sessions to generate a plurality of embeddings, wherein each of the embeddings is representative of a corresponding permissible API session of the plurality of permissible API sessions;
applying a dimensionality reduction technique to the plurality of embeddings to generate a plurality of compact embeddings;
applying a clustering technique to the plurality of compact embeddings to determine a plurality of different clusters of the compact embeddings;
and
generating a plurality of patterns based on the plurality of different clusters, wherein each of the plurality of patterns is descriptive of permissible API sessions associated with a corresponding cluster of the plurality of different clusters.

4 more elements

A computing system comprising:

one or more processors;
and
one or more memory configured to store computer executable instructions that, when executed by the one or more processors, cause the one or more processors to:
receive training data comprising a plurality of application programming interface (API) requests from a plurality of client devices;
generate a plurality of permissible API sessions based on the training data, wherein each of the plurality of permissible API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device;
apply a sequence embedding technique to the plurality of permissible API sessions to generate a plurality of embeddings, wherein each of the embeddings is representative of a corresponding permissible API session of the plurality of permissible API sessions;
apply a dimensionality reduction technique to the plurality of embeddings to generate a plurality of compact embeddings;
apply a clustering technique to the plurality of compact embeddings to determine a plurality of different clusters of the compact embeddings;
and
generate a plurality of patterns based on the plurality of different clusters, wherein each of the plurality of patterns is descriptive of permissible API sessions associated with a corresponding cluster of the plurality of different clusters.

7 more elements

Dependencies are inferred from the claim text.