Detection of abnormal application programming interface (API) sessions including a sequence of API requests

A computing system comprising:

• one or more processors;
• and
• one or more memory configured to store computer executable instructions that, when executed by the one or more processors, cause the one or more processors to:
• receive data comprising a plurality of application programming interface (API) requests from a plurality of client devices;
• generate a plurality of API sessions based on the data, wherein each of the plurality of API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device;
• compare each of the plurality of API sessions to one or more of a plurality of different patterns indicative of permissible API sessions determined based on training data;
• determine one or more API sessions of the plurality of API sessions generated based on the data are abnormal based, at least in part, on the comparing;
• and
• perform one or more actions based on determining the one or more API sessions are abnormal.

A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed by the computer system cause the computer system to:

• receive data comprising a plurality of application programming interface (API) requests from a plurality of client devices;
• generate a plurality of API sessions based on the data, wherein each of the plurality of API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device;
• compare each of the plurality of API sessions to one or more of a plurality of different patterns indicative of permissible API sessions determined based on training data;
• determine one or more API sessions of the plurality of API sessions generated based on the data are abnormal based, at least in part, on the comparing;
• and
• perform one or more actions based on determining the one or more API sessions are abnormal.