# US 12,120,129 B1 · Detection of abnormal application programming interface (API) sessions including a sequence of API requests > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,129 B1 - Document ID: US12120129B1 - Status: Granted - Kind: B1 - Application number: 18/403,913 - Filed: 2024-01-04 - Granted: 2024-10-15 - Earliest claimed: 2023-07-13 - Assignees: Intuit Inc. - Applicants: Intuit Inc. - Inventors: Itsik Yizhak Mantin; Laetitia Kahn; Sapir Porat; Yaron Sheffer - Web page: https://patentgrep.com/patent/US12120129B1 ## CPC - G06F 9/541: {via adapters, e.g. between incompatible applications} - G06F 9/547: {Remote procedure calls [RPC]; Web services} - G06F 21/552: {involving long-term monitoring or reporting} - G06N 20/00: Machine learning - H04L 63/00: {Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00)} - H04L 63/14: {for detecting or protecting against malicious traffic} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method includes receiving data comprising a plurality of application programming interface (API) requests from a plurality of client devices. The method includes generating a plurality of API sessions based on the data, wherein each of the API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device. The method includes comparing each of the plurality of API sessions to one or more of a plurality of different patterns indicative of permissible API sessions determined based on training data. The method includes determining one or more API sessions of the plurality of API sessions generated based on the data are abnormal based, at least in part, on the comparing. Finally, the method includes performing one or more actions based on determining the one or more API sessions are abnormal. ## Claims ### Claim 1 A method comprising: receiving data comprising a plurality of application programming interface (API) requests from a plurality of client devices; generating a plurality of API sessions based on the data, wherein each of the plurality of API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device; comparing each of the plurality of API sessions to one or more of a plurality of different patterns indicative of permissible API sessions determined based on training data; determining one or more API sessions of the plurality of API sessions generated based on the data are abnormal based, at least in part, on the comparing; and performing one or more actions based on determining the one or more API sessions are abnormal. ### Claim 2 (depends on 1) The method of claim 1, wherein determining the one or more API sessions are abnormal comprises determining a distance between the one or more API sessions and a first pattern of the plurality of different patterns indicative of permissible API sessions that is closest to the one or more API sessions exceeds a threshold distance. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more actions comprise generating a notification indicative of the one or more API sessions being abnormal. ### Claim 4 (depends on 1) The method of claim 1, wherein the one or more actions comprise updating a database to include the one or more API sessions determined to be abnormal. ### Claim 5 (depends on 1) The method of claim 1, further comprising: prior to the comparing, determining a first API session of the plurality of API sessions includes less than a threshold number of API requests; and removing the first API session from the plurality of API sessions in response to determining the first API session includes less than the threshold number of API requests. ### Claim 6 (depends on 5) The method of claim 5, wherein the threshold number of API requests is 3 API requests. ### Claim 7 (depends on 1) The method of claim 1, wherein a number of API requests included in each of the plurality of API sessions ranges from 3 API requests to thousands of API requests. ### Claim 8 A computing system comprising: one or more processors; and one or more memory configured to store computer executable instructions that, when executed by the one or more processors, cause the one or more processors to: receive data comprising a plurality of application programming interface (API) requests from a plurality of client devices; generate a plurality of API sessions based on the data, wherein each of the plurality of API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device; compare each of the plurality of API sessions to one or more of a plurality of different patterns indicative of permissible API sessions determined based on training data; determine one or more API sessions of the plurality of API sessions generated based on the data are abnormal based, at least in part, on the comparing; and perform one or more actions based on determining the one or more API sessions are abnormal. ### Claim 9 (depends on 8) The computing system of claim 8, wherein to determine the one or more API sessions are abnormal, the one or more processors are configured to determine a distance between the one or more API sessions and a first pattern of the plurality of different patterns that is closest to the one or more API sessions exceeds a threshold distance. ### Claim 10 (depends on 8) The computing system of claim 8, wherein the one or more actions comprise generating a notification indicative of the one or more API sessions being abnormal. ### Claim 11 (depends on 10) The computing system of claim 10, wherein the one or more actions further comprise updating a database to include the one or more API sessions determined to be abnormal. ### Claim 12 (depends on 8) The computing system of claim 8, wherein the computer executable instructions, when executed by the one or more processors, further cause the one more processors to: prior to the comparing, determine a first API session of the plurality of API sessions includes less than a threshold number of API requests; and removing the first API session from the plurality of API sessions in response to determining the first API session includes less than the threshold number of API requests. ### Claim 13 (depends on 12) The computing system of claim 12, wherein the threshold number of API requests is 3 API requests. ### Claim 14 (depends on 8) The computing system of claim 8, wherein a number of API requests included in each of the plurality of API sessions ranges from 3 API requests to thousands of API requests. ### Claim 15 A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed by the computer system cause the computer system to: receive data comprising a plurality of application programming interface (API) requests from a plurality of client devices; generate a plurality of API sessions based on the data, wherein each of the plurality of API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device; compare each of the plurality of API sessions to one or more of a plurality of different patterns indicative of permissible API sessions determined based on training data; determine one or more API sessions of the plurality of API sessions generated based on the data are abnormal based, at least in part, on the comparing; and perform one or more actions based on determining the one or more API sessions are abnormal. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein to determine the one or more API sessions are abnormal, the instructions when executed by the computer system cause the computer system to determine a distance between the one or more API sessions and a first pattern of the plurality of different patterns that is closes to the one or more API sessions exceeds a threshold distance. ### Claim 17 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the distance between the one or more API sessions and the first pattern is a Euclidian distance. ### Claim 18 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the instructions, when executed by the computer system, further cause the computer system to: prior to the comparing, determine a first API session of the plurality of API sessions includes less than a threshold number of API requests; and remove the first API session from the plurality of API sessions in response to determining the first API session includes less than the threshold number of API requests. ### Claim 19 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the one or more actions comprise generating a notification indicative of the one or more API sessions being abnormal. ### Claim 20 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the one or more actions comprise updating a database to include the one or more API sessions determined to be abnormal.