# US 12,184,609 B2 · Method and system for enhancing computer network security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,609 B2 - Document ID: US12184609B2 - Status: Granted - Kind: B2 - Application number: 17/695,899 - Filed: 2022-03-16 - Published: 2022-10-06 - Granted: 2024-12-31 - Earliest claimed: 2021-03-30 - Assignees: HCL Technologies Limited - Applicants: HCL Technologies Limited - Inventors: Simy Chacko; Venkatesh Shankar; Ramesh Gurusamy; Jose Vincent - Web page: https://patentgrep.com/patent/US12184609B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1433: {Vulnerability analysis} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/126: {the source of the received data} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The invention relates to method and system for enhancing computer network security. The method includes receiving a plurality of requests from client devices to avail a plurality of responses from services running on servers; determining a URL pattern for each of the plurality of requests based on URL associated with that request; determining a request data signature for each of the plurality of requests or a response data signature for each of the plurality of responses based on a set of request parameters associated with that request or based on a set of response parameters associated with that response, respectively, using a first machine learning model; and determining an authenticity of each of the plurality of requests based on the URL pattern and the data signature associated with that request, or an authenticity of each of the plurality of responses based on the data signature associated with that response. ## Claims ### Claim 1 A method for enhancing computer network security, the method comprising: receiving, by an Application Programming Interface (API) gateway, a plurality of requests from a plurality of client devices to avail a plurality of responses from a plurality of services running on one or more servers, wherein each of the plurality of requests comprises a Uniform Resource Locator (URL) for a corresponding service and a set of request parameters, and wherein each of the plurality of responses comprises a set of response parameters; determining, by the API gateway, a URL pattern for each of the plurality of requests, based on the URL associated with that request; determining, by the API gateway, a request data signature for each of the plurality of requests based on the respective set of request parameters associated with each of the plurality of requests and a response data signature for each of the plurality of responses based on the respective set of response parameters associated with each of the plurality of responses, using a first machine learning model, wherein the first machine learning model learns to determine the data signature for a request and for a response over a predefined period of time and until a predefined percentage accuracy is attained; and determining, by the API gateway, an authenticity of each of the plurality of requests based on the respective URL pattern and the respective data signature associated with each of the plurality of requests and an authenticity of each of the plurality of responses based on the respective data signature associated with each of the plurality of responses, wherein the authenticity is indicative of a potential security vulnerability. ### Claim 2 (depends on 1) The method of claim 1, wherein the set of request parameters and the set of response parameters are indicative of meta information associated with a request and a response, respectively, and wherein the meta information comprises at least one of a data size, an identification of a user agent, a geographical location, a Multipurpose Internet Mail Extensions (MIME) type, a content, a cookie, an authentication credentials, a cache, a user role and permission. ### Claim 3 (depends on 1) The method of claim 1, wherein determining the request data signature or the response data signature further comprises: detecting an aberration in at least one of the data size, the user agent, the geographic location, the MIME type, and a content data signature, wherein the content data signature is detected based on the content type, and wherein the content type is detected based on the content; identifying a corruption in at least one of the cookie, the content, and the cache; and identifying an aberration in at least one of the authentication credentials, the user role and permission, and a hit rate per session. ### Claim 4 (depends on 1) The method of claim 1, wherein determining the request data signature further comprises predicting an aberration tag or a corruption tag for each of the plurality of requests based on a value of each of the set of request parameters, and wherein determining the response data signature further comprises predicting an aberration tag or a corruption tag for each of the plurality of responses based on a value of each of the set of response parameters. ### Claim 5 (depends on 1) The method of claim 1, wherein the URL pattern for each of the plurality of requests is determined using one of a rule engine, a knowledge base, or a second machine learning model. ### Claim 6 (depends on 1) The method of claim 1, further comprising: verifying accuracy of determining the data signature by the first machine learning model; and generating a notification for reconciling learning of the first machine learning model, when the percentage accuracy of determining the data signature is below the predefined percentage accuracy. ### Claim 7 (depends on 1) The method of claim 1, further comprising performing a preventive action corresponding to the potential security vulnerability, wherein the preventive action comprises blocking at least one of the plurality of requests or at least one of the plurality of responses based on the authenticity of the at least one of the plurality of requests or based on the authenticity of the at least one of the plurality of responses, respectively. ### Claim 8 An Application Programming Interface (API) gateway for enhancing computer network security, the API gateway comprising: a processor; and a memory communicatively coupled to the processor, wherein the memory stores processor-executable instructions, which, on execution, cause the processor to: receive a plurality of requests from a plurality of client devices to avail a plurality of responses from a plurality of services running on one or more servers, wherein each of the plurality of requests comprises a Uniform Resource Locator (URL) for a corresponding service and a set of request parameters, and wherein each of the plurality of responses comprises a set of response parameters; determine a URL pattern for each of the plurality of requests, based on the URL associated with that request; determine a request data signature for each of the plurality of requests based on the respective set of request parameters associated with each of the plurality of requests and a response data signature for each of the plurality of responses based on the respective set of response parameters associated with each of the plurality of responses, using a first machine learning model, wherein the first machine learning model learns to determine the data signature for a request and for a response over a predefined period of time and until a predefined percentage accuracy is attained; and determine an authenticity of each of the plurality of requests based on the respective URL pattern and the respective data signature associated with each of the plurality of requests and an authenticity of each of the plurality of responses based on the respective data signature associated with each of the plurality of responses, wherein the authenticity is indicative of a potential security vulnerability. ### Claim 9 (depends on 8) The API gateway of claim 8, wherein the set of request parameters and the set of response parameters are indicative of meta information associated with a request and a response, respectively, and wherein the meta information comprises at least one of a data size, an identification of a user agent, a geographical location, a Multipurpose Internet Mail Extensions (MIME) type, a content, a cookie, an authentication credentials, a cache, a user role and permission. ### Claim 10 (depends on 8) The API gateway of claim 8, wherein the processor-executable instructions, on execution, further cause the processor to determine the request data signature or the response data signature by: detecting an aberration in at least one of the data size, the user agent, the geographic location, the MIME type, and a content data signature, wherein the content data signature is detected based on the content type, and wherein the content type is detected based on the content; identifying a corruption in at least one of the cookie, the content, and the cache; and identifying an aberration in at least one of the authentication credentials, the user role and permission, and a hit rate per session. ### Claim 11 (depends on 8) The API gateway of claim 8, wherein the processor-executable instructions, on execution, further cause the processor to determine the request data signature by predicting an aberration tag or a corruption tag for each of the plurality of requests based on a value of each of the set of request parameters and to determine the response data signature by predicting an aberration tag or a corruption tag for each of the plurality of responses based on a value of each of the set of response parameters. ### Claim 12 (depends on 8) The API gateway of claim 8, wherein the processor-executable instructions, on execution, cause the processor to determine the URL pattern for each of the plurality of requests by using one of a rule engine, a knowledge base, or a second machine learning model. ### Claim 13 (depends on 8) The API gateway of claim 8, wherein the processor-executable instructions, on execution, further cause the processor to: verify accuracy of determining the data signature by the first machine learning model; and generate a notification for reconciling learning of the first machine learning model, when the percentage accuracy of determining the data signature is below the predefined percentage accuracy. ### Claim 14 (depends on 8) The API gateway of claim 8, wherein the processor-executable instructions, on execution, further cause the processor to perform a preventive action corresponding to the potential security vulnerability, wherein the preventive action comprises blocking at least one of the plurality of requests or at least one of the plurality of responses based on the authenticity of the at least one of the plurality of requests or based on the authenticity of the at least one of the plurality of responses, respectively. ### Claim 15 A non-transitory computer-readable medium storing computer-executable instructions for enhancing computer network security, the computer-executable instructions configured for: receiving a plurality of requests from a plurality of client devices to avail a plurality of responses from a plurality of services running on one or more servers, wherein each of the plurality of requests comprises a Uniform Resource Locator (URL) for a corresponding service and a set of request parameters, and wherein each of the plurality of responses comprises a set of response parameters; determining a URL pattern for each of the plurality of requests, based on the URL associated with that request; determining a request data signature for each of the plurality of requests based on the respective set of request parameters associated with each of the plurality of requests and a response data signature for each of the plurality of responses based on the respective set of response parameters associated with each of the plurality of responses, using a first machine learning model, wherein the first machine learning model learns to determine the data signature for a request and for a response over a predefined period of time and until a predefined percentage accuracy is attained; and determining an authenticity of each of the plurality of requests based on the respective URL pattern and the respective data signature associated with each of the plurality of requests and an authenticity of each of the plurality of responses based on the respective data signature associated with each of the plurality of responses, wherein the authenticity is indicative of a potential security vulnerability. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of the claim 15, wherein the set of request parameters and the set of response parameters are indicative of meta information associated with a request and a response, respectively, and wherein the meta information comprises at least one of a data size, an identification of a user agent, a geographical location, a Multipurpose Internet Mail Extensions (MIME) type, a content, a cookie, an authentication credentials, a cache, a user role and permission, and wherein the computer-executable instructions are further configured to determine the request data signature or the response data signature by: detecting an aberration in at least one of the data size, the user agent, the geographic location, the MIME type, and a content data signature, wherein the content data signature is detected based on the content type, and wherein the content type is detected based on the content; identifying a corruption in at least one of the cookie, the content and the cache; and identifying an aberration in at least one of the authentication credentials, the user role and permission, and a hit rate per session. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of the claim 15, wherein the computer-executable instructions are further configured to determine the request data signature by predicting an aberration tag or a corruption tag for each of the plurality of requests based on a value of each of the set of request parameters and to determine the response data signature by predicting an aberration tag or a corruption tag for each of the plurality of responses based on a value of each of the set of response parameters. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of the claim 15, wherein the computer-executable instructions are further configured to determine the URL pattern for each of the plurality of requests by using one of a rule engine, a knowledge base, or a second machine learning model. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of the claim 15, wherein the computer-executable instructions are further configured to: verify accuracy of determining the data signature by the first machine learning model; and generate a notification for reconciling learning of the first machine learning model, when the percentage accuracy of determining the data signature is below the predefined percentage accuracy. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of the claim 15, wherein the computer-executable instructions are further configured to perform a preventive action corresponding to the potential security vulnerability, wherein the preventive action comprises blocking at least one of the plurality of requests or at least one of the plurality of responses based on the authenticity of the at least one of the plurality of requests or based on the authenticity of the at least one of the plurality of responses, respectively.