Methods and systems for api proxy based adaptive security

A system for securing one or more API servers, the system comprising:

• a proxy cluster configured for routing client messages to at least one target API implemented on the one or more API servers, the proxy cluster comprising a networked plurality of proxies, wherein each of the plurality of proxies are configured to:
• extract information identifying a target API from data packets corresponding to a received client message, and transmit the received client message to an API server implementing the target API;
• and
• responsive to receiving an indicator of compromise, discarding a received client message corresponding to a client or connection id associated with the received indicator of compromise, without onward transmission to an API server identified in the received client message;
• a set of security servers comprising at least one security server, wherein the set of security servers are configured to identify one or more indicators of compromise, based on the data received from the proxies within the proxy cluster.

A system for securing one or more API servers, the system comprising:

• a proxy cluster configured for routing client messages to at least one target API implemented on the one or more API servers, the proxy cluster comprising a networked plurality of proxies, wherein each of the plurality of proxies are configured to:
• extract information identifying a target API from data packets corresponding to a received client message, and transmit the received client message to an API server implementing the target API;
• and
• responsive to receiving an indicator of compromise, discard a received client message corresponding to a client or connection id associated with the received indicator of compromise, without onward transmission to an API server identified in the received client message;
• a cluster of security servers comprising:
• a first security server configured:
• to receive a first set of information comprising proxy access log information from at least a first proxy within the proxy cluster, and to analyse the first set of information for identifying a first set of indicators of compromise;
• and
• a second security server configured:
• to receive a second set of information comprising proxy access log information from at least a second proxy within the proxy cluster, and to analyse the second set of information for identifying a second set of indicators of compromise.

A method for routing client messages to a target API, the method comprising:

• receiving a client message at a proxy router;
• extracting from data packets corresponding to the received client message, an API name and hostname corresponding to a target API;
• comparing the extracted API name against API names associated with each of a set of API characteristics data definitions;
• and
• responsive to a failure to identify an API characteristics data definition comprising an API name that matches the extracted API name, discarding the received client message, without onward transmission to an API server identified in the received client message.

A method for securing one or more API servers, the method comprising:

• receiving at a security server, data from a plurality of proxies within a proxy cluster, wherein:
• the proxy cluster is configured for routing client messages to at least one target API implemented on the one or more API servers;
• and
• each of the plurality of proxies are configured to extract information identifying a target API from data packets corresponding to a received client message, and to transmit the received client message to an API server implementing the target API;
• identifying at the security server, one or more indicators of compromise, based on the data received from proxies within the proxy cluster;
• and
• responsive to receiving an indicator of compromise identified by the security server at a proxy within the proxy cluster, discarding a received client message corresponding to a client or connection id associated with the received indicator of compromise at said proxy, without onward transmission of said client message to an API server.

A method for securing one or more API servers, the method comprising:

• receiving at a first security server within a cluster of security servers, a first set of information comprising proxy access log information from at least a first proxy within a proxy cluster;
• analysing the first set of information for identifying a first set of indicators of compromise;
• receiving at a second security server within the cluster of security servers, a second set of information comprising proxy access log information from at least a second proxy within the proxy cluster;
• analysing the second set of information for identifying a second set of indicators of compromise;
• responsive to receiving an indicator of compromise at a proxy within the proxy cluster, discarding a received client message corresponding to a client or connection id associated with the received indicator of compromise, without onward transmission to an API server identified in the received client message;
• wherein the proxy cluster comprises a networked plurality of proxies, wherein each of the plurality of proxies is configured to extract information identifying a target API from data packets corresponding to a received client message, and to transmit the received client message to an API server implementing the target API.

A computer program product for routing client messages to a target API, comprising a non-transitory computer usable medium having a computer readable program code embodied therein, the computer readable program code comprising instructions for:

• receiving a client message at a proxy router;
• extracting from data packets corresponding to the received client message, an API name and hostname corresponding to a target API;
• comparing the extracted API name against API names associated with each of a set of API characteristics data definitions;
• and
• responsive to failure to identify an API characteristics data definition comprising an API name that matches the extracted API name, discarding the received client message, without onward transmission to an API server identified in the received client message.

A computer program product for securing one or more API servers, comprising a non-transitory computer usable medium having a computer readable program code embodied therein, the computer readable program code comprising instructions for:

• receiving at a security server, data comprising data from a plurality of proxies within a proxy cluster, wherein:
• the proxy cluster is configured for routing client messages to at least one target API implemented on the one or more API servers;
• and
• each of the plurality of proxies are configured to extract information identifying a target API from data packets corresponding to a received client message, and to transmit the received client message to an API server implementing the target API;
• identifying at the security server, one or more indicators of compromise, based on the data received from proxies within the proxy cluster;
• and
• responsive to receiving an indicator of compromise identified by the security server at a proxy within the proxy cluster, discarding a received client message corresponding to a client or connection id associated with the received indicator of compromise at said proxy, without onward transmission of said client message to an API server.

A computer program product for securing one or more API servers, comprising a non-transitory computer usable medium having a computer readable program code embodied therein, the computer readable program code comprising instructions for:

• receiving at a first security server within a cluster of security servers, a first set of information comprising proxy access log information from at least a first proxy within a proxy cluster;
• analysing the first set of information for identifying a first set of indicators of compromise;
• receiving at a second security server within the cluster of security servers, a second set of information comprising proxy access log information from at least a second proxy within the proxy cluster;
• analysing the second set of information for identifying a second set of indicators of compromise;
• responsive to receiving an indicator of compromise at a proxy within the proxy cluster, discarding a received client message corresponding to a client or connection id associated with the received indicator of compromise, without onward transmission to an API server identified in the received client message;
• wherein the proxy cluster comprises a networked plurality of proxies, wherein each of the plurality of proxies is configured to extract from data packets corresponding to a received client message, information identifying a target API and to transmit the received client message to an API server implementing the target API.