# US 2018/0324208 A1 · System and method for identifying and preventing malicious api attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324208 A1 - Document ID: US20180324208A1 - Status: Published application - Kind: A1 - Application number: 15/821,124 - Filed: 2017-11-22 - Published: 2018-11-08 - Earliest claimed: 2015-04-13 - Applicants: Secful, Inc. - Inventors: Roey Eliyahu; Omer Sadika - Web page: https://patentgrep.com/patent/US20180324208A1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/75: Indicating network or usage conditions on the user display - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for identifying and preventing malicious application programming interface attacks is configured to, during a learning stage: monitor all requests sent to and from the server API; identify one or more first characteristic data points of each request and response sent during the learning stage; and determine, based at least in part on the identified one or more first characteristic data points, one or more characteristic data models, wherein a characteristic data model represents at least one of an expected input to the API and an expected output of the API; and during a protection stage: monitor all requests sent to and from the server API; identify one or more second characteristic data points of each request and response sent during the protection stage; and one of validate and invalidate the identified one or more second characteristic data points against the one or more characteristic data models. ## Claims ### Claim 1 A method for identifying and preventing malicious application programming interface (API) attacks in a client-server architecture, performed on a computer having a processor, a memory, and one or more code sets stored in the memory and executed by the processor, the method comprising: during a learning stage: monitoring, by the processor, all requests sent to a server API and all responses sent from the server API; identifying, by the processor, one or more first characteristic data points of each request and response sent during the learning stage; and determining, by the processor, based at least in part on the identified one or more first characteristic data points, one or more characteristic data models, wherein a characteristic data model represents at least one of an expected input to the API and an expected output of the API; and during a protection stage: monitoring, by the processor, all requests sent to the server API and all responses sent from the server API; identifying, by the processor, one or more second characteristic data points of each request and response sent during the protection stage; and one of validating and invalidating, by the processor, the identified one or more second characteristic data points against the one or more characteristic data models. ### Claim 2 (depends on 1) The method as in claim 1, further comprising: passing to the server, by the processor, requests having no invalidated one or more second characteristic data points; and passing from the server, by the processor, responses having no invalidated one or more second characteristic data points. ### Claim 3 (depends on 1) The method as in claim 1, further comprising: blocking to the server, by the processor, requests having invalidated one or more second characteristic data points; and blocking from the server, by the processor, responses having invalidated one or more second characteristic data points. ### Claim 4 (depends on 1) The method as in claim 1, further comprising: generating, by the processor, an alert for each request having invalidated one or more second characteristic data points; and generating, by the processor, and alert for each response having invalidated one or more second characteristic data points. ### Claim 5 (depends on 4) The method as in claim 4, further comprising: generating, by the processor, an alert timeline, wherein the alert timeline represents a selection of one or more aggregations of alerts, the alerts in each of the one or more aggregations having a predefined similarity, the one or more aggregations being organized in a predefined order; and displaying, by the processor, the alert timeline on a visual display. ### Claim 6 (depends on 1) The method as in claim 1, further comprising: generating, by the processor, one or more attacker profiles based at least in part on the validating step; determining, by the processor, one or more suspicion scores for each attacker profile; and identifying, by the processor, one or more suspicious profiles based at least in part on respective suspicion scores, wherein all future requests and responses related to an identified suspicious profile are flagged with an alert irrespective of validity. ### Claim 7 (depends on 1) The method of claim 1, further comprising: updating, by the processor, the one or more characteristic data models based at least in part on the identified one or more second characteristic data points of each request and response sent during the protection stage. ### Claim 8 (depends on 1) The method as in claim 1, wherein the server API is one of a RESTful API, a SOAP API, an XML-RPC API, and a WSDL API. ### Claim 9 (depends on 1) The method as in claim 1, further comprising generating, by the processor, documentation comprising information reflecting a complete structure of the server API. ### Claim 10 A system for identifying and preventing malicious application programming interface (API) attacks in a client-server architecture, comprising: a computer having a processor and a memory; and one or more code sets stored in the memory and executed by the processor, which configure the processor to: during a learning stage: monitor all requests sent to a server API and all responses sent from the server API; identify one or more first characteristic data points of each request and response sent during the learning stage; and determine based at least in part on the identified one or more first characteristic data points, one or more characteristic data models, wherein a characteristic data model represents at least one of an expected input to the API and an expected output of the API; and during a protection stage: monitor all requests sent to the server API and all responses sent from the server API; identify one or more second characteristic data points of each request and response sent during the protection stage; and one of validate and invalidate the identified one or more second characteristic data points against the one or more characteristic data models. ### Claim 11 (depends on 10) The system as in claim 10, the processor further configured to: pass to the server requests having no invalidated one or more second characteristic data points; and pass from the server responses having no invalidated one or more second characteristic data points. ### Claim 12 (depends on 10) The system as in claim 10, the processor further configured to: block to the server requests having invalidated one or more second characteristic data points; and block from the server responses having invalidated one or more second characteristic data points. ### Claim 13 (depends on 10) The system as in claim 10, the processor further configured to: generate an alert for each request having invalidated one or more second characteristic data points; and generate and alert for each response having invalidated one or more second characteristic data points. ### Claim 14 (depends on 13) The system as in claim 13, the processor further configured to: generate an alert timeline, wherein the alert timeline represents a selection of one or more aggregations of alerts, the alerts in each of the one or more aggregations having a predefined similarity, the one or more aggregations being organized in a predefined order; and display the alert timeline on a visual display. ### Claim 15 (depends on 10) The system as in claim 10, the processor further configured to: generate one or more attacker profiles based at least in part on the validating step; determine one or more suspicion scores for each attacker profile; and identify one or more suspicious profiles based at least in part on respective suspicion scores, wherein all future requests and responses related to an identified suspicious profile are flagged with an alert irrespective of validity. ### Claim 16 (depends on 10) The system as in claim 10, the processor further configured to: update the one or more characteristic data models based at least in part on the identified one or more second characteristic data points of each request and response sent during the protection stage. ### Claim 17 (depends on 10) The system as in claim 10, wherein the server API is one of a RESTful API, a SOAP API, an XML-RPC API, and a WSDL API. ### Claim 18 (depends on 10) The system as in claim 10, the processor further configured to generate documentation comprising information reflecting a complete structure of the server API.