Machine Learning Techniques for Detecting Anomalous API Call Behavior

A non-transitory computer readable storage medium having stored thereon program code executable by a computer system, the program code embodying a method comprising:

• receiving one or more application programming interface (API) call traces, each API call trace including metadata regarding an API call made by an application;
• extracting features from the one or more API call traces, the extracting resulting in one or more feature vectors;
• and
• providing the one or more feature vectors as input to one or more machine learning (ML) models, wherein the one or more ML models are configured to generate a prediction for each of the one or more API call traces indicating whether the API call corresponding to the API call trace is normal or anomalous.

A computer system comprising:

• a processor;
• and
• a non-transitory computer readable medium having stored thereon program code that, when executed by the processor, causes the processor to:
• receive one or more application programming interface (API) call traces, each API call trace including metadata regarding an API call made by an application;
• extract features from the one or more API call traces, the extracting resulting in one or more feature vectors;
• and
• provide the one or more feature vectors as input to one or more machine learning (ML) models, wherein the one or more ML models are configured to generate a prediction for each of the one or more API call traces indicating whether the API call corresponding to the API call trace is normal or anomalous.