Method and system for protection of cloud-based infrastructure

A first computing device comprising:

• at least one processor;
• and
• memory storing instructions that, when executed by the at least one processor, cause the first computing device to:
• determine, based on data elements extracted from a first Application Programming Interface (API) request, an API request count associated with a first API for a first application;
• after determining, based on the API request count, a level of risk associated with the first API request:
• based on a determination that the level of risk is a first level of risk, select, from a plurality of decoy APIs, a first decoy API associated with a first quarantine function;
• and
• based on a determination that the level of risk is a second level of risk, different from the first level of risk, select, from the plurality of decoy APIs, a second decoy API, different from the first decoy API, associated with a second quarantine function, wherein the first quarantine function is different from the second quarantine function;
• modify the first API request to invoke a decoy API selected from the first decoy API or the second decoy API;
• and
• send, by the first computing device and to a second computing device, a response message output by the decoy API.

A non-transitory, computer-readable medium storing instructions that, when executed by a first computing device, cause:

• determining, based on data elements extracted from a first Application Programming Interface (API) request, an API request count associated with a first API for a first application;
• after determining, based on the API request count, a level of risk associated with the first API request:
• based on a determination that the level of risk is a first level of risk, selecting, from a plurality of decoy APIs, a first decoy API associated with a first quarantine function;
• and
• based on a determination that the level of risk is a second level of risk, different from the first level of risk, selecting, from the plurality of decoy APIs, a second decoy API, different from the first decoy API, associated with a second quarantine function, wherein the first quarantine function is different from the second quarantine function;
• modifying the first API request to invoke a decoy API selected from the first decoy API or the second decoy API;
• and
• sending, by the first computing device and to a second computing device, a response message output by the decoy API.