Api security based on inspection of obfuscated request and response bodies

A method to provide an API security service, the method comprising:

• capturing API traffic between a client and an API endpoint, the API traffic including at least one of a request and a response that contains structured data;
• modifying the structured data in the API traffic, at least by:
• (i) identifying a content-type associated with a structure of the structured data, and
• (ii) based on the content-type, obfuscating content of the structured data while retaining the structure of the structured data wherein said obfuscating comprises consistently replacing a particular piece of content with a particular obfuscated value across a set of API traffic, the set of API traffic comprising at least one of:
• a plurality of requests and a plurality of responses;
• passing at least the modified structured data in the API traffic to a detection engine that uses the modified structured data to assess the API traffic for security risk, at least by identifying a change in an obfuscated piece of content across the set of API traffic;
• and,
• based on a response from the detection engine, identifying a security risk level associated with the API traffic.

A system comprising one or more servers having circuitry forming one or more processors and memory holding computer program instructions to be executed on the one or more processors, the computer program instructions when so executed causing the one or more servers to:

• capture API traffic between a client and an API endpoint, the API traffic including at least one of a request and a response that contains structured data;
• modify the structured data in the API traffic, at least by:
• (i) identifying a content-type associated with a structure of the structured data, and
• (ii) based on the content-type, obfuscating content of the structured data while retaining the structure of the structured data wherein said obfuscating comprises consistently replacing a particular piece of content with a particular obfuscated value across a set of API traffic, the set of API traffic comprising at least one of:
• a plurality of requests and a plurality of responses;
• pass at least the modified structured data in the API traffic to a detection engine that uses the modified structured data to assess the API traffic for security risk, at least by identifying a change in an obfuscated piece of content across the set of API traffic;
• and,
• based on a response from the detection engine, identify a security risk level associated with the API traffic.

A non-transitory computer readable medium holding computer program instructions for execution by one or more computers, the computer program instructions when so executed causing the one or more computers to:

• capture API traffic between a client and an API endpoint, the API traffic including at least one of a request and a response that contains structured data;
• modify the structured data of the API traffic, at least by:
• (i) identifying a content-type associated with a structure of the structured data, and
• (ii) based on the content-type, obfuscating content of the structured data while retaining the structure of the structured data wherein said obfuscating comprises consistently replacing a particular piece of content with a particular obfuscated value across a set of API traffic, the set of API traffic comprising at least one of:
• a plurality of requests and a plurality of responses;
• pass at least the modified structured data in the API traffic to a detection engine that uses the modified structured data to assess the API traffic for security risk, at least by identifying a change in an obfuscated piece of content across the set of API traffic;
• and,
• based on a response from the detection engine, identify a security risk level associated with the API traffic.