Patent ID: 11916964
Assignee: ARECABAY, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 16:
17. A computer system for dynamically enforcing, at runtime, a multi-API security policy that covers multiple API calls of a multi-API transaction, the computer system comprising:
at least one processor;
system memory;
a log reading module residing in the system memory, the log reading module being configured to read logs of calls to multiple APIs of a multi-API transaction, the multi-API call transaction comprising a call to an initial API, and calls made to subsequent APIs by the initial API and by other subsequent APIs;
a data object identifying module residing in the system memory, the data object identifying module being configured to identify, from the logs, data objects used by the multiple APIs;
an assigning module residing in the system memory, the assigning module being configured to assign specific data labels to specific fields of data objects used by the multiple APIs, the specific data labels providing consistent identification of data fields of specific types across the multiple APIs;
a linkage identifying module residing in the system memory, the linkage identifying module being configured to identify linkages between specific ones of the multiple APIs, based on the consistent identification of data fields of specific types across the multiple APIs;
a call graph constructing module residing in the system memory, the call graph constructing module being configured to:
group limited information available concerning the multiple APIs and relationships between them in a candidate superset graph; and
grow the candidate superset graph by an iterative edge elimination process to construct an API call graph identifying a sequence of API calls made during the multi-API transaction, wherein a linear regression model is used to determine neighbors of service endpoints; and
a policy enforcing module residing in the system memory, the policy enforcing module being configured to use the API call graph identifying the sequence of API calls to enforce the multi-API security policy that covers multiple API calls of the multi-API transaction, the multi-API security policy using the specific data labels to consistently identify data fields of specific types across the multiple APIs.