Patent application EP18200235A (EP), filed 2018-10-12
Publication number: EP3471007A1
Title: METHODS AND APPARATUS FOR ANALYZING SEQUENCES OF APPLICATION PROGRAMMING INTERFACE TRAFFIC TO IDENTIFY POTENTIAL MALICIOUS ACTIONS
Abstract: In some embodiments, a method includes receiving, at a processor of a server, a first application programming interface (API) call from a client device and providing an indication associated with the first API call as an input to a machine learning model such that the machine learning model identifies a set of parameters associated with a set of likely subsequent API calls. The method can further include receiving a second API call from the client device, identifying the second API call as an anomalous API call based on the second API call not meeting the set of parameters associated with the set of likely subsequent API calls, and sending a signal to perform a remedial action based on the identifying.
IPC codes: H04L  12/    24            A I
H04L  29/    06            A I
G06F  21/    55            A I
G06F  21/    56            A I
G06N  20/    00            A I
Claims: number: 1
text: A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
number: 2
text: The non-transitory processor-readable medium of claim 1, wherein the indication associated with the at least one API call is an n-gram representation of the at least one API call.
number: 3
text: The non-transitory processor-readable medium of claim 1, wherein the proximity within the sequence is based on a number of API calls in the sequence between the first API call in that pair of API calls and the second API call in that pair of API calls.
number: 4
text: The non-transitory processor-readable medium of claim 1, wherein the proximity within the sequence is an indication of a time in the sequence between receiving the first API call in that pair of API calls and receiving the second API call in that pair of API calls.
number: 5
text: The non-transitory processor-readable medium of claim 1, wherein the machine learning model includes at least one of a neural network, a decision tree model, a random forest model, a Bayesian network or a clustering model.
number: 6
text: The non-transitory processor-readable medium of claim 1, wherein the code to cause the processor to identify includes code to cause the processor to identify that the client device is operating in the malicious manner based on at least one of a location of the client device, a type of the client device, an application sending the set of API calls, a number of API calls received from the client device within a predefined time period, a type of payload of at least one API call from the set of API calls, a time at least one API call from the set of API calls is received from the client device, or a day at least one API call from the set of API calls is received from the client device.
number: 7
text: The non-transitory processor-readable medium of claim 1, wherein the set of API calls is a first set of API calls and the code to cause the processor to receive includes code to cause the processor to receive the first set of API calls at a time, the code further comprising code to cause the processor to:
number: 8
text: The non-transitory processor-readable medium of claim 1, wherein each API call from the set of API calls is associated with a single application.
number: 9
text: The non-transitory processor-readable medium of claim 1, wherein the set of API calls is associated with a plurality of applications.
number: 10
text: A method, comprising:
number: 11
text: The method of claim 10, wherein the set of parameters associated with the set of likely subsequent API calls includes a predicted number of API calls between the first API call and the second API call.
number: 12
text: The method of claim 10, wherein the set of parameters associated with the set of likely subsequent API calls includes a predicted time period between the first API call and the second API call.
number: 13
text: The method of claim 10, wherein the first API call is addressed to a destination server, the second API call is addressed to the destination server.
number: 14
text: The method of claim 10, wherein the first API call is addressed to a first destination server, the second API call is addressed to a second destination server different from the first destination server.
number: 15
text: The method of claim 10, wherein the indication associated with the first API call is an n-gram representation of the first API call.
number: 16
text: An apparatus, comprising:
number: 17
text: The apparatus of claim 16, wherein each API call from the first set of API calls is associated with at least one of a user, an organization, an application or a client device, and each remaining API call from the first set of API calls is associated with the at least one of the user, the organization, the application or the client device.
number: 18
text: The apparatus of claim 16, wherein the processor is configured to train the machine learning model using unsupervised learning.
number: 19
text: The apparatus of claim 16, wherein the processor is configured to train the machine learning model using supervised learning.
number: 20
text: The apparatus of claim 16, wherein the processor is included within a proxy server in a network between a source of each API call from the second set of API calls and an intended destination of each API call from the second set of API calls.
Office action: search_report, dated 2019-04-17
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: WO2016168368A1
ref_type: patent
severity: background
ref_id: US2008016339A1
ref_type: patent
severity: background
ref_id: - SEYED MOHAMMAD GHAFFARIAN ET AL: "Software Vulnerability Analysis and Discovery Using Machine-Learning and Data-Mining Techniques", ACM COMPUTING SURVEYS, ACM, NEW YORK, NY, US, US, vol. 50, no. 4, 25 August 2017 (2017-08-25), pages 1 - 36, XP058366750, ISSN: 0360-0300, DOI: 10.1145/3092566
ref_type: npl
severity: background
ref_id: US2008016339
ref_type: patent
severity: novelty_destroying
ref_id: WO2016168368
ref_type: patent
severity: novelty_destroying
ref_id: - SEYED MOHAMMAD GHAFFARIAN ET AL, "Software Vulnerability Analysis and Discovery Using Machine-Learning and Data-Mining Techniques", ACM COMPUTING SURVEYS, ACM, NEW YORK, NY, US, US, (20170825), vol. 50, no. 4, doi:10.1145/3092566, ISSN 0360-0300, pages 1 - 36, XP058366750 [A] 1-20 * section 3 - section 6.1; page  56:5  - page  56:24 *
ref_type: npl
severity: background
Final disposition: pending (2019-04-17)