Traceable Inc.

Cisco Technology, Inc.

Avinash Kolluru

Shubham Jindal

Binod Pankajakshy Gangadharan

Prerana Singhal

Ravindra Guntar

Ravindra Guntur

Inon Shkedy

A system that intercepts and analyzes application program interface (API) traffic, identifies correlations between components of API traffic, and uses those correlations to detect anomalous behaviors. API traffic, including requests and responses, is intercepted and analyzed to identify correlations in the API traffic. The correlations may be based on API traffic and can include a sequence of APIs, parameters passed between earlier and subsequent APIs, user roles within a user session and APIs accessed by the user roles, and other correlations. Correlation data for user sessions is generated and stored, and later compared to subsequent user session traffic. If the subsequent user session traffic does not comply with the correlations detected in earlier user sessions, an anomaly may be triggered.

Session based anomaly dectection

A system analyzes APIs and automatically generates an API description for the system. The APIs each have an API behavior, which can include a request and a response. Each request and response can have different components. The present system automatically learns characteristics and patterns in the request and response components. As clients engage an API, the component data in the requests and responses for the API are monitored and distributions for various characteristics are determined. Once the API description is automatically generated by the system, the API description can be compared to incoming API requests to identify anomalies that can be associated with users without proper credentials.

Automatic generation of an API interface description

In one embodiment, a controller instructs agent processes to monitor for instances of particular types of interactions, each defined by a type of context entity within an interaction instance and one or both of a type of head entity sourcing an interaction instance and a type of tail entity as a destination of an interaction instance. The controller may then receive interaction objects from plurality of agent processes, each containing an identification of a respective interaction instance matching one of particular types of interactions, each respective interaction instance identifying, as components of each respective interaction instance, a particular context entity and one or both of a particular head entity and a particular tail entity. The controller may then index the components of each respective interaction instance, establish relationships between the indexed components according to each respective interaction instance, store the indexed components and established relationships, and generate reports based thereon.

Monitoring interactions between entities in a network by an agent for particular types of interactions and indexing and establishing relationships of the components of each interaction

Growing community of inventors

Bengaluru, India

Avinash Kolluru