What is abnormal API access behavior?
In the era of "Everything as an API", quickly building products and services through APIs to rapidly respond to customer needs has become an essential skill for digital enterprises. However, as APIs carry increasingly complex application logic and a large amount of sensitive data, they also become prime targets for hackers.
In recent years, many internationally renowned companies have suffered significant losses due to API security oversights. Additionally, according to the <API Security Report Q1 2022> published by Salt Labs, malicious API traffic increased by 681% over the past 12 months, with 95% of organizations experiencing API security incidents. Despite this, most organizations are not prepared to tackle these challenges, with more than a third (34%) lacking an API security strategy.
During API access, a large amount of data is transmitted. This data transmission can be categorized as normal access or data theft. For normal data access, features like Data Masking and Obfuscation can be implemented on a WAF when data classification is applied. In cases of data theft, it is essential to identify abnormal data leaks and block abnormal access and connections.
What are the abnormal access behaviors of API?
Attack behaviors with no obvious characteristics.
Abnormal access targeting the business.
A large amount of data transfer.
Abnormal access objects.
Expired or zombie APIs exploited by attacks.
Overexposed data.
API Anomalous Access Behavior Mining Practice Tutorial
Discovering anomalous access behavior of APIs, investigating such behavior, is a key method in daily security operations to identify and fix security or operational vulnerabilities. In the WAF Console, through API traffic analysis, BOT traffic analysis, and related security views, anomalous access behavior of APIs can be quickly discovered and mined, achieving a fast security operation closed-loop.
The investigation of anomalous access behavior of APIs mainly consists of the following steps:
1. Discovered abnormal access requests.
On the Attack Log Page, abnormal access behavior logs were identified and tracked.
In the API Traffic Analysis feature, abnormal API overview information was identified, confirming and tracking related abnormal API logs.
On the BOT Traffic Analysis Page, abnormal score API access requests were identified and tracked.
2. Confirm the unique UUID in abnormal access requests. Based on this UUID, determine the event explosion scope.
After enabling the access log, each access log has a unique UUID which can be used to analyze and track related users, API access logs, and BOT behavior information.
3. Consider abnormalities in the context of typical user behaviors.
In different business scenarios, the API access behaviors of different users are not consistent. For example, in the log in to API scenario, frequent access to the log in to interface is highly likely to indicate abnormalities.
4. Guided by access influencing factors to confirm abnormalities.
Confirm whether the current source of access is abnormal, whether the login location is abnormal, and whether the caller is a non-business source user.
5. Confirm abnormalities based on returned report content information.
Confirm whether the body size parameters of access significantly exceed abnormalities.
Confirm whether the returned content exceeds expectations.
6. Identify related APIs and user information to ensure a security closed loop.
Confirm abnormal access behavior, user information, and related API information, take appropriate action, and promptly perform security fixes.