US 12,373,553 B2
State-based detection of anomalous API calls within a real-time data stream
Stanislav Babourine, Walnut Creek, CA (US)
Assigned to Salesforce, Inc., San Francisco, CA (US)
Filed by Salesforce, Inc., San Francisco, CA (US)
Filed on Sep. 17, 2021, as Appl. No. 17/478,353.
Prior Publication US 2023/0090132 A1, Mar. 23, 2023
Int. Cl. G06F 21/55 (2013.01)
CPC G06F 21/554 (2013.01) [G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method for detecting anomalous data within a real-time data stream, the method comprising:
receiving the real-time data stream from a real-time data source, the real-time data stream comprising a plurality of log entries, individual log entries of the plurality of log entries including a plurality of data elements, wherein at least one data element of the plurality of data elements is obtained from an application programming interface (API) call, the real-time data source being a group-based communication system and the real-time data stream including group-based communication data associated with the group-based communication system, the group-based communication data including activity within communication channels by users that are authorized to access the communication channels;
filtering, as the real-time data stream is being received, the real-time data stream based at least in part on one or more filter criteria to obtain a filtered real-time data stream comprising a subset of the plurality of log entries;
generating a modified stored state by modifying a stored state corresponding to one or more log entry data elements of a particular type based at least in part on a determination that a log entry of the subset of the plurality of log entries is of the particular type, wherein the modified stored state corresponds to one or more failed log-in attempts by a particular user of the users of the group-based communication system and the particular type corresponds to a count of the one or more failed log-in attempts;
determining whether the count meets or exceeds a predetermined threshold;
determining that the modified stored state is an anomalous state based at least in part on the count meeting or exceeding the predetermined threshold; and
in response to determining that the modified stored state is the anomalous state, taking one or more remediation actions.