US 11,783,033 B2
Methods and apparatus for analyzing sequences of application programming interface traffic to identify potential malicious actions
Udayakumar Subbarayan, Bangalore (IN); Bernard Harguindeguy, Atherton, CA (US); Isidore Rosenblum, Pleasanton, CA (US); Yasar Kundottil, Bangalore (IN); Aditya Gunuganti, Hyderabad (IN); Amit Kumar Sharma, Bangalore (IN); and Avinash Kumar Sahu, Bangalore (IN)
Assigned to Ping Identity Corporation, Denver, CO (US)
Filed by Ping Identity Corporation, Denver, CO (US)
Filed on Feb. 25, 2022, as Appl. No. 17/680,767.
Application 17/680,767 is a continuation of application No. 16/909,272, filed on Jun. 23, 2020, granted, now 11,263,321.
Application 16/909,272 is a continuation of application No. 16/158,836, filed on Oct. 12, 2018, granted, now 10,699,010, issued on Jun. 30, 2020.
Claims priority of application No. 201711036534 (IN), filed on Oct. 13, 2017.
Prior Publication US 2022/0292190 A1, Sep. 15, 2022
Int. Cl. G06F 9/54 (2006.01); G06F 21/55 (2013.01); G06N 20/00 (2019.01); H04L 9/40 (2022.01); H04L 41/16 (2022.01); H04L 41/14 (2022.01); H04L 41/147 (2022.01); G06F 21/56 (2013.01); G06F 40/216 (2020.01)
CPC G06F 21/554 (2013.01) [G06F 9/54 (2013.01); G06F 21/552 (2013.01); G06F 21/566 (2013.01); G06F 40/216 (2020.01); G06N 20/00 (2019.01); H04L 41/145 (2013.01); H04L 41/147 (2013.01); H04L 41/16 (2013.01); H04L 63/1425 (2013.01); H04L 63/1441 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
receive, at a first time, a first application programming interface (API) call in a sequence of API calls, the first API call addressed to an API;
receive, at a second time, a second API call in the sequence of API calls;
predict a predicted time period between the first API call and the second API call;
compare the predicted time period with an actual time period between the first time and the second time to generate a consistency score; and
perform a remedial action associated with the sequence of API calls when the consistency score does not meet a criterion.