US 11,855,968 B2
Methods and systems for deep learning based API traffic security
Udayakumar Subbarayan, Bangalore (IN); Bernard Harguindeguy, Atherton, CA (US); Anoop Krishnan Gopalakrishnan, Bangalore (IN); Nagabhushana Angadi, Bengaluru (IN); Ashwani Kumar, Bengaluru (IN); Santosh Sahu, Bangalore (IN); Abdu Raheem Poonthiruthi, Bangalore (IN); Avinash Kumar Sahu, Bangalore (IN); and Yasar Kundottil, Bangalore (IN)
Assigned to Ping Identity Corporation, Denver, CO (US)
Filed by Ping Identity Corporation, Denver, CO (US)
Filed on Aug. 4, 2022, as Appl. No. 17/817,577.
Application 17/817,577 is a continuation of application No. 16/894,222, filed on Jun. 5, 2020, granted, now 11,411,923.
Application 16/894,222 is a continuation of application No. 15/793,671, filed on Oct. 25, 2017, granted, now 10,681,012, issued on Jun. 9, 2020.
Claims priority of application No. 201611036787 (IN), filed on Oct. 26, 2016.
Prior Publication US 2023/0061142 A1, Mar. 2, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 20/00 (2019.01); G06F 21/55 (2013.01); G06F 21/62 (2013.01)
CPC H04L 63/0281 (2013.01) [G06F 21/55 (2013.01); G06F 21/554 (2013.01); G06F 21/6281 (2013.01); G06N 20/00 (2019.01); H04L 63/02 (2013.01); H04L 63/04 (2013.01); H04L 63/0807 (2013.01); H04L 63/0876 (2013.01); H04L 63/1425 (2013.01); H04L 63/1458 (2013.01); H04L 63/1491 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to:
receive an event trigger to analyze traffic parameter data associated with network traffic of an Application Programming Interface (API);
identify the API as associated with an API class from a plurality of API classes;
identify, in response to the event trigger, an anomaly detection model from a plurality of anomaly detection models and associated with the API class, each anomaly detection model from the plurality of anomaly detection models being associated with a different API class from the plurality of API classes;
analyze, using the anomaly detection model and in response to the event trigger, the traffic parameter data to identify deviations between the traffic parameter data and a traffic parameter baseline value associated with the API; and
restrict network traffic associated with the API when the deviations meet a criterion.