API Security Based on Automatic OpenAPI Mapping
TLDR
MRG is a novel unsupervised method for securing HTTP REST APIs by automatically mapping their structure to OpenAPI from real-world traffic.
Key contributions
- Learns API structure from real-world traffic without labels, generating OpenAPI documentation.
- Enables real-time updates, explainable visualization, and anomaly detection for undocumented behaviors.
- Detects malformed requests, structural deviations, and injection attacks using graph validation.
- Achieves up to 11.4% higher recall, 20x faster inference, and 100% precision vs. SOTA.
Why it matters
This paper introduces a fully automated and efficient pipeline for real-time API visibility, schema inference, and anomaly detection. It addresses the challenge of securing dynamic microservice environments without manual tuning or labeled data, significantly improving security posture.
Original Abstract
This paper presents Map Reduce Graph (MRG), a novel unsupervised method for modeling and securing HTTP REST APIs. MRG learns API structure from real-world traffic without prior knowledge or labels, automatically generating OpenAPI-compliant documentation by reconstructing routes, methods, and parameter formats. MRG enables real-time updates, explainable visualization, and anomaly detection, helping identify undocumented or evolving behaviors. It detects malformed requests, structural deviations, and injection attacks using graph-based validation and a deep autoencoder for payload analysis. Compared to state-of-the-art methods like HRAL and FT-ANN, MRG achieves up to 11.4% higher recall, over 20 times faster inference, and perfect precision (100%) on multiple API-layer attacks. Designed for dynamic microservice environments, MRG operates in three phases - training, updating, and detection - and integrates smoothly with observability and security tools. This work contributes a fully automated, efficient pipeline for real-time API visibility, schema inference, and anomaly detection without manual tuning or labeled data.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.