A Real-Time Approach to Detecting API Abuses Based on Behavioral Patterns

Over the past two decades, the internet has undergone a remarkable expansion, giving rise to the development of web-based software solutions. This evolution has led to widespread web Application Programming Interface (API) usage, facilitating remote software communication. However, the increased frequency of API calls has unfortunately resulted in a corresponding surge in API misuse instances. Monitoring API traffic becomes imperative to ensure data security, service availability, and system integrity. This paper introduces an API abuse detection system within a Log Storage Application utilizing Spring Boot with OAuth2.0 and JSON Web Token (JWT) based authentication. The proposed system effectively safeguards against critical security threats, such as Economical Denial of Service (EDoS) attacks (OWASP top 4), Unauthorized Access attempts (OWASP top 3), Brute Force Broken User Authentication, and Behavioral API abuses, with alerts promptly sent to the server. The prevalence of API usage has created numerous attack surfaces, offering a rich landscape for further research opportunities.