The truth about anomaly detection in API security
summary
Company deploys simple honeypot apps to AWS, Azure, GCP and Heroku and runs Resurface Labs’ collector to capture full request/response audit trails; every endpoint is probed within ~30 minutes and averages 154 attacks/day/endpoint, with some API-first services (finance/crypto) showing up to 80% malicious traffic. Purely statistical anomaly detection fails when attack traffic dominates; experiments even reveal unexpected application vulnerabilities (open redirect) discovered by attacker probes, so continuous API observability and retroactive search are required.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:04Agenda
- 2:16What is anomaly detection
- 14:17What is Resurface
- 18:04Analysis
- 20:47Results
- 21:59Conclusion
- 23:40Outro
related talks
31mAPI security
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
32mApisecure, 14 & 15 March 2023 - Shannon Wilkinson, Cybersecurity Founder | Women in Technology [...]
50mHunting Supply Chain Threats Using Anomaly Detection
01h 01mApisecure, 14 & 15 March 2023 - Jeremy Ventura, CISO at ThreatX.
24mAPI security, mitigate API abuses using machine learning
20mFrom Chaos to Calm: Navigating Emerging API Security Challenges.
19mAvoid These API Security Pitfalls: Expert Insights