Apisecure, 14 & 15 March 2023 - Sagar Bhure, Security Engineer at F5.
summary
Claims that a machine learning layer can detect API threats in near real time using a XGBoost binary classifier trained on 5 million labeled HTTP requests and engineered features (length, nonprintables, SQL keywords). Demo shows a proof‑of‑concept WAF that classifies payloads and returns 403 for XSS/SQLi samples and 200 for benign inputs. Covers supervised vs unsupervised tradeoffs, MLops deployment at API gateways, false positives and adversarial‑training via WASP ML SVSS guidance.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:46Speaker intro
- 2:53ML basics for API security
- 9:19ML model types
- 12:30Traditional API security limits
- 17:12ML in API gateways
- 22:29API security threats addressed by machine learning
- 33:33Demo setup & model
- 38:19Live ML WAF demo
- 41:29ML AppSec best practices
- 44:22Q&A
related talks
24mSecuring AI Integration with API's
12mSweet or Heat
41mWill Machine Learning Replace The WAF?
33mSafeguard Your APIs: Machine Learning Solutions
24mAPI security, mitigate API abuses using machine learning
51mThe Next Application Security Frontier: AI-Ready API Defense
24mDiscussion between Mehdi Medjaoui and Troy Leliard,API Security.
03mAI vs AI to protect APIs