International Business Machines Corporation
Detecting inappropriate activity in the presence of unauthenticated API requests using artificial intelligence

Abstract:

Unauthenticated client access to an application (e.g., a SaaS-based web application) that employs unauthenticated API endpoints is monitored and protected by an access control system and method that leverages a neural network. The neural network is trained to recognize user behaviors that should be deemed to be "inappropriate" according to a policy. Using the neural network, the system provides effective discrimination with respect to unauthenticated user behavior, and it enables access controls to be more effectively enforced with respect to users that are not using the application according to an enterprise security policy. By training the neural network to recognize pattern(s) behind regular user behavior, the approach enables robust access control with respect to users that are unauthenticated. More generally, the approach facilitates access control based in whole or in part on API interactions with an application where the identity of the individuals making that access are unknown or necessarily ascertainable.