Securing an application based on auto-learning and auto-mapping of application services and apis

Abstract

A computerized method for securing an application based on auto-learning and auto-mapping of application services and application programming interfaces (APIs), includes the step of providing a distributed application security mesh system. The method includes the step of implementing a learning mode of the distributed application security mesh system. This includes learning a set of services and a set of APIs that are used by the set of services to interact with each other. The service comprises an application service. This includes creating a record of the set of services. The record comprises a list of services that are currently active in a specified environment of the distributed application security mesh system, and a list of interactions of the services. The method includes the step of implementing an enforcing mode of the distributed application security mesh system. This includes determining that there is a deviation from a state of at least one record of the set of services provided during the learning mode. This includes implementing a mechanism for the review of the deviations by administrators of the systems and updating the learned state or to take an action based on the review.

What is claimed as new and desired to be protected by Letters Patent of the United States is: 
     
         1 . A computerized method for securing an application based on auto-learning and auto-mapping of application services and application programming interfaces (APIs), comprising:
 providing a distributed application security mesh system;   implementing a learning mode of the distributed application security mesh system comprising:
 learning a set of services and a set of APIs that are used by the set of services to interact with each other, wherein the service comprises an application service; 
 creating a record of the set of services, wherein the record comprises:
 a list of services that are currently active in a specified environment of the distributed application security mesh system, and 
 a list of interactions of the services; and 
 
   implementing an enforcing mode of the distributed application security mesh system comprising:
 determining that there is a deviation from a state of at least one record of the set of services provided during the learning mode, and 
 implementing a mechanism for the review of the deviations by administrators of the systems and updating the learned state or to take an action based on the review. 
   
     
     
         2 . The computerized method of  claim 1 , wherein the set of services are discovered:
 using a service discovery mechanism provided by a platform on which the application is deployed,   using a manually entered configuration of the platform on which the application is deployed, and   using traffic inspection in the application environment.   
     
     
         3 . The computerized method of  claim 1  further comprising:
 categorizing each service of the set of services into a set of different categories that are based on the attributes of the service interactions of each service, wherein the attributes comprises:
 a protocol of the service, 
 an administrator assigned attribute to the service, 
 an administrator assigned attribute to the API that is being provided by the service when the service is interacting with external users or external services. 
 
 
     
     
         4 . The computerized method of  claim 1  further comprising:
 generating a service dependency map from the list of interactions of each service of the list of services; and 
 generating an API dependency map from the list of API interactions of each service of the list of services. 
 
     
     
         5 . The computerized method of  claim 1 , wherein the step of learning a set of services and a set of APIs that are used by the set of services to interact with each other, wherein the learning of the services and APIs comprises the steps of:
 determining the various services that are interacting with each other and are active in the environment;   determining the categories of various services that are interacting with each other and are active in the environment; and   determining all the unique pairs or segments of services that interact with each other.   
     
     
         6 . The computerized method of  claim 5 , wherein the step of learning a set of services and a set of APIs that are used by the set of services to interact with each other, wherein the learning of the services and APIs comprises the steps of:
 determining set of APIs used by each service to interact with other service;   determining the services that are interacting with the external users or services; and   determining a schema of the set of APIs, wherein the schema of an API governs the format and structure of the API.   
     
     
         7 . The computerized method of  claim 6 , wherein the step of learning a set of services and a set of APIs that are used by the set of services to interact with each other, wherein the learning of the services and APIs comprises the steps of:
 determining a rate of requests per second at which each API of the set of APIs is invoked;   determining an invocation sequence of each API of the set of APIs with respect to the other APIs of the set of APIs; and   determining amount of data that is transmitted or received by the service changes.   
     
     
         8 . The computerized method of  claim 7 , wherein the step of learning a set of services and a set of APIs that are used by the set of services to interact with each other, wherein the learning of the services and APIs comprises the steps of:
 determining the resource usage of the services in terms of CPU, memory and network usage; and   determining the resource usage of the APIs in terms of CPU, memory and network usage.   
     
     
         9 . The computerized method of  claim 1 , wherein the step of determining that there is a deviation from a state of at least one record of the set of services provided during the learning mode:
 for each API of the set of APIs, determining a deviation from the learned state, wherein the deviation from the learned state comprises:
 a new service that was not seen previously during learning mode and has become active in the environment; 
 a new pair of services start to interact with each other that were not seen previously interacting during learning mode; and 
 a new pair of services categories to interact with each other that were not seen previously interacting during learning mode. 
   
     
     
         10 . The computerized method of  claim 9 , wherein the step of determining that there is a deviation from a state of at least one record of the set of services provided during the learning mode:
 for each API of the set of APIs, determining a deviation from the learned state, wherein the deviation from the learned state comprises:
 a known service start to use a new API that it was not previously used during learning mode; 
 a known service start to use a known API but with a different service that was not previously used; and 
 a new service start to interact with the external users or the applications that were not used before. 
   
     
     
         11 . The computerized method of  claim 10 , wherein the step of determining that there is a deviation from a state of at least one record of the set of services provided during the learning mode:
 for each API of the set of APIs, determining a deviation from the learned state, wherein the deviation from the learned state comprises:
 a rate at which the service was invoking APIs or a specific API changes; 
 an amount of data that is transmitted or received by the service changes; and 
 an invocation sequence in which the service was invoking the APIs changes. 
   
     
     
         12 . The computerized method of  claim 11 , wherein the step of determining that there is a deviation from a state of at least one record of the set of services provided during the learning mode:
 for each API of the set of APIs, determining a deviation from the learned state, wherein the deviation from the learned state comprises:
 a schema of API changes; 
 a request origin change in terms of geo-location; and 
 a user identifier is associated with an API requests change, and 
 a specified service is associated with the deviation is shut down, stopped or mitigated in a specified manner. 
   
     
     
         13 . The computerized method of  claim 1 , wherein the step of implementing the enforcing mode of the distributed application security mesh system further comprises:
 communicating the deviation to a system administrator;   allow the administrator to be able to review the deviation either manually or programmatically through a script, and   implementing an action specified by the system administrator.   
     
     
         14 . The computerized method of  claim 2 , wherein the action specified by the system administrator results in:
 blocking the interaction between services such that the deviation is no longer observed;   blocking the specific service that is causing deviation such that deviation is no longer observed; and   blocking a specific API that is causing deviation such that the deviation is no longer observed.   
     
     
         15 . The computerized method of  claim 14 , wherein the action specified by the system administrator results in:
 logging the interaction between services such that the deviating behavior is logged but the services are allowed to interact;   logging the activity from a specific service such that the deviating behavior is logged but the service is allowed to be active in the environment; and   logging the specific API requests and responses such that deviating behavior is logged but the API is continued to be allowed in the environment.   
     
     
         16 . The computerized method of  claim 15 , wherein the action specified by the system administrator results in:
 remediating the deviation by rate controlling the API requests; and   accepting the deviating behavior such that the specific deviating behavior then is added to the learned state and the deviating behavior then is considered as the good behavior and does not lead to deviation.