HTTP REST API Structure Learning
2026-07-02 • Software Engineering
Software EngineeringCryptography and Security
AI summaryⓘ
The authors developed a new method called HRAL to spot unusual or harmful activity in web APIs by learning their normal behavior from network data, without needing detailed rules or documentation. They tested HRAL and found it works well even when API documentation is incomplete, outperforming other methods. When combined with existing security rules, their approach detected all threats in their tests. This suggests HRAL could help protect APIs in real-world situations where documentation is often missing or partial.
APIREST APIanomaly detectionunsupervised learningOpenAPInetwork trafficOWASPModSecurityF1-scoreAPI security
Authors
Ran Dubin, Amit Dvir
Abstract
Application Programming Interfaces (APIs) are essential in software development, enabling web services, mobile apps, and microservices. However, their widespread use introduces significant security risks, highlighting the importance of API security. This paper presents HTTP REST API Learning (HRAL), a novel unsupervised anomaly detection approach that models the structure and behavior of API endpoints directly from network traffic, without relying on predefined rules or documentation. HRAL enables robust detection of malicious activity by understanding how APIs behave and flagging deviations as potential threats. We evaluate HRAL across varying levels of OpenAPI documentation detail and compare it with existing techniques. HRAL achieves strong performance, with an average recall of 82.07% and an F1-score of 87.24%, significantly outperforming alternatives when API documentation is limited. Moreover, our results approach the effectiveness of full API document definitions. When combined with signature-based rules such as the OWASP ModSecurity CRS, our system achieves 100% detection. These results highlight HRAL's effectiveness in real-world, partially documented API environments and its potential as a foundational layer for modern API security solutions.