Organizations increasingly use API-driven applications to provide authentication, user management, object access, transactions, and application functionality through network-accessible interfaces. API requests contain behavioral characteristics such as request methods, URI structures, parameters, object identifiers, response information, and other request-level attributes that can be analyzed for security monitoring.
If malicious API activity produces behavioral characteristics that differ from normal application activity, a detection mechanism based only on predefined signatures or known attack patterns may not identify the activity effectively. Behavioral anomaly detection provides an additional approach by learning normal request behavior and identifying requests that significantly deviate from the established behavioral pattern.
In this use case, an intentionally vulnerable API-driven application is deployed in a controlled laboratory environment. The application provides API functionality and intentionally vulnerable security scenarios that can be used for authorized security experimentation.
A public web-request dataset is used as the existing data source for the machine-learning stage. Normal request records are selected and processed to establish the behavioral characteristics required for model training. The dataset is not manually created for this project.
Isolation Forest is used as the machine-learning algorithm because it can identify observations that differ from the learned normal behavioral population. The model is trained using the selected normal request behavior and is not directly trained on the controlled attack used during validation.
A controlled API authorization attack is then performed against the local application. The resulting API request is captured and processed using the same feature-extraction process used for the training data. The trained Isolation Forest model evaluates the new request and generates an anomaly result.
Public Web-Request Dataset → Normal Request Selection → Data Preprocessing → Behavioral Feature Extraction → Isolation Forest Training → Normal API Behavior Learning → OWASP crAPI → Controlled API Attack → API Request Capture → Feature Extraction → Isolation Forest Analysis → Anomalous Behavior Detection → Attack Validation
Application: OWASP crAPI
OWASP crAPI is the target API-driven application in this use case. It provides a controlled environment containing intentionally vulnerable API functionality for security testing and experimentation.
It is deployed only within the authorized laboratory environment so that API requests and controlled attack behavior can be safely generated and analyzed.
API-driven applications may expose object-level functionality through API endpoints. If authorization controls do not correctly verify whether the authenticated user is permitted to access a requested object, an attacker may manipulate an object identifier and attempt to access another user's resource.
Traditional detection mechanisms may rely on predefined attack signatures, known malicious values, or vulnerability-specific rules. Such approaches may not identify previously unseen behavioral variations when the malicious request does not exactly match an existing detection pattern.
The proposed solution introduces a behavioral anomaly-detection mechanism that learns normal API-request characteristics from existing public request data, applies Isolation Forest to the processed behavioral features, analyzes newly captured API requests, and validates the detected anomaly against a controlled attack performed in the laboratory environment.
Specific Attack: Controlled Broken Object Level Authorization Attack
The controlled attack scenario evaluates whether an authenticated API client can manipulate an object identifier and request an object that should belong to another user.
The attack is performed only against the intentionally vulnerable local application. The objective is not to cause destructive activity but to generate a realistic unauthorized API request that can be captured and analyzed by the behavioral anomaly-detection model.
Behavioral Anomaly Detection and API Security Testing
The primary security concept is Behavioral Anomaly Detection combined with controlled API Security Testing.
The first objective is to establish a behavioral representation of normal API request activity using existing public request data. The selected normal records are processed into numerical features that represent relevant characteristics of API requests.
The second objective is to evaluate whether a new API request can be identified as behaviorally different from the learned normal request population. Isolation Forest is used to isolate observations that differ from the normal behavioral distribution.
The security concept defines the overall security strategy.
The following are the specific defensive mechanisms implemented.
Normal request characteristics are processed to establish the behavioral representation required by the anomaly-detection model.
Isolation Forest evaluates request features and identifies observations that differ from the learned normal behavioral population.
The same request-feature processing approach is applied to the training data and newly captured API requests.
API requests generated during the controlled application activity are captured and analyzed for behavioral deviations.
The anomaly result is correlated with the known controlled attack performed against the application.
OWASP crAPI provides the intentionally vulnerable API environment used to generate legitimate API behavior and controlled unauthorized API activity.
Python provides the main environment for dataset processing, feature extraction, model training, anomaly scoring, and result analysis.
Scikit-learn provides the Isolation Forest implementation used for behavioral anomaly detection.
Pandas is used to load, filter, transform, and organize the existing public request records.
NumPy supports numerical transformations required during feature preparation and model processing.
cURL is used to generate and reproduce controlled HTTP/API requests against the local application.
OWASP ZAP is used to inspect and capture API communication during the controlled security assessment.
Nmap is used to identify the locally exposed services associated with the API testing environment.
Kali Linux provides the controlled environment for network discovery, API testing, and security validation activities.
Ubuntu provides the local environment for the application and machine-learning workflow.
VirtualBox provides the isolated laboratory environment used for the application and security-testing systems.
An OWASP crAPI API environment is successfully deployed in an isolated laboratory environment for controlled behavioral anomaly-detection research.
The application API services are identified and validated using controlled network-service discovery, establishing the initial API testing surface within the authorized laboratory.
Existing public web/API request data is processed without manually creating a training dataset, providing the normal behavioral information required for the machine-learning experiment.
Normal request characteristics are transformed into numerical behavioral features, creating a consistent representation suitable for Isolation Forest analysis.
The Isolation Forest model is trained using normal request behavior and establishes a behavioral baseline without directly training on the controlled attack used for validation.
Normal API activity generated through the OWASP crAPI application is captured and processed using the same feature-extraction workflow, validating the consistency of the detection pipeline.
A controlled Broken Object Level Authorization attack is performed against the local API environment, generating an unauthorized object-access request for security validation.
The attack request is captured, transformed into behavioral features, and analyzed by the trained Isolation Forest model to determine whether its behavior differs from the learned normal request population.
The detected anomaly is correlated with the controlled attack evidence, providing a practical evaluation of behavioral anomaly detection for API activity that was not directly represented in the normal-behavior training process.
The complete workflow of public request-data processing, normal behavior learning, Isolation Forest training, API service testing, controlled attack execution, request capture, behavioral feature extraction, anomaly detection, attack correlation, and final security validation is successfully demonstrated.
Research Breakthrough Possible @S-Logix