Adoption of Deep-Learning Models for Managing Threat in API Calls with Transparency Obligation Practice for Overall...

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Software Engineering

Background:

• Application Programming Interfaces (APIs) are crucial for system-to-system communication, enabling efficient service delivery.
• APIs introduce security vulnerabilities exploitable by attackers, necessitating robust threat identification and mitigation strategies.
• Analyzing API call traffic for threats is challenging due to large data volumes and evolving attack vectors.

Purpose of the Study:

• To develop an integrated architecture for effective threat detection in system-to-system communication via API calls.
• To enhance organizational security posture by identifying and mitigating API-related vulnerabilities.
• To introduce transparency in the AI lifecycle for better understanding and trust in threat detection models.

Main Methods:

• An integrated architecture combining Artificial Neural Network (ANN) and Multilayer Perceptron (MLP) deep-learning models was developed.
• Threat analysis was performed using open-intelligence catalogues (CWE, CAPEC) and NIST SP 800-53 controls.
• Transparency was ensured through data/methodological practices and SHapley Additive exPlanations (SHAP) analysis.

Main Results:

• The proposed methodology achieved an average detection accuracy of 88% on the Windows PE Malware API dataset.
• Key features like FindResourceExA and NtClose were identified as indicators of potential weaknesses and threats.
• The study provides a list of accurate control actions for managing identified API call threats.

Conclusions:

• The developed deep-learning architecture effectively detects threats in large API call datasets, improving system resilience.
• Transparency in AI models enhances understandability and trust for all user groups.
• Identifying specific API features linked to threats enables targeted security control implementation.