Does Behavioural Detection Work Against AI Agent API Traffic?

Imagine a customer logged in to your online portal. Their token is valid, and so is their session. Then one number at the end of an API call changes, and the response comes back with a different customer's account. The WAF sees a well-formed request from an authenticated user. The schema check passes. Nothing in the log says attack.

That is an abuse of business logic; cybersecurity analyst Jonathan Care refers to it as a series of "perfectly valid calls in a sequence you never anticipated, doing something you never intended."

In this episode of The Security Strategist podcast, Jonathan Care, lead analyst at KuppingerCole, sat down with Uri Dorot, Senior Product Marketing Manager at Radware, to talk about possibilities and impossibilities of API tooling, how detection can tell the difference between an attacker and an unusual customer, and the steps a CISO can take when working with a limited budget.

Also Watch: Can Runtime Security Keep Autonomous AI Under Control?

Why Visibility is Key in Protecting Enterprise APIs?

According to Dorot, the process begins with an inventory. He says, “Visibility is King.” If you don't know something, you can't protect it.

He points out that enterprises are unaware of more than the majority of their APIs. This is why the API discussion has to begin with visibility and understanding what API’s enterprises have to protect them. 

The problem is that these enterprises lack visibility into their APIs and don’t have access to the right tools or the right methodologies in place to document APIs or follow them. 

For instance, Dorot exemplifies this: Think of an insurance company or a bank that has been around for a while. They began launching their first digital assets in the late 90s or early 2000s. Now think of many developers and security professionals who have worked for that company through the years on different projects, teams, and products. They worked on several different APIs implemented — internal, external, or third-party. 

Now the question is whether the professionals who worked on these legacy APIs did a good job of documenting them, updating them, and ensuring that when they leave the company, everyone at the enterprise knows about the stranded APIs. “The answer is no,” Dorot says. 

The world has advanced rapidly, and “we moved from monolithic applications to more of a multi-layer distributed app sitting in all sorts of environments,” he adds. “Relying on third-party services means lots of data and content coming from third-party providers; it's really hard to determine where your application environment begins and where it ends. With the world of APIs, it's really expanding fast.”

It’s the legacy components of enterprise applications that are behind the API attacks. 

A shadow API is one that developers are aware of but which security personnel are not; beyond that, there are APIs "which even the DevOps teams are not aware of", for example, deprecated endpoints. Care also introduces the concept of the zombie API, which remains connected to backend data even after the application has been decommissioned.

Also Watch: Unmasking the Invisible Threat: Defend Your APIs Before Attackers Do

What Are The Repercussions of AI in API Protection?

Dorot claims that AI has increased the difficulty of the task. In the past, locating forgotten endpoints required a certain level of skill and involved manual work. Nowadays, "it's quite easy for them to use all sorts of AI tools for reconnaissance". 

“Before the democratisation of Gen AI, hackers would have to manually explore enterprise applications, database to find loopholes, vulnerable, deprecated, outdated API endpoints,” the Radware speaker explains. 

“Today it's quite easy for hackers to use a multitude of AI tools for reconnaissance or use sophisticated, or even unsophisticated, tools or crawlers. They can find vulnerabilities in large numbers.”

Behavioural detection is another area, Dorot tells Care, that is a hot topic right now. It plays a critical role in detecting agentic AI traffic. 

The world is heading beyond API detection to a world of agent trust management. Understanding the incoming AI traffic will become centre stage. Radware helps businesses leverage this new area of tackling AI traffic so enterprises don’t lose. 

"You need to identify the fact that the traffic is coming from an agent, and then you have to examine the behaviour, the context and the content,” Dorot states.

While the importance of identity cannot be overlooked, Dorot says that an enterprise can’t rely on identity alone. One must consider which agent is acting on behalf of which person and under what authority. Radware integrates with customers' API gateways when it comes to authentication and authorisation. However, a gateway is not a replacement, since "it does not replace API security platforms".

Also Watch: Can You Stop an API Business Logic Attack?

Key Takeaways

• Majority of enterprises fail to detect more than 90% of their APIs.
• Developers are familiar with Shadow APIs, whereas zombie APIs are not.
• Endpoint tools can be located cheaply via AI tools and crawlers.
• Attacks based on business logic make use of valid calls; schema checks can’t detect them.
• Business logic attacks use valid calls, so schema checks miss them.
• Response inspection catches reused tokens and PII leaving.
• Identity alone is insufficient; behaviour and context also matter.
• A gateway does not replace an API security platform.
• Every discovered API needs a named owner.