Advanced API Security menggunakan aturan deteksi untuk mendeteksi pola yang tidak biasa dalam traffic API yang dapat mewakili aktivitas berbahaya. Aturan ini mencakup model machine learning, yang dilatih dengan data API asli, dan aturan deskriptif, berdasarkan jenis ancaman API yang diketahui.
Tabel berikut mencantumkan aturan deteksi dan deskripsinya.
Aturan deteksi
Deskripsi
Model machine learning yang
mendeteksi scraping API, yaitu proses mengekstrak informasi
yang ditargetkan dari API untuk tujuan berbahaya.
Model machine learning untuk mendeteksi anomali—pola peristiwa yang tidak biasa—dalam
traffic API. Lihat Tentang Deteksi Anomali Lanjutan.
Brute Guessor
Proporsi error respons yang tinggi selama 24 jam sebelumnya
Flooder
Proporsi traffic yang tinggi dari alamat IP dalam periode 5 menit
Penyalahgunaan OAuth
Sejumlah besar sesi OAuth dengan sejumlah kecil agen pengguna selama 24 jam sebelumnya
Pelaku Penyalahgunaan Robot
Sejumlah besar error penolakan 403 dalam 24 jam terakhir
Pengikis Konten Statis
Proporsi ukuran payload respons yang tinggi dari alamat IP dalam jangka waktu 5 menit
TorListRule
Daftar IP node keluar Tor. Node keluar Tor adalah node Tor terakhir yang dilewati traffic
di jaringan Tor
sebelum keluar ke internet. Mendeteksi node keluar Tor menunjukkan bahwa
agen telah mengirim traffic ke API Anda dari jaringan Tor, mungkin untuk
tujuan berbahaya.
Tentang Deteksi Anomali Lanjutan
Algoritma Deteksi Anomali Lanjutan mempelajari traffic API Anda, dengan mempertimbangkan
faktor seperti tingkat error, volume traffic, ukuran permintaan, latensi, geolokasi, dan metadata
traffic lainnya di tingkat lingkungan. Jika ada perubahan signifikan dalam pola traffic (misalnya, lonjakan traffic, rasio error, atau latensi), model akan menandai alamat IP yang menyebabkan anomali di Traffic yang Terdeteksi.
Untuk mengurangi risiko bahwa pelaku kejahatan dapat mengeksploitasi model, kami tidak memaparkan detail spesifik
tentang cara kerja model atau cara mendeteksi insiden. Namun, informasi tambahan ini dapat membantu Anda memanfaatkan deteksi anomali secara optimal:
Memperhitungkan varians musiman:Karena model dilatih dengan data traffic Anda, model dapat mengenali dan memperhitungkan varians traffic musiman (seperti traffic liburan), jika data traffic Anda menyertakan data sebelumnya untuk pola tersebut, seperti liburan yang sama pada tahun sebelumnya.
Menampilkan anomali:
Untuk pelanggan Apigee dan hybrid yang sudah ada: Apigee
merekomendasikan agar Anda memiliki data traffic API historis minimal selama 2 minggu dan, untuk hasil yang lebih akurat, sebaiknya memiliki data historis selama 12 minggu. Deteksi Anomali Lanjutan
mulai menampilkan anomali dalam waktu enam jam setelah ikut serta dalam pelatihan model.
Pengguna Apigee baru: Model mulai memunculkan anomali 6 jam setelah
Anda mengaktifkan fitur ini, jika Anda memiliki data historis minimal 2 minggu.
Namun, sebaiknya berhati-hatilah saat menindaklanjuti anomali yang terdeteksi hingga
model memiliki data pelatihan setidaknya selama 12 minggu. Model ini terus dilatih dengan data historis traffic Anda sehingga menjadi lebih akurat seiring waktu.
Batasan
Untuk Deteksi Penyalahgunaan dan Deteksi Anomali Lanjutan:
Anomali terdeteksi di tingkat
lingkungan. Deteksi anomali di tingkat proxy individual tidak didukung untuk saat ini.
Deteksi anomali saat ini tidak didukung untuk pelanggan VPC-SC.
Machine learning dan aturan deteksi
Advanced API Security menggunakan model yang dibangun dengan algoritma machine learning Google untuk mendeteksi ancaman keamanan pada API Anda. Model ini telah dilatih sebelumnya pada set data traffic API nyata (termasuk data traffic Anda saat ini, jika diaktifkan) yang berisi ancaman keamanan yang diketahui. Hasilnya, model akan mempelajari cara mengenali pola traffic API yang tidak biasa, seperti scraping dan anomali API, serta mengelompokkan peristiwa berdasarkan pola yang serupa.
Dua aturan deteksi didasarkan pada model machine learning:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eThis page provides information about Advanced API Security features in Apigee and Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003eAdvanced API Security uses detection rules, including machine learning models and descriptive rules, to identify unusual patterns in API traffic that might indicate malicious activity.\u003c/p\u003e\n"],["\u003cp\u003eThe detection rules include machine learning models like "Advanced API Scraper" and "Advanced Anomaly Detection," which are trained on real API traffic data to identify patterns indicative of security threats.\u003c/p\u003e\n"],["\u003cp\u003eOther detection rules include "Brute Guessor," "Flooder," "OAuth Abuser," "Robot Abuser," "Static Content Scraper," and "TorListRule", each targeting specific types of potential API abuse.\u003c/p\u003e\n"],["\u003cp\u003eSecurity incidents, which are groups of similar events representing security threats, can be triggered by one or multiple detection rules.\u003c/p\u003e\n"]]],[],null,["# Detection rules\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nAdvanced API Security uses *detection rules* to detect unusual patterns in\nAPI traffic that could represent malicious activity. These rules include both\nmachine learning models, trained on real API data, and descriptive rules,\nbased on known types of API threats.\n| **Note:** The Advanced API Security [Abuse detection](/apigee/docs/api-security/abuse-detection) page uses detection rules to detect security incidents. A security incident is a group of events with similar patterns that could represent a security threat. Note that one incident might be triggered by multiple detection rules, in which case all of the rules that triggered the incident are listed in the Abuse detection [Environment details](/apigee/docs/api-security/abuse-detection#environment-details) view.\n\nThe following table lists the detection rules and their descriptions.\n\nAbout Advanced Anomaly Detection\n--------------------------------\n\nThe Advanced Anomaly Detection algorithm learns from your API traffic, taking into account\nfactors like error rates, traffic volume, request size, latency, geolocation, and other traffic\nmetadata at the environment level. If there are significant shifts in traffic patterns (for\nexample, a surge in traffic, error rates, or latency), the model flags the IP address that\ncontributed to the anomaly in Detected Traffic.\n| **Note:** Use of Advanced Anomaly Detection requires opting in to training the model on your API traffic data. For more information, see [Opt in for machine learning models for Abuse Detection](/apigee/docs/api-security/abuse-detection#opt-in-for-machine-learning-models-for-machine-learning).\n\nYou can also combine anomaly detection with\n[security actions](/apigee/docs/api-security/security-actions) to automatically flag\nor deny traffic that is detected as anomalous by the model. See the\n[\"Using Apigee Advanced API Security's Security Actions to Flag and Block Suspicious Traffic\"\ncommunity post](https://www.googlecloudcommunity.com/gc/Cloud-Product-Articles/Using-Apigee-Advanced-API-Security-s-Security-Actions-to-Flag/ta-p/842645) for additional information.\n\n### Model behavior\n\nTo reduce the risk that bad actors can exploit the model, we do not expose specific details\nabout how the model works or how incidents are detected. However, this additional\ninformation can help you make the best use of anomaly detection:\n\n- **Accounting for seasonal variance:**Because the model is trained on your traffic data, it can recognize and account for seasonal traffic variances (such as holiday traffic), if your traffic data includes previous data for that pattern, such as the same holiday in a previous year.\n- **Surfacing anomalies:**\n - **For existing Apigee and hybrid customers:** Apigee recommends that you have at least 2 weeks of historical API traffic data and, for more accurate results 12 weeks of historical data is preferable. Advanced Anomaly Detection starts surfacing anomalies within six hours of opting in to model training.\n - **New Apigee users:** The model starts surfacing anomalies 6 hours after opt-in, if you have a minimum of 2 weeks of historical data. However, we recommend using caution when acting on detected anomalies until the model has at least 12 weeks of data for training. The model is continuously trained on your historical traffic data so that it becomes more accurate over time.\n\n### Limitations\n\nFor Abuse Detection Advanced Anomaly Detection:\n\n- Anomalies are detected at the environment level. Anomaly detection at an individual proxy level is not supported at this time.\n- Anomaly detection is not supported for VPC-SC customers at this time.\n\nMachine learning and detection rules\n------------------------------------\n\nAdvanced API Security uses models built with Google's machine learning algorithms to\ndetect security threats to your APIs. These models are pre-trained on real\nAPI traffic data sets (including your current traffic data, if enabled) that contain known\nsecurity threats. As a result,\nthe models learn to recognize unusual API traffic patterns, such as API scraping and anomalies,\nand cluster events together based on similar patterns.\n\nTwo of the detection rules are based on machine learning models:\n\n- Advanced API Scraper\n- Advanced Anomaly Detection\n\n| **Note:** The data used to train the machine learning models for the rules Advanced API Scraper and Advanced Anomaly Detection contain metadata, including source IP address, source geography, and the values of some HTTP request headers. However, the detection data received by the models do not include the actual values of this metadata. The model makes detections based on the statistical properties of the data, not on the values of the metadata."]]
