Abstract: A system and method for mitigating cyber threats based on excessive computing interface usage behaviors. A method includes creating a baseline with respect to at least one computing interface usage metric, wherein each computing interface usage metric is defined with respect to computing interface usage by a user, wherein creating the baseline further comprises training an anomaly detection machine learning model using a training set including a plurality of training values for the at least one computing interface metric; detecting an anomaly in calls made by the user based on at least one deviation from the baseline above a threshold, wherein detecting the anomaly further comprises applying the anomaly detection machine learning model to a plurality of features including values of the at least one computing interface usage metric for the calls made by the user; and mitigating the detected anomaly.

Abstract: Systems and methods for resolving dependencies of computing interfaces. An example method includes identifying at least one example value with respect to a specification of a first computing interface, wherein each of the at least one example value is a value included in a respective request to the first computing interface; and linking the first computing interface to at least one second computing interface based on the identified at least one example value.

Abstract: A system and method for identifying computing interface calls using communications protocols. A method includes extracting data from a communications session involving communication between a first computing interface and a second computing interface, wherein the communication between the first computing interface and the second computing interface is implemented via a plurality of communication protocol layers, wherein extracting the data from the communications session further comprises building at least one layer of the plurality of communication protocol layers based on a portion of the data extracted from at least one other layer of the plurality of communication protocol layers; duplicating traffic for the communications session based on the extracted data, wherein duplicating the traffic further comprises converting the extracted data into a unified data modeling format; and identifying at least one computing interface call based on the duplicated traffic.

Abstract: A system and method for clustering computing interface calls. A method includes: determining a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings; and clustering a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings.

Abstract: A system and method for securing a computing infrastructure. A method includes performing reconnaissance with respect to a computing infrastructure in order to identify a plurality of portions of the computing infrastructure and a plurality of components of the computing infrastructure; correlating the plurality of portions of the computing infrastructure with the plurality of components of the computing infrastructure; identifying an integration point among the computing infrastructure based on the correlation, wherein the integration point is one of the plurality of components of the computing infrastructure through which the computing infrastructure is integrable; and performing at least one mitigation action based on the identified integration point.

Abstract: A system and method for securing computing interfaces based on call flows. A method includes identifying a plurality of computing interface calls, wherein each computing interface call is identified as being associated with a user of a plurality of users; identifying at least one computing interface call flow with respect to the plurality of computing interface calls based on the user with which each computing interface call is associated, wherein each computing interface call flow includes an ordered sequence of computing interface calls among the plurality of computing interface calls; and detecting, based on the at least one computing interface call flow, at least one abnormality with respect to the plurality of computing interface calls.

Abstract: A system and method for clustering computing interface calls. A method includes: determining a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings; and clustering a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings.

Abstract: A system and method for clustering computing interface calls. A method includes: determining a plurality of computing interface cluster definitions, the plurality of computing interface cluster definitions including a plurality of parameter type strings; and clustering a plurality of computing interface call instances into a plurality of clusters based on the plurality of computing interface cluster definitions, wherein a number of clusters among the plurality of clusters is fewer than a number of computing interface call instances among the plurality of computing interface call instances, wherein clustering the plurality of computing interface call instances includes determining a plurality of portions of the plurality of computing interface call instances which match types of parameters represented by respective parameter type strings of the plurality of parameter type strings.

Abstract: A system and method for securing a computing environment using graphing of computing interfaces. A method includes traversing a network configuration graph with respect to a first component deployed in a computing environment. Traversing the network configuration graph results in a connections between components in the computing environment represented by nodes including at least one connection to a first node representing the first component. The nodes include at least one computing interface node and at least one other node. Each computing interface node represents a computing interface of computing interfaces deployed in the computing environment. The method also includes determining, based on the connections, a configuration of the first component with respect to service or consumption of at least one of the computing interfaces. The method also includes detecting a misconfiguration of the first component based on the determined configuration of the first component.

Abstract: A system and method for traffic-based misconfiguration detection. A method includes analyzing a first set of computing interface traffic data to identify types of data included among traffic to and from a computing interface; creating at least one computing interface schema based on the analysis, wherein each computing interface schema defines a plurality of schema fields and a plurality of corresponding schema values, wherein each schema value indicates a normal behavior for the computing interface with respect to the corresponding schema field; and identifying a misconfiguration of the computing interface based on the at least one computing interface schema and a second set of computing interface traffic data.

Abstract: A system and method for securing a computing environment using graphing of computing interfaces. A method includes traversing a network configuration graph with respect to a first component deployed in a computing environment. Traversing the network configuration graph results in a connections between components in the computing environment represented by nodes including at least one connection to a first node representing the first component. The nodes include at least one computing interface node and at least one other node. Each computing interface node represents a computing interface of computing interfaces deployed in the computing environment. The method also includes determining, based on the connections, a configuration of the first component with respect to service or consumption of at least one of the computing interfaces. The method also includes detecting a misconfiguration of the first component based on the determined configuration of the first component.

Abstract: Systems and methods for resolving dependencies of computing interfaces. An example method includes identifying at least one example value with respect to a specification of a first computing interface, wherein each of the at least one example value is a value included in a respective request to the first computing interface; and linking the first computing interface to at least one second computing interface based on the identified at least one example value.

Abstract: Systems and methods for active parameter identification. An example method includes applying a machine learning model to features extracted from each of at least one request to a computing interface, wherein the machine learning model is trained per value using a training set including a plurality of training values of a plurality of training requests, wherein the machine learning model is trained to output an indicator as to whether each portion of a request containing a respective value indicates a parameter when applied to the request; and identifying at least one parameter-indicating portion of each request to the computing interface based on outputs of the machine learning model.

Abstract: A system and method for static analysis. A method includes accessing a cloud component in order to obtain configurations including sets of instructions used for routing to computing interfaces, wherein the cloud component is used to route requests to a plurality of computing interfaces. Dependencies of the computing interfaces are identified by scanning each of the configurations, where each dependency is a reliance by the computing interface on a service provided by another component in a computing environment and the dependencies are identified by applying dependency identification rules with respect to at least one type of resource implemented in each computing interface. Paths are determined based on the identified dependencies, where each path includes at least one of the computing interfaces through which requests are routed. A vulnerability is detected among the computing interfaces based on the determined paths.

Abstract: A system and method for identifying computing interface calls using communications protocols. A method includes extracting data from a communications session involving communication between a first computing interface and a second computing interface, wherein the communication between the first computing interface and the second computing interface is implemented via a plurality of communication protocol layers, wherein extracting the data from the communications session further comprises building at least one layer of the plurality of communication protocol layers based on a portion of the data extracted from at least one other layer of the plurality of communication protocol layers; duplicating traffic for the communications session based on the extracted data, wherein duplicating the traffic further comprises converting the extracted data into a unified data modeling format; and identifying at least one computing interface call based on the duplicated traffic.