Abstract: A system and method of Application Programming Interface (API) anomaly by a processor may include receiving a target API request; inferring a machine-learning based language model on the target API request, to generate a target API vector, representing an embedding of a text of the target API request in a textual embedding space; obtaining a nearest neighbor model, comprising a plurality of baseline API vectors, each representing embedding of text of a respective baseline API request in the textual embedding space; searching the nearest neighbor model, based on the target API vector, to select one or more baseline API vectors; calculating a similarity metric value, representing similarity of the target API request to the one or more baseline API requests, based on the target API vector and the selected one or more baseline API vectors; and determining anomaly of the target API request, based on the similarity metric value.

Abstract: A system and method of providing Application Programming Interface (API) security may include receiving an API documentation data element, describing one or more types of API requests; parsing the API documentation data element, to create one or more first schemes, each comprising one or more definitions for utilization of a corresponding API request type; receiving an API request to access a computing device on a protected computer network; associating a scheme of the one or more first schemes to the received API request, based on a type of the received API request; and filtering the received API request based on the associated first scheme.

Abstract: A method includes receiving files. Deployed models analyze the files to create results with corresponding data. The results identify suspicious files. The system calculates ranked results by ranking the results according to a confidence level, and clustered groups by clustering the results based on similar data. The system calculates classes by correlating the ranked results to the clustered groups. The classes indicate accurate results and inaccurate results. The system retrains the deployed models having the class indicating inaccurate results with new training sets to create retrained models. The system validates the retrained models when the retrained models identify one or more suspicious files from the receiving. The system compares the classes of the deployed models to new classes of the retrained models. The computerized system deploys the retrained models when the new classes of the retrained models indicate accurate results greater than the classes of the deployed models.

Abstract: A method includes receiving, by a computerized system, a file in network traffic to an enterprise system. The computerized system identifies data associated with the file. The computerized system receives a policy based on the data associated with the file for an event of the file. The computerized system executes the file in a user mode of a virtual machine. A driver in a kernel mode of the virtual machine analyzes the event of the file based on the policy during the executing of the file. When the event violates the policy, the computerized system denies an entry of the file to the enterprise system.

Abstract: A method includes receiving files. Deployed models analyze the files to create results with corresponding data. The results identify suspicious files. The system calculates ranked results by ranking the results according to a confidence level, and clustered groups by clustering the results based on similar data. The system calculates classes by correlating the ranked results to the clustered groups. The classes indicate accurate results and inaccurate results. The system retrains the deployed models having the class indicating inaccurate results with new training sets to create retrained models. The system validates the retrained models when the retrained models identify one or more suspicious files from the receiving. The system compares the classes of the deployed models to new classes of the retrained models. The computerized system deploys the retrained models when the new classes of the retrained models indicate accurate results greater than the classes of the deployed models.

Abstract: A method includes receiving, by a computerized system, a file in network traffic to an enterprise system. The computerized system identifies data associated with the file. The computerized system receives a policy based on the data associated with the file for an event of the file. The computerized system executes the file in a user mode of a virtual machine. A driver in a kernel mode of the virtual machine analyzes the event of the file based on the policy during the executing of the file. When the event violates the policy, the computerized system denies an entry of the file to the enterprise system.