Abstract: Live and legitimate user traffic is used with in depth knowledge of the business logic for an API specification to perform security testing on a set of APIs. The present system intercepts and analyzes application program interface (API) traffic, identifies user session data, and identifies traffic suitable to duplicate. The identified traffic is duplicated and modified by addition of malicious code. The modified code is then sent to its intended API destination, where it is processed as normal. The resulting response and other traffic as well as the API system and optionally other systems, such as datastore systems, are analyzed to determine if the malicious code resulted in a valid attack. Results from the modified code attack attempts are reported to a user.

Abstract: A system that intelligently traces and identify sensitive data, tracks the flow of the sensitive data and is able to quickly and accurately identify privacy compliance issues. Tracing agents installed in a monitored system intercept API requests and responses, store the data, and process the data. Processing the data may include grouping APIs based on type and identifying user sessions. Baseline activity of a valid user is determined based on the analyze request and response data, and blocking rules can be applied at each individual tracing agent. The blocking rules can prevent unauthorized transmission of sensitive data, privacy violations, unauthorized users, and other improper access to data. The blocking rules may block all or a portion of an API request or response.

Abstract: Live and legitimate user traffic is used with in depth knowledge of the business logic for an API specification to perform security testing on a set of APIs. The present system intercepts and analyzes application program interface (API) traffic, identifies user session data, and identifies traffic suitable to duplicate. The identified traffic is duplicated and modified by addition of malicious code. The modified code is then sent to its intended API destination, where it is processed as normal. The resulting response and other traffic as well as the API system and optionally other systems, such as datastore systems, are analyzed to determine if the malicious code resulted in a valid attack. Results from the modified code attack attempts are reported to a user.