Abstract: A system that intercepts and analyzes application program interface (API) traffic, identifies correlations between components of API traffic, and uses those correlations to detect anomalous behaviors. API traffic, including requests and responses, is intercepted and analyzed to identify correlations in the API traffic. The correlations may be based on API traffic and can include a sequence of APIs, parameters passed between earlier and subsequent APIs, user roles within a user session and APIs accessed by the user roles, and other correlations. Correlation data for user sessions is generated and stored, and later compared to subsequent user session traffic. If the subsequent user session traffic does not comply with the correlations detected in earlier user sessions, an anomaly may be triggered.

Abstract: A system generates a number of uniform resource locators as application program interfaces in an intelligent way based on live traffic. Live traffic between a server and multiple users is monitored and intercepted and forwarded to a remote server that processes the traffic. Traffic URLs are processed to build a digital data structure that represents nodes or portions within each URL. For URLs having different nodes at the same hierarchical level that have the same type, the present system may replace those different nodes with a representative node. The representative node replaces the nodes at the same hierarchical level having the same type, but having different values.

Abstract: A system analyzes APIs and automatically generates an API description for the system. The APIs each have an API behavior, which can include a request and a response. Each request and response can have different components. The present system automatically learns characteristics and patterns in the request and response components. As clients engage an API, the component data in the requests and responses for the API are monitored and distributions for various characteristics are determined. Once the API description is automatically generated by the system, the API description can be compared to incoming API requests to identify anomalies that can be associated with users without proper credentials.

Abstract: In one embodiment, a monitoring process detects one or more events capable of causing a future state change in a browser application having initially loaded a single page application (SPA) page, and maintains one or more causality chains of the one or more events, each causality chain tracing events of that causality chain to a respective root cause event of that causality chain. Upon detecting a virtual page transition to create a new virtual page, the monitoring process may determine that a cause of the virtual page transition matches a particular root cause event of a particular causality chain, and correlates all events of the particular causality chain to the new virtual page (e.g., where events may notably include XHRs). In another embodiment, the monitoring process may further set a start time of the particular root cause event as the start time of the new virtual page.

Abstract: In one embodiment, a monitoring process identifies a plurality of media elements added inside a viewport of a webpage, and calculates a render time of each of the plurality of media elements. After determining a load completion time of the webpage, the monitoring process may then determine a particular media element of the plurality of media elements that rendered last in the viewport before the load completion time based on the calculated render times. Accordingly, the monitoring process may then establish that a visually complete time (VCT) of the webpage is a corresponding render time of the particular media element that rendered last in the viewport.

Abstract: In one embodiment, a monitoring process detects a page load start time of a single page application (SPA) page having added direct resources and dynamic resources, tracks the direct resources and dynamic resources, and notes a load end time for each of the tracked direct resources and dynamic resources. The monitoring process stops the tracking of the direct resources and dynamic resources in response to a determination of a threshold duration of network inactivity, and determines a maximum load end time of the tracked direct resources and dynamic resources. Accordingly, the monitoring process may then set a page load time of the SPA page as a difference between the maximum load end time and the page load start time.

Abstract: In one embodiment, a monitoring process identifies a plurality of media elements added inside a viewport of a webpage, and calculates a render time of each of the plurality of media elements. After determining a load completion time of the webpage, the monitoring process may then determine a particular media element of the plurality of media elements that rendered last in the viewport before the load completion time based on the calculated render times. Accordingly, the monitoring process may then establish that a visually complete time (VCT) of the webpage is a corresponding render time of the particular media element that rendered last in the viewport.

Abstract: In one embodiment, a monitoring process detects one or more events capable of causing a future state change in a browser application having initially loaded a single page application (SPA) page, and maintains one or more causality chains of the one or more events, each causality chain tracing events of that causality chain to a respective root cause event of that causality chain. Upon detecting a virtual page transition to create a new virtual page, the monitoring process may determine that a cause of the virtual page transition matches a particular root cause event of a particular causality chain, and correlates all events of the particular causality chain to the new virtual page (e.g., where events may notably include XHRs). In another embodiment, the monitoring process may further set a start time of the particular root cause event as the start time of the new virtual page.

Abstract: In one embodiment, a monitoring process detects a page load start time of a single page application (SPA) page having added direct resources and dynamic resources, tracks the direct resources and dynamic resources, and notes a load end time for each of the tracked direct resources and dynamic resources. The monitoring process stops the tracking of the direct resources and dynamic resources in response to a determination of a threshold duration of network inactivity, and determines a maximum load end time of the tracked direct resources and dynamic resources. Accordingly, the monitoring process may then set a page load time of the SPA page as a difference between the maximum load end time and the page load start time.

Abstract: In one embodiment, techniques herein determine a plurality of resources loaded during rendering of a web page on a client device, and determine a duration of time taken for each of the plurality of resources to fully load. Accordingly, the techniques herein may then cluster the plurality of resources into clusters, comprising a first cluster consisting of resources having the shortest durations of the plurality of resources and a second cluster consisting of resources having the longest durations of the plurality of resources. Those resources of the first cluster may then be classified as cached resources, while those resources of the second cluster may be classified as non-cached resources.

Abstract: In one embodiment, techniques herein determine a plurality of resources loaded during rendering of a web page on a client device, and determine a duration of time taken for each of the plurality of resources to fully load. Accordingly, the techniques herein may then cluster the plurality of resources into clusters, comprising a first cluster consisting of resources having the shortest durations of the plurality of resources and a second cluster consisting of resources having the longest durations of the plurality of resources. Those resources of the first cluster may then be classified as cached resources, while those resources of the second cluster may be classified as non-cached resources.