Citation:

Rajesh Balaji, 2025. "Request-Level Anomaly Detection and Risk-Adaptive Authorization for Microservice APIs", ESP Journal of Engineering & Technology Advancements  5(2): 342-351.

Abstract:

A request can satisfy an authorization policy and still be harmful. A support agent may be permitted to issue refunds but misuse that authority; a customer can scrape public catalogue data; and a stolen session can present a valid token. We investigate whether a microservice API can use the decisions and permissions already encoded in its authorization policy to recognize such behavior and apply a proportionate restriction. Our method aggregates gateway and Open Policy Agent (OPA) decision records into five-minute windows, combines six gateway rules with role-specific Isolation Forest scores, and scales anomaly evidence according to the sensitive actions available to each principal. Depending on risk and the type of signal, the proposed response is a step-up challenge, a restricted session, or session revocation. The evaluation uses a synthetic AegisCommerce retail-API workload with policy-derived allow/deny decisions. Across five held-out test seeds, approximately one million generated requests include 200 modeled incidents spanning eight scenarios. The combined detector achieves mean window-level F1 of 0.748 and incident recall of 0.885, compared with 0.672 and 0.785 for gateway rules and 0.323 and 0.535 for Isolation Forest alone. It produces 4.3 false alert episodes per day on average. In a separately simulated response model, graded actions stop 70.2% of modeled attack activity, compared with 74.5% for a 60-minute block on the same alerts, while reducing legitimate requests blocked from 49.9 to 33.8 per day and avoiding complete benign-user lockouts under the assumed challenge outcomes. These findings establish behavior within the specified simulation; production effectiveness and user impact remain unmeasured.

References:

[1] S. Rose, O. Burchett, S. Mitchell, and S. Connelly, "Zero Trust Architecture," NIST Special Publication 800-207, Aug. 2020.

[2] OWASP Foundation, "OWASP API Security Top 10 – 2023," owasp.org.

[3] OWASP Foundation, "OWASP Automated Threats to Web Applications," handbook, owasp.org.

[4] P. A. Grassy et al., "Digital Identity Guidelines: Authentication and Lifecycle Management," NIST Special Publication 800-63B, Jun. 2017 (updated Mar. 2020).

[5] Open ID Foundation, "Open ID Continuous Access Evaluation Profile 1.0," Shared Signals Working Group.

[6] Hard, Ed., "The Oath 2.0 Authorization Framework," RFC 6749, IETF, Oct. 2012.

[7] M. Freeman, S. Jain, M. Demuth, B. Baggie, and G. Jacinto, "Who Are You? A Statistical Approach to Measuring User Authenticity," in Proc. Network and Distributed System Security Symposium (NDSS), 2016.

[8] S. Waffling, L. Lo Dacono, and M. Demuth, "Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild," in Proc. IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), 2019.

[9] K. Thomas et al., "Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials," in Proc. ACM SIGSAC Conference on Computer and Communications Security (CCS), 2017.

[10] T. Liu, K. M. Ting, and Z.-H. Zhou, "Isolation Forest," in Proc. 8th IEEE International Conference on Data Mining (ICDM), 2008.

[11] R. Summer and V. Parson, "Outside the Closed World: On Using Machine Learning for Network Intrusion Detection," in Proc. IEEE Symposium on Security and Privacy, 2010.

[12] Arp et al., "Dos and Don'ts of Machine Learning in Computer Security," in Proc. 31st USENIX Security Symposium, 2022.

[13] B. A. Alameda, L. Axon, and I. Martinovic, "99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms," in Proc. 31st USENIX Security Symposium, 2022.

[14] M. B. Salem, S. Hershkop, and S. J. Stolfo, "A Survey of Insider Attack Detection Research," in Insider Attack and Cyber Security, Springer, 2008.

[15] Software Engineering Institute, "Common Sense Guide to Mitigating Insider Threats," 6th ed., Carnegie Mellon University, 2019.

[16] OWASP Foundation, "Credential Stuffing Prevention Cheat Sheet," cheatsheetseries.owasp.org.

[17] Pedregosa et al., "Sickie-learn: Machine Learning in Python," Journal of Machine Learning Research, vol. 12, pp. 2825-2830, 2011.

[18] Open Policy Agent Project, openpolicyagent.org.

[19] W. U. Hassan et al., "No Doze: Combatting Threat Alert Fatigue with Automated Provenance Triage," in Proc. Network and Distributed System Security Symposium (NDSS), 2019.

[20] Joint Task Force Transformation Initiative, "Guide for Conducting Risk Assessments," NIST Special Publication 800-30 Rev. 1, Sep. 2012.

[21] S. Waffling, M. Demuth, and L. Lo Dacono, "More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication," in Proc. Annual Computer Security Applications Conference (ACSAC), 2020.

[22] J. Bonnie, C. Harley, P. C. van Borscht, and F. Stefano, "The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes," in Proc. IEEE Symposium on Security and Privacy, 2012.

[23] V. Bertocci and B. Campbell, "Oath 2.0 Step Up Authentication Challenge Protocol," RFC 9470, IETF, Sep. 2023.

[24] T. Norderstedt, Ed., S. Drone, and M. Scurtescu, "Oath 2.0 Token Revocation," RFC 7009, IETF, Aug. 2013.

[25] R. Bali, "Threat-Model-Driven Zero-Trust Authorization for Micro service APIs in Cabernets-Based Cloud-Native Applications," manuscript in preparation.

Keywords:

API Security, Anomaly Detection, Insider Threat, Risk-Based Authentication, Step-Up Authentication, Continuous Access Evaluation, Microservices, Open Policy Agent, Zero Trust