APISentry: A Real-Time Hybrid Machine Learning Gateway for Detecting Behavioural and Payload-Based API Attacks

Abstract

APISentry is a real-time, hybrid machine-learning security gateway for REST APIs. Deployed as a reverse proxy, it detects and blocks seven attack types — SQL injection, parameter tampering, brute-force login, credential stuffing, broken object level authorization (BOLA), API flooding, and token replay — by jointly analysing per-request payload features and causal behavioural features computed over per-IP and per-token sliding windows. What's included in this archive The gateway itself; a deliberately vulnerable test API used as the protected target; a traffic generator that produces labelled normal and attack traffic; the complete machine-learning pipeline (feature engineering, training, cross-validation, ablations, SHAP explainability); a labelled eight-class dataset (11,415 requests); two validation notebooks (one on the project's own dataset, one on public CSIC 2010 / ECML-PKDD benchmarks); and a ModSecurity (OWASP CRS) baseline comparison for reference. Requirements A Linux machine (developed and tested on Kali Linux) with Python 3, Docker, and Docker Compose installed. How to get it running Download and extract the zip file from this record. Run ./setup.sh once to create the Python virtual environments and install all dependencies. Run ./run.sh to start all four services: the PostgreSQL database, the target test API, the AI security gateway, and the live dashboard. Open http://localhost:8080 in a browser to view the live security dashboard. Trigger a demo attack run with ./demo.sh, or run the individual attack scripts in traffic-generator/ to see requests being classified and blocked in real time. Exact commands for all seven attack types are listed in DEMO_GUIDE.md. Stop everything with ./stop.sh. Reproducing the research The full experimental pipeline — dataset generation, feature engineering, model training, cross-validation, ablations, and the ModSecurity comparison — can be re-run end to end using the scripts in ml-pipeline/, traffic-generator/, and baseline/. The two Jupyter notebooks in validation/ reproduce the primary evaluation and the external benchmark validation independently.