API Threat Detection Platform
Overview
Built a reusable API security platform that combines low-latency synchronous gateway enforcement with asynchronous behavioral threat detection using Kafka and Redis.
The platform detects multi-request attack patterns such as credential stuffing, BOLA enumeration, and sensitive business-flow abuse, then feeds temporary risk signals back into the gateway for subsequent request enforcement.
Architecture
Internet → Gateway → Upstream Application
Gateway → Kafka → Analyzer Service → Redis → Gateway Enforcement
The gateway handles known enforcement decisions synchronously, while behavioral analysis is processed asynchronously through Kafka consumers. Detected threats are stored as temporary Redis TTL flags and evaluated on subsequent requests.
Key Implementations
- Threat Detection: Implemented independent analyzers for credential stuffing, Broken Object Level Authorization (BOLA), and sensitive business-flow abuse using sliding-window state tracking.
- Asynchronous Processing: Used Kafka to decouple behavioral analysis from the gateway request path, allowing threat detection to run asynchronously.
- Threat Feedback Loop: Used Redis TTL-based threat flags to propagate analyzer results back to the gateway and enforce subsequent requests.
- Risk Scoring: Combined analyzer signals into a 0–100 risk score with configurable actions ranging from allow and warn to rate-limit and block.
- Event-Driven Design: Defined a canonical security event schema containing request, application, authentication, and resource metadata required for behavioral analysis.
- Observability: Integrated Prometheus metrics and Grafana dashboards for monitoring gateway behavior, threat detection, and system health.
Attack Scenarios
- Credential Stuffing: Detects repeated authentication failures across multiple accounts and source IPs within a sliding time window.
- BOLA Enumeration: Detects suspicious access patterns involving large numbers of distinct resources within a short time period.
- Business Flow Abuse: Detects excessive completion of configured multi-step workflows, such as payment-related API flows.
- False-Positive Testing: Includes normal-user simulations to verify that legitimate traffic is not incorrectly blocked.
Risk Scoring
- 0–29: LOW — Allow
- 30–59: MEDIUM — Warn
- 60–79: HIGH — Rate Limit (429)
- 80–100: CRITICAL — Block (403)
Infrastructure
- Gateway: Node.js enforcement proxy and event ingestion service
- Kafka: Security event streaming and asynchronous analyzer processing
- Redis: Threat state, TTL flags, and sliding-window tracking
- Docker: Containerized development and deployment environment
- Observability: Prometheus and Grafana
Security Considerations
- Security events exclude passwords, tokens, cookies, and raw credentials.
- Redis keys are scoped by application ID to prevent cross-application state leakage.
- API key authentication protects the HTTP event ingestion endpoint.
- Configurable fail-closed behavior blocks requests when Redis is unavailable.
Limitations
- Detection is eventually consistent, so initial requests in a new attack pattern may pass before a threat signal is established.
- Shared IP addresses can produce noisy signals for users behind corporate NATs or VPNs.
- BOLA detection depends on resource ownership metadata being available in the security event.
- Detection is threshold-based and does not currently use machine learning or statistical anomaly detection.