Abstract:System-to-system communication via Application Programming Interfaces (APIs) plays a pivotal role in the seamless interaction among software applications and systems for efficient and automated service delivery. APIs facilitate the exchange of data and functionalities across diverse platforms, enhancing operational efficiency and user experience. However, this also introduces potential vulnerabilities that attackers can exploit to compromise system security, highlighting the importance of identifying and mitigating associated security risks. By examining the weaknesses inherent in these APIs using security open-intelligence catalogues like CWE and CAPEC and implementing controls from NIST SP 800-53, organizations can significantly enhance their security posture, safeguarding their data and systems against potential threats. However, this task is challenging due to evolving threats and vulnerabilities. Additionally, it is challenging to analyse threats given the large volume of traffic generated from API calls. This work contributes to tackling this challenge and makes a novel contribution to managing threats within system-to-system communication through API calls. It introduces an integrated architecture that combines deep-learning models, i.e., ANN and MLP, for effective threat detection from large API call datasets. The identified threats are analysed to determine suitable mitigations for improving overall resilience. Furthermore, this work introduces transparency obligation practices for the entire AI life cycle, from dataset preprocessing to model performance evaluation, including data and methodological transparency and SHapley Additive exPlanations (SHAP) analysis, so that AI models are understandable by all user groups. The proposed methodology was validated through an experiment using the Windows PE Malware API dataset, achieving an average detection accuracy of 88%. The outcomes from the experiments are summarized to provide a list of key features, such as FindResourceExA and NtClose, which are linked with potential weaknesses and related threats, in order to identify accurate control actions to manage the threats.

An Application Programming Interface (API) Sensitive Data Identification Method Based on the Federated Large Language Model

APIReal: an API Recognition and Linking Approach for Online Developer Forums

Federated Large Language Model: Solutions, Challenges and Future Directions

Harnessing LLMs for API Interactions: A Framework for Classification and Synthetic Data Generation

Adoption of Deep-Learning Models for Managing Threat in API Calls with Transparency Obligation Practice for Overall Resilience

PAPILLON: PrivAcy Preservation from Internet-based and Local Language MOdel ENsembles

Safely Learning with Private Data: A Federated Learning Framework for Large Language Model

APILOT: Navigating Large Language Models to Generate Secure Code by Sidestepping Outdated API Pitfalls

FedSpaLLM: Federated Pruning of Large Language Models

On Protecting the Data Privacy of Large Language Models (LLMs): A Survey

Octopus: On-device language model for function calling of software APIs

Federated Large Language Models: Current Progress and Future Directions

Federated Domain-Specific Knowledge Transfer on Large Language Models Using Synthetic Data

Personalized Wireless Federated Learning for Large Language Models

Large Language Models Can Be Good Privacy Protection Learners

A Federated Learning Approach to Privacy Preserving Offensive Language Identification

Automated Federated Pipeline for Parameter-Efficient Fine-Tuning of Large Language Models

API-BLEND: A Comprehensive Corpora for Training and Benchmarking API LLMs

Large Language Models: A New Approach for Privacy Policy Analysis at Scale

Demystifying Application Programming Interfaces (APIs): Unlocking the Power of Large Language Models and Other Web-based AI Services in Social Work Research

Towards Federated Large Language Models: Motivations, Methods, and Future Directions