Skip to content

Home

Jump to bottom
Siddharth Sriram edited this page Jan 26, 2026 · 23 revisions
image
  1. (Fill in the blank with hyperlink to section in the wiki)
  2. (Fill in the blank with hyperlink to section in the wiki)
  3. (Fill in the blank with hyperlink to section in the wiki)
  4. (Fill in the blank with hyperlink to section in the wiki)
  5. (Fill in the blank with hyperlink to section in the wiki)

What is Interceptor?

Interceptor is an API security gateway that acts as an intelligent security layer between client applications and backend services. Built with Python (FastAPI) and machine learning (PyTorch), it monitors, analyzes, and protects API traffic in real-time.

Core Components:

  • API Gateway - FastAPI-based reverse proxy that intercepts all API requests
  • ML Service - PyTorch-powered anomaly detection engine that identifies suspicious behavior
  • Data Layer - Redis for caching and rate limiting, Cassandra for time-series logs, MySQL for structured data
  • Dashboard - React-based monitoring interface for real-time visibility and alert management

Technology Stack:

  • Backend: Python 3.11, FastAPI, Uvicorn
  • Machine Learning: PyTorch, scikit-learn
  • Databases: Redis (caching), Cassandra (logs), MySQL (user data)
  • Authentication: Auth0 (OAuth2/JWT)
  • Frontend: React, TypeScript
  • Infrastructure: Docker, AWS (ECS/EKS)
  • Security Frameworks: MITRE ATT&CK, NIST RMF

What is Interceptor for?

Interceptor is designed for organizations that need to protect their APIs from security threats while maintaining performance and scalability.

Primary Use Cases:

  1. API Security for SaaS Platforms

    1. Protect customer-facing APIs from abuse
    2. Prevent account takeover attacks
    3. Detect unusual access patterns

  2. Security Operations Centers (SOCs)

    1. Real-time monitoring of API traffic
    2. Automated threat detection and alerting
    3. Compliance reporting (NIST, MITRE ATT&CK)

  3. Microservices Protection

    1. Centralized security for distributed architectures
    2. Consistent authentication and authorization
    3. Cross-service rate limiting

  4. Compliance and Audit Requirements

    1. Complete audit trail of all API requests
    2. Behavioral analysis for anomaly detection
    3. Automated security reporting

Who should user Interceptor?

  • DevOps/Platform Teams - Securing internal and external APIs
  • Security Teams - Monitoring and threat detection
  • Compliance Officers - Audit trails and reporting
  • API Product Managers - Protecting customer-facing services

What problem does Interceptor solve?

Modern applications rely heavily on APIs, but traditional security measures are often insufficient. Interceptor addresses critical API security challenges.

Problems Solved:

  1. Credential Stuffing and Account Takeover
  • The Issue: Attackers use stolen credentials to access user accounts, often trying thousands of username/password combinations.

How APIs are vulnerable:

  • Login endpoints are publicly accessible
  • Traditional firewalls can't distinguish legitimate from malicious login attempts
  • Rate limiting alone isn't enough (attackers use distributed IPs)

Interceptor's Solution:

  • ML-based behavioral analysis detects abnormal login patterns
  • Rate limiting prevents brute force attacks
  • Real-time alerting when suspicious activity is detected
  • Automatic blocking of compromised accounts
  1. Data Exfiltration
  • The Issue: Compromised accounts or malicious insiders download large amounts of sensitive data.

How APIs are vulnerable:

  • Valid credentials bypass traditional security
  • Large data downloads appear legitimate
  • Detection often happens too late

Interceptors Solution:

  • Monitors data transfer volumes per user
  • Detects unusual download patterns (accessing endpoints rarely used)
  • ML model identifies deviations from normal behavior
  • Real-time alerts for potential data theft
  1. API Abuse and DDoS
  • The Issue: Attackers overwhelm APIs with requests, causing service degradation or outages.

How APIs are vulnerable:

  • Public endpoints are easy targets
  • Distributed attacks bypass IP-based blocking
  • Traditional rate limiting is too rigid

Interceptor's Solution:

  • Intelligent rate limiting per user, endpoint, and time window
  • Circuit breaker pattern prevents cascade failures
  • Redis-based distributed rate limiting
  • Automatic throttling during attacks
  1. Insufficient Visibility and Logging
  • The Issue: Security teams lack visibility into API usage patterns and can't investigate incidents.

How APIs are vulnerable:

  • Logs are scattered across services
  • No centralized view of user behavior
  • Difficult to reconstruct attack timelines

Interceptor's Solution:

  • Centralized logging of all API requests to Cassandra
  • Time-series analysis for behavior patterns
  • Complete audit trail with request/response details
  • Dashboard for real-time monitoring
  1. Zero-Day and Unknown Attacks
  • The Issue: Signature-based security tools can't detect new attack types.

How APIs are vulnerable:

  • New attack techniques emerge constantly
  • Rule-based systems need manual updates
  • Attackers evolve faster than security patches

Interceptor's Solution:

  • Unsupervised ML detects anomalies without prior knowledge
  • Behavioral baselines adapt to legitimate usage changes
  • Identifies suspicious patterns rather than known signatures
  • Continuous learning from traffic patterns
  1. Slow Incident Response
  • The Issue: Security incidents are discovered hours or days after they occur.

How APIs are vulnerable:

  • Manual log analysis is time-consuming
  • Alerts are scattered across tools
  • Investigation requires correlating multiple data sources

Interceptor's Solution:

  • Real-time anomaly detection (sub-second response)
  • Automated alerting to security teams
  • Centralized dashboard for investigation
  • Pre-built queries for common attack patterns

Interceptor Documentation:

main.py documentation:

Notes:

from fastapi import FastAPI, Request
from fastapi refers specifically to the FastAPI framework
"import FastAPI" indicates that the FastAPI class imported from the fastapi module
"import Request" indicates that the Request class is also imported from the fastapi module

"import CORSMiddleware" indicates that the CORSMiddleware class is imported from the fastapi.middleware.cors module

CORSMiddleware is used to handle Cross-Origin Resource Sharing (CORS) in FastAPI applications (security feature) that controls which websites are allowed to talk to your application

"import logging" library that helps track whats happening in program, records messages about errors, warnings, or just general information "import os" library that lets program interact with OS, can read environment variables, work with file paths, etc

"logging.basicConfig(" Configuring or setting up how logging your system will work (remember Cassandra and setting up logs on there so actions be tracked and basicConfig (basic configuration) means your choosing you setting

"level=logging.INFO" Sets what level of messages you want to record Different levels:

  • DEBUG (very detailed)
  • ERROR (actual problems)
  • INFO (general info)
  • WARNING (potential problems)
  • CRITICAL (serious problem)

logging.INFO "record INFO messages and anything more serious)

Logging message format:

format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'

  • %(asctime)s ; time
  • %(name)s : which part of application or program sent this
  • %(levelname)s : the level (INFO, WARNING, ERROR, etc)
  • %(message)s : Actual message (Server started successfully)

Example: 2024-12-29 10:30:45 - my_app - INFO - Server started successfully

logger = logging.getLogger(name)

  • Creates actual logger object that you'll use to write messages
  • "getLogger(name)" - create a logger with the name of this file/module
  • name is a special Python variable that contains the name of your current file
  • Now you can use logger.info("something happened") to record messages!

app = FastAPI(title="Interceptor", description="API Security Gateway with Behavior Analysis", version="1.0.0", docs_url="/api/docs", )

Add the CORS middleware (allows dashboard to connect)

app.add_middleware( CORSMiddleware, # React dashboard allow_origins=["http://localhost:3000"], allow_credentials=True, allow_methods=[""], allow_headers=[""], )

Starting up and shutting down interceptor tool

@app.on_event("startup") async def startup_event(): """Run when the application starts""" logger.info("=" * 50) logger.info("Interceptor Gateway Starting Up") logger.info("=" * 50) # TODO: Initialize database connections logger.info("Gateway ready to accept requests")

@app.on_event("shutdown") async def shutdown_event(): """Run when the application shuts down""" logger.info("Interceptor Gateway Shutting Down") # TODO: Close database connections

Basic Endpoint

@app.get("/") async def root(): """Root endpoint - welcome message""" return { "message": "Welcome to Interceptor Gateway", "version": "1.0.0", "docs": "/docs", "health": "/health" }

@app.get("/health") async def health_check(): """Health check endpoint""" return { "status": "healthy", "service": "interceptor-gateway", "timestamp": datetime.utcnow().isoformat() }

@app.get("/api/test") async def test_endpoint(request: Request): """Test endpoint to verify gateway is working""" return { "message": "Gateway is working!", "client_ip": request.client.host, "path": request.url.path, "method": request.method, "timestamp": datetime.utcnow().isoformat() }

Create the database configuration

init.py

Empty file to make it a python packet

Now create database.py

Clone this wiki locally