Upstream’s Ocean AI Dramatically Improves API Security Investigations

As the automotive industry continues its rapid shift towards connectivity and digitalization, API security has become a critical pillar of cybersecurity. GenAI holds transformative potential for automotive security teams. Through extensive research and our experience monitoring millions of vehicles, we’ve discovered how GenAI can optimize and streamline the work of Vehicle Security Operations Center (vSOC) teams. The power of GenAI spans across various risks and attack vectors, but in this blog, we chose to focus on the overwhelming challenge in API security.

From Idea to Implementation: GenAI’s Targeted Approach

The journey to leveraging GenAI for API security began with a brainstorming session around potential use cases. Initially, ideas like an alert summary or general classification emerged as valuable options. Further analysis revealed that investigating API Security alerts should be a prioritized use case, as these alerts are both frequent and impactful for vSOC teams. In many environments, analysts are flooded with hundreds of API Security, including injections and other risks, alerts each week. Reviewing each alert consumes a tremendous amount of time and resources, resulting in inefficiencies and, at times, delayed responses to genuine threats.

This constant influx of alerts underscored a critical need: to use GenAI for prioritizing likely genuine and large-scale threats. By automating the classification process and reducing false positives, vSOC teams could focus their time on critical alerts rather than sifting through the noise.

To achieve this, we put Ocean AI, our GenAI layer, to action, prioritizing alerts and assessing their severity. By doing so, we aim to enhance vSOC teams’ capacity to respond swiftly to actual threats.

Integrating Upstream’s Ocean AI and API Security Solutions

Our advancements in GenAI are bundled into Upstream’s Ocean AI and integrated across many cyber use cases, including our API Security solution. Ocean AI, integrated into Upstream’s XDR platform, enables efficient analysis of vast cyber alerts and data, detecting patterns, accelerating cybersecurity operations, and automating investigations. This GenAI capability empowers cybersecurity teams to combat cyberattacks effectively.

Upstream’s API Security solution offers comprehensive detection beyond OWASP API Security Top Ten risks, ensuring coverage against common and emerging API threats and attacks. It provides deep contextual detection of API traffic alongside operational data feeds, leveraging IT, OT, and IoT data for fusion detection. This purpose-built solution ensures operations run without disruptions, enabling application developers to deploy and monitor APIs and risks safely.

In practical terms, this feature means that any detected alert will be reviewed automatically by Ocean AI. The model will assess the threat and generate actionable insights for vSOC teams, allowing analysts to focus on verified threats rather than wasting time on irrelevant noise.

Testing and Results: Promising Accuracy and Impact

To evaluate the impact of Ocean AI, we conducted a rigorous test, analyzing over 500 real-world API injection alerts. The results were promising, with Ocean AI successfully matching analyst classifications with a 97% success rate. This impressive performance highlights Ocean AI’s capability to match human-level precision in detecting genuine threats, bolstering our confidence in its ability to transform API security workflows.

This high accuracy rate is a crucial milestone, demonstrating that Ocean AI can effectively shoulder some of the burdens faced by analysts. By the end of Q4’2024, we plan to roll out this feature, aiming to empower vSOC and API Security teams with a reliable tool for more efficient injection alert handling.

Beyond Injection Alerts: The Future of GenAI in Automotive Cybersecurity

This targeted approach to automotive cyber and API alerts is only the beginning. As we continue refining GenAI’s capabilities, we envision broadening its application to other areas of API security.

Our ultimate goal is clear: to harness the power of GenAI to make API security in the automotive and smart mobility ecosystem more robust, precise, and efficient. By automating repetitive tasks and improving alert prioritization, we’re enabling vSOC teams to work smarter, not harder. GenAI’s role in API security is poised to grow, offering significant value to the automotive industry as it moves towards a more connected future.