  Application Programming Interface (API) attacks refer to the unauthorized or
malicious use of APIs, which are often exploited to gain access to sensitive
data or manipulate online systems for illicit purposes. Identifying actors that
deceitfully utilize an API poses a demanding problem. Although there have been
notable advancements and contributions in the field of API security, there
still remains a significant challenge when dealing with attackers who use novel
approaches that don't match the well-known payloads commonly seen in attacks.
Also, attackers may exploit standard functionalities in unconventional manners
and with objectives surpassing their intended boundaries. This means API
security needs to be more sophisticated and dynamic than ever, with advanced
computational intelligence methods, such as machine learning models that can
quickly identify and respond to anomalous behavior. In response to these
challenges, we propose a novel few-shot anomaly detection framework, named
FT-ANN. This framework is composed of two parts: First, we train a dedicated
generic language model for API based on FastText embedding. Next, we use
Approximate Nearest Neighbor search in a classification-by-retrieval approach.
Our framework enables the development of a lightweight model that can be
trained with minimal examples per class or even a model capable of classifying
multiple classes. The results show that our framework effectively improves API
attack detection accuracy compared to various baselines.
