Skip to main content
Multi-Tier Detection · 94,000+ Training Samples · OWASP 10/10/10

Stop API Attacks
Before They Reach Your Backend

Block SQL injection, XSS, and more with an ML detector trained on 94,000+ labeled attack samples

Pattern matching catches the cheap stuff in under 1 ms. Embeddings catch what regex misses. NLI catches what embeddings miss. LLM escalation catches what NLI misses. Behavioral baselines catch the rest. Every tier is CI-baseline-gated — a regression in recall or precision fails the build.

Multi-Tier Detection Pipeline
3.12% FPR · Held-Out Set
ML Detector · 94,000+ Training Samples
7 Evasion Vectors Handled
Shadow API Auto-Block
Start Free TrialSee How It Works
94,000+
Training samples
24 categories
5
Detection tiers
regex → behavioral
3.12%
False-positive rate
2,084 held-out benign prompts
90%
Evasion recall
45 of 50 caught, 0 of 50 benign flagged
<1ms
Tier-1 overhead
cache hit path
99.71%
Under load
2,424 concurrent
7
Evasion vectors
all handled
10/10/10
OWASP
Web · API · LLM

What is API Security?

Understanding modern API threats and why traditional WAFs aren't enough

The Modern API Attack Surface

APIs are the backbone of modern applications. Every mobile app, SaaS platform, and microservice talks via APIs — and attackers know it. They target APIs to steal data, manipulate business logic, and gain unauthorized access faster than any other surface.

Injection Attacks
SQL injection: '; DROP TABLE users--
Broken Authentication
JWT tampering, session hijacking, credential stuffing
Business Logic Abuse
Price manipulation, inventory hoarding, privilege escalation
Rate Abuse
API endpoint flooding and resource exhaustion, throttled by rate limits

Why Traditional WAFs Fail

Traditional WAFs rely on signature-based detection and regex patterns. They miss context-aware attacks, business-logic abuse, and the entire class of AI-specific threats — prompt injection, MCP tool abuse, jailbreaks, indirect injection. APIs in 2026 need semantic understanding, not pattern lists.

No Context Awareness
Can't detect "user is trying to access another user's data"
Signature-Based Only
Misses zero-day attacks and novel exploit techniques
Ignores Business Logic
Can't detect "user bought 1000 items at $0.01 each"
No AI Protection
Unaware of prompt injection, MCP tool abuse, LLM attacks

How G8KEPR Secures APIs

Multi-tier defense that understands your API's semantics and business logic, not just its bytes

API Request Analysis
1. Request Interception
POST /api/users/123/transfer { amount: 10000 }

Intercept every API request before it reaches your backend

2. G8KEPR Multi-Tier Detection Pipeline
Cheap tiers run first — escalation only when confidence is low
T1
Regex Pattern Matching
< 1 ms
Pre-compiled patterns on normalized input — SQLi, XSS, path traversal, command chaining. Score > 0.9 → immediate block.
T2
Embedding Similarity
5–15 ms
SentenceTransformer cosine similarity vs. known injection vectors. Catches semantic equivalents that bypass literal regex.
T3
NLI Intent Classification
< 15 ms
Zero-shot NLI on request intent. Plus base64/URL/hex decode-then-rescan, NFKD normalization, character-split detection, entropy analysis.
T4
LLM Escalation
200–2000 ms
Off by default (ENABLE_ML_LLM). When enabled: high-uncertainty inputs only, routed via the AI Gateway to an LLM provider for final classification. Fail-open on timeout.
T5
Behavioral Baselines
continuous
10K-request rolling deque per endpoint, 1K per IP. Detects rate, geo, time-based, and credential-stuffing anomalies via stddev.
✓ Request Allowed
Forwarded to backend
2.3ms latency
🚫 Request Blocked
SQL injection detected
Alert sent, logged

Injection Prevention

Block SQL, NoSQL, XSS, XXE, LDAP injection with pattern analysis and semantic validation.

✓ Pattern-based + semantic analysis detection

Auth & Session Security

Validate JWT tokens, detect session hijacking, enforce MFA, prevent credential stuffing.

✓ Sub-1ms JWT validation

Intelligent Rate Limiting

Per-user, per-endpoint limits with burst allowance. Differentiate humans from bots.

✓ Redis-backed sliding windows with burst allowance

Anomaly Detection

Behavioral analysis and anomaly detection identify zero-days, account takeovers, and unusual patterns.

✓ Catches unknown threats
Network-Layer WAFs Don't Cover This

What G8KEPR Adds That AWS WAF & Cloudflare Don't

Five capabilities that exist in the platform — not in a network-layer WAF, not in a regex-only proxy, not in any signature-database product.

Multi-Tier ML Pipeline

Regex (<1ms) → SentenceTransformer embeddings → NLI zero-shot → LLM escalation (off by default) → behavioral. Cheap tiers handle the bulk; expensive tiers reserved for the ambiguous.

regex → LLMmodules/threat_detection/
Signature WAFs only do tier 1.

Held-Out Detection Test

Scored on a frozen 2,580-sample held-out set the detector was never trained on: 0.788 recall, 0.857 precision, 3.12% false-positive rate. The test fails the build on any regression.

3.12% FPRbackend/tests/security/test_detector_heldout_external.py
WAF vendors do not publish baselines.

94,000+ Sample ML Detector

Spans web (SQLi, XSS, traversal), API (BOLA, auth, rate abuse), LLM (prompt injection, jailbreak, role hijack), and MCP (tool poisoning, redefinition, command injection).

24 categoriesWeb · API · LLM · MCP
Generic WAFs cover web only.

7 Evasion Vectors

Base64 decode-then-rescan · NFKC homoglyph normalize · l33tspeak reconstruction · prompt-wrap unwrap · zero-width strip · cross-request fragment correlation.

all handlednormalize · decode · stitch
Pattern matchers fall to encoding tricks.

Shadow API Auto-Block

Passive traffic analysis flags endpoints not in the catalog. Risk-scored on auth, HTTPS, rate-limit, PII, traffic. Auto-blocks above threshold. FP ≤ 2% · FN ≤ 5%.

risk score ≥ 50shadow_detector.py
Most platforms only list — never block.
ML Threat Detector

ML Detection Across 15 Attack Categories

Most WAFs ship a generic SQLi/XSS regex pack. G8KEPR's library spans the full modern attack surface — web, API, LLM, and MCP — and is versioned alongside the codebase.

Prompt Injection (direct)19+
Jailbreak19+
MCP Tool Poisoning25+
MCP Tool Redefinition25+
MCP Session Hijacking20+
Credential Theft25+
Log-to-Leak Exfiltration20+
MCP Command Injection25+
SQL Injection5+
XSS5+
Path Traversal5+
Command Injection5+
Supply Chain Poisoning15+
PII Extraction15+
Policy Puppetry15+
Evasion Coverage

7 Bypass Vectors — All Handled

Pattern matchers fall to encoding tricks. G8KEPR normalizes, decodes, and re-stitches before pattern matching, so the same payload can't slip through dressed differently.

Base64 / URL / Hex encoding
Decode-then-rematch — payload loses its disguise
Unicode homoglyphs
NFKC normalization collapses look-alikes to canonical form
l33tspeak / character substitution
Reconstruction-pattern detection
Prompt wrapping ("Ignore previous…")
RAG context-wrapper patterns recognize the wrapper
Indirect injection via external data
IndirectInjectionScanner gates tool/RAG output
Token smuggling (U+200B, U+FEFF)
Zero-width characters stripped pre-analysis
Payload fragmentation across requests
FragmentCorrelationStore — Redis 5-min sliding window, 10-fragment cap

Why Choose G8KEPR for API Security?

API security built for modern AI applications

AI-First Protection

Secures APIs, AI agents and MCP tools in one platform. Protect LLM applications from prompt injection, tool abuse, and context poisoning.

Prompt injection detection
MCP tool monitoring
LLM cost optimization

Zero Performance Impact

Targets sub-5ms routing overhead for cached requests (targets ~40ms p99 with full threat detection). Edge caching, parallel analysis, and optimized pattern matching. Deploy as proxy, sidecar, or library - your choice.

Targets <5ms routing overhead
Horizontal scale-out behind the load balancer
Edge deployment available

Complete Visibility

Real-time dashboards showing every attack, blocked request, and anomaly. Export logs to your SIEM. Generate compliance reports (SOC 2, HIPAA, PCI-DSS).

Full request logging
SIEM integration
Compliance reporting

Complete API Security Platform

Everything you need to secure REST and GraphQL APIs

OWASP 10/10/10 Coverage

Mapped to OWASP Top 10 (Web), OWASP API Security 2023 and OWASP LLM Top 10 2025, plus MITRE ATLAS and the ATT&CK techniques relevant to API and agent threats, including custom AI-specific techniques (T1059.AI, T1562.AI).

✓ Web · API · LLM · MITRE ATT&CK

Sliding-Window Rate Limiting

Redis-backed sliding window with atomic Lua scripts — no burst spikes, every window is a true sliding calculation. Three enforcement axes (API key, JWT user, IP) with priority ordering. In-memory fallback if Redis is unavailable.

✓ Lua atomic · 3-axis enforcement

Strict-Tier Auth Endpoints

Login: 5 requests / 60s, then 300s block on breach. Register: 3 / 300s, then 600s block. X-RateLimit-Limit / Remaining / Reset headers on every response so clients can self-throttle gracefully.

✓ Brute-force resistant by default

WAF Engine — 50+ Rules

OWASP-mapped: SQLi (5+ vectors incl. blind/boolean/time), XSS (5+ incl. stored/reflected/DOM), path traversal (5+), command injection (5+), SSRF blocklist, custom regex per org. Block / log / challenge actions with priority ordering.

✓ waf_rule_engine.py · 22KB

Shadow API Auto-Block

Passive traffic analyzer compares discovered endpoints to api_inventory. Risk-scored on auth, HTTPS, rate-limit, PII, traffic. SHADOW_API_BLOCK_MODE auto-blocks above threshold. False-positive filter strips static assets, probes, scanner noise.

✓ FP ≤ 2% · FN ≤ 5%

TLS / JA3 Bot Fingerprinting

ML-based classification using behavioral fingerprinting (timing, ordering, paths) and TLS/JA3 handshake characteristics unique to each client. Five-class output: human, automation, bot, scraper, scanner.

✓ bot_detector.py · 27KB

API Discovery + Path Normalization

EndpointExtractor normalizes /users/123 → /users/{id} for consistent rule matching. The API inventory records the protocol of each API (REST / GraphQL / gRPC / WebSocket).

✓ api_discovery/endpoint_extractor.py

Data Classification — 4 Tiers

Classifies fields and values as Restricted / Confidential / Internal / Public using credential, payment-card and health-record patterns. Each tier carries handling rules, including its encryption requirement.

✓ modules/data_classification

Append-Only Audit Log

API requests, decisions, and blocks are written to an append-only audit table (a database trigger blocks DELETE and edits to core fields). Authentication and domain events are HMAC-SHA256 hash-chained per tenant and verified daily (since 2026-09-13), with three verification levels (full chain, single entry, last-N).

✓ Maps to SOC 2 / HIPAA / FedRAMP AU-9 (mapping, not an attestation)

API Security FAQs

Common questions about protecting your APIs with G8KEPR

Network-layer WAFs (AWS WAF, Cloudflare) sit at L7 with signature-based rules. G8KEPR inspects at the application layer. On the default API request path, ~340 regex rules are evaluated on every request (<1ms), with token-abuse checks. The AI-gateway path adds an ML classifier trained on 94,000+ labeled attack samples spanning LLM- and MCP-specific threats no general-purpose WAF covers; embedding and NLI tiers activate only when their models load, and LLM escalation is off by default. A held-out benchmark scores the shipped regex-plus-classifier predicate on 2,580 samples it was never trained on (0.788 recall, 0.857 precision, 3.12% false-positive rate); on a separate, independently-labeled set of 50 adversarial-evasion + 50 benign prompts it catches 45 of 50 evasions (90%) and flags none of the 50 benign prompts. These are benchmark results for the shipped code, not measurements of production traffic.

Need help securing your APIs?

Talk to our API security experts →
2,000+ Mapped Controls Across 14 Frameworks

API Logs Generate Control Evidence For

Every blocked request, rate-limit event, and policy violation is mapped to specific controls in 12 compliance frameworks with assessment engines, plus 8 reference catalogs. Controls the platform can measure are scored from its evidence; the rest are self-attested. Auditors get exports — not spreadsheets.

115 controls
NIST 800-53 Rev5
55 controls
PCI DSS v4
197
CSA CCM v4
153
CIS Controls v8
110+
CMMC 2.0
106
NIST CSF 2.0
93
ISO 27001:2022
84
FedRAMP
72
NIST AI RMF
64
SOC 2
48
HIPAA
27
ISO 42001
23
EU AI Act
22
MITRE ATLAS

Subject to independent audit and attestation. G8KEPR provides the technical controls and evidence — your auditor issues the certification.

Deploy in Minutes

Stop API Attacks Today
No Credit Card Required

multi-tier detection, an ML detector trained on 94,000+ attack samples, 7 evasion vectors handled, shadow API auto-block, and 2,000+ mapped compliance controls — across REST, GraphQL and WebSocket.

30-day free trial (extend to 90 days free)
Targets sub-5ms routing overhead
OWASP Top 10 coverage
REST + GraphQL
Start Free TrialView Pricing

No credit card required • Quick deploy • Cancel anytime