We present a combined ML/NLP (Machine Learning, Natural Language Processing) pipeline for protecting cloud-based APIs (Application Programming Interfaces), which works both at the level of individual HTTP (Hypertext Transfer Protocol) requests and at the access log file reading mode, linking explicitly technical anomalies with business risks. The system processes each event/access log through parallel numerical and textual branches: a set of anomaly detectors trained on traffic engineering characteristics and a hybrid NLP stack that combines rules, TF-IDF (Term Frequency-Inverse Document Frequency), and character-level models trained on enriched security datasets. Their results are integrated using a risk-aware policy that takes into account endpoint type, data sensitivity, exposure, and authentication status, and creates a discrete risk level with human-readable explanations and recommended SOC (Security Operations Center) actions. We implement this design as a containerized microservice pipeline (input, preprocessing, ML, NLP, merging, alerting, and retraining services), orchestrated using Docker Compose and instrumented using OpenSearch Dashboards. Experiments with OWASP-like (Open Worldwide Application Security Project) attack scenarios show a high detection rate for injections, SSRF (Server-Side Request Forgery), Data Exposure, and Business Logic Abuse, while the processing time for each request remains within real-time limits even in sequential testing mode. Thus, the pipeline bridges the gap between ML/NLP research for security and practical API protection channels that can evolve over time through feedback and retraining.

Machine learning (ML) detectors of web and application programming interface (API) attacks report near-perfect laboratory performance but overwhelm analysts with false alerts in production. We argue analytically and support experimentally that when the attack class is produced by a fixed set of tools on a testbed, the learned decision function approximates the complement of the training benign distribution, so its false alert rate on real traffic depends mainly on benign distribution shift. We formalize this as a coverage condition with a false alert bound and measure coverage directly. On four real-traffic datasets, a text-only character-level detector trained on the target domain’s own benign traffic yields alert rates of 0.42% and 0.61% on two independent domains, against 99.5% after training on a different source, with recall of at least 93% on independent attack datasets, although residual source confounding cannot be excluded. The detector outperforms a declared regular-expression baseline on real attacks, with 100% recall against 45.8%, and the entire difference arises from attacks outside the rule dictionary. Attack family attribution does not transfer. Target domains lack request bodies, so results hold for the uniform resource identifier (URI) and header channel. Testbed labels derive from provenance. A public artifact reproduces every result.

This paper proposes and experimentally validates an ML-oriented pipeline for detecting hazardous events in the API/HTTP traffic of cloud services. The approach combines two numerical channels: (i) a supervised channel based on structured event features for stable separation between benign events and attacks, and (ii) an auxiliary atypical-behavior channel that strengthens the response to rare or novel scenarios that are weakly represented in labeled data. The key methodological idea is to unify heterogeneous model outputs into a common probabilistic risk scale via calibration, temperature scaling, and prior attack-rate adjustment, which enables comparable scores across models of different nature. To achieve controlled management of false-positive activations, the decision threshold is selected under an FPR budget, while group-level score stability is improved through ensembling, including averaging in the additive log-odds domain. After combining channel signals, the final decision is stabilized with operational policies (including hysteresis) to avoid frequent state switching in streaming mode. Model quality is verified both with tabular metrics and visually by analyzing risk-score distributions for benign events and attacks, which helps interpret overlap regions and the impact of the threshold on false alerts. Experiments on a test set show high performance of the supervised channel: for the primary ML ensemble, ROC-AUC = 0.9843, PR-AUC = 0.9511, and F1 = 0.8400 are achieved at an FPR of approximately 0.051, whereas the baseline linear model yields substantially lower F1 values. The auxiliary atypical-behavior channel provides a practically useful signal that complements the supervised channel while maintaining a controlled false-alert rate. The proposed formulation scales to other API types and load profiles because it separates policies (thresholds, weights, calibration parameters) from the main event-processing flow. The results confirm the suitability of the approach for integration into cloud monitoring and incident-response infrastructure with controllable threshold policies and model updates.