A REVIEW PAPER ON API MALWARE ANALYSIS AND FORENSICS

VEESAM SAI VAMSI

Student, Department of Information Security, School of Computer Science and Engineering, Vellore Institute of Technology, Vellore – 632014, Tamil Nadu, India.

Abstract - AsignificantareaofcybersecuritystudyisAPI MalwareAnalysisandForensics.Itiscrucialtohaveeffective defences in place to identify and stop malware assaults throughAPIssincetheycanhavecatastrophiceffects.The goalofthearticleistogiveabroadoverviewofthestateof theartinAPImalwareanalysisandforensics,aswellasthe methodsandequipmentemployedtoidentify,evaluate,and counteractAPI-basedmalwareattacks.

Thepaperwillexplorethevariouskindsofmalwarethatcan bedistributedthroughAPIs,suchasbackdoors,command andcontrol(C2)servers,andRemoteAccessTrojans(RATs). Additionally, an overview of the various methods for detecting malware in APIs, such as static and dynamic analysis,willbeprovided.

Thispaper'soverallgoalistoprovideathoroughoverview of API malware analysis and investigation, encompassing severalmethodsandinstrumentsthatareusedtofindand examine API malware. This study also emphasizes the significanceoftakingproactivestepstopreventAPI-based malware attacks, such as routinely testing APIs for vulnerabilities, putting security protocols in place, and utilizing cutting-edge security technologies to detect and mitigateAPI-basedmalwareassaults.

Key Words: Malware Analysis, Forensics Investigations, MalwareAttacks.

1.INTRODUCTION

Software programmerscan connectandinteract with one anotherthankstoacollectionofprotocols,procedures,and tools called an application programming interface (API). Regardless of the underlying hardware and operating systems,APIsofferastandardmethodfordataandservice interchangeacrossvarioussoftwarecomponents[10][12]

Insoftwaredevelopment,APIsplayacrucialroleincreating modularandscalableapplications.ByusingAPIs,developers canbreakdowncomplexsystemsintosmaller,independent components that can be developed, tested, and deployed separately.APIsalsoallowdeveloperstoreuseexistingcode andservices,savingtimeandreducingdevelopmentcosts [10][12].

APIs can be used in a variety of software applications, including web applications, mobile apps, and desktop software.Theyareoftenusedtointegratedifferentsoftware

***

systems,suchasconnectingafront-endwebapplicationtoa back-enddatabase[10][12]

However,APIscanalsobeapotentialsecurityvulnerability. MaliciousactorscanexploitweaknessesinAPIdesignand implementation to launch attacks, such as API malware attacks. Therefore, it is important for developers and security professionals to implement proper security measuresandconductregularAPIsecuritytestingtoensure theintegrityoftheirsystems[10]

1.1 KEY CHARACTERISTICS OF API SECURITY THAT DISTINGUISH IT FROM TRADITION SECURITY

1. A castle with many openings and no moat: In the past,popularportslike80(HTTP)and443(HTTPS) wereallthatneededtobeprotectedontraditional networks. There are several API endpoints that employvariousprotocolsintoday'swebapps.Even one API can make security a challenging task becauseAPIsoftengrowovertime[3]

2. Incomingrequestformatsthatchangefrequently:In a DevOps context, APIs change quickly, and most WAFs cannot handle this level of elasticity. Traditional security tools require manual tuning and reconfiguration whenever an API changes, which is an error-prone procedure that uses up resourcesandtime[3].

3. Clients often do not use a web browser: The majorityofnativeandmobileapplications,aswell as other services and software components, have accesstoserviceormicroserviceAPIs.Websecurity technologiescannotemploybrowserverificationon these clients since they don't use browsers. Automated traffic from API endpoints is typically difficult to exclude for solutions that rely on browserverificationtodetectharmfulbots[3].

Examiningincomingrequestsdoesnotguaranteedetecting attacks;manyAPIabuseattacksexploitrequeststhatlook legitimate.

1.2 THREAT OF API MALWARE ATTACKS

APImalwareattacksareatypeofcyberattackthatusesAPIs toinjectandexecutemaliciouscodeonatargetedsystem. MalwareisoftenhiddeninAPIcalls,whichcanthenbeused

to exploit vulnerabilities in the targeted system and gain unauthorizedaccessorcontrol.

API malware attacks can take many forms, including:[22][10][12]

 Remote code execution: Malware is injected throughanAPIcall,allowingattackerstoremotely executecodeonthetargetedsystem.

 Credential theft: Malware is used to steal user credentials, such as usernames and passwords, throughAPIcalls.

 Data exfiltration: Malware is used to extract sensitivedatafromthetargetedsystemthroughAPI calls.

 DDoSattacks:ThroughtheuseofAPIs,malwareis used to perform Distributed Denial of Service (DDoS)attacks,whichbombardthetargetedsystem withtrafficandinterferewithregularoperations.

To prevent API malware attacks, it is important for developers and security professionals to implement proper security measures and conduct regular API securitytesting.

1.3 IMPORTANCE OF API MALWARE ANALYSIS AND FORENSICS

API malware analysis and forensics are essential for detecting analyzing, and mitigating API malware attacks. Malware attacks can have serious consequences for organizations, including data theft, system downtime, financiallosses,andreputationaldamage[10][22]

Effective API malware analysis and forensics can help identifythesourceandextentoftheattack,recoverlostor stolendata,andpreventfutureattacks.

API malware analysis involves examining APIs and their associatedcodeforsignsof malware,suchasunusual API calls or unexpected system behaviour. This can be a challengingtask,asmalwarecanbedisguisedorobfuscated toavoiddetection.

API malware forensics involves conducting a detailed investigation of the attack to identify the root cause and prevent similar attacks in the future. This may involve analyzing system logs, network traffic, and other digital evidencetoreconstructtheattackanddeterminetheextent ofthedamage[22].

TheimportanceofAPImalwareanalysisandforensicshas only increased with the rise of APIs in software development.AsmoreorganizationsrelyonAPIstoconnect

theirsystemsandservices,thepotentialattacksurfacefor APImalwareattackshasalsoincreased[22][10].

In conclusion, API malware analysis and forensics are essential for protecting organizations from the damaging effects of API malware attacks. By investing in these practices,organizationscanensuretheintegrityandsecurity oftheirAPIsandpreventfutureattacks[22]

2. TYPES OF API MALWARE ATTACKS

ThereareseveralcommontypesofAPImalwareattacksthat organizationsneedtobeawareof:[8][9][12]

1. APISpoofing:APIspoofingisatypeofattackwhere attackers create a fake API that mimics a legitimate one. When users try to connect to the fake API, the attackerscanstealusercredentialsorinjectmalware intotheuser'ssystem.

2. APIInjection: Inordertorunmaliciouscodeonthe targeted system, API injection requires inserting erroneous code into valid API calls. This can be accomplishedinanumberofways,suchasbytaking advantage of flaws in API inputs or by intercepting and changing API calls using man-in-the-middle attacks.

3. APIParameterTampering:APIparametertampering isatypeofattackwhereattackersmodifyparameters inAPIcallstogainunauthorizedaccessormanipulate data.Thiscanbedonebyinterceptingandmodifying APIcallsorbyusingautomatedtoolstomanipulate APIinputs.

4. APIDenial-of-Service(DoS)Attacks:APIDoSattacks involveoverwhelminganAPIwithrequests,causingit to crash or become unresponsive. This can be done throughavarietyofmeans,suchasusingautomated tools to flood the API with requests or exploiting vulnerabilitiesintheAPI'sdesignorimplementation.

5. APIPhishing:APIphishinginvolvestrickingusersinto connectingtoafakeAPIthatappearstobelegitimate. WhenusersentertheircredentialsintothefakeAPI, theattackerscanstealthemforlateruse.

6. APIRemoteCodeExecution(RCE):Anyarbitrarycode can be run on the targeted machine by taking advantageofAPIRCEweaknesses.Thiscanbedonein a number of ways, such as by using a malicious payload in an API call or by taking advantage of vulnerabilities in the API's input validation or authenticationmechanisms.

The number of Application Programming Interfaces (APIs) deployed within organizations is multiplying.

Accordingtothissurvey,26%ofbusinessesuseatleast twice as many APIs as they did a year ago, increasing attacks on APIs. APIs are integral to any application, makingthemaprimetargetforattacks[9]

2.1 EXPLANATION OF HOW API MALWARE CAN BE USED TO EXECUTE MALICIOUS CODE

API malware can be used to execute malicious code by exploitingvulnerabilitiesinsoftwarecomponents thatuse APIs.MalwarecanbehiddeninAPIcalls,allowingattackers to inject and execute malicious code on a targeted system [13][14]

Onecommonmethodforexecutingmaliciouscodethrough API malware is remote code execution (RCE). In an RCE attack,attackersuseanAPItosendapayloadthatcontains maliciouscodetothetargetedsystem.Thepayloadisthen executedonthesystem,givingtheattackerremoteaccess andcontroloverthesystem[13][14]

APIinjectionisanothertechniqueforusingAPImalwareto runmaliciouscode.Attackerscanexecutethemaliciouscode onthetargetedsystembyinjectingitintolegalAPIcallsin an API injection attack. This can be accomplished in a numberofways,suchasbytakingadvantageofflawsinthe APIinputsorbyinterceptingandchangingAPIcallsusing man-in-the-middleattacks[22].

Inadditiontothesemethods,APImalwarecanalsobeused to execute malicious code through credential theft, data exfiltration,andDDoSattacks.Forexample,attackersmay useAPImalwaretostealusercredentialsthroughAPIcalls andthenusethosecredentialstoexecutemaliciouscodeon thetargetedsystem[15][10]

To protect against API malware attacks that execute malicious code, organizations should implement proper securitymeasures,suchassecureAPIdesign,authentication andauthorizationmechanisms,andmonitoringAPIactivity forsuspicious behaviour.RegularAPIsecuritytestingand analysis can also help detect and prevent API malware attacks.[10][22]

2.2 EXAMPLES OF REAL-WORLD API MALWARE ATTACKS

Therehavebeenseveralreal-worldAPImalwareattacksthat haveimpactedorganizationsandusers:

1. FacebookAPIMalwareAttack:In2018,amalware attackonFacebook'sAPIsallowedattackerstosteal access tokens and gain access to over 30 million user accounts. The attackers used an API vulnerabilitytoexploitthe"ViewAs"feature,which allowedthemtostealaccesstokensandtakeover useraccounts[4]

2. Twitter API Malware Attack: In 2013, a malware attackonTwitter'sAPIsallowedattackerstosteal userdata,includingpasswordsandemailaddresses. TheattackersusedanAPIvulnerabilitytoexploita cross-sitescripting (XSS)flawinTwitter's mobile app[5]

3. UberAPIMalwareAttack:In2016,amalwareattack on Uber's APIs allowed attackers to steal the personaldataofover57millionusersanddrivers. TheattackersusedanAPIvulnerabilitytoaccessa database containing user data, which they then downloadedandencrypted[6].

4. SalesforceAPIMalwareAttack:In2018,amalware attack on Salesforce's APIs allowed attackers to stealcustomerdatafromanumberofSalesforce's customers.TheattackersusedanAPIvulnerability to access customer data, which they then used to conductphishingattacksandotherformsoffraud.

5. Equifax API Malware Attack: In 2017, a malware attackonEquifax'sAPIsallowedattackerstosteal the personal data of over 143 million customers. The attackers used an API vulnerability to access customer data, which they then downloaded and exfiltrated[7].

3. TECHNIQUES FOR API MALWARE DETECTION.

APImalwarecanbefoundusingavarietyofmethods,such asanomalydetectionbasedonmachinelearning,behaviourbaseddetection,andsignature-baseddetection[2][1].

1. Signature-based detection: This method looks for patternsorsignaturesofknownmalwarewithinthe APIrequests.Signatures,whicharepatternstaken fromwell-knownmalware,areusedtospotrelated malware in API calls. While successful against known malware, signature-based detection may missthepresenceoffreshorundiscoveredthreats.

2. Behaviour-baseddetection:Thisapproachfocuses on analyzing the behaviour of the API calls to identify potential malware. Behavior-based detection involves profiling normal API call behavior, creating a baseline, and then detecting anydeviationsfromthebaseline.Behaviour-based detectioncanidentifynewandunknownmalware butmayproducefalsepositives.

3. Machinelearning-Baseddetection:Inthismethod, aberrant patterns in the API calls are identified using machine learning methods. To detect departures from the norm, machine learning algorithms can be trained on typical API call behaviour.Thismethodcanidentifybrand-newand

unidentified malware, but it could also result in falsepositivesandfalsenegatives.

AdvantagesandDisadvantagesofsignature-based,Machine Learning-based, and behaviour-based techniques are presentedinbelowTable1.

Table1:Advantagesanddisadvantagesofsignaturebased,MachineLearning-basedandbehaviour-based techniques

Advantage Disadvantage

Signaturebased Its reduced runtime results from the fact that itonlydependson the code's signature[2]

Behaviourbased Itismoreeffective in finding polymorphic malware than signature-based methods[1]

Machine Learningbased

This can analyze large volumes of API data to learn patterns and behaviours associated with malware.

Unknown Malware can not be detected because this technique only looks for patterns from known malware signatures[2]

Many polymorphic viruses, often known as packers, are undetectablebyit[2]

It requires a significant amount of labelled training data to build accurate models.

3.1 TECHNIQUES OF API MALWARE ANALYSIS.

AnalyzingAPIcallsisacriticalcomponentofidentifyingand detectingmaliciouscode.Thereareseveraltechniquesfor analyzingAPIcallsandidentifyingmaliciouscode,including codeanalysis,dynamicanalysis,andsandboxing.

1. StaticAnalysis:Thistechniqueinvolvesexamining the code within API calls to identify known malicious code patterns and behaviours. Code analysiscanbeperformedmanuallyorthrough,the useofautomatedtools,suchasstaticanalysistools. Static analysis tools scan the API calls to identify any suspicious code, including known malware patternsandcodeobfuscationtechniques.

Severaltechniquescanbeusedforstaticmalware analysis[2].

 Filefingerprinting: Thismethodoperates atthefilelevel,forexample,bycomputing

thefile'scryptographichash.Bydoingso, you can tell it apart from other files and confirm that the file hasn't been altered. This method doesn't check the file's externalcharacteristics.

 Extraction of hard- coded strings: This method extracts strings that are hardcoded into the binary. This is possible because programme code compiles error andstatusnotificationsintoreadabletext. Therefore,drawingconclusionsaboutthe examined binary may be possible by looking at hard- coded error and status messages.

 File format: Any file format's metadata could be used to gather valuable data. A magic number can be used on UNIX systems to identify the file type. Some information, including imported and exported functions, strings, icons, and menus, can be acquired for a Windows binary, which is typically in a portable executableformat.

 AV scanning: Malware binaries are examined using this method. Anti-virus (AV)scannersarelikelytoidentifyabinary asmalwareifitiswell-known.

 Packer detection: By utilizing packers, malware is produced in an obfuscated format, such as an encrypted or compressed file. The malware has a new appearance after packing, making it difficult to find. Although there are numerous unpackers, including PEiD2, there is no universal unpacker for all the malwarethathasbeenpackaged.Themain drawbackofstaticmalwareanalysisisthis limitation.

 Disassembly: The main function of static analysis is the disassembly of a malware binary.The machinecodeis convertedto disassembly language using disassembly toolslikeIDAPro.Theprogrammelogical functions can then be examined, and its objectives can be ascertained, using the disassembledcode.

2. Dynamic Analysis: This technique involves analyzingthebehaviourofAPIcallsinreal-timeto identify any malicious activity. Dynamic analysis can involve monitoring network traffic, analyzing system logs, and using tools such as intrusion

detection systems (IDS). By observing the behaviourofAPIcallsinreal-time,itispossibleto detectanomaliesandothermaliciousactivity. Therearetwodynamicanalysisapproaches[2]:

 Analyzingthedifferencebetweendefined points: In this method, a sample of input malware is run for a while, and if any changesaremadetothesystem,theyare examined by comparing them to the system's initial state. The course of the infection will be shown in the report created by comparing the two states. watchingtheruntime.

 Behaviour

 : Monitoring tools like API Monitor are used to keep an eye on malware activity whileitisrunning.

3. Sandboxing:Sandboxingistheprocessofexecuting APIcallsinaregulatedsettinginordertoobserve theirbehaviourandspotanyharmfulactivities.API calls can be isolated with the use of sandboxing, which keeps the overall system from being impacted.Thismethodcanbehelpfulforanalyzing malware behaviour and spotting any odd or suspiciousactivity.

4. Memory Forensics: Memory forensics examines a system'smemorytofindanyharmfulbehaviouror code. This method can be used to locate malware thatdoesn'texistinthefilesystembutonlyexistsin memory.Usingspecializedtoolsandmethods,such as memory dump analysis and debugging tools, memoryforensicscanbecarriedout.

5. API Fuzzing: API fuzzing involves sending malformed or unexpected data to API calls to identify any vulnerabilities or weaknesses in the API. This technique can help identify potential security issues and is often used during the developmentandtestingphasesofsoftware.

Researchonsomeofthetechniquesdescribedaboveis presentedinTable2.

Table2:ResearchonAPIMalwareAnalysis.

4.API FORENSICS

Investigating and examining APIs to see if they have been exploited, misused, or compromised is known as API forensics. In order to uncover security flaws and attacks, collectevidenceforuseincourtcases,andcollectdatafrom APIs and the systems that are connected to them, it is necessarytoapplyforensictechniquesandtechnologies.API forensics is essential in the linked world of today, when systemsandplatformsareincreasinglyintegratedthrough theuseofAPIs[16][20]

4.1 API FORENSICS PROCESS

The API forensics process involves several steps, including:[21][19][16]

1.Identification:Thefirststepintheprocessisidentifying the APIs that are being used by the organization. This includesidentifyingthetypesofAPIs,theirfunctionality,and theirassociatedsystemsandplatforms.

2. Collection: Once the APIs have been identified, the next step is to collect data from them. This includes collecting logs, traffic data, and other relevant information that can helpidentifysecuritybreachesandattacks.

3. Analysis: The collected data is then analyzed using forensictechniquesandtools.Thisincludesanalyzingtraffic patterns,identifyingabnormalbehaviour,anddetermining therootcauseofanysecuritybreachesorattacks.

4. Evidence Gathering: The final step in the process is to gatherevidencethatcanbeusedinlegalproceedings.This includespreservingthecollecteddatainasecuremanner, creatinganaudittrailoftheinvestigation,anddocumenting thefindingsandconclusions.

4. 2 CHALLENGES OF API FORENSICS

APIforensicshasitsshareofdifficulties.Thecomplexityof contemporary API architectures, which might include severallevelsandcomponents,isoneofthemainobstacles. Thismakesitchallengingtospotandisolatesecurityflaws, attacks.Theintricacyoftheforensicinvestigationprocessis furtherincreasedbythefactthatmanythird-partyservices serveasthefoundationforAPIs[19][21]

Theabsenceofstandardisedforensicmethodsandtoolsfor API forensics is another difficulty. While certain tools are accessible,theyarefrequentlyproprietaryand rarelyused. This makes it challenging for researchers to successfully sharedataandworktogether[19][21].

4.3 TECHNIQUES FOR API FORENSICS

API forensics involves the collection, preservation, and analysis of evidence related to API-based attacks. The

following are some common techniques for API forensics: [16][18][19][20][21]

1. Memory Dump Analysis: To find any malicious activity,memorydumpanalysisincludesretrieving the memory from a machine. This method can be usedtolocatemalwarethatdoesn'texistinthefile systembutonlyexistsinmemory.Itispossibleto analyzememorydumpsusingspecializedtoolsand methods,suchastheVolatilityFramework.

2. LogAnalysisLoganalysisinvolveslookingthrough system logs for any odd activity that might be connected to API-based attacks. System logs may contain important details about the behaviour of APIcalls,suchasthedateandtimeofexecution,the sourceanddestinationaddresses,andthenatureof theoperation.Bothautomatictools,likeLogParser, and human analytic methods can be used to performloganalysis.

3. NetworkTrafficAnalysis:Networktrafficanalysis involvesmonitoringthetrafficbetweensystemsto identifyanysuspiciousactivityrelatedtoAPI-Based attacks.Thistechniquecanbeusedtoidentifythe source and destination of API calls, as well as the type of data being transferred. Network traffic analysiscanbeperformedusingspecializedtools, suchasWireshark.

4. System Profiling: System profiling involves collecting information about the configuration of thesystemtoidentifyanypotentialvulnerabilities or weaknesses. This technique can be used to identify any software or hardware configurations that may be susceptible to API-based attacks. Systemprofilingcanbeperformedusingautomated tools,suchasOSSEC,ormanualanalysistechniques.

5. Evidence Collection: Evidence collection involves thepropercollectionandpreservationofevidence related to API-based attacks. This includes the collection of system logs, memory dumps, and networktrafficdata.Properevidencecollectionis critical to ensuring that the evidence collected is admissibleincourtandcanbeusedtosupportlegal action,ifnecessary.

4.4 API FORENSICS TOOLS

There are several tools available for performing API forensics. The following are some commonly used tools: [16][17]

1. Volatility Framework: API forensics can be performedusingtheopen-sourcememoryforensics framework Volatility. It enables the detection of

maliciousbehaviourconnectedtoAPI-basedattacks throughthestudyofsystemmemorydumps.

2. Wireshark:Wiresharkisanetworktrafficanalysis tool that can be used to monitor and analyze networktrafficrelatedtoAPI-basedattacks.Itcan capture and decode network traffic in real-time, allowing for the analysis of the data transferred duringAPIcalls.

3. LogParser:LogParserisaloganalysistoolthatcan beusedtoparseandanalyzesystemlogsrelatedto API-based attacks. It can extract relevant informationfromlogfilesandprovideinsightinto thebehaviourofAPIcalls.

4. OSSEC: OSSEC is a host-based intrusion detection systemthatcanbeusedforsystemprofilingandto detect and prevent API-based attacks. It can monitor system logs, file changes, and network trafficandalertadministratorswhensuspicious activityisdetected.

5. Fiddler:Fiddlerisawebdebuggingproxytoolthat can be used to analyze and debug HTTP traffic related to API-based attacks. It can capture and analyze HTTP traffic between clients and servers, allowing for the identification of any malicious activity.

5.FUTURE STUDY:

In terms of potential future research directions in API malware analysis and forensics, machine learning-based techniques could be developed to detect and classify APIbased attacks with high accuracy. There is also a need for automatedsystemsthatcandetectAPI-basedattacksinrealtimeandrespondappropriately.Additionally,techniquesfor analyzing encrypted traffic could be developed to identify anysuspiciousactivityrelatedtoAPI-basedattacks.

Emerging technologies such as cloud computing and the InternetofThings(IoT)canhaveanimpactonAPIsecurity. Asmoreapplicationsaredevelopedforthesetechnologies,it becomesincreasinglyimportanttoensurethattheirAPIsare secure.Futureresearchcouldfocusondevelopingsecurity solutionsfortheseemergingtechnologies.

In terms of implications for software development and cybersecurity best practices, API security should be a top priority. Developers should be trained in secure coding practicesandfollowestablishedsecurityguidelines.Regular security assessments and testing should be performed to identifyanyvulnerabilitiesinAPI-basedapplications.

6.CONCLUSION:

ThepaperexploredthetopicofAPImalwareanalysisand forensics, providing an overview of APIs and their role in software development, the threat of API malware attacks, andtheimportanceofAPImalwareanalysisandforensics.It also discussed common types of API malware attacks, techniques for API malware detection and analysis, techniquesforanalyzingAPIcallsandidentifyingmalicious code, techniques for API forensics, and tools used for API forensics.

ThepaperhighlightstheimportanceofAPIsecurityandthe needforregularsecurityassessmentsandtestingtoidentify vulnerabilitiesinAPI-basedapplications.Developersshould follow established security guidelines and be trained in securecodingpractices.Incidentresponseplansshouldalso be in place to quickly respond to any API-based attacks. Researchersshouldfocusondevelopingautomatedsystems thatcandetectAPI-basedattacksinreal-time,techniquesfor analyzing encrypted traffic, and security solutions for emergingtechnologiessuchascloudcomputingandIoT.

Future research should focus on developing machine learning-based techniques for API malware analysis and forensics, automated systems that can detect API-based attacks in real-time, techniques for analyzing encrypted traffic,andsecuritysolutionsforemergingtechnologiessuch ascloudcomputingandIoT.Additionally,moreresearchis needed on the effectiveness of different API malware detectionandanalysistechniques,andonthedevelopment ofbestpracticesforAPIsecurity.

7. REFERENCE:

[1] Youngjoon Ki,1 Eunjin Kim,2 and Huy Kang Kim1, A Novel Approach to Detect Malware Based on API Call Sequence Analysis, 1 Korea University, 145 Anam-ro, Seongbuk-gu,Seoul137-713,RepublicofKorea.

[2]FahadMira,AReviewPaperofMalwareDetectionUsing API Call Sequences, School of Computer Science and TechnologyUniversityofBedfordshire,Luton,UK

[3]https://brightsec.com/blog/api-security/

[4] https://techcrunch.com/2018/09/28/everything-youneed-to-know-about-facebooks-data-breach-affecting-50musers/

[5] https://venturebeat.com/security/twitter-breach-apiattack/

[6]https://techcrunch.com/2017/11/21/uber-data-breachfrom-2016-affected-57-million-riders-and-drivers/

[7]https://en.wikipedia.org/wiki/2017_Equifax_data_breach

[8] https://www.radware.com/cyberpedia/applicationsecurity/api-attack/

[9] https://www.dpsolutions.com/blog/common-attacktypes-on-apis

[10]https://www.techtarget.com/searchapparchitecture/de finition/application-program-interface-API

[11] Qiao, Y., Yang, Y., He, J., Tang, C. and Liu, Z. (2014), CbmCBM:free,automaticmalwareanalysisframeworkusing apiAPIcallsequences

,in,KnowledgeEngineeringandManagement‟.

[12]Goertzel,K.M.,2009.ToolsonAntiMalware.Technical InformationCenter

[13]Acosta,J.C.,Mendoza,H.andMedina,B.G.(2012),An efficient common substrings algorithm for on-the-fly behavior-based malware detection and analysis, in „Proceedings-–IEEEMilitaryCommunicationsConference MILCOM‟

[14]Ki,Y.,Kim,E.andKim,H.K.(2015),ANovelApproach toDetectMal-wareBased onAPI Call SequenceAnalysis‟, InternationalJournalofDis-tributedSensorNetworks

[15] Sundarkumar, G.G. and Ravi, V., 2013, December. Malware detection by text and data mining. In 2013 IEEE InternationalConferenceonComputationalIntelligenceand ComputingResearch

[16]VassilRoussev,AndresBarretoandIrfanAhmed,APIBASEDFORENSICACQUISITIONOFCLOUDDRIVES.

[17] Cloud forensicseTool development studies & future outlook , Vassil Roussev* , Irfan Ahmed, Andres Barreto, ShaneMcCulley,VivekShanmughan

[18] API Tracing Tool for Android-Based Mobile Devices ,SeonhoChoi,MichaelBijou,KunSun,andEdwardJung

[19] Live Forensics on RouterOS using API Services to Investigate Network Attacks, Muhammad Itqan Mazdadi ,ImamRiadiAhmadLuthfi.

[20] Mike Bond and Ross Anderson, API-Level Attacks on EmbeddedSystems.

[21]https://indiaforensic.com/api-forensics-security/

[22]https://en.wikipedia.org/wiki/API