Sequence Analytics: A New Layer of API Abuse Detection
Cloudflare has announced Sequence Analytics for its API Gateway product. This new feature identifies and surfaces the most important sequences of API requests made to a customer’s endpoints, allowing teams to prioritize protection for the critical parts of their API surface.
A sequence is a time-ordered list of HTTP requests made by a single visitor during a session—whether that’s a human on a website, a mobile app user, or a B2B partner integrating via API. An example of a sequence for a bank funds transfer might include calls like:
| Order | Method | Path | Description |
|---|---|---|---|
| 1 | GET | /api/v1/users/{user_id}/accounts | user_id is the active user |
| 2 | GET | /api/v1/accounts/{account_id}/balance | account_id is one of the user’s accounts |
| 3 | GET | /api/v1/accounts/{account_id}/balance | account_id is a different account belonging to the user |
| 4 | POST | /api/v1/transferFunds | Containing a request body detailing an account to transfer funds from, an account to transfer funds to, and an amount of money to transfer |
Why examine sequences at all? A request to POST /api/v1/transferFunds arriving without the typical prior requests would be immediately suspicious—how would the client know account IDs or available balances without first querying them? But with thousands of requests hitting production APIs, manually spotting these kinds of anomalies isn’t feasible.
Sequence Analytics introduces a positive security model for API traffic. Rather than attempting to block every possible threat, a positive model allows known-good behavior and denies everything else by default. API Gateway already supports positive models through volumetric abuse protection and schema validation. Sequences form the third pillar: by establishing endpoint precedence within a sequence, the gateway can log or block traffic that doesn’t follow expected patterns.
Why Sequence Order Reveals Abuse
Attackers rarely follow legitimate traffic patterns. API fuzzing tools fire off many requests with varying parameters to probe for unexpected responses. Manual attackers may attempt Broken Object Level Authorization attacks by replaying or altering valid requests. Rate limiting helps, but attackers can deliberately execute these sequences slowly to evade volumetric detection.
Consider the legitimate funds transfer sequence again, but this time with an attacker copying a valid request and altering the payload:
| Order | Method | Path | Description |
|---|---|---|---|
| 1 | GET | /api/v1/users/{user_id}/accounts | user_id is the active user |
| 2 | GET | /api/v1/accounts/{account_id}/balance | account_id is one of the user’s accounts |
| 3 | GET | /api/v1/accounts/{account_id}/balance | account_id is a different account belonging to the user |
| 4 | POST | /api/v1/transferFunds | Containing a request body detailing an account to transfer funds from, an account to transfer funds to, and an amount of money to transfer |
| … attacker copies the request to a debugging tool like Postman … | |||
| 5 | POST | /api/v1/transferFunds | Attacker has modified the POST body to try and trick the API |
| 6 | POST | /api/v1/transferFunds | A further modified POST body to try and trick the API |
| 7 | POST | /api/v1/transferFunds | Another, further modified POST body to try and trick the API |
If a customer knew that POST /transferFunds is critical and should happen only once per sequence, they could write a rule to prevent repeated or out-of-order calls. Without prior knowledge of which sequences matter, however, defining useful rules is guesswork. Low rate limits are too risky—a legitimate user might reasonably have several transfers in short succession. Today most customers only discover such abuse after the fact.
Cloudflare’s approach to positive security based on request sequences has three components:
- Sequence Analytics: Determining which sequences occur and summarizing them into an interpretable form.
- Sequence Abuse Detection: Classifying sequences as likely benign or malicious.
- Sequence Mitigation: Defining rules on sequences that decide which traffic to allow or block.
Challenges in Sequence Construction
Building reliable sequences is technically demanding. Sessions can be long-lived and contain hundreds of requests, so grouping by session ID alone doesn’t work—a single session may contain many distinct sequences. Also, important sequences aren’t necessarily the most frequent ones; the set of possible sequences is astronomically large, and the goal is to surface the meaningful ones.
Data from api.cloudflare.com illustrates the scale of the problem. A one-hour snapshot of about 88,000 sessions and 260 million requests across 301 endpoint types was processed with a sliding window of varying length:
With a window size of one request, there are only 301 distinct sequences. Every additional request in the window multiplies that sharply, reaching roughly 780,000 distinct sequences at ten requests per window. The explosion in sequence space makes finding abuse a true “needle in a haystack” challenge.
Viewing Important Sequences
Sequence Analytics is available in the API Gateway dashboard:
The feature identifies sequences automatically and scores them using a metric called the Correlation Score. The top 20 sequences by score are displayed in the dashboard, representing the most important sequences for the customer. High-correlation sequences can contain both rarely used (potentially anomalous) and frequently used (likely benign) endpoints. Because endpoints in a high-correlation sequence appear together regularly, they reflect real usage patterns.
Customers are advised to inspect these sequences carefully. For the endpoints involved, they should apply available API Gateway protection including rate limiting, Schema Validation, JWT Validation, and mTLS, and confirm expected endpoint order with their development team.
Coming soon, Cloudflare will add sequence precedence rules that let customers explicitly define the exact order of allowable API requests. These rules will extend the positive security model to block traffic that deviates from the specified sequence.
Getting Started
Sequence Analytics is now available to all API Gateway customers in the Cloudflare dashboard under Security > API Gateway > Sequences. Enterprise customers without an API Gateway subscription can enable a trial inside the dashboard or contact their account manager.
Future releases will add custom sequence matching, real-time mitigation, and reports identifying which API users attempted sequences that violate policy.
