.png){kind=icon}
Return
HotPatchCaps: A Capsule Network With Runtime Hot Patching for Zero-Day API Attack Detections
.png){kind=icon}
PRE
AI
DOI：10.1109/tnsm.2026.3713465.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Modern services are awash in Application Programming Interfaces (APIs), yet most security pipelines end at pre-deployment testing using fuzzers and scanners. This leaves a run-time gap where payload obfuscation and other evolving request-visible misuse patterns outpace static rules and slow retraining cycles. We present HotPatchCaps, an expert-in-the-loop runtime framework that closes this gap by hot patching expert knowledge into a capsule architecture without retraining. HotPatchCaps fuses Term Frequency-Inverse Document Frequency (TF-IDF) statistics on request tokens with security cues such as parameter names, encodings, and payload substrings, and employs slot-controlled routing to amplify semantically relevant evidence into interpretable capsule activations. New rules arrive as lightweight runtime patches that can be injected on the fly, aligning with operational practice while preserving the generalization of learned models. We evaluated the CSIC 2010 dataset and the ATRDF 2023 dataset in both in-distribution and zero-day settings against classical machine learning (ML) and deep baselines. Experimental results demonstrate that HotPatchCaps consistently improves accuracy and recall at competitive precision and remains robust under label noise and schema drift. By turning expert knowledge into patchable capsule priors, HotPatchCaps provides a practical path from testing to on-call defence for API-centric systems.
Keywords:
Modeling
Application programming interfaces
Security
Signal detection
Runtime
Training
Poles and zeros
Labeling
Conferences
Routing
API security
runtime defence
zero-day attack detection
capsule networks
hot patching
Journal
IF:
5.4
Papers:
637
Citations:
9.2K
Organization
Cited Papers
No cited papers available