The week's pick
Random Articles
Reseach Article
An AI-Assisted Governance Framework for Risk-Aware Enterprise API Security
| International Journal of Computer Applications |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 187 - Number 149 |
| Year of Publication: 2026 |
| Authors: Ram Lokam |
10.5120/ijca55bf0f440c49
|
Ram Lokam . An AI-Assisted Governance Framework for Risk-Aware Enterprise API Security. International Journal of Computer Applications. 187, 149 ( Oct 2026), 52-58. DOI=10.5120/ijca55bf0f440c49
Abstract
The enterprise API ecosystems are distributed, and span applications, cloud services, partners, mobile clients and internal platforms, making it difficult to consistently govern for security. This research aims to develop a Security Governance framework to address the issue of security governance in information systems using AI including identity verification, gateway screening, policy enforcement, behavioral monitoring, telemetry feedback and executive oversight. The selected 134 security instances for the empirical evaluation are based on the UNSW-NB15 benchmark, which have been reinterpreted as enterprise API-session case studies to enable normal and hostile behaviors to be evaluated in a governance-oriented workflow. It is implemented in Python for data preparation and visualization, a structured rule layer for mapping the policies and supervised learning routines for the behavioural risk classification. The framework is measured using the Control Assurance, Exposure Reduction, Policy Compliance, Alert Clarity, Response Readiness and Residual-risk Patterns at Governance Maturity Stages. The results indicate that the best results come from a link between policy enforcement and behavior monitoring and a continuous telemetry. The proposed framework also enables to have a more transparent accountability, and connect machine generated risk observations with human governance decisions. The study offers a viable architecture for organizations that need to secure API estates that are heterogeneous but also have to maintain operational visibility, flexible access control, and a unified control over both internal and external (partner, customer-facing and privileged) APIs.
References
- S. Gamage and J. Samarabandu, “Deep learning methods in network intrusion detection: A survey and an objective comparison,” Journal of Network and Computer Applications, vol. 169, art. 102767, 2020. https://doi.org/10.1016/j.jnca.2020.102767
- L. Ferretti, F. Magnanini, M. Andreolini, and M. Colajanni, “Survivable zero trust for cloud computing environments,” Computers & Security, vol. 110, art. 102419, 2021. https://doi.org/10.1016/j.cose.2021.102419
- M. T. Nguyen and K. Kim, “Genetic convolutional neural network for intrusion detection systems,” Future Generation Computer Systems, vol. 113, pp. 418–427, 2020. https://doi.org/10.1016/j.future.2020.07.042
- W. Yeoh, M. Liu, M. Shore, and F. Jiang, “Zero trust cybersecurity: Critical success factors and a maturity assessment framework,” Computers & Security, vol. 133, art. 103412, 2023. https://doi.org/10.1016/j.cose.2023.103412
- F. Minna and F. Massacci, “SoK: Run-time security for cloud microservices. Are we there yet?,” Computers & Security, vol. 127, art. 103119, 2023. https://doi.org/10.1016/j.cose.2023.103119
- A. Abusitta, M. Bellaïche, M. Dagenais, and T. Halabi, “A deep learning approach for proactive multi-cloud cooperative intrusion detection system,” Future Generation Computer Systems, vol. 98, pp. 308–318, 2019. https://doi.org/10.1016/j.future.2019.03.043
- C. Buck, C. Olenberger, A. Schweizer, F. Völter, and T. Eymann, “Never trust, always verify: A multivocal literature review on current knowledge and research gaps of zero-trust,” Computers & Security, vol. 110, art. 102436, 2021. https://doi.org/10.1016/j.cose.2021.102436
- M. Pawlicki, M. Choraś, and R. Kozik, “Defending network intrusion detection systems against adversarial evasion attacks,” Future Generation Computer Systems, vol. 110, pp. 148–154, 2020. https://doi.org/10.1016/j.future.2020.04.013
- Q. Shen and Y. Shen, “Endpoint security reinforcement via integrated zero-trust systems: A collaborative approach,” Computers & Security, vol. 136, art. 103537, 2024. https://doi.org/10.1016/j.cose.2023.103537
- J. Roldán, J. Boubeta-Puig, J. L. Martínez, and G. Ortiz, “Integrating complex event processing and machine learning: An intelligent architecture for detecting IoT security attacks,” Expert Systems with Applications, vol. 149, art. 113251, 2020. https://doi.org/10.1016/j.eswa.2020.113251
- Z. Adahman, A. W. Malik, and Z. Anwar, “An analysis of zero-trust architecture and its cost-effectiveness for organizational security,” Computers & Security, vol. 122, art. 102911, 2022. https://doi.org/10.1016/j.cose.2022.102911
- A. Robles-González, P. Arias Cabarcos, and J. Parra-Arnau, “Privacy-centered authentication: A new framework and analysis,” Computers & Security, vol. 132, art. 103353, 2023. https://doi.org/10.1016/j.cose.2023.103353
- N. Moustafa, J. Hu, and J. Slay, “A holistic review of Network Anomaly Detection Systems: A comprehensive survey,” Journal of Network and Computer Applications, vol. 128, pp. 33–55, 2019. https://doi.org/10.1016/j.jnca.2018.12.006
- N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in *Proc. 2015 Military Communications and Information Systems Conf. (MilCIS)*, Canberra, ACT, Australia, 2015, pp. 1–6, https://doi.org/10.1109/MilCIS.2015.7348942.
Index Terms
Keywords