Risk-Aware Federated Graph-Temporal Learning for Cross-Domain Application Programming Interface Security Monitoring

Abstract

Application programming interfaces have become the principal communication surface of cloud-native and distributed business systems, but their security telemetry is fragmented across gateways, service meshes, application logs, and organizational domains. Centralized monitoring is difficult when request payloads, identity tokens, object identifiers, and business parameters cannot leave their original security boundaries. This paper presents FedAPI-Mon, a risk-aware federated graph-temporal framework for cross-domain application programming interface security monitoring. Each participant converts locally observed requests into windowed call graphs that jointly represent endpoint semantics, identity transitions, object access, response status, latency, and invocation order. A relational graph-attention encoder learns lateral dependencies among services, while a temporal self-attention encoder models multi-step behaviors that are weak when viewed as isolated requests. A risk-aware aggregation rule then weights local updates by threat coverage, update consistency, and validation reliability, reducing model drift under non-independent and non-identically distributed traffic. Finally, an adaptive boundary combines classification confidence, representation distance, and short-term baseline deviation to identify both known and previously withheld attack patterns. Controlled replay experiments containing 1.24 million requests, 40 monitoring items, 12 services, and six attack families show a macro-F1 of 96.4%, a receiver-operating-characteristic area of 98.3%, and a 1.7% false-positive rate. In leave-one-attack-family-out tests, the method retains a macro-F1 of 91.8%. It also compresses 96.2% of repetitive alerts while preserving 95.4% of malicious events. The results indicate that federated graph-temporal learning can improve API risk visibility without centralizing sensitive request data.