Palimpsest
Real-time API anomaly detection, without signature matching.
Learns what normal API behavior looks like — per-endpoint and per-session — and flags meaningful deviations, catching novel attacks that signature-based WAFs miss. The most production-mature of Encore IT's security research platforms.
Overview
Signature-based WAFs can only catch attacks they already recognize. Palimpsest instead learns the normal behavioral shape of API traffic, per endpoint and per session, and flags meaningful deviations from it, catching novel attacks that signatures structurally cannot see: credential stuffing paced under rate limits, distributed scraping across identities, and slow data exfiltration. It is the most production-mature of Encore IT's security research platforms.
Key figures
100%
recall across 5 tested attack categories (credential stuffing, scraping, IDOR probing, parameter tampering, slow exfiltration)
0.69%
false-positive rate across 581 normal requests
<5ms
per-request detection latency
How it works
Baseline every endpoint
A per-endpoint statistical baseline, maintained with Welford's algorithm, scores each request in under 5ms.
Learn request sequences
In the background, a GRU-Autoencoder analyzes sequences of requests to spot sessions that deviate from normal behavior.
Run targeted detectors
Dedicated detectors cover call frequency, login failure-rate anomalies, scraping patterns, and sequential-ID (IDOR) enumeration.
Combine without dilution
Detector scores are combined with a maximum function rather than an average, so one strong signal is never diluted by other detectors scoring low.
Respond proportionally
A tier engine turns the result into one of four actions: log, flag, throttle, or block.
Key features
Dual point + session ML detection
Sub-5ms per-request latency
Credential-stuffing & scraping detectors
Sequential-ID enumeration checks
Full observability stack
Interested in Palimpsest?
Tell us about your needs and we will get back to you within one business day.
Request a Demo