AI Agent API Security: How IP Intelligence Stops $8.4B in Agent-Based Attacks

// IP verification middleware for AI agents
async function verifyAgentIP(request: AgentRequest): Promise<AgentDecision> {
  const clientIP = request.headers['x-forwarded-for'] || request.ip;

  // Fast IP lookup (12ms average)
  const ipIntelligence = await ipInfoClient.lookup(clientIP, {
    fields: ['security', 'connection', 'location']
  });

  // Known AI provider allowlist
  const allowedProviders = ['openai.com', 'anthropic.com', 'google.com'];

  if (ipIntelligence.connection.domain) {
    const domain = ipIntelligence.connection.domain.toLowerCase();
    for (const provider of allowedProviders) {
      if (domain.endsWith(provider)) {
        return { action: 'allow', reason: 'known_ai_provider' };
      }
    }
  }

  // Security flags check
  if (ipIntelligence.security.isProxy ||
      ipIntelligence.security.isVpn ||
      ipIntelligence.security.isTor) {
    return {
      action: 'challenge',
      reason: 'anonymization_detected',
      riskScore: 0.85
    };
  }

  // Datacenter with no AI provider association
  if (ipIntelligence.connection.type === 'hosting') {
    return {
      action: 'rate_limit',
      reason: 'unknown_datacenter',
      rateLimit: 100 // requests per minute
    };
  }

  // Residential traffic for AI agents is suspicious
  if (ipIntelligence.connection.type === 'residential') {
    return {
      action: 'block',
      reason: 'residential_ai_traffic',
      riskScore: 0.92
    };
  }

  return { action: 'allow', reason: 'standard_verification' };
}

// Behavioral analysis with IP enrichment
interface AgentBehaviorProfile {
  avgRequestsPerMinute: number;
  uniqueEndpoints: Set<string>;
  geographicSpread: Set<string>;
  timePatterns: number[];  // Hour-of-day distribution
  asnHistory: Map<string, number>;
}

async function analyzeAgentBehavior(
  agentId: string,
  ipData: IPIntelligence
): Promise<BehaviorScore> {
  const profile = await getAgentProfile(agentId);

  // Detect geographic impossibility
  const recentIPs = profile.asnHistory.keys();
  for (const prevASN of recentIPs) {
    if (prevASN !== ipData.asn.asn) {
      const prevLocation = await getLocationByASN(prevASN);
      const distance = calculateDistance(
        prevLocation,
        ipData.location
      );
      const timeDiff = getTimeSinceLastRequest(agentId);

      // Impossible travel: >1000km in <1 hour
      if (distance > 1000 && timeDiff < 3600000) {
        return {
          score: 0.95,
          flags: ['impossible_travel', 'asn_switch']
        };
      }
    }
  }

  // Check for scraping patterns
  const endpointEntropy = calculateEntropy(profile.uniqueEndpoints);
  if (endpointEntropy > 0.9 && profile.avgRequestsPerMinute > 50) {
    return {
      score: 0.88,
      flags: ['potential_scraping', 'high_frequency']
    };
  }

  return { score: 0.1, flags: [] };
}

// Dynamic rate limiting configuration
interface RateLimitConfig {
  windowMs: number;
  maxRequests: number;
  keyGenerator: (req: Request) => string;
}

function getRateLimitForIP(ipData: IPIntelligence): RateLimitConfig {
  // Base limits for different connection types
  const baseLimits = {
    'corporate': { windowMs: 60000, maxRequests: 1000 },
    'hosting_known': { windowMs: 60000, maxRequests: 500 },
    'hosting_unknown': { windowMs: 60000, maxRequests: 100 },
    'residential': { windowMs: 60000, maxRequests: 50 },
  };

  let config = baseLimits[ipData.connection.type] || baseLimits.residential;

  // Adjust for security flags
  if (ipData.security.threatLevel > 0.5) {
    config.maxRequests = Math.floor(config.maxRequests * 0.5);
  }

  // Known AI providers get enhanced limits
  if (isKnownAIProvider(ipData.connection.isp)) {
    config.maxRequests = config.maxRequests * 3;
  }

  // ASN reputation adjustment
  const asnReputation = getASNReputation(ipData.asn.asn);
  if (asnReputation.fraudRate > 0.02) {
    config.maxRequests = Math.floor(config.maxRequests * 0.3);
  }

  return config;
}