A computer-implemented method includes receiving data comprising a plurality of application programming interface (API) requests from a plurality of client devices. The method includes generating a plurality of API sessions based on the data, wherein each of the API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device. The method includes comparing each of the plurality of API sessions to one or more of a plurality of different patterns indicative of permissible API sessions determined based on training data. The method includes determining one or more API sessions of the plurality of API sessions generated based on the data are abnormal based, at least in part, on the comparing. Finally, the method includes performing one or more actions based on determining the one or more API sessions are abnormal.