Interface abnormal call monitoring method and device

Abstract

An interface abnormal call monitoring method and device solve the problems that an existing method based on a blacklist, rules and machine learning is low in detection rate and high in false detectionrate, and new abnormal behaviors cannot be found in time. The characteristics of the clustering algorithm are obtained by using the user portrait technology, and the users are divided into a plurality of user subclasses with comparability, so that the detection rate of abnormal interface calling is higher, and the false detection rate is lower. Learning a behavior mode of each user subclass by using a neural network model; according to the method, the envelope of the normal behavior mode is obtained, the trained neural network is used for predicting the subsequent normal API interface callingbehavior of the client, and the predicted behavior is compared with the actual API interface calling behavior of the client, so that the new abnormal behavior can be found in time.

Description

technical field [0001] The present invention relates to the technical field of interface invocation, and more specifically, to a method and device for monitoring abnormal interface invocation. Background technique [0002] With the improvement of informatization level, more and more enterprises open up their service capabilities through API, and build their own ecosystems on the basis of open services. With the increase in the number of API service interface calls, the security issue of interface calls is becoming more and more urgent and important. Blacklist-based and rule-based methods have been proposed one after another, but there are still problems of low detection rate and high false detection rate, and the above methods can only detect known security problems, for new security problems that have not occurred before , it cannot be detected. Contents of the invention [0003] In order to solve at least one of the above problems, the present application provides a me...

AI Technical Summary

Problems solved by technology

Blacklist-based and rule-based methods have been proposed one after another, but there are still problems of low detection rate and high false detection rate, and the above methods can only detect known security problems, for new security problems that have not occurred before , it is not possible to detect

Images