API asset identification method, device and equipment

Abstract

The present application provides an API asset identification method, device and equipment, which includes: obtaining flow data for asset identification through flow monitoring; in the case where the obtained flow data is application program interface API interface session flow, parsing the obtained flow data to obtain API interface session information in the flow data; extracting API interface features from the obtained API interface session information; and using a pre-trained machine learning model to perform asset identification based on the extracted API interface features. This method can reduce the data complexity of asset identification, improve the applicability of the method and the accuracy of asset identification.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things security, and in particular to an API asset identification method, device and equipment. Background Art

[0002] IoT devices have played an important role in transportation, finance, energy and other fields. However, due to the wide variety of devices and the large number of devices, users usually cannot rely on a single platform to sort and manage all assets. They need to rely on asset identification devices to discover assets and sort asset information. Asset information refers to the manufacturer, type, model and other information of the device, and asset information is usually sorted in an active and passive manner.

[0003] Therefore, how to accurately realize asset identification has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, the present application provides an API asset identification method, device and equipment.

[0005] Specifically, the present application is implemented through the following technical solutions:

[0006] According to a first aspect of an embodiment of the present application, there is provided an API asset identification method, comprising:

[0007] Obtain flow data for asset identification through flow monitoring;

[0008] When the acquired traffic data is application program interface (API) session traffic, the acquired traffic data is parsed to acquire API session information in the traffic data;

[0009] Extracting API interface features from the acquired API interface session information; wherein the API interface features include part or all of request method features, uniform resource identifier URI structure features, request body structure features, and response body structure features;

[0010] Based on the extracted API interface features, asset identification is performed using a pre-trained machine learning model.

[0011] According to a second aspect of an embodiment of the present application, there is provided an API asset identification device, including:

[0012] An acquisition unit, used for acquiring flow data for asset identification through flow monitoring;

[0013] A parsing unit, configured to parse the acquired traffic data to acquire API interface session information in the traffic data when the traffic data acquired by the acquisition unit is application program interface API interface session traffic;

[0014] A feature extraction unit is used to extract API interface features from the acquired API interface session information; wherein the API interface features include part or all of request method features, uniform resource identifier URI structure features, request body structure features, and response body structure features;

[0015] Asset identification is used to identify assets based on the extracted API interface features using a pre-trained machine learning model.

[0016] According to a third aspect of an embodiment of the present application, there is provided an electronic device, including a processor and a memory, wherein:

[0017] Memory, used to store computer programs;

[0018] The processor is used to implement the method provided in the first aspect when executing the program stored in the memory.

[0019] According to a fourth aspect of an embodiment of the present application, a computer program product is provided, wherein a computer program is stored in the computer program product, and when the computer program is executed by a processor, the method provided in the first aspect is implemented.

[0020] The API asset identification method of the embodiment of the present application obtains traffic data for asset identification by means of traffic monitoring. When the acquired traffic data is API interface session traffic, the acquired traffic data is parsed to obtain API interface session information in the traffic data, and API interface features are extracted from the acquired API interface session information. Then, based on the extracted API interface features, asset identification is performed using a pre-trained machine learning model. By extracting API interface features, the specific API interface data is not paid attention to, which reduces the data complexity of asset identification and improves the applicability of the method and the accuracy of asset identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of an API asset identification method shown as an exemplary embodiment of the present application;

[0022] Figure 2 A flowchart of an API asset identification method is shown as an exemplary embodiment of the present application;

[0023] Figure 3 This is a schematic diagram of the structure of an API asset identification device shown as an exemplary embodiment of the present application;

[0024] Figure 4 This is a schematic diagram of the structure of an API asset identification device shown as an exemplary embodiment of the present application;

[0025] Figure 5 The figure is a schematic diagram of the hardware structure of an electronic device shown as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0026] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0027] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0028] In order to enable those skilled in the art to better understand the technical solutions provided by the embodiments of the present application, some terms involved in the embodiments of the present application are briefly explained below.

[0029] 1. API (Application Programming Interface): The API mentioned in the embodiments of the present application specifically refers to the API interface provided after the device is equipped with web services (which can be called an API interface based on HTTP (HyperText Transfer Protocol)), which can be expressed as a URL (Uniform Resource Locator) string + interface request method / interface response message.

[0030] 2. Asset identification: Identify the IP of the traffic data and determine one or more of the asset information such as the manufacturer, type, and model to which the IP belongs.

[0031] 3. API request methods: including but not limited to GET, HEAD, POST, PUT, DELETE, OPTIONS, TRACE, PATCH, MOVE, COPY. Among them:

[0032] The GET method is used to obtain resources;

[0033] The HEAD method is similar to the GET method, but does not need to return the message body content;

[0034] The POST method is used to create subresources;

[0035] The PUT method is used to create and update resources;

[0036] The DELETE method is used to delete resources;

[0037] The OPTIONS method is used for URI verification to verify whether the interface service is normal;

[0038] The TRACE method is used to echo the request received by the server, mainly for testing or diagnosis;

[0039] The PATCH method is a supplement to the PUT method and is used to partially update known resources.

[0040] The MOVE method is used to move the specified resource to the location specified by the Destination message header.

[0041] The COPY method is used to copy the specified resource to the location specified by the Destination message header.

[0042] In order to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application are further described in detail below with reference to the accompanying drawings.

[0043] See also Figure 1 , is a flow chart of an API asset identification method provided in an embodiment of the present application, such as Figure 1 As shown, the API asset identification method may include the following steps:

[0044] Step S100: Obtaining flow data for asset identification through flow monitoring.

[0045] Exemplarily, traffic monitoring can be achieved through traffic bypass mirroring, and the monitored traffic data, such as core network traffic data, can be determined as traffic data for asset identification, thereby enabling API asset identification without generating interference data.

[0046] For example, the device for API asset identification can be deployed at the traffic intersection of the core network, such as deploying the device for API asset identification in a bypass manner on the core network switch, and the core network switch mirrors the traffic data and sends the mirrored traffic data to the device for API asset identification.

[0047] Step S110: When the acquired traffic data is API interface session traffic, the acquired traffic data is parsed to acquire API interface session information in the traffic data.

[0048] In the embodiments of the present application, it is considered that IoT devices are usually equipped with web services, and the API interface supporting the response in the web service is implemented according to a unified protocol specification, that is, devices of the same manufacturer and the same device type have similarities in the API, while devices of different manufacturers or different device types of the same manufacturer have differences in the API.

[0049] Therefore, asset identification can be achieved based on API interface characteristics.

[0050] Accordingly, in the case where the acquired traffic data is API interface session traffic, the acquired traffic data for asset identification may be parsed to acquire the API interface session information in the traffic data.

[0051] It should be noted that, in the embodiments of the present application, taking into account the actual application scenarios, there may be a situation where the scanner sends an API request message to a device that does not have an API interface. For the device that does not have an API interface, when it receives the request message, it will not return a response message; in this case, if these messages sent to the device that does not have an API interface are also analyzed and processed, it will lead to the situation that the device that does not have an API interface is mistakenly identified as a device with an API interface, affecting the recognition accuracy. Therefore, unless otherwise specified, the above-mentioned API interface session traffic refers to the API interface session in which the request message and response message are monitored, and for the request message without a response, it is not necessary to analyze and process it.

[0052] Step S120: extract API interface features from the acquired API interface session information; wherein the API interface features include part or all of request method features, URI structure features, request body structure features, and response body structure features.

[0053] In the embodiment of the present application, API interface feature extraction may be performed on the API interface session information obtained in the above manner.

[0054] Exemplarily, the API interface features may include, but are not limited to, part or all of request method features, URI (Uniform Resource Identifiers) structure features, request body structure features, and response body structure features.

[0055] Exemplarily, the request method feature includes a feature obtained by extracting a feature of the request method in the API interface session information;

[0056] The URI structure feature includes features obtained by extracting the URI structure information in the API interface session information;

[0057] The request body structure feature includes a feature obtained by extracting the request body structure information in the API interface session information;

[0058] The response body structure feature includes features obtained by extracting features of the response body structure information in the API interface session information.

[0059] In an example, the API interface features may include at least two features of a request method feature, a URI structure feature, a request body structure feature, and a response body structure feature.

[0060] Step S130: Based on the extracted API interface features, use the pre-trained machine learning model to perform asset identification.

[0061] In an embodiment of the present application, in order to realize asset identification, a machine learning model for asset identification based on API interface features can be pre-trained.

[0062] When the API interface features of the traffic data used for asset identification are extracted in the above manner, asset identification can be performed based on the extracted API interface features using a pre-trained machine learning model.

[0063] Exemplarily, the machine learning model may include but is not limited to a neural network model or a decision tree model, etc.

[0064] Among them, the neural network model calculation can be highly parallelized, and hardware acceleration can be used for fast training and reasoning; it has good robustness and a certain degree of fault tolerance for noise and changes in input data.

[0065] The structure and judgment process of the decision tree model can be displayed intuitively, which is easy to understand and explain. It can provide a highly explainable decision-making process and support user-defined modifications and adjustments.

[0066] It can be seen that in Figure 1 In the method flow shown, traffic data for asset identification is obtained through traffic monitoring. When the acquired traffic data is API interface session traffic, the acquired traffic data is parsed to obtain API interface session information in the traffic data, and API interface features are extracted from the acquired API interface session information. Then, based on the extracted API interface features, a pre-trained machine learning model is used to perform asset identification. By extracting API interface features, specific API interface data is not paid attention to, which reduces the data complexity of asset identification and improves the applicability of the method and the accuracy of asset identification.

[0067] In some embodiments, the above-mentioned API interface feature extraction of the acquired API interface session information may include:

[0068] When the API interface characteristics include request methods and URI structure characteristics, hierarchical division is performed on the URI in the obtained API interface session information to obtain multiple character strings;

[0069] Generate request method features and URI structure features according to the API request method and the multiple character strings;

[0070] and / or,

[0071] When the API interface feature includes a request body structure feature, extract key fields and data types from the request body in the acquired API interface session information;

[0072] Generate request body structure features based on the extracted key fields and data types;

[0073] and / or,

[0074] When the API interface feature includes a response body structure feature, extract key fields and data types from the response body in the acquired API interface session information;

[0075] Generate response body structure features based on the extracted key fields and data types.

[0076] Exemplarily, for request method features and URI structure features, when API interface session information in traffic data is obtained, the URI in the obtained API interface session information can be hierarchically divided to obtain multiple character strings.

[0077] Exemplarily, the URI may be divided into levels according to “ / ”.

[0078] For example, for the URI: / ISAPI / Intelligent / channels / <channelid> / OCR / capabilities, the hierarchical character strings can include: ISAPI, Intelligent, channels, <channelid>, OCR, capabilities six strings.

[0079] Exemplarily, the request method features and URI structure features may be generated according to the API request method and multiple character strings obtained by hierarchically dividing the URI.

[0080] For example, the API request method and the string obtained by hierarchical division of the URI can be combined and processed into a one-dimensional vector through onehot encoding.

[0081] Exemplarily, the API request method may include, but is not limited to, some or all of GET, HEAD, POST, PUT, DELETE, OPTIONS, TRACE, PATCH, MOVE, and COPY.

[0082] It should be noted that in the embodiments of the present application, the API request method characteristics and the URI interface characteristics are not limited to being jointly generated in the above manner, but can also be generated independently, that is, when the API interface characteristics include the request method, the request method characteristics are generated based on the API request method; when the API interface characteristics include the URI structure characteristics, the URI in the acquired API interface session information is hierarchically divided to obtain multiple strings, and based on the multiple strings, the URI structure characteristics are generated. The specific implementation will not be described here.

[0083] Exemplarily, for request body structural features, when API interface session information in traffic data is obtained, key fields and data types can be extracted from the request body in the obtained API interface session information, and request body structural features can be generated based on the extracted key fields and data types.

[0084] The generation of response body structure features is similar to that of request body structure features.

[0085] For example, for an OCR structure, its key field may be an "enabled" field, and its data type may be a Boolean type. The key field and the data type may be processed as a whole by onehot processing, and processed into a vector of a fixed length, thereby generating corresponding structural features.

[0086] In some embodiments, when the API interface features include request method features, URI structure features, request body structure features, and response body structure features, the above-mentioned API interface feature extraction from the acquired API interface session information may also include:

[0087] Generate a first tensor of M*N according to the request method characteristics and URI structure characteristics; where M and N are both positive integers, and a row of the first tensor corresponds to the API request method, or one of the multiple strings obtained by hierarchically dividing the URI;

[0088] Generate a second tensor of M*N according to the structural features of the request body; wherein a row of the second tensor corresponds to a key field and its data type of the request body in the API interface session information;

[0089] Generate a third tensor of M*N according to the structural characteristics of the response body; wherein a row of the third tensor corresponds to a key field and its data type of the response body in the API interface session information;

[0090] Generate API interface features according to the first tensor, the second tensor, and the third tensor.

[0091] Exemplarily, when the request method characteristics, URI structure characteristics, request body structure characteristics and response body structure characteristics are obtained in the above manner, on the one hand, an M*N tensor (which can be called the first tensor) can be generated based on the request method characteristics and URI structure characteristics.

[0092] For example, the request method feature and the URI structure feature can be concatenated to obtain the first tensor of M*N. The first row corresponds to the request method feature, and the second to Mth rows each correspond to a URI keyword (i.e., one of the multiple strings obtained by hierarchical division of the URI).

[0093] It should be noted that if the number of URI keywords is insufficient, it can be supplemented by filling in 0; if the number of URI keywords exceeds (such as more than M-1), some URI keywords can be truncated (the same below).

[0094] On the other hand, an M*N tensor (which may be called the second tensor) may be generated according to the structural characteristics of the request body.

[0095] Exemplarily, each row of the second tensor corresponds to a key field and its data type of the request body in the API interface session information.

[0096] Exemplarily, for a keyword in the request body in the API interface session information, the keyword and its data type may be processed to obtain a corresponding vector feature, and a row in the second tensor may be obtained based on the vector feature.

[0097] On the other hand, an M*N tensor (which may be called the third tensor) may be generated according to the structural characteristics of the response body.

[0098] Exemplarily, each row of the third tensor corresponds to a key field and its data type of the response body in the API interface session information.

[0099] Exemplarily, for a keyword of the response body in the API interface session information, the keyword and its data type may be processed to obtain a corresponding vector feature, and a row in the third tensor may be obtained based on the vector feature.

[0100] Exemplarily, when the first tensor, the second tensor, and the third tensor are generated in the above manner, an API interface feature can be generated based on the first tensor, the second tensor, and the third tensor.

[0101] For example, the first tensor, the second tensor, and the third tensor can be concatenated into a tensor of M*N*3 as the final API interface feature, that is, the API interface feature is processed into the image data dimension. Since the current machine learning model has a high degree of adaptability to the image data dimension features, the above processing can improve the performance of the machine learning model in processing the API interface features and optimize the processing effect.

[0102] In some embodiments, the pre-trained machine learning model includes one or more of a device vendor identification model, a device type identification model, and a device model identification model;

[0103] Based on the extracted API interface features, asset identification can be performed using a pre-trained machine learning model, which may include:

[0104] In the case where the pre-trained machine learning model includes a device model identification model, based on the extracted API interface features, the device model identification model is used to identify the device model corresponding to the destination IP address of the API interface session, and when the device model corresponding to the destination IP address of the API interface session is identified, the device type and device manufacturer corresponding to the destination IP address of the API interface session are determined based on the device model corresponding to the destination IP address of the API interface session;

[0105] and / or,

[0106] In the case where the pre-trained machine learning model includes a device type identification model, the device type corresponding to the destination IP address of the API interface session is identified using the device type identification model based on the extracted API interface features, and when the device type corresponding to the destination IP address of the API interface session is identified, the device manufacturer corresponding to the destination IP address of the API interface session is determined based on the device type corresponding to the destination IP address of the API interface session;

[0107] and / or,

[0108] In the case where the pre-trained machine learning model includes a device manufacturer identification model, the device manufacturer corresponding to the destination IP address of the API interface session is identified using the device manufacturer identification model based on the extracted API interface features, and when the device manufacturer corresponding to the destination IP address of the API interface session is identified, the device manufacturer corresponding to the destination IP address of the API interface session is identified.

[0109] Exemplarily, the pre-trained machine learning model includes one or more of a device manufacturer identification model, a device type identification model, and a device model identification model.

[0110] Considering the upward compatibility between device models, device types and device manufacturers, that is, for any IP, when the device model is identified, the device type and device manufacturer corresponding to the IP can be automatically determined.

[0111] For any IP, when the device type is identified, the device manufacturer corresponding to the IP can be automatically determined.

[0112] Accordingly, when the pre-trained machine learning model includes a device model identification model, the device model corresponding to the destination IP address of the API interface session can be identified based on the extracted API interface features using the device model identification model. When the device model corresponding to the destination IP address of the API interface session is identified, the device type and device manufacturer corresponding to the destination IP address of the API interface session can be determined based on the device model corresponding to the destination IP address of the API interface session.

[0113] Exemplarily, when the pre-trained machine learning model includes a device type identification model, the device type corresponding to the destination IP address of the API interface session can be identified based on the extracted API interface features using the device type identification model. When the device type corresponding to the destination IP address of the API interface session is identified, the device manufacturer corresponding to the destination IP address of the API interface session can be determined based on the device type corresponding to the destination IP address of the API interface session.

[0114] Exemplarily, in the case where the pre-trained machine learning model includes a device manufacturer identification model, the device manufacturer identification model is utilized based on the extracted API interface features to identify the device manufacturer corresponding to the destination IP address of the API interface session, and when the device manufacturer corresponding to the destination IP address of the API interface session is identified, the device manufacturer corresponding to the destination IP address of the API interface session is used.

[0115] In one example, the priority of each model for asset identification is, in descending order, as follows: device model identification model, device type identification model, and device manufacturer identification model;

[0116] In the case where the pre-trained machine learning models include multiple equipment manufacturer identification models, equipment type identification models, and equipment model identification models, during the asset identification process, if the currently used machine learning model fails to identify successfully, the next machine learning model is used to continue asset identification in order of priority; if the currently used machine learning model successfully identifies successfully, the asset identification result is determined based on the identification result of the currently used machine learning model.

[0117] Exemplarily, since there is an upward compatibility relationship between device models, device types and device manufacturers, for any IP, the device model identification model (if any) can be preferentially used to identify the device model based on the extracted API interface features. When the device model identification is successful, the device type and device manufacturer can be determined based on the identified device model. When the device model identification is unsuccessful, the device type identification model (if any) can be used to identify the device type. When the device type identification is successful, the device manufacturer can be determined based on the identified device type. When the device type identification is unsuccessful, the device manufacturer identification model (if any) can be used to identify the device manufacturer.

[0118] In some embodiments, the machine learning model is trained by:

[0119] Collect basic information about manufacturers and devices; the basic information about manufacturers and devices includes API interface documents of devices of various manufacturers, types, and models;

[0120] For any API interface document, decompose the API interface information included in the API interface document and extract API interface features; wherein the API interface information includes part or all of the URI corresponding to the API, the API request method, the API request body, and the API response body;

[0121] The machine learning model is trained based on the API interface features corresponding to the collected API interface documents; wherein the machine learning models involved in the training include one or more of a device manufacturer identification model, a device type identification model and a device model identification model. The device manufacturer identification model is used to obtain a device manufacturer identification result based on the input API interface features, the device type identification model is used to obtain a device type identification result based on the input API interface features, and the device model identification model is used to obtain a device model identification result based on the input API interface features.

[0122] For example, in order to implement the training of the above-mentioned machine learning model, basic information of manufacturers and equipment can be collected.

[0123] Exemplarily, the manufacturer and device basic information may include API interface documents of devices of multiple device manufacturers, multiple device types, and multiple device models.

[0124] For any obtained API interface document, the API interface information included in the API interface document can be decomposed and the API interface features can be extracted.

[0125] It should be noted that the API interface feature type used in the machine learning model training process is consistent with the API interface feature type used when performing asset identification using the trained machine learning model described in the above method embodiment.

[0126] For example, assuming that the API interface feature types used in the machine learning model training process include request method features, URI structure features, request body structure features, and response body structure features, then the API interface features used when using the trained machine learning model for asset identification may also include request method features, URI structure features, request body structure features, and response body structure features.

[0127] Exemplarily, the type of API interface information used for API interface feature extraction is determined according to the type of API interface features that need to be extracted.

[0128] For example, machine learning model training can be performed based on the API interface features corresponding to the collected API interface documents.

[0129] For example, all API interface features can be divided into 8:1:1 ratio, 80% as training data, 10% as test data, and 10% as validation data, and the model parameters can be trained until the model converges (the training loss is less than the threshold, or the number of training epochs reaches the threshold).

[0130] Exemplarily, the machine learning models involved in the training include one or more of a device manufacturer identification model, a device type identification model, and a device model identification model.

[0131] The device manufacturer identification model is used to obtain the device manufacturer identification result based on the input API interface characteristics; the device type identification model is used to obtain the device type identification result based on the input API interface characteristics; the device model identification model is used to obtain the device model identification result based on the input API interface characteristics.

[0132] Exemplarily, for the API interface document of any device, the API interface features corresponding to the API interface document can be used as input features in the model training process, and one or more of the device manufacturer, device type, and device model of the device to which the API interface document belongs can be used as corresponding labels.

[0133] For example, for the training of the device manufacturer identification model, the device manufacturer can be used as the label; for the training of the device type identification model, the device manufacturer and the device type can be used as labels; for the training of the device model identification model, the device manufacturer, the device type and the device model can be used as labels.

[0134] Taking the training of the equipment manufacturer identification model as an example, during the training process, any API interface feature used as training data can be input into the equipment manufacturer identification model, and the equipment manufacturer identification model outputs the corresponding equipment manufacturer, and determines whether the training data is accurate based on the equipment manufacturer output by the model and the equipment manufacturer actually corresponding to the API interface feature (which can be determined based on the API interface document corresponding to the API interface feature, as the training label of the equipment manufacturer identification model). Accordingly, the training loss can be determined based on the comparison result of the output result of each training data and the training label.

[0135] Exemplarily, when the model recognizes the device model, the device manufacturer and device type can be automatically filled in; when the model recognizes the device type, the device manufacturer can be automatically filled in, and the device model is empty; when the model recognizes the device manufacturer, the device type and device model are empty.

[0136] In some embodiments, the API asset identification method provided in the embodiments of the present application may also include:

[0137] For any API session destination IP address, if there are multiple API interface sessions corresponding to different API interfaces at the IP address, and the multiple API interface sessions include a first type of API interface session and a second type of API interface session, the second type of API interface session is marked with asset information based on the first type of API interface session; wherein the first type of API interface session is an API interface session that successfully completes asset identification based on the corresponding API interface features using a pre-trained machine learning model; and the second type of API interface session is an interface session that fails to successfully complete asset identification based on the corresponding API interface features using a pre-trained machine learning model;

[0138] The machine learning model is optimized and trained based on the API interface features corresponding to the marked second type of API interface sessions.

[0139] For example, considering that a single device may be provided with multiple API interfaces, in the API interface sessions corresponding to the multiple API interfaces, some API interfaces may be able to successfully complete asset identification in the manner described in the above embodiments, while some API interfaces may not be able to successfully complete asset identification in the manner described in the above embodiments. Since the multiple API interfaces belong to the same device, i.e., correspond to the same IP address, the asset information corresponding to the unidentified API interface can be reverse-marked based on the identified IP asset information.

[0140] Correspondingly, for any API session destination IP address, if there are multiple API interface sessions corresponding to different API interfaces at the IP address, and the multiple API interface sessions include a first type API interface session and a second type API interface session, the second type API interface session can be marked with asset information based on the first type API interface session.

[0141] For example, suppose that an API interface corresponding to IP1 (assuming it is API interface 1) does not identify the device manufacturer, device type and device model corresponding to IP1 based on the API interface features corresponding to the API interface session of API interface 1, but the corresponding device manufacturer, device type and device model are identified based on the API interface features corresponding to the API interface session of another API interface corresponding to IP1 (assuming it is API interface 2). Then the device manufacturer, device type and device model can be marked for the API interface features corresponding to API interface 1.

[0142] Exemplarily, when the asset information of the second type API interface session is marked in the above manner, the machine learning model can be optimized and trained based on the API interface features corresponding to the marked second type API interface session, thereby achieving automated model enhancement training, enhancing the performance of the machine learning model, and optimizing the recognition effect of the machine learning model.

[0143] It should be noted that in the embodiment of the present application, successfully completing asset identification includes identifying one or more of the device manufacturer, device type, and device model. In the process of optimizing and training the machine learning model based on the API interface features corresponding to the marked second type API interface, the corresponding machine learning model can be optimized and trained based on the marked asset information.

[0144] For example, in the case where the marked asset information includes the device manufacturer, the device manufacturer identification model can be optimized and trained based on the API interface features corresponding to the marked second type API interface.

[0145] In the case where the marked asset information includes the device type, the device type recognition model can be optimized and trained based on the API interface features corresponding to the marked second type API interface.

[0146] In the case where the marked asset information includes the device model, the device model recognition model can be optimized and trained based on the API interface features corresponding to the marked second type API interface.

[0147] In order to enable those skilled in the art to better understand the technical solutions provided in the embodiments of the present application, the technical solutions provided in the embodiments of the present application are described below with reference to specific examples.

[0148] This embodiment provides an API asset identification method, which can collect API interface information corresponding to the IP without generating a detection message, and perform asset identification based on a pre-trained machine learning model.

[0149] In this embodiment, considering that the API interface of the IoT device can identify the manufacturer, device type and device model of the device, the API interface information of the device can be collected through passive traffic monitoring, so as to reversely identify the manufacturer, device type and device model of the device (identified by IP).

[0150] like Figure 2 As shown, the asset identification method process in this embodiment may include:

[0151] 1: Collect basic information about manufacturers and devices, including the manufacturer's domain name information and IP information, and the device's API interface documentation.

[0152] 2: Preprocess the collected basic information.

[0153] 3: API interface feature extraction.

[0154] 4: Build a machine learning model based on API interface features; wherein the machine learning model may include a device manufacturer identification model, a device type identification model, and a device model identification model.

[0155] 5: Build an asset identification framework based on passive traffic.

[0156] 6: Framework deployment and asset identification.

[0157] 7: Reverse optimization model based on asset identification information.

[0158] The implementation details of each step in the above process are described below.

[0159] 1. Collect basic information about manufacturers and equipment

[0160] 1.1. Collect the manufacturer’s domain name and IP information.

[0161] For example, different manufacturers will apply for and operate different domain names; similarly, different manufacturers will also apply for and operate different IP information for running related services.

[0162] 1.2. Collect the API interface documentation of the device.

[0163] For example, the API interfaces of devices from the same manufacturer are partially the same, and different devices from different manufacturers will provide different API interfaces. The API interface documents of devices from each manufacturer are collected for subsequent feature extraction and model training.

[0164] 1.3. The API interface document includes: API corresponding URI, API request method, API request body, and API response body.

[0165] For example, a manufacturer's smart camera provides a video text recognition interface, which includes two key interfaces:

[0166] / ISAPI / System / capabilities / / Whether to support this article recognition capability

[0167] / ISAPI / Intelligent / channels / <channelid> / OCR / capabilities?format=json / / Text recognition configuration parameters

[0168] Take the second example

[0169] URI: / ISAPI / Intelligent / channels / <channelid> / OCR / capabilities

[0170] Request method: GET

[0171] Request body: empty

[0172] Response body:

[0173]

[0174] 2. Preprocessing the collected basic information

[0175] 2.1. Construct a domain name and manufacturer mapping matrix (used to store the mapping relationship between domain names and manufacturers).

[0176] For example, one domain name is mapped to one manufacturer, but one manufacturer can be mapped to multiple domain names.

[0177] 2.2. Construct IP and manufacturer mapping matrix.

[0178] For example, one IP maps to one manufacturer, but one manufacturer can be mapped to multiple IPs.

[0179] 2.3. Decompose API interface document information.

[0180] Exemplarily, decomposing the API interface document information mainly includes: decomposing the URI, the request body, and the response body.

[0181] It should be noted that an API interface may be mapped to multiple device types and device models, but basically only to one manufacturer.

[0182] 2.3.1、URI is divided into levels according to " / ". Taking the second URI above as an example, it can be divided into: ISAPI, Intelligent, channels, <channelid>, OCR, and capabilities. Combined with 10 API request methods (GET, HEAD, POST, PUT, DELETE, OPTIONS, TRACE, PATCH, MOVE, and COPY), all strings can be processed into a one-dimensional vector consisting of numbers by one-hot processing.

[0183] Exemplarily, the length of the one-dimensional vector may be determined according to the total number of character strings. For example, assuming that there are 2000 different character strings in total, the length of the one-dimensional vector is 2000.

[0184] For the obtained one-dimensional vector, feature compression can be performed to compress the one-dimensional vector into a vector of a fixed length, such as a vector of a length of 256.

[0185] 2.3.2. Key fields and corresponding data types can be extracted from the request body and response body. For example, for the OCR structure, its key field and corresponding data type can be enabled and Boolean respectively; for the Rect structure, its key field and corresponding data type can be height and floating point respectively. A key field and the corresponding data type can be processed as a whole for onehot, and feature compression can be performed to process it into a fixed-length vector, such as a vector of length 256.

[0186] 3. API interface feature extraction

[0187] Exemplarily, feature extraction may be performed on the decomposed API interface information for subsequent model building and training.

[0188] For example, the extracted features may include: request methods (GET, HEAD, POST, PUT, DELETE, OPTIONS, TRACE, PATCH, MOVE, COPY), URI structure features (ISAPI + Intelligent + channels + <channelid>+ OCR + capabilities), request body structure characteristics, response body structure characteristics.

[0189] 3.1. The request method and URI structure features are concatenated into a 256*256 tensor (a matrix). The first row is the request method, and the second to 256th rows are URI keywords. If the number of keywords is insufficient, 0 is filled in.

[0190] 3.2. The request body structural features are truncated or filled into a 256*256 tensor. Each row corresponds to a vector feature after a key field and data type processing. If the number of fields and data types exceeds 256, only the first 256 are taken, otherwise 0 is filled.

[0191] 3.3. The response body structure features are truncated or filled into a 256*256 tensor. Each row corresponds to a vector feature after a key field and data type processing. If the number of fields and data types exceeds 256, only the first 256 are taken, otherwise filled with 0.

[0192] 3.4. Concatenate the three 256*256 tensors into a 256*256*3 tensor as the final API interface feature.

[0193] 4. Build a machine learning model based on API interface features

[0194] Exemplarily, a convolutional neural network can be selected as the model infrastructure.

[0195] It should be noted that three models can be constructed and trained, including a device manufacturer identification model, a device type identification model, and a device model identification model. Among them, the identification models of different device manufacturers can be consistent except for the feature corresponding labels.

[0196] Among them, during actual testing, when the device model is identified, the device manufacturer and device type can be automatically filled in; when the device type is identified, the device manufacturer can be automatically filled in.

[0197] The following is an example of model building and training.

[0198] Assume that a model structure is constructed, including input layer, convolution layer 1, pooling layer 1, convolution layer 2, pooling layer 2, convolution layer 3, pooling layer 3, linear layer and output layer. Based on the API interface features extracted in step 3, all API interface features are divided in a ratio of 8:1:1, 80% as training data, 10% as test data, and 10% as validation data. The model parameters are trained until the model converges (the training loss is less than the threshold, or the number of training epochs reaches the threshold).

[0199] 5. Building an asset identification framework based on passive traffic

[0200] Exemplarily, the asset identification framework may mainly include the following modules:

[0201] 5.1. Traffic monitoring module: used to monitor the traffic data in the actual environment in real time, and parse the IP address in the traffic data, the domain name information in the DNS (Domain Name System) protocol, and the API interface session in the HTTP protocol.

[0202] It should be noted that for API interface sessions, feature extraction needs to be performed when both request and response messages are monitored. Otherwise, for example, for traffic data where request messages are monitored but response messages are not monitored, feature extraction is not performed (because it may be a probe message for batch scanning).

[0203] 5.2. Domain name manufacturer mapping module: used to determine the manufacturer of the device based on the mapping matrix in 2.1 and the DNS protocol domain name information in the traffic data.

[0204] It should be noted that the manufacturer identified in this step is the manufacturer corresponding to the IP after the domain name resolution in the DNS protocol, rather than the manufacturer corresponding to the source IP or destination IP of the DNS protocol data packet.

[0205] 5.3. IP vendor mapping module: used to determine the vendor of the device based on the mapping table in 2.2.

[0206] Exemplarily, the monitored traffic data may include DNS protocol data or API session traffic data, etc.

[0207] For DNS protocol data, you can query the mapping table in 2.1 based on the domain name information to determine the device manufacturer mapped to the domain name. The device manufacturer is the device manufacturer corresponding to the IP address after the domain name resolution; or, you can query the mapping table in 2.2 based on the IP address after the domain name resolution to determine the device manufacturer corresponding to the IP.

[0208] For API session traffic data, you can query the mapping table in 2.2 based on the session destination IP address to determine the device manufacturer corresponding to the IP.

[0209] 5.4. Real-time feature extraction module: used to extract API interface features from HTTP protocol sessions.

[0210] Exemplarily, the API interface features may include: request method, URI structure features, request body structure features, and response body structure features.

[0211] Exemplarily, features are extracted according to step 3 and processed into 256*256*3 feature data.

[0212] 5.5. Asset information identification module. Based on the machine learning model trained in step 4 and the above-mentioned real-time extracted features:

[0213] 5.5.1. Use the device model identification model to identify the device model to which the asset belongs; the model output result can be the probability of the device model to which the feature belongs. If the probability exceeds a threshold (which can be called the first threshold), the destination IP of the HTTP protocol session is determined to be a certain model of device, and the manufacturer and type information is automatically filled in; otherwise, the API interface information A1 (including the destination IP address and API interface original information) is recorded and the next model is entered.

[0214] 5.5.2. Use the device type model to identify the device type (camera, NVR, server, etc.) to which the asset belongs. The model output result can be the probability of the device type to which the feature belongs. If the probability exceeds a threshold (which can be called the second threshold), the destination IP of the HTTP protocol session is determined to be a certain type of device, and the manufacturer information is automatically filled in; otherwise, the API interface information A2 (including the destination IP address and the original information of the API interface) is recorded and the next model is entered.

[0215] 5.5.3. Use the manufacturer identification model to identify the manufacturer of the device to which the asset belongs. The model output result can be the probability that the feature belongs to the device manufacturer. If the probability exceeds a threshold (which can be called the third threshold), the destination IP of the HTTP protocol session is determined to be a device of a certain manufacturer; otherwise, record the API interface information A3 (including the destination IP address and the original information of the API interface).

[0216] It should be noted that for any IP address, if the corresponding device manufacturer is determined in 5.2 or 5.3, there is no need to use the manufacturer identification model again to identify the device manufacturer.

[0217] Exemplarily, the first threshold, the second threshold, and the third threshold may be the same or different (including partially the same or completely different).

[0218] 6. Framework deployment and asset identification

[0219] Exemplarily, the asset information identification framework can be deployed at the traffic intersection of the core network, bypassing the mirrored traffic packet data, monitoring and determining the device manufacturer, device type and device model information of each IP in the network in real time, accumulating unidentified information for a period of time (such as [A1, A2, A3] in step 5) and entering step 7 for model reverse optimization.

[0220] 7. Reverse optimization model based on asset identification information

[0221] The purpose of reverse optimization is to supplement the API interface information that is not pre-collected in step 1 based on unidentified API interfaces (one or more of the device manufacturer, device type or device model are unidentified):

[0222] 7.1. Automation solution: Some API interfaces of a certain IP may not be able to identify asset information, but other API interfaces can identify it. Based on the identified IP asset information, the asset information corresponding to the unidentified API interfaces can be reverse-marked, including device manufacturer, device type and device model.

[0223] For example, suppose that a certain API interface corresponding to IP1 (assuming it is API interface 1) does not identify the device manufacturer, device type and device model corresponding to IP1 based on the API interface features corresponding to API interface 1, but the corresponding device manufacturer, device type and device model are identified based on the API interface features corresponding to another API interface corresponding to IP1 (assuming it is API interface 2). Then the device manufacturer, device type and device model can be marked for the API interface features corresponding to API interface 1, and used to optimize the training of the above machine learning model.

[0224] 7.2. Semi-automatic solution: If some API interfaces of a certain IP cannot identify all the device information, such as the missing device type or model, you can manually access the IP and fill it in manually.

[0225] 7.3. Add the above two pieces of information to step 1 to retrain and optimize the model.

[0226] The method provided by the present application is described above. The device provided by the present application is described below:

[0227] See also Figure 3 , is a schematic diagram of the structure of an API asset identification device provided in an embodiment of the present application, such as Figure 3 As shown, the API asset identification device may include:

[0228] An acquisition unit 310, configured to acquire flow data for asset identification by means of flow monitoring;

[0229] The parsing unit 320 is used to parse the acquired traffic data to acquire API session information in the traffic data when the traffic data acquired by the acquisition unit is API session traffic;

[0230] The feature extraction unit 330 is used to extract API interface features from the acquired API interface session information; wherein the API interface features include part or all of the request method features, the uniform resource identifier URI structure features, the request body structure features, and the response body structure features;

[0231] The asset identification unit 340 is used to perform asset identification based on the extracted API interface features using a pre-trained machine learning model.

[0232] In some embodiments, the feature extraction unit 330 extracts API interface features from the acquired API interface session information, including:

[0233] When the API interface characteristics include request methods and URI structure characteristics, hierarchical division is performed on the URI in the obtained API interface session information to obtain multiple character strings;

[0234] Generate request method features and URI structure features according to the API request method and the multiple character strings;

[0235] and / or,

[0236] When the API interface feature includes a request body structure feature, extract key fields and data types from the request body in the acquired API interface session information;

[0237] Generate request body structure features based on the extracted key fields and data types;

[0238] and / or,

[0239] When the API interface feature includes a response body structure feature, extract key fields and data types from the response body in the acquired API interface session information;

[0240] Generate response body structure features based on the extracted key fields and data types.

[0241] In some embodiments, when the API interface features include request method features, URI structure features, request body structure features, and response body structure features, the feature extraction unit 330 extracts API interface features from the acquired API interface session information, and further includes:

[0242] Generate a first tensor of M*N according to the request method characteristics and the URI structure characteristics; wherein M and N are both positive integers, and a row of the first tensor corresponds to the API request method, or one of the multiple strings obtained by hierarchically dividing the URI;

[0243] Generate a second tensor of M*N according to the structural features of the request body; wherein a row of the second tensor corresponds to a key field and its data type of the request body in the API interface session information;

[0244] Generate a third tensor of M*N according to the structural characteristics of the response body; wherein a row of the third tensor corresponds to a key field and its data type of the response body in the API interface session information;

[0245] Generate API interface features based on the first tensor, the second tensor, and the third tensor.

[0246] In some embodiments, the pre-trained machine learning model includes one or more of a device manufacturer identification model, a device type identification model, and a device model identification model;

[0247] The asset identification unit 340 performs asset identification based on the extracted API interface features using a pre-trained machine learning model, including:

[0248] In a case where the pre-trained machine learning model includes a device model identification model, based on the extracted API interface features, the device model identification model is used to identify the device model corresponding to the destination IP address of the API interface session, and in a case where the device model corresponding to the destination IP address of the API interface session is identified, the device type and device manufacturer corresponding to the destination IP address of the API interface session are determined based on the device model corresponding to the destination IP address of the API interface session;

[0249] and / or,

[0250] In a case where the pre-trained machine learning model includes a device type identification model, based on the extracted API interface features, the device type identification model is used to identify the device type corresponding to the destination IP address of the API interface session, and in a case where the device type corresponding to the destination IP address of the API interface session is identified, the device manufacturer corresponding to the destination IP address of the API interface session is determined based on the device type corresponding to the destination IP address of the API interface session;

[0251] and / or,

[0252] In the case where the pre-trained machine learning model includes a device manufacturer identification model, the device manufacturer corresponding to the destination IP address of the API interface session is identified using the device manufacturer identification model based on the extracted API interface features, and when the device manufacturer corresponding to the destination IP address of the API interface session is identified, the device manufacturer corresponding to the destination IP address of the API interface session is identified.

[0253] In some embodiments, the priority of each model for asset identification is, in descending order, as follows: device model identification model, device type identification model, and device manufacturer identification model;

[0254] In the case where the pre-trained machine learning model includes multiple types of equipment manufacturer identification models, equipment type identification models, and equipment model identification models, during the asset identification process, if the currently used machine learning model fails to identify successfully, the next machine learning model is used to continue to identify the asset in order of priority; if the currently used machine learning model successfully identifies, the asset identification result is determined based on the identification result of the currently used machine learning model.

[0255] In some embodiments, the machine learning model is trained by:

[0256] Collect basic information about manufacturers and devices; wherein the basic information about manufacturers and devices includes API interface documents of devices of multiple device manufacturers, multiple device types, and multiple device models;

[0257] For any API interface document, decompose the API interface information included in the API interface document and extract API interface features; wherein the API interface information includes part or all of the URI corresponding to the API, the API request method, the API request body, and the API response body;

[0258] Machine learning model training is performed based on the API interface features corresponding to the collected API interface documents.

[0259] In some embodiments, Figure 4 As shown, the API asset identification device may also include:

[0260] The marking unit 350 is used for marking the asset information of the second type of API interface session according to the first type of API interface session when, for any API session destination IP address, there are multiple API interface sessions corresponding to different API interfaces at the IP address, and the multiple API interface sessions include a first type of API interface session and a second type of API interface session; wherein the first type of API interface session is an API interface session that successfully completes asset identification based on the corresponding API interface features using a pre-trained machine learning model; and the first type of API interface session is an interface session that fails to successfully complete asset identification based on the corresponding API interface features using a pre-trained machine learning model;

[0261] Among them, the API interface features corresponding to the marked second type API interface session are used to optimize the training of the machine learning model.

[0262] An embodiment of the present application also provides an electronic device, including a processor and a memory, wherein the memory is used to store computer programs; and the processor is used to implement the API asset identification method described above when executing the program stored in the memory.

[0263] See also Figure 5 , is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 501 and a memory 502 storing machine executable instructions. The processor 501 and the memory 502 may communicate via a system bus 503. In addition, by reading and executing the machine executable instructions corresponding to the API asset identification logic in the memory 502, the processor 501 may execute the API asset identification method described above.

[0264] The memory 502 mentioned herein may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory, random access memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof.

[0265] In some embodiments, a machine-readable storage medium is also provided. Figure 5 The memory 502 in the machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by the processor, the API asset identification method described above is implemented. For example, the machine-readable storage medium can be ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0266] The embodiment of the present application also provides a computer program product, which stores a computer program, and when a processor executes the computer program, it prompts the processor to execute the API asset identification method described above.

[0267] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0268] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.< / channelid> < / channelid> < / channelid> < / channelid> < / channelid> < / channelid>

Claims

1. An API asset identification method, characterized in that: include: Obtaining flow data for asset identification through flow monitoring; wherein the flow monitoring method includes a flow bypass mirroring method; When the acquired traffic data is application program interface (API) session traffic, the acquired traffic data is parsed to acquire API session information in the traffic data; Extracting API interface features from the acquired API interface session information; wherein the API interface features include at least two features of request method features, uniform resource identifier URI structure features, request body structure features, and response body structure features; wherein devices of the same manufacturer and the same device type have similarities in API, and devices of different manufacturers or different device types of the same manufacturer have differences in API; the request method features include features obtained by extracting features from the API request method in the API interface session information; Based on the extracted API interface features, use the pre-trained machine learning model to identify assets; The pre-trained machine learning model includes a device manufacturer identification model, a device type identification model, and a device model identification model; the device model, device type, and device manufacturer are upwardly compatible; the priority of each model for asset identification is in descending order: device model identification model, device type identification model, and device manufacturer identification model; During the asset identification process, if the currently used machine learning model fails to identify successfully, the next machine learning model is used to identify the asset in order of priority; if the currently used machine learning model successfully identifies the asset, the asset identification result is determined based on the identification result of the currently used machine learning model; In the case where the model recognizes the device model, the device manufacturer and device type are automatically determined; In the case where the model recognizes the device type, the device manufacturer is automatically determined; Wherein, when the device model corresponding to the destination IP address of the API interface session is identified according to the device model identification model, the device type and device manufacturer corresponding to the destination IP address of the API interface session are determined according to the device model corresponding to the destination IP address of the API interface session; When the device type corresponding to the destination IP address of the API interface session is identified according to the device type identification model, the device manufacturer corresponding to the destination IP address of the API interface session is determined according to the device type corresponding to the destination IP address of the API interface session.

2. The method according to claim 1, characterized in that The step of extracting API interface features from the acquired API interface session information includes: When the API interface characteristics include request methods and URI structure characteristics, hierarchical division is performed on the URI in the obtained API interface session information to obtain multiple character strings; Generate request method features and URI structure features according to the API request method and the multiple character strings; and / or, When the API interface feature includes a request body structure feature, extract key fields and data types from the request body in the acquired API interface session information; Generate request body structure features based on the extracted key fields and data types; and / or, When the API interface feature includes a response body structure feature, extract key fields and data types from the response body in the acquired API interface session information; Generate response body structure features based on the extracted key fields and data types.

3. The method according to claim 2, characterized in that In the case where the API interface features include request method features, URI structure features, request body structure features, and response body structure features, the extracting the API interface features from the acquired API interface session information further includes: Generate a first tensor of M*N according to the request method characteristics and the URI structure characteristics; wherein M and N are both positive integers, and a row of the first tensor corresponds to the API request method, or one of the multiple strings obtained by hierarchically dividing the URI; Generate a second tensor of M*N according to the structural features of the request body; wherein a row of the second tensor corresponds to a key field and its data type of the request body in the API interface session information; Generate a third tensor of M*N according to the structural characteristics of the response body; wherein a row of the third tensor corresponds to a key field and its data type of the response body in the API interface session information; Generate API interface features based on the first tensor, the second tensor, and the third tensor.

4. The method according to claim 1, characterized in that The asset identification is performed based on the extracted API interface features using a pre-trained machine learning model, including: In a case where the pre-trained machine learning model includes a device model identification model, based on the extracted API interface features, the device model identification model is used to identify the device model corresponding to the destination IP address of the API interface session, and in a case where the device model corresponding to the destination IP address of the API interface session is identified, the device type and device manufacturer corresponding to the destination IP address of the API interface session are determined based on the device model corresponding to the destination IP address of the API interface session; and / or, In a case where the pre-trained machine learning model includes a device type identification model, based on the extracted API interface features, the device type identification model is used to identify the device type corresponding to the destination IP address of the API interface session, and in a case where the device type corresponding to the destination IP address of the API interface session is identified, the device manufacturer corresponding to the destination IP address of the API interface session is determined based on the device type corresponding to the destination IP address of the API interface session; and / or, In the case where the pre-trained machine learning model includes a device manufacturer identification model, the device manufacturer corresponding to the destination IP address of the API interface session is identified using the device manufacturer identification model based on the extracted API interface features, and when the device manufacturer corresponding to the destination IP address of the API interface session is identified, the device manufacturer corresponding to the destination IP address of the API interface session is identified.

5. The method according to claim 1, characterized in that Machine learning models are trained by: Collect basic information about manufacturers and devices; wherein the basic information about manufacturers and devices includes API interface documents of devices of multiple device manufacturers, multiple device types, and multiple device models; For any API interface document, decompose the API interface information included in the API interface document and extract API interface features; wherein the API interface information includes part or all of the URI corresponding to the API, the API request method, the API request body, and the API response body; The machine learning model is trained based on the API interface features corresponding to the collected API interface documents; wherein the machine learning models involved in the training include one or more of a device manufacturer identification model, a device type identification model and a device model identification model. The device manufacturer identification model is used to obtain a device manufacturer identification result based on the input API interface features, the device type identification model is used to obtain a device type identification result based on the input API interface features, and the device model identification model is used to obtain a device model identification result based on the input API interface features.

6. The method according to claim 1, characterized in that The method further comprises: For any API session destination IP address, if there are multiple API interface sessions corresponding to different API interfaces at the IP address, and the multiple API interface sessions include a first type of API interface session and a second type of API interface session, the second type of API interface session is marked with asset information based on the first type of API interface session; wherein the first type of API interface session is an API interface session that successfully completes asset identification based on the corresponding API interface features using a pre-trained machine learning model; and the second type of API interface session is an interface session that fails to successfully complete asset identification based on the corresponding API interface features using a pre-trained machine learning model; The machine learning model is optimized and trained based on the API interface features corresponding to the marked second type of API interface sessions.

7. An API asset identification device, characterized in that: include: An acquisition unit, used to acquire flow data for asset identification through a flow monitoring method; wherein the flow monitoring method includes a flow bypass mirroring method; A parsing unit, configured to parse the acquired traffic data to acquire API interface session information in the traffic data when the traffic data acquired by the acquisition unit is application program interface API interface session traffic; A feature extraction unit is used to extract API interface features from the acquired API interface session information; wherein the API interface features include at least two features of request method features, uniform resource identifier URI structure features, request body structure features, and response body structure features; wherein devices of the same manufacturer and the same device type have similarities in API, and devices of different manufacturers or different device types of the same manufacturer have differences in API; the request method features include features obtained by extracting features of the API request method in the API interface session information; The asset identification unit is used to identify assets based on the extracted API interface features using a pre-trained machine learning model; The pre-trained machine learning model includes a device manufacturer identification model, a device type identification model, and a device model identification model; the device model, device type, and device manufacturer are upwardly compatible; the priority of each model for asset identification is in descending order: device model identification model, device type identification model, and device manufacturer identification model; During the asset identification process, if the currently used machine learning model fails to identify successfully, the next machine learning model is used to identify the asset in order of priority; if the currently used machine learning model successfully identifies the asset, the asset identification result is determined based on the identification result of the currently used machine learning model; In the case where the model recognizes the device model, the device manufacturer and device type are automatically determined; In the case where the model recognizes the device type, the device manufacturer is automatically determined; Wherein, when the device model corresponding to the destination IP address of the API interface session is identified according to the device model identification model, the device type and device manufacturer corresponding to the destination IP address of the API interface session are determined according to the device model corresponding to the destination IP address of the API interface session; When the device type corresponding to the destination IP address of the API interface session is identified according to the device type identification model, the device manufacturer corresponding to the destination IP address of the API interface session is determined according to the device type corresponding to the destination IP address of the API interface session.

8. An electronic device, characterized in that: comprising a processor and a memory, wherein: Memory, used to store computer programs; A processor, for implementing the method according to any one of claims 1 to 6 when executing a program stored in a memory.

9. A computer program product, characterized in that The computer program product stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images