Method and apparatus for detecting API behavior across resource pools

Abstract

This application discloses a method and apparatus for cross-resource pool API behavior detection. The method includes: acquiring historical code corresponding to API behavior in the source and destination resource pools and related network performance loss data; constructing sine / cosine functions based on this data and determining the positional encoding of the historical code; acquiring the code corresponding to the API behavior in the source and destination pools and determining the corresponding word segmentation encoding; determining the positional vector corresponding to the source and destination code based on the word segmentation encoding and the stored positional encoding; detecting whether the positional vector matches the stored sine / cosine functions; and determining whether the API behavior in the source and destination pools is abnormal based on the detection result. This application improves the uniqueness of consistency analysis results by expanding the code dimension features through multiple sine / cosine functions, solving the problem of low accuracy in consistency analysis of program behavior using distance similarity in related technologies, and avoiding the problem that consistency analysis results in related technologies are easily manipulated and corrupted by malicious nodes.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method and apparatus for detecting API behavior across resource pools. Background Technology

[0002] In cloud computing environments, cross-resource pool synchronization is a technique to ensure environmental consistency between different resource pools. The code on the source and destination resource pools primarily synchronizes host configurations via APIs (Application Programming Interfaces). During this process, to prevent data security issues arising from attacks, leaks of non-human account information related to the code, or unauthorized operations on either the source or destination resource pools, consistency checks are required on the API behavior, i.e., the relevant code, of both the source and destination resource pools.

[0003] The following code consistency detection schemes are proposed in related technologies: 1) Compress the bytecode and function parameters of the original code according to the cosine function formula, replace the bytecode objects in linear memory, and then update the corresponding content in the original bytecode as a bytecode optimization method. Then, decompress the updated bytecode using the cosine function formula, generate a hash code through the smart contract module, and establish a mapping relationship between it and the bytecode. The cosine function formula used in this technology does not include the characteristics of the code's runtime environment, and the consistency check based on the blockchain consensus mechanism is easily manipulated by malicious member nodes and fails; 2) Convert the bytecode segmentation encoding extracted from the code sample into grayscale image features, then obtain the relevant angular frequency and phase difference according to the cosine function formula formed by the grayscale image pixel values, and then use Gaussian... The function transforms the value of the cosine function to obtain the Gabor function value. The distance between the Gabor values ​​of different sample classifications is used as the image texture feature of the code sample. The code dimension features that can be expressed by a single cosine function formula are relatively simple, and the uniqueness of the established consistency features needs to be improved. 3) The position code of each character in the target code in the string sequence features is calculated by the sine / cosine function formula. This is used as part of the malicious code feature sequence required for fine-tuning the Transformer pre-trained model. The anomaly detection module performs cosine distance similarity judgment to reduce the position code with large distance. The cosine distance similarity calculation method adopted by this technology is relatively vague in describing whether the program behavior conforms to normal behavior, which reduces the accuracy of the consistency analysis results.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a method and apparatus for cross-resource pool API behavior detection. By expanding the code dimension features through multiple sine / cosine functions, the uniqueness of the consistency analysis results is improved. This solves the problem that the accuracy of consistency analysis results based on distance similarity in related technologies is not high, and avoids the problem that consistency analysis results in related technologies are easily manipulated and corrupted by malicious nodes.

[0006] According to one aspect of the embodiments of this application, a method for detecting API behavior across resource pools is provided, comprising: acquiring a first code corresponding to the API behavior of a source resource pool and a second code corresponding to the API behavior of a destination resource pool; determining a first word segmentation code corresponding to the first code and a second word segmentation code corresponding to the second code; acquiring a plurality of pre-stored target functions, a first position code, and a second position code, wherein the target functions, the first position code, and the second position code are determined by a first historical code corresponding to the API behavior of the source resource pool, a second historical code corresponding to the API behavior of the destination resource pool, actual network performance loss data and promised network performance loss data between the source resource pool and the destination resource pool, and the target function is a sine function or a cosine function; determining a first position vector corresponding to the first code based on the first position code and the first word segmentation code, and determining a second position vector corresponding to the second code based on the second position code and the second word segmentation code; detecting whether the first position vector and the second position vector match the plurality of target functions respectively, and determining whether there is an anomaly in the API behavior of the source resource pool and the destination resource pool based on the detection results.

[0007] Optionally, obtaining the first code corresponding to the API behavior of the source resource pool and the second code corresponding to the API behavior of the destination resource pool includes: obtaining the first bytecode corresponding to the API behavior of the source resource pool and determining the first machine code corresponding to the first bytecode as the first code; obtaining the second bytecode corresponding to the API behavior of the destination resource pool and determining the second machine code corresponding to the second bytecode as the second code.

[0008] Optionally, determining the first word segmentation code corresponding to the first code and the second word segmentation code corresponding to the second code includes: determining the first one-hot code corresponding to the first code and the second one-hot code corresponding to the second code based on the first context composed of the first code and the second code; determining the product of the first one-hot code and the first preset network weight as the first word segmentation code corresponding to the first code; and determining the product of the second one-hot code and the second preset network weight as the second word segmentation code corresponding to the second code.

[0009] Optionally, the process of determining the objective function, the first positional code, and the second positional code includes: obtaining the first historical code corresponding to the API behavior of the source resource pool, the second historical code corresponding to the API behavior of the destination resource pool, actual network performance loss data, and promised network performance loss data, wherein the type of network performance loss data includes: network latency; determining the third word segmentation code corresponding to the first historical code, the fourth word segmentation code corresponding to the second historical code, the fifth word segmentation code corresponding to the actual network performance loss data, and the sixth word segmentation code corresponding to the promised network performance loss data; determining the target angular frequency based on the third and fourth word segmentation codes, and determining the target angular frequency based on the fifth and sixth word segmentation codes. The six-segment encoding determines the target phase difference and generates multiple target functions whose angular frequencies are all target angular frequencies and whose phase differences are preset multiples of the target phase difference. The first absolute position value corresponding to the first historical code is obtained, and the first absolute position value is substituted into the multiple target functions. The resulting multiple function values ​​are combined to form a third position vector, and the sum of the third position vector and the third segmentation encoding is determined to be the first position encoding corresponding to the first historical code. The second absolute position value corresponding to the second historical code is obtained, and the second absolute position value is substituted into the multiple target functions. The resulting multiple function values ​​are combined to form a fourth position vector, and the sum of the fourth position vector and the fourth segmentation encoding is determined to be the second position encoding corresponding to the second historical code.

[0010] Optionally, determining the third word segmentation code corresponding to the first historical code, the fourth word segmentation code corresponding to the second historical code, the fifth word segmentation code corresponding to the actual network performance loss data, and the sixth word segmentation code corresponding to the promised network performance loss data includes: determining the third unique-hot code corresponding to the first historical code and the fourth unique-hot code corresponding to the second historical code based on the second context composed of the first historical code and the second historical code; determining that the product of the third unique-hot code and the third preset network weight is the third word segmentation code corresponding to the first historical code, and determining that the product of the fourth unique-hot code and the fourth preset network weight is the fourth word segmentation code corresponding to the second historical code; determining the fifth unique-hot code corresponding to the actual network performance loss data and the sixth unique-hot code corresponding to the promised network performance loss data based on the third context composed of the actual network performance loss data and the promised network performance loss data; determining that the product of the fifth unique-hot code and the fifth preset network weight is the fifth word segmentation code corresponding to the actual network performance loss data, and determining that the product of the sixth unique-hot code and the sixth preset network weight is the sixth word segmentation code corresponding to the promised network performance loss data.

[0011] Optionally, the target angular frequency is determined based on the third and fourth word segmentation codes, and the target phase difference is determined based on the fifth and sixth word segmentation codes, including: determining the Euclidean distance between the third and fourth word segmentation codes as n, and determining the target angular frequency as nπ; determining the dot product result between the fifth and sixth word segmentation codes as k, and determining the target phase difference as kπ.

[0012] Optionally, determining the first position vector corresponding to the first code based on the first position code and the first word segmentation code, and determining the second position vector corresponding to the second code based on the second position code and the second word segmentation code, includes: determining that the difference between the first position code and the first word segmentation code is the first position vector corresponding to the first code; and determining that the difference between the second position code and the second word segmentation code is the second position vector corresponding to the second code.

[0013] Optionally, the system detects whether the first and second position vectors match multiple objective functions, and determines whether the API behavior of the source and destination resource pools is abnormal based on the detection results. This includes: comparing each element in the first position vector with each element in the third position vector corresponding to the multiple objective functions; if the elements in the first and third position vectors are exactly the same, the source resource pool's API behavior is determined to be normal; if there are different elements between the first and third position vectors, the source resource pool's API behavior is determined to have a risk of unauthorized access; comparing each element in the second position vector with each element in the fourth position vector corresponding to the multiple objective functions; if the elements in the second and fourth position vectors are exactly the same, the destination resource pool's API behavior is determined to be normal; if there are different elements between the second and fourth position vectors, the destination resource pool's API behavior is determined to have a risk of account identity theft.

[0014] According to another aspect of the embodiments of this application, a cross-resource pool API behavior detection device is also provided, comprising: a first acquisition module, configured to acquire a first code corresponding to the API behavior of a source resource pool and a second code corresponding to the API behavior of a destination resource pool; a first determination module, configured to determine a first word segmentation code corresponding to the first code and a second word segmentation code corresponding to the second code; a second acquisition module, configured to acquire a plurality of pre-stored target functions, a first position code and a second position code, wherein the target function, the first position code and the second position code are determined by a first historical code corresponding to the API behavior of the source resource pool, a second historical code corresponding to the API behavior of the destination resource pool, actual network performance loss data and promised network performance loss data between the source resource pool and the destination resource pool, and the target function is a sine function or a cosine function; a second determination module, configured to determine a first position vector corresponding to the first code based on the first position code and the first word segmentation code, and determine a second position vector corresponding to the second code based on the second position code and the second word segmentation code; and a detection module, configured to detect whether the first position vector and the second position vector match the plurality of target functions respectively, and determine whether there is an anomaly in the API behavior of the source resource pool and the destination resource pool based on the detection results.

[0015] According to another aspect of the embodiments of this application, a computer program product is also provided, the computer program product comprising: a computer program, wherein the computer program, when executed by a processor, implements the above-described cross-resource pool API behavior detection method.

[0016] In this embodiment, firstly, the first and second historical codes corresponding to the API behavior of the source and destination resource pools, the actual network performance loss data of the source and destination, and the promised network performance loss data are obtained. Based on these data, multiple sine / cosine functions are constructed and the position codes corresponding to the source and destination historical codes are determined and stored. Secondly, the first and second codes corresponding to the API behavior of the source and destination resource pools are obtained and their corresponding word segmentation codes are determined. Based on the stored position codes and the determined word segmentation codes, the position vectors corresponding to the source and destination codes are determined. Whether the position vectors match the stored multiple sine / cosine functions is detected, and based on the detection results, it is determined whether there is an anomaly in the API behavior of the source and destination resource pools. This scheme uses machine code features related to API call behavior and network performance loss data to jointly reflect the characteristics of the operating environment, enriching the dimensions that code consistency features can express. The diversity of position vector elements on the generated sine / cosine function also improves the uniqueness of behavior consistency features. The validity of consistency test results is maintained by using a unified sine / cosine function arrangement rule. By analyzing whether the position vectors of the source and destination code conform to the distribution of the preset sine / cosine curve, the description of consistency is more accurate. This scheme effectively solves the technical problem of low accuracy of consistency analysis results for program behavior in related technologies. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a schematic diagram of the structure of an optional computer terminal according to an embodiment of this application;

[0019] Figure 2 This is a flowchart illustrating an optional cross-resource pool API behavior detection method according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram illustrating an optional method for determining word segmentation encoding according to an embodiment of this application;

[0021] Figure 4 This is a schematic diagram illustrating an optional cosine function for determining a position vector according to an embodiment of this application;

[0022] Figure 5This is a schematic diagram of an optional cross-resource pool API behavior detection device according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] To better understand the embodiments of this application, the following is a translation and explanation of some nouns or terms that appear in the description of the embodiments of this application:

[0026] Bytecode (BC): In programming languages, bytecode is generated by a high-level language compiler and can be executed on a virtual machine. Bytecode is a platform-independent instruction set representation, typically stored in binary form, and can run on different operating systems and hardware platforms. Execution of bytecode requires an interpreter or just-in-time (JIT) compiler to convert it into machine code. Common bytecode formats include Java bytecode (.class files) and .NET bytecode (.dll files).

[0027] Machine code (MC): Machine code is a set of instructions that computer hardware can directly execute. Compared to bytecode, it is closer to the hardware. Machine code can be executed directly on the hardware, thus its execution efficiency is higher. However, it is incompatible with different hardware platforms, and therefore contains the characteristics of the code's runtime environment.

[0028] Positional Encoding (PE): In natural language self-attention mechanisms, the same words arranged in different contextual orders produce different semantics. PE is used to reflect the sequential information of text input. PE can be further divided into absolute positional encoding and relative positional encoding. This application uses absolute positional encoding, calculated as PE = word segmentation encoding + position vector.

[0029] Token Encoding (TE) is a common semantic feature in natural language models. It is obtained by multiplying a word or phrase by a neural network weight parameter through one-hot encoding. It is the basis for subsequent generation of word embedding vectors, positional encoding, attention values, etc.

[0030] Positional Vector (PV): In the positional encoding calculation process of the self-attention mechanism, the word segmentation code of each word corresponds to a complex number of values ​​on the cosine wave, and the positional vector is the combination of values ​​on the cosine wave. The more cosine waves in the cosine wave combination, the richer the combination of positional vector and corresponding positional code.

[0031] Example 1

[0032] According to an embodiment of this application, a method for detecting API behavior across resource pools is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an API behavior detection method across resource pools is shown. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0034] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0035] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the cross-resource pool API behavior detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the above-mentioned application vulnerability detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0036] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0037] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0038] Under the above operating environment, this application embodiment provides a method for detecting API behavior across resource pools, such as... Figure 2 As shown, the method includes the following steps:

[0039] Step S202: Obtain the first code corresponding to the API behavior of the source resource pool and the second code corresponding to the API behavior of the destination resource pool;

[0040] Step S204: Determine the first word segmentation code corresponding to the first code and the second word segmentation code corresponding to the second code;

[0041] Step S206: Obtain multiple pre-stored objective functions, first position codes, and second position codes. The objective functions, first position codes, and second position codes are determined by the first historical code corresponding to the API behavior of the source resource pool, the second historical code corresponding to the API behavior of the destination resource pool, the actual network performance loss data between the source resource pool and the destination resource pool, and the promised network performance loss data. The objective function is a sine function or a cosine function.

[0042] Step S208: Determine the first position vector corresponding to the first code based on the first position code and the first word segmentation code, and determine the second position vector corresponding to the second code based on the second position code and the second word segmentation code;

[0043] Step S210: Detect whether the first position vector and the second position vector match multiple objective functions, and determine whether there are any abnormalities in the API behavior of the source resource pool and the destination resource pool based on the detection results.

[0044] The following section describes each step of the cross-resource pool API behavior detection method in conjunction with a specific implementation process.

[0045] The objective of this application embodiment is to accurately describe the consistency of behavior by analyzing whether the position vectors of the source resource pool and the destination resource pool conform to the distribution of a preset sine / cosine curve. Therefore, as an optional implementation, it is necessary to first construct a basic sine / cosine function and determine the first position code corresponding to the basic code of the source resource pool and the second position code corresponding to the basic code of the destination resource pool.

[0046] Specifically, we can first obtain the first historical code corresponding to the API behavior of the source resource pool, the second historical code corresponding to the API behavior of the destination resource pool, and the actual network performance loss data and promised network performance loss data between the source resource pool and the destination resource pool.

[0047] Understandably, in order to enrich the dimensions covered by code behavior consistency analysis and strengthen the uniqueness of behavior consistency credentials, this application needs to obtain machine code reflecting the code execution environment and network performance loss data of the source and destination resource pools when analyzing the API behavior of the source and destination resource pools. The specific acquisition method is as follows: obtain the first historical bytecode corresponding to the API behavior of the source resource pool, and determine the first historical machine code corresponding to the first historical bytecode as the first historical code; obtain the second historical bytecode corresponding to the API behavior of the destination resource pool, and determine the second historical machine code corresponding to the second historical bytecode as the second historical code; obtain the actual network performance loss data and the promised network performance loss data between the source and destination resource pools. The types of network performance loss data include network latency, packet loss rate, throughput, etc. The embodiments of this application mainly use network latency as an example for illustration.

[0048] For example, suppose a pair of payloads belonging to different cloud resource pools synchronize host configurations through an API interface with the link "https: / / api-football-v1.p.rapidapi.com / v2 / leagues / league / %d". The payload in the source resource pool sends the configuration file to the destination resource pool through the configuration distribution script C1, and the payload in the destination resource pool receives the configuration file through the configuration receiving script C2. At this time, the first historical bytecode BC1 corresponding to script C1 can be obtained and its corresponding first historical machine code MC3 can be determined to be "hhm0119po919". The second historical bytecode BC2 corresponding to script C2 can be obtained and its corresponding second historical machine code MC4 can be determined to be "nm110kk769lkk". At the same time, the actual network latency data L between the source resource pool and the destination resource pool is determined to be 18ms, and the promised network latency data L' is 9ms.

[0049] Optionally, after obtaining the relevant codes and data, the third word segmentation code corresponding to the first historical code, the fourth word segmentation code corresponding to the second historical code, the fifth word segmentation code corresponding to the actual network performance loss data, and the sixth word segmentation code corresponding to the promised network performance loss data can be determined respectively. The specific method is as follows: Based on the second context composed of the first historical code and the second historical code, the third unique hot code corresponding to the first historical code and the fourth unique hot code corresponding to the second historical code are determined respectively; the product of the third unique hot code and the third preset network weight is determined to be the third word segmentation code corresponding to the first historical code, and the product of the fourth unique hot code and the fourth preset network weight is determined to be the fourth word segmentation code corresponding to the second historical code; based on the third context composed of the actual network performance loss data and the promised network performance loss data, the fifth unique hot code corresponding to the actual network performance loss data and the sixth unique hot code corresponding to the promised network performance loss data are determined respectively; the product of the fifth unique hot code and the fifth preset network weight is determined to be the fifth word segmentation code corresponding to the actual network performance loss data, and the product of the sixth unique hot code and the sixth preset network weight is determined to be the sixth word segmentation code corresponding to the promised network performance loss data.

[0050] like Figure 3 As shown in part a, when determining the word segmentation encoding, the third preset network weight corresponding to the first historical machine code MC3 is [1.76, 1.91], so the calculated third word segmentation encoding TE3 is [1.76, 1.91]. The fourth preset network weight corresponding to the second historical machine code MC4 is [1.97, 2.02], so the calculated fourth word segmentation encoding TE4 is [1.97, 2.02]. Figure 3 As shown in part b, when determining the word segmentation encoding of network latency data, the fifth preset network weight corresponding to the actual network latency is [1.87, 1.93], so the calculated fifth word segmentation encoding TL is [1.87, 1.93], and the sixth preset network weight corresponding to the promised network latency is [0.15, -0.77], so the calculated sixth word segmentation encoding TL' is [0.15, -0.77].

[0051] After obtaining the word segmentation code, the target angular frequency can be determined based on the third and fourth word segmentation codes, and the target phase difference can be determined based on the fifth and sixth word segmentation codes. Multiple target functions are generated, each with an angular frequency equal to the target angular frequency and a phase difference equal to a preset multiple of the target phase difference. The target function is either a sine function or a cosine function. This application embodiment uses a cosine function as an example for illustration.

[0052] Optionally, the Euclidean distance between the third and fourth word segmentation codes can be determined as n, and the target angular frequency can be determined as nπ. Taking the third word segmentation code TE3 and the fourth word segmentation code TE4 as examples, the target angular frequency is calculated as follows:

[0053] Optionally, the dot product between the fifth and sixth word segmentation codes can be determined as k, and the target phase difference can be determined as kπ. Taking the fifth word segmentation code TL and the sixth word segmentation code TL' as an example, the first phase difference is calculated as ψ=kπ=(1.87*0.15+1.93*(-0.77))π=-1.2π.

[0054] Ultimately, multiple cosine functions can be determined: cos(ωt+ψ) = cos(0.237tπ-1.2mπ), where t is the absolute position value of the code, which can be understood as the code's sequence number in the context, and m = 0, 1, ... The specific number of cosine functions is determined by the number of elements in the word segmentation encoding. For example, in this embodiment, the number of elements in the word segmentation encoding is 2, so two cosine functions, cos(0.237tπ) and cos(0.237tπ-1.2π), are generated. Figure 4 As shown.

[0055] Next, the first absolute position value corresponding to the first historical code can be obtained, the first absolute position value can be substituted into multiple objective functions, the resulting multiple function values ​​can be combined into a third position vector, and the sum of the third position vector and the third word segmentation code can be determined as the first position code corresponding to the first historical code; the second absolute position value corresponding to the second historical code can be obtained, and the second absolute position value can be substituted into multiple objective functions, the resulting multiple function values ​​can be combined into a fourth position vector, and the sum of the fourth position vector and the fourth word segmentation code can be determined as the second position code corresponding to the second historical code.

[0056] like Figure 4 As shown, assuming the first absolute position value corresponding to the first historical code is 1, and the function values ​​corresponding to this position value in the two cosine function waveforms are -0.99 and 0.74 respectively, then the third position vector PV3 is determined to be [-0.99, 0.74], and the sum of the third position vector PV3 and the third word segmentation code TE3 [0.77, 2.65] is determined to be the first position code PE1 corresponding to the first historical code; assuming the second absolute position value corresponding to the second historical code is 2, and the function values ​​corresponding to this position value in the two cosine function waveforms are -0.65 and 0.08 respectively, then the fourth position vector PV4 is determined to be [-0.65, 0.08], and the sum of the fourth position vector PV4 and the fourth word segmentation code TE4 [1.32, 2.10] is determined to be the second position code PE2 corresponding to the second historical code.

[0057] When analyzing the API behavior of the source and destination resource pools, the first code corresponding to the API behavior of the source resource pool and the second code corresponding to the API behavior of the destination resource pool can be obtained in the manner described above. Specifically, the first bytecode corresponding to the API behavior of the source resource pool can be obtained, and the first machine code corresponding to the first bytecode can be identified as the first code; the second bytecode corresponding to the API behavior of the destination resource pool can be obtained, and the second machine code corresponding to the second bytecode can be identified as the second code.

[0058] Optionally, after obtaining the relevant code and data, the corresponding word segmentation code can be determined in the following way: based on the first context composed of the first code and the second code, determine the first one-hot code corresponding to the first code and the second one-hot code corresponding to the second code respectively; determine the product of the first one-hot code and the first preset network weight as the first word segmentation code corresponding to the first code; determine the product of the second one-hot code and the second preset network weight as the second word segmentation code corresponding to the second code.

[0059] As an optional implementation, the difference between the first position code and the first word segmentation code can be determined in reverse by referring to the method of determining the first position code and the second position code, and the difference between the second position code and the second word segmentation code can be determined in reverse, and the second position vector corresponding to the current second code can be determined in reverse.

[0060] Then, it is possible to detect whether the first position vector and the second position vector match multiple objective functions, and determine whether there are any abnormalities in the API behavior of the source resource pool and the destination resource pool based on the detection results.

[0061] Optionally, each element in the first position vector can be compared with each element in the third position vector corresponding to multiple objective functions. If the elements in the first and third position vectors are exactly the same, it is determined that the API behavior of the source resource pool is normal. If there are different elements between the first and third position vectors, it is determined that the API behavior of the source resource pool is at risk of unauthorized access. Each element in the second position vector can be compared with each element in the fourth position vector corresponding to multiple objective functions. If the elements in the second and fourth position vectors are exactly the same, it is determined that the API behavior of the destination resource pool is normal. If there are different elements between the second and fourth position vectors, it is determined that the API behavior of the destination resource pool is at risk of account identity theft.

[0062] For example, the first machine code MC1 of the source resource pool is "nnm0119p7619", and its corresponding first word segmentation code TE1 is [2.11, 1.02]. The second machine code MC2 of the destination resource pool is "nm110kk769lkk", and its corresponding second word segmentation code TE2 is [1.97, 2.02]. Based on the locally stored first position code PE1 and second position code PE2, the first position vector PV1 corresponding to the current first code is determined to be [-1.34, 1.63], and the second position vector PV2 corresponding to the current second code is determined to be [-1.34, 1.63]. Given the range [-0.65, 0.08], we can directly compare the elements in the first and third position vectors, and the elements in the second and fourth position vectors. We find that there are different elements in the first and third position vectors, meaning that the first position vector does not match multiple cosine functions. The elements in the second and fourth position vectors are the same, meaning that the second position vector matches multiple cosine functions. Therefore, we consider that the API behavior of the destination resource pool is normal, while the API behavior of the source resource pool is abnormal. It is possible that non-human accounts in the source code are engaging in unauthorized access to the destination resource pool.

[0063] For example, the first machine code MC1 of the source resource pool is "hhm0119po919", and its corresponding first word segmentation code TE1 is [1.76, 1.91]. The second machine code MC2 of the destination resource pool is "nm777kk76yyj", and its corresponding first word segmentation code TE2 is [1.17, 3.02]. Based on the locally stored first position code PE1 and second position code PE2, the first position vector PV1 corresponding to the current first code is determined to be [-0.99, 0.74], and the second position vector PV2 corresponding to the current second code is [0.15]. [-0.92], comparing the elements in the first position vector and the third position vector, and comparing the elements in the second position vector and the fourth position vector, it was found that the elements in the first position vector and the third position vector are the same, that is, the first position vector matches multiple cosine functions. The elements in the second position vector and the fourth position vector are different, that is, the second position vector does not match multiple cosine functions. Therefore, it is considered that the API behavior of the source resource pool is normal, the API behavior of the destination resource pool is abnormal, and the non-human accounts related to the destination resource pool code are at risk of identity theft. The user traffic of the source end is redirected to the fake destination resource pool.

[0064] Optionally, each element in the first position vector can be substituted into multiple objective functions as objective function values ​​to check whether the multiple first position values ​​are the same; if the multiple first position values ​​are different, it is determined that the API behavior of the source resource pool has the risk of unauthorized access; each element in the second position vector can be substituted into multiple objective functions as objective function values ​​to check whether the multiple second position values ​​are the same; if the multiple second position values ​​are different, it is determined that the API behavior of the destination resource pool has the risk of account identity theft.

[0065] Using the example above, the first position vector PV1 is [-0.99, 0.74], and the second position vector PV2 is [0.15, -0.92]. Substituting each element of the first position vector into multiple objective functions, i.e., letting cos(0.237tπ-1.2π) = -0.99 and cos(0.237tπ) = 0.74, we find that both position values ​​t are 1. Therefore, we consider the first position vector to match multiple cosine functions. We then use each element of the second position vector as the objective function... Substituting the values ​​into multiple objective functions, i.e., setting cos(0.237tπ-1.2π)=0.15 and cos(0.237tπ)=-0.92, we obtain two position values ​​t1=6.97 and t2=3.68. Since the two position values ​​are different, it is considered that the second position vector does not match multiple cosine functions. It is considered that the API behavior of the source resource pool is normal, while the API behavior of the destination resource pool is abnormal. There is a risk of identity theft for non-human accounts related to the destination resource pool code, and the user traffic of the source is redirected to a fake destination resource pool.

[0066] In this embodiment, firstly, the first and second historical codes corresponding to the API behavior of the source and destination resource pools, the actual network performance loss data of the source and destination, and the promised network performance loss data are obtained. Based on these data, multiple sine / cosine functions are constructed and the position codes corresponding to the source and destination historical codes are determined and stored. Secondly, the first and second codes corresponding to the API behavior of the source and destination resource pools are obtained and their corresponding word segmentation codes are determined. Based on the stored position codes and the determined word segmentation codes, the position vectors corresponding to the source and destination codes are determined. Whether the position vectors match the stored multiple sine / cosine functions is detected, and based on the detection results, it is determined whether there is an anomaly in the API behavior of the source and destination resource pools. This scheme uses machine code features related to API call behavior and network performance loss data to jointly reflect the characteristics of the operating environment, enriching the dimensions that code consistency features can express. The diversity of position vector elements on the generated sine / cosine function also improves the uniqueness of behavior consistency features. The validity of consistency test results is maintained by using a unified sine / cosine function arrangement rule. By analyzing whether the position vectors of the source and destination code conform to the distribution of the preset sine / cosine curve, the description of consistency is more accurate. This scheme effectively solves the technical problem of low accuracy of consistency analysis results for program behavior in related technologies.

[0067] Example 2

[0068] According to an embodiment of this application, a cross-resource pool API behavior detection device is also provided for implementing the cross-resource pool API behavior detection method in Embodiment 1, such as... Figure 5 As shown, the cross-resource pool API behavior detection device includes at least: a first acquisition module 51, a first determination module 52, a second acquisition module 53, a second determination module 54, and a detection module 55, wherein:

[0069] The first acquisition module 51 is used to acquire the first code corresponding to the API behavior of the source resource pool and the second code corresponding to the API behavior of the destination resource pool.

[0070] The first determining module 52 is used to determine the first word segmentation code corresponding to the first code and the second word segmentation code corresponding to the second code;

[0071] The second acquisition module 53 is used to acquire multiple pre-stored target functions, first position codes and second position codes, wherein the target functions, first position codes and second position codes are determined by the first historical code corresponding to the API behavior of the source resource pool, the second historical code corresponding to the API behavior of the destination resource pool, the actual network performance loss data and the promised network performance loss data between the source resource pool and the destination resource pool, and the target function is a sine function or a cosine function.

[0072] The second determining module 54 is used to determine the first position vector corresponding to the first code based on the first position code and the first word segmentation code, and to determine the second position vector corresponding to the second code based on the second position code and the second word segmentation code;

[0073] The detection module 55 is used to detect whether the first position vector and the second position vector match multiple objective functions respectively, and to determine whether there are any abnormalities in the API behavior of the source resource pool and the destination resource pool based on the detection results.

[0074] The following section describes the functions of each module of the cross-resource pool API behavior detection device in conjunction with the specific implementation process.

[0075] The objective of this application embodiment is to accurately describe the consistency of behavior by analyzing whether the position vectors of the source resource pool and the destination resource pool conform to the distribution of a preset sine / cosine curve. Therefore, as an optional implementation, the cross-resource pool API behavior detection device in this application embodiment also includes a construction module for constructing a basic sine / cosine function and determining the first position code corresponding to the basic code of the source resource pool and the second position code corresponding to the basic code of the destination resource pool.

[0076] Specifically, the construction module can first obtain the first historical code corresponding to the API behavior of the source resource pool, the second historical code corresponding to the API behavior of the destination resource pool, the actual network performance loss data between the source resource pool and the destination resource pool, and the promised network performance loss data.

[0077] Understandably, in order to enrich the dimensions covered by code behavior consistency analysis and strengthen the uniqueness of behavior consistency credentials, this application needs to obtain machine code reflecting the code execution environment and network performance loss data of the source and destination resource pools when analyzing the API behavior of the source and destination resource pools. The specific acquisition method is as follows: the construction module obtains the first historical bytecode corresponding to the API behavior of the source resource pool and determines the first historical machine code corresponding to the first historical bytecode as the first historical code; it obtains the second historical bytecode corresponding to the API behavior of the destination resource pool and determines the second historical machine code corresponding to the second historical bytecode as the second historical code; it obtains the actual network performance loss data and the promised network performance loss data between the source and destination resource pools. The types of network performance loss data include network latency, packet loss rate, throughput, etc. The embodiments of this application mainly use network latency as an example for illustration.

[0078] Optionally, after the construction module obtains the relevant code and data, it can determine the third word segmentation code corresponding to the first historical code, the fourth word segmentation code corresponding to the second historical code, the fifth word segmentation code corresponding to the actual network performance loss data, and the sixth word segmentation code corresponding to the promised network performance loss data, respectively. Specifically, the following steps are taken: Based on the second context composed of the first and second historical codes, determine the third unique-hot code corresponding to the first historical code and the fourth unique-hot code corresponding to the second historical code; determine the product of the third unique-hot code and the third preset network weight as the third word segmentation code corresponding to the first historical code, and determine the product of the fourth unique-hot code and the fourth preset network weight as the fourth word segmentation code corresponding to the second historical code; based on the third context composed of the actual network performance loss data and the promised network performance loss data, determine the fifth unique-hot code corresponding to the actual network performance loss data and the sixth unique-hot code corresponding to the promised network performance loss data; determine the product of the fifth unique-hot code and the fifth preset network weight as the fifth word segmentation code corresponding to the actual network performance loss data, and determine the product of the sixth unique-hot code and the sixth preset network weight as the sixth word segmentation code corresponding to the promised network performance loss data.

[0079] After obtaining the word segmentation encoding, the construction module can determine the target angular frequency based on the third and fourth word segmentation encodings, and determine the target phase difference based on the fifth and sixth word segmentation encodings, generating multiple target functions whose angular frequencies are all target angular frequencies and whose phase differences are preset multiples of the target phase differences. The target functions are either sine or cosine functions. This application embodiment uses a cosine function as an example for illustration.

[0080] Optionally, the construction module can determine the Euclidean distance between the third and fourth word segmentation codes as n, and the target angular frequency as nπ; it can determine the dot product between the fifth and sixth word segmentation codes as k, and the target phase difference as kπ.

[0081] Then, the construction module can obtain the first absolute position value corresponding to the first historical code, substitute the first absolute position value into multiple objective functions, form a third position vector from the multiple function values ​​obtained, and determine that the sum of the third position vector and the third word segmentation code is the first position code corresponding to the first historical code; obtain the second absolute position value corresponding to the second historical code, substitute the second absolute position value into multiple objective functions, form a fourth position vector from the multiple function values ​​obtained, and determine that the sum of the fourth position vector and the fourth word segmentation code is the second position code corresponding to the second historical code.

[0082] When analyzing the API behavior of the source and destination resource pools, the first acquisition module can obtain the first code corresponding to the API behavior of the source resource pool and the second code corresponding to the API behavior of the destination resource pool in the manner described above. Specifically, it can obtain the first bytecode corresponding to the API behavior of the source resource pool and determine the first machine code corresponding to the first bytecode as the first code; it can also obtain the second bytecode corresponding to the API behavior of the destination resource pool and determine the second machine code corresponding to the second bytecode as the second code.

[0083] Optionally, after obtaining the relevant code and data, the first determining module can determine the corresponding word segmentation code in the following way: based on the first context composed of the first code and the second code, determine the first one-hot code corresponding to the first code and the second one-hot code corresponding to the second code respectively; determine the product of the first one-hot code and the first preset network weight as the first word segmentation code corresponding to the first code; determine the product of the second one-hot code and the second preset network weight as the second word segmentation code corresponding to the second code.

[0084] As an optional implementation, the second determining module can refer to the method of determining the first position code and the second position code to reverse determine the difference between the first position code and the first word segmentation code as the first position vector corresponding to the current first code; and reverse determine the difference between the second position code and the second word segmentation code as the second position vector corresponding to the current second code.

[0085] Then, the detection module can detect whether the first position vector and the second position vector match multiple objective functions, and determine whether there are any abnormalities in the API behavior of the source resource pool and the destination resource pool based on the detection results.

[0086] Optionally, the detection module can compare each element in the first position vector with each element in the third position vector corresponding to multiple objective functions. If the elements in the first and third position vectors are exactly the same, it is determined that the API behavior of the source resource pool is normal. If there are different elements between the first and third position vectors, it is determined that the API behavior of the source resource pool is at risk of unauthorized access. The module can also compare each element in the second position vector with each element in the fourth position vector corresponding to multiple objective functions. If the elements in the second and fourth position vectors are exactly the same, it is determined that the API behavior of the destination resource pool is normal. If there are different elements between the second and fourth position vectors, it is determined that the API behavior of the destination resource pool is at risk of account identity theft.

[0087] It should be noted that each module in the cross-resource pool API behavior detection device in this application embodiment corresponds one-to-one with each implementation step of the cross-resource pool API behavior detection method in embodiment 1. Since embodiment 1 has been described in detail, some details not shown in this embodiment can be referred to embodiment 1, and will not be elaborated further here.

[0088] Example 3

[0089] According to an embodiment of this application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, it implements the cross-resource pool API behavior detection method in embodiment 1.

[0090] According to an embodiment of this application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the cross-resource pool API behavior detection method in Embodiment 1 by running the computer program.

[0091] According to an embodiment of this application, a processor is also provided for running a computer program, wherein the computer program executes the cross-resource pool API behavior detection method in Embodiment 1 during runtime.

[0092] According to an embodiment of this application, an electronic device is also provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the cross-resource pool API behavior detection method of Embodiment 1 through the computer program.

[0093] Specifically, the computer program executes the following steps during runtime: obtaining the first code corresponding to the API behavior of the source resource pool and the second code corresponding to the API behavior of the destination resource pool; determining the first word segmentation code corresponding to the first code and the second word segmentation code corresponding to the second code; obtaining multiple pre-stored target functions, first position codes, and second position codes, wherein the target functions, first position codes, and second position codes are determined by the first historical code corresponding to the API behavior of the source resource pool, the second historical code corresponding to the API behavior of the destination resource pool, the actual network performance loss data between the source resource pool and the destination resource pool, and the promised network performance loss data, and the target function is a sine function or a cosine function; determining the first position vector corresponding to the first code based on the first position code and the first word segmentation code, and determining the second position vector corresponding to the second code based on the second position code and the second word segmentation code; detecting whether the first position vector and the second position vector match multiple target functions respectively, and determining whether there are any anomalies in the API behavior of the source resource pool and the destination resource pool based on the detection results.

[0094] The sequence numbers of the above embodiments are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0095] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0096] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0097] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0098] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0099] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0100] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting API behavior across resource pools, the method comprising: The application comprises: obtaining the first code corresponding to the API behavior of the source resource pool and the second code corresponding to the API behavior of the sink resource pool; determining the first segmentation coding corresponding to the first code and the second segmentation coding corresponding to the second code; obtaining a plurality of target functions, a first position coding and a second position coding pre-stored; determining the first position vector corresponding to the first code according to the first position coding and the first segmentation coding, and determining the second position vector corresponding to the second code according to the second position coding and the second segmentation coding; respectively detecting whether the first position vector and the second position vector match the plurality of target functions, and determining whether the API behavior of the source resource pool and the sink resource pool is abnormal according to the detection result; wherein the determination process of the target function, the first position coding and the second position coding comprises: obtaining the first historical code corresponding to the API behavior of the source resource pool, the second historical code corresponding to the API behavior of the sink resource pool, the actual network performance loss data and the promised network performance loss data, wherein the type of network performance loss data includes network delay; determining the third segmentation coding corresponding to the first historical code, the fourth segmentation coding corresponding to the second historical code, the fifth segmentation coding corresponding to the actual network performance loss data, and the sixth segmentation coding corresponding to the promised network performance loss data, wherein the number of elements in the third segmentation coding, the fourth segmentation coding, the fifth segmentation coding and the sixth segmentation coding is the same as that in the first segmentation coding and the second segmentation coding; determining the target angular frequency according to the third segmentation coding and the fourth segmentation coding, and determining the target phase difference according to the fifth segmentation coding and the sixth segmentation coding, and generating the plurality of target functions with the angular frequency being the target angular frequency and the phase difference being a preset multiple of the target phase difference, wherein the target function is a sine function or a cosine function, and the number of target functions is determined by the number of elements in the segmentation coding; obtaining the first absolute position value corresponding to the first historical code, substituting the first absolute position value into the plurality of target functions, composing a third position vector with the plurality of function values obtained, and determining that the sum of the third position vector and the third segmentation coding is the first position coding corresponding to the first historical code; obtaining the second absolute position value corresponding to the second historical code, substituting the second absolute position value into the plurality of target functions, composing a fourth position vector with the plurality of function values obtained, and determining that the sum of the fourth position vector and the fourth segmentation coding is the second position coding corresponding to the second historical code.

2. The method of claim 1, wherein, Obtaining the first code corresponding to the API behavior of the source resource pool and the second code corresponding to the API behavior of the sink resource pool comprises: obtaining the first bytecode corresponding to the API behavior of the source resource pool, and determining the first machine code corresponding to the first bytecode as the first code; Obtaining a second bytecode corresponding to an API behavior of the sink resource pool, and determining a second machine code corresponding to the second bytecode as the second code.

3. The method of claim 1, wherein, Determining a first tokenization code corresponding to the first code and a second tokenization code corresponding to the second code comprises: According to a first context composed of the first code and the second code, respectively determining a first one-hot code corresponding to the first code and a second one-hot code corresponding to the second code; Determining a product of the first one-hot code and a first preset network weight as the first tokenization code corresponding to the first code; Determining a product of the second one-hot code and a second preset network weight as the second tokenization code corresponding to the second code.

4. The method of claim 1, wherein, Determining a third tokenization code corresponding to the first historical code, a fourth tokenization code corresponding to the second historical code, a fifth tokenization code corresponding to the actual network performance loss data, and a sixth tokenization code corresponding to the promised network performance loss data comprises: According to a second context composed of the first historical code and the second historical code, respectively determining a third one-hot code corresponding to the first historical code and a fourth one-hot code corresponding to the second historical code; Determining a product of the third one-hot code and a third preset network weight as the third tokenization code corresponding to the first historical code, and determining a product of the fourth one-hot code and a fourth preset network weight as the fourth tokenization code corresponding to the second historical code; According to a third context composed of the actual network performance loss data and the promised network performance loss data, respectively determining a fifth one-hot code corresponding to the actual network performance loss data and a sixth one-hot code corresponding to the promised network performance loss data; Determining a product of the fifth one-hot code and a fifth preset network weight as the fifth tokenization code corresponding to the actual network performance loss data, and determining a product of the sixth one-hot code and a sixth preset network weight as the sixth tokenization code corresponding to the promised network performance loss data.

5. The method of claim 1, wherein, According to the third tokenization code and the fourth tokenization code, determining a target angular frequency, and according to the fifth tokenization code and the sixth tokenization code, determining a target phase difference, comprises: Determining a Euclidean distance between the third tokenization code and the fourth tokenization code as n, and determining the target angular frequency as nπ; Determining a dot product result between the fifth tokenization code and the sixth tokenization code as k, and determining the target phase difference as kπ.

6. The method of claim 1, wherein, According to the first position code and the first tokenization code, determining a first position vector corresponding to the first code, and according to the second position code and the second tokenization code, determining a second position vector corresponding to the second code, comprises: Determining a difference between the first position code and the first tokenization code as the first position vector corresponding to the first code; Determining a difference between the second position code and the second tokenization code as the second position vector corresponding to the second code.

7. The method of claim 1, wherein, Respectively detecting whether the first position vector and the second position vector match the plurality of target functions, and determining whether the API behavior of the source resource pool and the sink resource pool is abnormal according to the detection result, comprising: Comparing each element in the first position vector with each element in the third position vector corresponding to the plurality of target functions respectively; If the elements in the first position vector and the third position vector are completely same, it is determined that the API behavior of the source resource pool is normal; if there are different elements between the first position vector and the third position vector, it is determined that the API behavior of the source resource pool has the risk of account over-reach access; Comparing each element in the second position vector with each element in the fourth position vector corresponding to the plurality of target functions respectively; If the elements in the second position vector and the fourth position vector are completely same, it is determined that the API behavior of the sink resource pool is normal; if there are different elements between the second position vector and the fourth position vector, it is determined that the API behavior of the sink resource pool has the risk of account identity being stolen.

8. A cross-resource pool API behavior detection apparatus, characterized by, Comprising: A first acquisition module for acquiring a first code corresponding to the API behavior of the source resource pool and a second code corresponding to the API behavior of the sink resource pool; A first determination module for determining a first segmentation coding corresponding to the first code and a second segmentation coding corresponding to the second code; The second acquisition module is configured to acquire a plurality of target functions, a first position code and a second position code, wherein the determination process of the target functions, the first position code and the second position code comprises: acquiring a first historical code corresponding to an API behavior of the source resource pool, a second historical code corresponding to an API behavior of the sink resource pool, actual network performance loss data and promised network performance loss data, wherein the type of the network performance loss data comprises network latency; determining a third tokenized code corresponding to the first historical code, a fourth tokenized code corresponding to the second historical code, a fifth tokenized code corresponding to the actual network performance loss data and a sixth tokenized code corresponding to the promised network performance loss data, wherein the third tokenized code, the fourth tokenized code, the fifth tokenized code and the sixth tokenized code have the same number of elements as the first tokenized code and the second tokenized code; determining a target angular frequency according to the third tokenized code and the fourth tokenized code, and determining a target phase difference according to the fifth tokenized code and the sixth tokenized code, and generating the plurality of target functions with the target angular frequency and the target phase difference being a preset multiple of the target phase difference, wherein the target function is a sine function or a cosine function, and the number of the target functions is determined by the number of elements in the tokenized code; acquiring a first absolute position value corresponding to the first historical code, substituting the first absolute position value into the plurality of target functions, composing a third position vector with the plurality of function values obtained, and determining the first position code corresponding to the first historical code as the sum of the third position vector and the third tokenized code; acquiring a second absolute position value corresponding to the second historical code, substituting the second absolute position value into the plurality of target functions, composing a fourth position vector with the plurality of function values obtained, and determining the second position code corresponding to the second historical code as the sum of the fourth position vector and the fourth tokenized code; The second determination module is configured to determine a first position vector corresponding to the first code according to the first position code and the first tokenized code, and determine a second position vector corresponding to the second code according to the second position code and the second tokenized code. The detection module is configured to detect whether the first position vector and the second position vector match the plurality of target functions respectively, and determine whether the API behaviors of the source resource pool and the sink resource pool are abnormal according to the detection results.

9. A computer program product, characterised in that, The computer program, wherein the computer program is executed by the processor to realize the cross-resource pool API behavior detection method of any one of claims 1-7. The computer program, wherein the computer program is executed by the processor to realize the cross-resource pool API behavior detection method of any one of claims 1-7.

Images