Abnormal API detection method, electronic device and storage medium

Abstract

The present invention provides a method for detecting an abnormal API, an electronic device and a storage medium, and relates to the field of data detection. The method comprises: obtaining a development API list identified by a target application in a development phase, obtaining an operation and maintenance API list identified by a target application in an operation and maintenance phase, obtaining a development API that does not exist in the operation and maintenance API list as an initial zombie API based on the development API list and the operation and maintenance API list, thereby obtaining an initial zombie API list, obtaining an operation and maintenance API that does not exist in the development API list as an initial shadow API, thereby obtaining an initial shadow API list. By comparing the API lists in the development phase and the operation and maintenance phase, the present invention can more accurately obtain zombie APIs and shadow APIs.

Description

Technical Field

[0001] The present invention relates to the field of data detection, and in particular to a method for detecting an abnormal API, an electronic device and a storage medium. Background Art

[0002] At present, with the increasing emphasis on information security, the identification, classification and monitoring of the rapidly growing and ever-changing API interfaces, especially those involving the flow of sensitive data, have become more important. Abnormal API interfaces include zombie APIs and shadow APIs.

[0003] Zombie APIs are APIs that were once valid and approved, but were later abandoned or replaced by newer versions for various reasons. These APIs are often forgotten because organizations are busy developing new code and are not properly abandoned or updated, so they continue to exist in the system. The existence of zombie APIs may lead to data breaches or other security issues because they may contain outdated logic and weak security measures.

[0004] Shadow APIs are APIs that are introduced by internal developers or other users during the development process, but are not managed and protected by the organization's IT and security teams. Shadow APIs are not necessarily used for malicious purposes, but due to the lack of proper supervision and protection, they may become a path for security vulnerabilities and attacks. For example, if a shadow API exposes sensitive data and the organization's IT and security teams are unaware of it, they will not be able to take the necessary measures to prevent potential risks.

[0005] Therefore, the identification of zombie APIs and shadow APIs becomes particularly important. Summary of the invention

[0006] In view of the above technical problems, the technical solution adopted by the present invention is: a method for detecting abnormal APIs, wherein the abnormal APIs include zombie APIs and shadow APIs, and the method comprises the following steps:

[0007] S100, obtaining a development API list A identified by the target application during the development phase = {A1, A2, ..., A i , …, A m}, A i is the i-th development API, i ranges from 1 to m, and m is the number of development APIs;

[0008] S200, obtaining an operation and maintenance API list B identified by the target application during the operation and maintenance phase = {B1, B2, ..., B j , …, B n}, B jis the jth operation and maintenance API. The value of j ranges from 1 to n, where n is the number of operation and maintenance APIs.

[0009] S300, based on A and B, obtain a development API that does not exist in B as an initial zombie API, thereby obtaining an initial zombie API list C = {C1, C2, ..., C r , …, C s}, C r is the rth initial zombie API, r ranges from 1 to s, s is the number of initial zombie APIs; s≤m;

[0010] S400, based on A and B, obtain an operation and maintenance API that does not exist in A as an initial shadow API, thereby obtaining an initial shadow API list D = {D1, D2, ..., D g , …, D z}, D g is the gth initial shadow API, where g ranges from 1 to z, and z is the number of initial shadow APIs, z≤n.

[0011] According to another aspect of the present invention, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the aforementioned method.

[0012] According to yet another aspect of the present invention, an electronic device is provided, comprising a processor and the aforementioned non-transitory computer-readable storage medium.

[0013] The present invention has at least the following beneficial effects:

[0014] In summary, a development API list identified by the target application in the development stage is obtained, and an operation and maintenance API list identified by the target application in the operation and maintenance stage is obtained. Based on the development API list and the operation and maintenance API list, the development API that does not exist in the operation and maintenance API list is obtained as the initial zombie API, thereby obtaining the initial zombie API list, and the operation and maintenance API that does not exist in the development API list is obtained as the initial shadow API, thereby obtaining the initial shadow API list. The present invention obtains the zombie API list and the shadow API list by comparing the API lists in the development stage and the operation and maintenance stage. Compared with the prior art method of setting traffic intervals or traffic thresholds, the present invention can more accurately obtain zombie APIs and shadow APIs. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 A flowchart of a method for detecting an abnormal API provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0018] The embodiment of the present invention provides a method for detecting abnormal APIs, wherein the abnormal APIs include zombie APIs and shadow APIs. Figure 1 As shown, the method comprises the following steps:

[0019] S100, obtaining a development API list A identified by the target application during the development phase = {A1, A2, ..., A i , …, A m}, A i is the i-th development API, the value range of i is 1 to m, and m is the number of development APIs.

[0020] Specifically, the development API list A identified by the target application during the development phase is obtained by presetting a fixed code.

[0021] Specifically, static code analysis technology is used to comprehensively scan the code of the target application to obtain a development API list A identified by the target application during the development stage. Furthermore, the present invention also includes comprehensively scanning the code of the target application based on API information such as API request method, API parameter structure, and API permission configuration, thereby obtaining a development API list A identified by the target application during the development stage.

[0022] In one embodiment of the present invention, by identifying @Controller, @RestController obtains a development API list identified by the target application during the development phase.

[0023] S200, obtaining an operation and maintenance API list B identified by the target application during the operation and maintenance phase = {B1, B2, ..., B j , …, Bn}, B j is the jth operation and maintenance API. The value of j ranges from 1 to n, and n is the number of operation and maintenance APIs.

[0024] Specifically, by bypassing the monitoring of the traffic of the target application, the operation and maintenance API list B identified by the target application during the operation and maintenance phase is analyzed and obtained.

[0025] S300, based on A and B, obtain a development API that does not exist in B as an initial zombie API, thereby obtaining an initial zombie API list C = {C1, C2, ..., C r , …, C s}, C r is the rth initial zombie API, r ranges from 1 to s, s is the number of initial zombie APIs; s≤m.

[0026] Specifically, it can be understood that if an API exists in A but not in B, the API will be used as the initial zombie API, wherein the zombie API is an API that was once valid and approved but was later abandoned or replaced by a newer version for various reasons. Therefore, in the present invention, an API that appears in the development stage but does not appear in the operation and maintenance stage is used as a zombie API.

[0027] S400, based on A and B, obtain an operation and maintenance API that does not exist in A as an initial shadow API, thereby obtaining an initial shadow API list D = {D1, D2, ..., D g , …, D z}, D g is the gth initial shadow API, where g ranges from 1 to z, and z is the number of initial shadow APIs, z≤n.

[0028] Specifically, it can be understood that if an API does not exist in A but exists in B, then the API will be used as the initial shadow API, where the shadow API is an API introduced by developers or other personnel within the organization during the development process but not managed and protected. Therefore, in the present invention, the API that does not appear in the development stage but appears in the operation and maintenance stage is used as the shadow API.

[0029] In summary, a development API list identified by the target application in the development stage is obtained, and an operation and maintenance API list identified by the target application in the operation and maintenance stage is obtained. Based on the development API list and the operation and maintenance API list, the development API that does not exist in the operation and maintenance API list is obtained as the initial zombie API, thereby obtaining the initial zombie API list, and the operation and maintenance API that does not exist in the development API list is obtained as the initial shadow API, thereby obtaining the initial shadow API list. The present invention obtains the zombie API list and the shadow API list by comparing the API lists in the development stage and the operation and maintenance stage. Compared with the prior art method of setting traffic intervals or traffic thresholds, the present invention can more accurately obtain zombie APIs and shadow APIs.

[0030] Specifically, after S300, it also includes:

[0031] S310, obtain C r The corresponding eigenvector E r ={E r1 , E r2 ,…,E rx ,…,E rq} and zombie weight vector E0 = {E 01 , E 02 ,…,E 0x ,…,E 0q}, E rx YesE r The corresponding eigenvalue of the x-th preset feature, E 0x is the zombie weight of the xth preset feature, the value range of x is 1 to q, q is the number of preset features, where ∑ q x＝1 E 0x =1.

[0032] Specifically, the preset features can be determined according to actual needs. Furthermore, the preset features do not include traffic features. This is because traffic features have been used when obtaining the operation and maintenance API. The preset features at this time are to increase the judgment dimension of zombie weights, so the preset features do not include traffic features.

[0033] S320, get C r The corresponding eigenvector value E r0 =∑ q x＝1 (E 0x ×E rx ).

[0034] S330, when E r0 When it is greater than the first preset threshold, C r Identify it as the final zombie API to obtain the final zombie API list.

[0035] Specifically, the first preset threshold can be determined according to actual needs.

[0036] S340, when E r0 When C is not greater than the first preset threshold, r Record it as gray API to get the gray API list.

[0037] Specifically, when E r0 When it is not greater than the first preset threshold, it cannot be determined that C r For the final zombie API, C r Note that it is gray API.

[0038] In summary, we can obtain C r The corresponding feature vector and zombie weight vector are obtained by r The corresponding eigenvector value, when E r0 When it is greater than the first preset threshold, C r Determine the final zombie API to obtain the final zombie API list. r0 When C is not greater than the first preset threshold, r It is recorded as a gray API, thereby obtaining a gray API list. Under the premise of determining it as an initial zombie API, the present invention uses the feature vector of the initial zombie API and the feature vector value of the zombie weight vector, and further determines whether it is a zombie API by judging the feature vector value and the first preset threshold. At the same time, the corresponding weights and dimensions of the preset features are introduced, so that the final identification of the zombie API is more accurate.

[0039] Specifically, after S400, it also includes:

[0040] S410, obtain D g The corresponding eigenvector F g ={F g1 , F g2 , …, F gx , …, F gq} and shadow weight vector F0 = {F 01 , F 02 , …, F 0x , …, F 0q}, F gx Yes D g The corresponding eigenvalue of the x-th preset feature, F 0x is the shadow weight of the x-th preset feature, where ∑ q x＝1 F 0x =1.

[0041] S420, obtain D g The corresponding eigenvector value F g0 =∑q x＝1 (F gx ×F 0x ).

[0042] S430, when F g0 When D g Identify as the final shadow API to obtain the final shadow API list.

[0043] Specifically, the second preset threshold can be determined according to actual needs.

[0044] S440, when F g0 When D g Record them as gray APIs, and update the gray API list.

[0045] Specifically, when F g0 When it is not greater than the second preset threshold, D cannot be determined. g For the final shadow API, D g Note that it is gray API.

[0046] In summary, obtain D g The corresponding feature vector and shadow weight vector are obtained. g The corresponding eigenvector value, when F g0 When D g Determine the final shadow API to obtain the final shadow API list. g0 When D g Recorded as gray API, the gray API list is updated. When determining the final shadow API, the present invention introduces weights and dimensions corresponding to preset features, so that the identification of the final shadow API is more accurate.

[0047] Furthermore, after S440, it also includes:

[0048] S441, obtain the updated gray API list H = {H1, H2, ..., H t , …, H k}, H t is the tth updated gray API, t ranges from 1 to k, and k is the number of updated gray APIs.

[0049] Specifically, H includes an initial zombie API whose characteristic value is not greater than a first preset threshold and an initial shadow API whose characteristic value is not greater than a second preset threshold.

[0050] S442, obtaining a test API list G={G1, G2, . . . , G y, …, G p}, G y is the yth test API, y ranges from 1 to p, and p is the number of test APIs.

[0051] Specifically, by monitoring the traffic of the target application, the test API list G identified by the target application in the test phase is obtained. More specifically, by monitoring the traffic of the target application through the Agent, the test API list G identified by the target application in the test phase is obtained.

[0052] S443, H in G t As the final shadow API, added to the final shadow API list.

[0053] Specifically, the gray API in the test API list G is used as the final shadow API.

[0054] S444, replace H which is not present in G t As the final zombie API, join the final zombie API list.

[0055] Specifically, the gray APIs that do not exist in the test API list G are used as the final zombie APIs.

[0056] In summary, obtain an updated gray API list, obtain the test API list identified by the target application during the testing phase, use the gray API in the test API list as the final shadow API, and use the gray API that does not exist in the test API list as the final zombie API. Zombie APIs are more likely to be APIs that are not used in the testing phase, and shadow APIs are more likely to be APIs that are used in the testing phase but not securely managed. Therefore, the test API list is used to distinguish gray APIs.

[0057] Specifically, in one embodiment of the present invention, the zombie weight vector E0 is obtained by the following steps:

[0058] S001, get the historical zombie API list J = {J1, J2, ..., J e , …, J h}, J e is the e-th historical zombie API, where the value of e ranges from 1 to h, and h is the number of historical zombie APIs.

[0059] S002, Get J e The first zombie feature value list K in the operation and maintenance phase e ={K e1 , K e2 , …, K ex , …, K eq}, K ex It's Je The feature value of the x-th preset feature corresponding to the operation and maintenance stage.

[0060] S003, Get J e The second zombie feature value list L in the testing phase e ={L e1 , L e2 , …, L ex , …, L eq}, L ex It's J e The feature value of the x-th preset feature corresponding to the test phase.

[0061] S004, based on L ex To K ex The change range of E 0x , thereby obtaining the zombie weight vector E0.

[0062] In summary, a list of historical zombie APIs is obtained, a list of first zombie feature values ​​of historical zombie APIs in the operation and maintenance stage is obtained, a list of second zombie feature values ​​of historical zombie APIs in the test stage is obtained, and a zombie weight vector is obtained based on the change range of the first zombie feature value and the second zombie feature value. The present invention finds out the change range of the zombie API through the change of feature values ​​from the test stage to the operation and maintenance stage, and introduces the second zombie feature value of the test stage, so that the dimension of the zombie weight vector is richer and the acquisition of the zombie API is more accurate.

[0063] Specifically, in one embodiment of the present invention, the shadow weight vector F0 is obtained by the following steps:

[0064] S005, obtain the historical shadow API list M = {M1, M2, ..., M a , …, M b},M a It is the ath historical shadow API. The value of a ranges from 1 to b, and b is the number of historical shadow APIs.

[0065] S006, Get M a The first shadow feature value list N in the operation and maintenance phase a = {N a1 , N a2 ,…,N ax ,…,N aq},N ax It is M a The feature value of the x-th preset feature corresponding to the operation and maintenance stage.

[0066] S007, Get M a The second shadow feature value list P in the testing phase a = {P a1, P a2 ,…,P ax ,…,P aq}, P ax It is M a The feature value of the x-th preset feature corresponding to the test phase.

[0067] S008, based on P ax To N ax The change range of F 0x , thereby obtaining the shadow weight vector F0.

[0068] In summary, a list of historical shadow APIs is obtained, a list of first shadow eigenvalues ​​of historical shadow APIs in the operation and maintenance stage is obtained, a list of second shadow eigenvalues ​​of historical shadow APIs in the testing stage is obtained, and a shadow weight vector is obtained based on the change amplitude of the first shadow eigenvalue and the second shadow eigenvalue. The present invention finds out the change amplitude of the shadow API through the change of eigenvalues ​​from the testing stage to the operation and maintenance stage, and introduces the second shadow eigenvalue of the testing stage, so that the dimension of the shadow weight vector is richer and the acquisition of the shadow API is more accurate.

[0069] An embodiment of the present invention also provides a non-transitory computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to implementing a method in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method provided in the above embodiment.

[0070] An embodiment of the present invention further provides an electronic device, comprising a processor and the aforementioned non-transitory computer-readable storage medium.

[0071] Although some specific embodiments of the present invention have been described in detail by way of example, it will be appreciated by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present invention. It will also be appreciated by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. A method for detecting abnormal APIs, wherein the abnormal APIs include zombie APIs and shadow APIs, characterized in that: The method comprises the following steps: S100, obtaining a development API list A={A1, A2, ..., A i , …, A m }, A i is the i-th development API, i ranges from 1 to m, and m is the number of development APIs; S200, obtaining an operation and maintenance API list B={B1, B2, ..., B j , …, B n }, B j is the jth operation and maintenance API. The value of j ranges from 1 to n, where n is the number of operation and maintenance APIs. S300, based on A and B, obtain a development API that does not exist in B as an initial zombie API, thereby obtaining an initial zombie API list C = {C1, C2, ..., C r , …, C s }, C r is the rth initial zombie API, r ranges from 1 to s, and s is the number of initial zombie APIs; s≤m; S400, based on A and B, obtain the operation and maintenance API that does not exist in A as the initial shadow API, thereby obtaining the initial shadow API list D = {D1, D2, ..., D g , …, D z }, D g is the gth initial shadow API, where g ranges from 1 to z, and z is the number of initial shadow APIs, z≤n; Among them, after S300, it also includes: S310, obtain C r The corresponding eigenvector E r ={E r1 , E r2 , …, E rx , …, E rq } and zombie weight vector E0={E 01 , E 02 , …, E 0x , …, E 0q }, E rx YesE r The corresponding eigenvalue of the x-th preset feature, E 0x is the zombie weight of the xth preset feature, the value range of x is 1 to q, q is the number of preset features, where ∑ q x=1 E 0x =1; S320, get C r The corresponding eigenvector value E r0 =∑ q x=1 (E 0x ×E rx ); S330, when E r0 When it is greater than the first preset threshold, C r Determine the final zombie API, thereby obtaining the final zombie API list; S340, when E r0 When C is not greater than the first preset threshold, r Record it as gray API to get the gray API list.

2. The abnormal API detection method according to claim 1, characterized in that: After S400, it also includes: S410, obtain D g The corresponding eigenvector F g ={F g1 , F g2 , …, F gx , …, F gq } and the shadow weight vector F0={F 01 , F 02 , …, F 0x , …, F 0q }, F gx Yes D g The corresponding eigenvalue of the x-th preset feature, F 0x is the shadow weight of the x-th preset feature, where ∑ q x=1 F 0x =1; S420, obtain D g The corresponding eigenvector value F g0 =∑ q x=1 (F gx ×F 0x ); S430, when F g0 When D g Determine the final shadow API to obtain the final shadow API list; S440, when F g0 When D g Record them as gray APIs, and update the gray API list.

3. The method for detecting abnormal API according to claim 2, characterized in that: After S440, it also includes: S441, obtain the updated gray API list H={H1, H2, ..., H t , …, H k }, H t is the tth updated gray API, t ranges from 1 to k, and k is the number of updated gray APIs; S442, obtaining a test API list G={G1, G2, ..., G y , …, G p }, G y is the yth test API, y ranges from 1 to p, and p is the number of test APIs; S443, H in G t As the final shadow API, add it to the final shadow API list; S444, replace H which is not present in G t As the final zombie API, join the final zombie API list.

4. The method for detecting abnormal API according to claim 1, characterized in that: Get the zombie weight vector E0 through the following steps: S001, get the historical zombie API list J={J1, J2, ..., J e , …, J h }, J e is the e-th historical zombie API, where the value of e ranges from 1 to h, and h is the number of historical zombie APIs; S002, Get J e The first zombie feature value list K in the operation and maintenance phase e ={K e1 , K e2 , …, K ex , …, K eq }, K ex It's J e The feature value of the xth preset feature corresponding to the operation and maintenance stage; S003, Get J e The second zombie feature value list L in the testing phase e ={L e1 , L e2 , …, L ex , …, L eq }, L ex It's J e The feature value of the x-th preset feature corresponding to the test phase; S004, based on L ex To K ex The change range of E 0x , thereby obtaining the zombie weight vector E0.

5. The method for detecting abnormal API according to claim 2, characterized in that: Obtain the shadow weight vector F0 by following the steps below: S005, obtain the historical shadow API list M={M1, M2, ..., M a , …, M b },M a is the ath historical shadow API, where a ranges from 1 to b, and b is the number of historical shadow APIs; S006, Get M a The first shadow feature value list N in the operation and maintenance phase a ={N a1 , N a2 ,…,N ax ,…,N aq },N ax It is M a The feature value of the xth preset feature corresponding to the operation and maintenance stage; S007, Get M a The second shadow feature value list P in the testing phase a ={P a1 , P a2 ,…,P ax ,…,P aq }, P ax It is M a The feature value of the x-th preset feature corresponding to the test phase; S008, based on P ax To N ax The change range of F 0x , thereby obtaining the shadow weight vector F0.

6. The method for detecting abnormal API according to claim 3, characterized in that: By monitoring the traffic of the target application, a test API list G identified by the target application during the testing phase is obtained.

7. The method for detecting abnormal API according to claim 1, characterized in that: By presetting fixed codes, a development API list A identified by the target application during the development phase is obtained.

8. A non-transitory computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, characterized in that: The at least one instruction or the at least one program is loaded and executed by the processor to implement the abnormal API detection method as described in any one of claims 1-7.

9. An electronic device, characterized in that: The invention comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 8.

Images