Interface access control method and device, equipment, storage medium and program product

Abstract

The invention provides an interface access control method and device, equipment, a storage medium and a program product, and relates to the technical field of computers.The method comprises the steps that the request frequency of a user for accessing an API interface is obtained; if the request frequency is greater than the user-level request threshold, adjusting the user-level request threshold according to a user-level threshold adjustment coefficient, and sending adjustment information of the request frequency to the user; the user-level request threshold value is the upper limit of the number of requests of each user IP; and if the request frequency within the preset time is smaller than the adjusted user-level request threshold, allowing the user to access the API interface. According to the method, when the request frequency of the user fluctuates, the user-level request threshold value is reduced by adjusting the coefficient, so that more protection space is provided for the system, and meanwhile, the opportunity of warning user behaviors and self-adjustment is provided. In addition, the traffic of the user is precisely limited through a self-adaptive adjustment strategy, and the availability of the service to other users is ensured while resource abuse is prevented.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an interface access control method, device, equipment, storage medium and program product. Background Art

[0002] In a distributed microservice architecture, the core interface provided by each project will be called by a large number of other microservices. In high-concurrency situations, if the provided interface is not restricted and users are allowed to call it without restriction, the resources of the service system will be quickly exhausted until it crashes. The interface service is unavailable, which will cause other systems to be unable to use the service normally, and crawlers will use it to leak information. Therefore, how to implement interface access control has become an urgent problem to be solved. Summary of the invention

[0003] The present invention provides an interface access control method, device, equipment, storage medium and program product, which are used to solve the defects of interface access control in the prior art, accurately limit the user's traffic, prevent resource abuse and ensure the availability of services to other users.

[0004] The present invention provides an interface access control method, comprising the following steps: Obtain the request frequency of users accessing the application programming interface API interface; If the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and adjustment information of the request frequency is sent to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is the upper limit of the number of requests for each user IP; If the request frequency is less than the adjusted user-level request threshold within the preset time, the user is allowed to access the API interface.

[0005] According to an interface access control method provided by the present invention, the user-level request threshold is determined based on the following method: Obtain historical access data for each API interface and each user IP; Input the historical access data into the access prediction model to obtain the access prediction result of the API interface within a future set time period output by the access prediction model; Based on the access prediction result, the user-level request threshold is determined.

[0006] According to an interface access control method provided by the present invention, the user-level threshold adjustment coefficient is determined based on the following method: Determine the user-level threshold adjustment coefficient according to the user's current request frequency, the user's historical average request frequency, the system's current load ratio, the access prediction result, the basic adjustment coefficient, the adjustment of the historical request frequency and the impact of the prediction trend on the adjustment coefficient; The user-level threshold adjustment coefficient is used to adjust the user-level request threshold when the request frequency fluctuates.

[0007] According to an interface access control method provided by the present invention, after inputting the historical access data into an access prediction model to obtain the access prediction result of the API interface within a future set time period output by the access prediction model, the method further includes: Based on the access prediction result, a global request threshold is determined; the global request threshold is the maximum number of requests allowed by the system or a specific interface within a preset time window; If the request frequency of the system or the specific interface is greater than the global request threshold, the user's access to the API interface is suspended.

[0008] According to an interface access control method provided by the present invention, the step of obtaining the request frequency of a user accessing an application programming interface (API) interface comprises: The entire time axis is divided according to the preset time window length to obtain multiple time windows; Dividing each of the time windows to obtain a plurality of sub-time windows; Determine the sub-time window to which each historical access request belongs according to the timestamps of the historical access requests of the API interface, so as to record the number of requests in each sub-time window; According to the API interface and the user IP, the requests in each sub-time window are classified and counted to obtain the request frequency of the user accessing the API interface in the current sub-time window.

[0009] According to an interface access control method provided by the present invention, if the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and after the adjustment information of the request frequency is sent to the user, the method further includes: If the request frequency is less than the adjusted user-level request threshold within the preset time, the adjusted user-level request threshold is restored to the original setting after the current time window ends.

[0010] According to an interface access control method provided by the present invention, if the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and after the adjustment information of the request frequency is sent to the user, the method further includes: If the request frequency is greater than or equal to the adjusted user-level request threshold within a preset time, the user's access to the API interface is suspended.

[0011] The present invention also provides an interface access control device, comprising the following modules: An acquisition module is used to obtain the request frequency of users accessing the application programming interface API interface; An adjustment module, for adjusting the user-level request threshold according to a user-level threshold adjustment coefficient if the request frequency is greater than the user-level request threshold, and sending adjustment information of the request frequency to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is an upper limit of the number of requests for each user IP; The access control module is used to allow the user to access the API interface if the request frequency is less than the adjusted user-level request threshold within a preset time.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-mentioned interface access control methods when executing the computer program.

[0013] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the interface access control method described in any one of the above methods is implemented.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the interface access control method described above is implemented.

[0015] The interface access control method, device, equipment, storage medium and program product provided by the present invention obtain the request frequency of the user accessing the API interface; if the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and the adjustment information of the request frequency is sent to the user; the user-level request threshold is the upper limit of the number of requests for each user IP; if the request frequency is less than the adjusted user-level request threshold within a preset time, the user is allowed to access the API interface. When the user's request frequency fluctuates, the present invention reduces the user-level request threshold by adjusting the coefficient, thereby giving the system more protection space, and also provides warnings and self-adjustment opportunities for user behavior. In addition, the user's traffic is accurately limited through an adaptive adjustment strategy to prevent resource abuse while ensuring the availability of services to other users. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flow chart of the interface access control method provided by the present invention.

[0018] Figure 2 It is a schematic diagram of the adaptive flow control strategy provided by the present invention.

[0019] Figure 3 It is a flow chart of the data-driven adaptive flow control provided by the present invention.

[0020] Figure 4 It is a structural diagram of the interface access control device provided by the present invention.

[0021] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] In related content, the flow control of the API interface has the following problems: (1) Service quality cannot be guaranteed: Hard isolation and flow control strategies usually do not consider the importance of requests or the different needs of users. Once the flow control threshold is reached, all subsequent requests are indiscriminately rejected or queued. This "one-size-fits-all" approach will cause key service requests to be delayed or blocked, and the quality and response speed of the service cannot be guaranteed, which will damage the user experience.

[0024] (2) Lack of dynamic adjustment capability: The hard isolation flow control strategy lacks flexibility and cannot be dynamically adjusted according to the real-time system load or business priority. This means that when the traffic pattern changes, the system cannot adaptively optimize resource allocation and ensure the performance of key businesses.

[0025] (3) Poor resource utilization: Hard isolation and current limiting may cause system resources to be underutilized at certain times. For example, during periods of low system load, strict current limiting thresholds may block more legitimate business requests, resulting in a waste of resources.

[0026] To solve the above problems, the present invention proposes an interface access control method to implement data-driven adaptive flow control.

[0027] Combine the following Figure 1-Figure 5 The interface access control method, device, equipment, storage medium and program product of the present invention are described.

[0028] Figure 1 is a flow chart of the interface access control method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 101: Obtain the request frequency of users accessing the application programming interface (API).

[0029] The request frequency of an API (Application Programming Interface) can be understood as the number of times each user (or each user IP address) initiates a request to a certain API interface within a certain period of time.

[0030] In the embodiment of the present invention, the request frequency of the user (or user IP) accessing the API interface in the current time window is obtained through a sliding time window algorithm.

[0031] In one embodiment, the entire timeline is divided according to a preset time window length to obtain multiple time windows; further, each time window is divided to obtain multiple sub-time windows; then, based on the timestamps of the historical access requests of the API interface, the sub-time window to which each historical access request belongs is determined to record the number of requests in each sub-time window; finally, according to the API interface and the user IP, the requests in each sub-time window are classified and counted to obtain the request frequency of the user accessing the API interface in the current sub-time window.

[0032] For example, first, determine the length of the sliding time window, such as every second, every minute, or a longer time period; then, according to the length of the sliding time window, divide the entire time range into multiple fixed-size time windows (for example, one window of 1 second), and each time window will slide in sequence as time passes. Further, subdivide the large time window into multiple small windows (i.e., sub-time windows), such as dividing 1 second into 10 small windows, each of which is 100 milliseconds. At the same time, maintain a counter for each small window to record the number of requests within the time window. Whenever a new request arrives, determine the corresponding small window according to the timestamp of the request, and increase the count on the counter of the small window. Finally, classify and count the requests in each small window according to the API interface and user IP, and obtain the request frequency of the user (or user IP) accessing the API interface in the current sub-time window.

[0033] Step 102: If the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to a user-level threshold adjustment coefficient, and adjustment information of the request frequency is sent to the user.

[0034] In an embodiment of the present invention, the user-level request threshold is the upper limit of the number of requests for each independent user (or user IP); the user-level threshold adjustment coefficient is temporarily lower than the user-level request threshold and higher than the preset blocking threshold, between 0 and 1, and is used to adjust the user-level request threshold when the request frequency fluctuates.

[0035] If the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and request frequency adjustment information is sent to the user, wherein the adjustment information is used to instruct the user to adjust the request frequency.

[0036] For example, suppose the user-level request threshold (original setting) is to allow the user IP to send a maximum of 100 requests per minute. The user-level threshold adjustment coefficient is 0.8, that is, when the user's request frequency exceeds the preset threshold, the system will reduce its request limit to 80%. The user IP actually sent 120 requests within 1 minute, exceeding the original threshold of 100 times / minute. The system detects that the request frequency of the user IP exceeds the setting of 100 times / minute. According to the set adjustment coefficient of 0.8, the system calculates the new request limit: 100 times / minute*0.8=80 times / minute, and adjusts the request limit of the user IP to a maximum of 80 requests per minute. At the same time, the system sends a notification to the user, informing him that the current request frequency has exceeded the set threshold, so the system has adjusted the request limit. The notification message will contain the new request limit: a maximum of 80 requests per minute, so that the user can adjust the current request frequency.

[0037] Step 103: If the request frequency is less than the adjusted user-level request threshold within a preset time, the user is allowed to access the API interface.

[0038] After sending the request frequency adjustment information to the user, monitor whether the user's request frequency in the current time window is less than the adjusted user-level request threshold. If so, the user is allowed to access the API interface. At the same time, after the current time window ends, the adjusted user-level request threshold is restored to the original setting. If not, the user's access to the API interface is suspended.

[0039] For example, the user-level request threshold is 100 requests per minute, and the adjusted user-level request threshold is 80 requests per minute, with each minute as a time window. After sending the request frequency adjustment information to the user, the system monitors the user's request frequency in the current time window. If the user's request number is less than 80 times (the adjusted user-level request threshold) in the current time window, the system allows the user to access the API interface because the user operates within the adjusted limit. Since the user's request number in the current time window does not exceed 80 times, after the current time window ends, the system will restore the user-level request threshold to the initial setting, that is, 100 times per minute. If the user's request number in the current time window is greater than or equal to 80 times (the adjusted user-level request threshold), the system will further process according to the set policy, such as suspending the user's access to the API interface, intercepting the user's request, or temporarily banning the user to protect the system from overload or abuse.

[0040] The interface access control method provided by the embodiment of the present invention obtains the request frequency of the user accessing the application programming interface API interface; if the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and the adjustment information of the request frequency is sent to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is the upper limit of the number of requests for each user IP; if the request frequency is less than the adjusted user-level request threshold within a preset time, the user is allowed to access the API interface. When the user's request frequency fluctuates, the present invention reduces the user-level request threshold by adjusting the coefficient, thereby giving the system more protection space, and also provides warnings and self-adjustment opportunities for user behavior. In addition, the user's traffic is accurately limited through an adaptive adjustment strategy to prevent resource abuse while ensuring the availability of services to other users.

[0041] Based on the above embodiment, the user-level request threshold is determined based on the following method: Step 211, obtaining the historical access data of each API interface and each user IP; Step 212, inputting the historical access data into an access prediction model to obtain the access prediction result of the API interface within a future set time period output by the access prediction model; Step 213: Determine the user-level request threshold based on the access prediction result.

[0042] In the embodiment of the present invention, the access prediction model is trained using the Prophet algorithm, and the principle of the Prophet algorithm is based on the fitting of time series decomposition and machine learning. After the access prediction model is pre-trained, the access prediction model is used to predict the API access trend and pattern of the API interface in the future.

[0043] First, the historical access data of each API interface and each user IP is obtained in time series, and then the historical access data is input into the pre-trained access prediction model to obtain the access prediction result of the API interface in the future set time period output by the access prediction model, wherein the access prediction result includes the predicted value on the time series, the lower bound of the predicted value, and the upper bound of the predicted value. Furthermore, the lower bound of the predicted value (i.e., the lower limit of the predicted value) is defined as the user-level request threshold, which is used to limit the request frequency of a single user.

[0044] In one embodiment, the user-level threshold adjustment factor is determined based on: The user-level threshold adjustment coefficient is determined based on the user's current request frequency, the user's historical average request frequency, the system's current load ratio, access prediction results, the basic adjustment coefficient, and the impact of adjusting the historical request frequency and the predicted trend on the adjustment coefficient.

[0045] The calculation formula of the user-level threshold adjustment coefficient is as follows: ; In the formula, R now is the user's current request frequency, R avg is the historical average request frequency of the user, L system is the current load ratio of the system, T predict The access prediction result is the future traffic trend indicator predicted based on historical access data, ranging from 0 to 1, where 1 means that the predicted traffic will reach the maximum load of the system; k is the basic adjustment factor to ensure C The final value of is within a reasonable range. α and β Adjust the impact of historical request frequency and predicted trend on the adjustment coefficient respectively.

[0046] The user-level threshold adjustment coefficient in the embodiment of the present invention is intended to balance the relationship between user experience and system protection. When the system detects abnormal traffic but has not yet determined it as a malicious attack, the user-level threshold adjustment coefficient is calculated. C The specific value of is multiplied by the user-level request threshold to obtain the adjustment threshold for individual users. The formula is: Adjustment threshold for individual users = C × User-level request threshold. Due to the user-level threshold adjustment factor C It is a value between 0 and 1, so the user-level request threshold can be lowered through the user-level threshold adjustment coefficient, thereby giving the system more protection space, while also providing warnings to user behavior and opportunities for self-adjustment.

[0047] In one embodiment, the upper bound of the predicted value in the access prediction result (i.e., the upper limit of the predicted value) is defined as the global current limiting threshold, wherein the global request threshold is the maximum number of requests allowed by the system or a specific interface within a preset time window. It can be understood that the global current limiting threshold sets the maximum number of requests that the system can handle, helps prevent the system from being overloaded or crashed due to too many requests, and is used to control the maximum load of the entire system.

[0048] When the request frequency of the system or a specific interface is greater than the global request threshold, the following policies can be adopted: (1) Limiting requests: When the request frequency exceeds the global limit threshold, the system can choose to reject new requests, that is, suspend user access to the API interface to avoid system overload or performance degradation. For example, this can be achieved by intercepting or blocking user requests to inform the client that the current service is unavailable or has reached the limit threshold.

[0049] (2) Degraded service: The system accepts requests, but may downgrade some of them. For example, it can lower the priority of request processing, delay processing of non-critical requests, or return a more simplified response. This can maintain service availability, although the service provided during high load may be more simplified or delayed than usual.

[0050] (3) Waiting in queue: For requests that exceed the threshold, the system can choose to queue them for processing. This means that the requests are not processed immediately, but enter a queue and wait for the system load to decrease to a level that can handle more requests. This approach ensures that all requests are processed, but may increase the response time of the request because the request needs to wait for the previous request to complete before it can be processed.

[0051] In a high concurrency situation, the embodiment of the present invention can effectively avoid system overload or crash caused by too many requests by limiting requests, degrading services or queuing, and at the same time, can more effectively allocate and utilize limited resources.

[0052] In order to further analyze and explain the interface access control method proposed by the present invention, refer to the following embodiments.

[0053] The interface access control method proposed in the embodiment of the present invention can be understood as a service interface reliability protection method based on adaptive adjustment, which mainly includes the following contents: (1) Personalized user traffic limiting: In related technologies, there is a lack of the ability to perform fine-grained traffic limiting on individual users or user groups, which makes it impossible to effectively deal with abnormal traffic of individual users. The embodiments of the present invention introduce an adaptive dynamic traffic monitoring strategy to achieve the ability to independently limit the traffic of each user. This method emphasizes that when the request volume of a single user is abnormal, the system can automatically take measures to accurately limit the traffic of the user through adaptive adjustment strategies, aiming to prevent resource abuse while ensuring the availability of services to other users.

[0054] (2) Dynamic flow control: Different from the static flow control mechanism of related technologies, the embodiments of the present invention emphasize the dynamic flow control adjustment capability based on real-time data. When the request frequency of a single user exceeds the set threshold, the system will automatically enable the adaptive adjustment mechanism to adjust the flow control threshold according to the current flow conditions and user behavior patterns, including implementing stricter flow control measures during peak flow periods and relaxing restrictions accordingly during off-peak periods, thereby optimizing resource allocation and ensuring service stability and response speed.

[0055] like Figure 2 As shown in the figure, at time t1, the system identified abnormal traffic and implemented preliminary restrictions, which reflects an adaptive traffic control strategy that uses an adjustment coefficient to reduce the allowed request frequency instead of completely cutting off user requests. If the user adjusts his request behavior and keeps the request frequency within the adjusted threshold range, the system will not further restrict his requests. When it reaches point t2, assuming that the user has adjusted the request frequency, the traffic chart shows that the request threshold gradually returns to normal, indicating that the system's adaptive mechanism effectively handles traffic peaks and maintains system stability.

[0056] This dynamic buffering current limiting method ensures that the system will not be down due to sudden traffic, while taking into account the operation of important businesses and user experience. In addition, this method increases the system's resilience to emergencies by allowing users to adjust their behavior within a certain period of time, which is crucial to maintaining the long-term stability of the system and user satisfaction. With this method, the quality and continuity of business processes can be ensured while ensuring system security.

[0057] The interface access control method can be understood as a flow control method for managing and regulating the amount of requests for accessing the API interface. Therefore, the present invention also proposes a data-driven adaptive flow control system, which is used to execute the interface access control method proposed above. The system can dynamically adjust the API access flow limit threshold by combining the long-term flow prediction of the adaptive feedback loop unit and the real-time management capability of the dynamic flow monitoring unit, thereby achieving efficient allocation of system resources and effective defense against malicious traffic.

[0058] Figure 3 This is a flow chart of data-driven adaptive flow control provided by the present invention, which shows how the system coordinates prediction and real-time monitoring data to intelligently execute flow control strategies. Data-driven adaptive flow control mainly includes the following contents: (1) Define thresholds and time windows: Define global request thresholds, user-level request thresholds, and user-level request threshold adjustment coefficients. The global request threshold is the maximum number of requests allowed for the entire system or a specific API interface within a given time window (such as per second, per minute, or per hour). The user-level request threshold sets an upper limit on the number of requests for each independent user IP to prevent individual users from making too many malicious requests in a short period of time. For user IPs that exceed the user-level request threshold for the first time, the system does not immediately block them, but instead limits the user's request threshold through the user-level request threshold adjustment coefficient. The user-level request threshold adjustment coefficient defines a temporary threshold interval that is lower than the normal user-level request threshold but higher than the blocking condition, allowing users to continue accessing at this threshold while issuing a warning to the user. For example, assuming that the global request threshold is 100 times per second, the user-level request threshold is 70 times per second, and the user-level request threshold adjustment coefficient (0-1 interval) is 0.6, the frequency interval of the number of requests allowed for user access to the interface is [42, 60].

[0059] (2) Traffic monitoring tool integration: Introduce a dynamic traffic monitoring unit for continuous real-time monitoring, and configure rules to detect the request frequency of each API interface and user IP to ensure that it does not exceed the set global request threshold and user-level request interval threshold.

[0060] (3) Historical data analysis and prediction: First, the improved adaptive Prophet algorithm is used to analyze historical access data, including the total number of requests and the distribution of requests from different user IPs. Based on the Prophet model, the API access trend and possible traffic peak in the future are predicted, and the global request threshold, user-level request threshold, and adjustment threshold for individual users are dynamically set. By analyzing the system's historical traffic data, the difference between normal use and abnormal traffic is identified, and the user-level request threshold adjustment coefficient is added to the Prophet algorithm to obtain the adjustment threshold, which can tolerate normal traffic fluctuations but has some restrictions on abnormally high traffic.

[0061] (4) Request classification and counting: All incoming requests are classified and counted according to the API interface and user IP, and the counter is updated when each request arrives. At the same time, a cache database such as Redis is used to implement a sliding counter for the time window. Each counter is automatically reset according to the time window to ensure the accuracy and real-time nature of the counting.

[0062] (5) Over-threshold behavior detection: Automatically identify request behaviors that exceed the threshold through configured monitoring rules. Once a user IP is detected to exceed the user-level request threshold within the specified time window, the user-level request threshold adjustment coefficient is used to adjust the request threshold, warn the user of temporary restrictions triggered by abnormal access frequency, and remind the user to adjust the request frequency within the specified time. Requests that do not exceed the user-level request threshold are released.

[0063] (6) Threshold recovery and ban strategy: If the user adjusts the request behavior within the time window and the request frequency does not exceed the adjustment coefficient threshold, the system will not take further action and restore the user-level request threshold to the original setting at the end of the time window. On the contrary, if the user ignores the warning and continues to exceed the adjustment coefficient threshold, the system will take more stringent measures to temporarily block / ban the access rights of the user's IP and record the relevant events for future review.

[0064] (7) Malicious access handling: For user IPs identified as malicious, we will immediately implement a temporary access ban, prohibiting them from further accessing any API interface, and send a notification to the banned user, explaining the reason for the ban and the estimated ban duration. At the same time, we will provide a channel for appeal and review for legitimate users who are mistakenly identified as malicious users, to ensure that non-malicious users are not misjudged.

[0065] (8) Record all restricted and banned behaviors and their reasons to facilitate subsequent analysis and audit.

[0066] On the other hand, the data-driven adaptive traffic control system includes a dynamic traffic monitoring unit, an adaptive feedback loop unit, and a user-level over-threshold detection unit. The main functions of each unit are as follows: (1) Dynamic traffic monitoring unit: It provides a traffic control mechanism that can dynamically adjust the API access limit threshold to ensure system stability and high service availability. It also provides a variety of strategies and flexible configurations to meet complex business needs. The sliding time window algorithm is used to implement traffic control and monitor the interaction between services in real time. The core idea of ​​the sliding time window algorithm is to divide a period of time into multiple time windows and count requests in each time window to determine whether to allow the request to continue.

[0067] Among them, the main functions of the dynamic flow monitoring unit are as follows: Dynamic traffic limiting: Dynamically adjust the access limit threshold of the API interface based on real-time traffic and forecast data to adapt to different traffic demands and avoid potential service interruptions; Fine-grained flow control: supports multiple flow control strategies, such as QPS (Queries Per Second) flow control, concurrent flow control, etc. It can perform fine-grained flow control for APIs, resources or sources; System adaptive protection: Automatically adjusts traffic rules based on the real-time load of the system, such as CPU usage or overall throughput, to avoid system overload.

[0068] The main steps of current limiting through the sliding time window algorithm include: ① Time window definition: determine the length of the sliding time window, divide the entire time range into multiple fixed-size time windows (for example, one window of 1 second), and these time windows will slide in sequence as time passes; ② Time window division: subdivide the time into multiple small windows, such as dividing 1 second into 10 small windows, each of which is 100 milliseconds; ③ Request counting: A counter is maintained for each small window to record the number of requests within the time window. Whenever a new request arrives, the corresponding small window is determined based on the timestamp of the request, and the count is increased on the counter of the window; ④ Sliding time window: Slide the time window regularly, delete the expired time window, and create a new time window, so as to keep the time window rolling; ⑤ Current limit judgment: When a request arrives, check whether the number of requests in the current time window exceeds the preset limit threshold. If it exceeds the limit threshold, the request will be rejected or the downgrade strategy will be implemented; ⑥ Dynamic adjustment: Continuously monitor real-time traffic and system load to adapt to emergencies or traffic fluctuations, and dynamically adjust the flow limit threshold according to monitoring results and business needs to achieve the best flow control effect; ⑦Count reset: Reset the counter of the expiration time window regularly to ensure that the counter does not grow indefinitely.

[0069] The dynamic traffic monitoring unit implements traffic control by adopting a sliding time window algorithm. It can freely select the control angle and flexibly combine it to achieve the desired effect, reduce the impact of sudden high traffic on the service, and protect the system from overload and potential service interruption.

[0070] (2) Adaptive feedback loop unit: The global request threshold and user-level request threshold are predicted by the improved adaptive Prophet algorithm, and an adjustment coefficient (i.e., user-level request threshold adjustment coefficient) is introduced into the original Prophet algorithm. The adjustment coefficient adjusts the user-level request threshold. The Prophet model outputs the predicted value, the lower bound of the predicted value, and the upper bound of the predicted value on the time series. In the embodiment of the present invention, the upper bound of the predicted value is defined as the global flow limiting threshold, which is used to control the maximum load of the entire system; the lower bound of the predicted value is defined as the user-level request threshold, which is used to limit the request frequency of a single user. This method can analyze and dynamically adjust the threshold of the number of requests per second based on the sequence, making the interface access flow restriction more flexible, intelligent, and stable.

[0071] An adjustment coefficient is introduced into the Prophet algorithm. The adjustment coefficient is between 0 and 1 and is used to dynamically adjust the user-level request threshold. The coefficient is automatically adjusted according to the real-time monitored traffic conditions or user behavior to improve the system's response flexibility and robustness. By analyzing the system's historical traffic data, the difference between normal use and abnormal traffic, as well as factors such as user request frequency, system current load, and predicted traffic trends are identified. Dynamic adjustments are made based on the system's operating status and user request behavior, allowing it to tolerate normal traffic fluctuations but limit abnormally high traffic.

[0072] In an embodiment of the present invention, by combining the use model, the improved adaptive Prophet algorithm can provide a comprehensive forecast of future API request volumes. These forecasts include not only overall trends, but also carefully reflect periodic seasonal patterns and the impact of specific events. Based on the forecast results, the global flow limiting threshold and user-level flow limiting threshold can be set more accurately, and can be dynamically adjusted according to the operating status of the system and user request behavior, so that it can tolerate normal traffic fluctuations, but limit abnormally high traffic while avoiding unnecessary restrictions.

[0073] (3) User-level over-threshold detection unit: Dynamically adjust the coefficient according to the overall performance and security requirements of the system to adapt to different traffic and attack patterns. By deeply analyzing users with over-threshold behavior, the system can learn and distinguish normal traffic peaks from potential malicious attacks, thereby improving the accuracy and effectiveness of response strategies in the future. The system is more flexible and humane when handling over-threshold request behaviors, which can not only effectively curb potential malicious behaviors, but also avoid unnecessary impacts on normal users due to overly strict flow control measures. In addition, this strategy can also provide feedback and adjustment opportunities, providing space for users to correct their behavior, thereby maintaining the fairness of the service and a good user experience.

[0074] The specific implementation details of the user-level over-threshold detection unit are as follows: ① Introducing an adjustment coefficient. For IP addresses that exceed the user-level request threshold for the first time, the system does not immediately block them. Instead, it applies an adjustment coefficient to temporarily limit the user's request frequency. ② Once a user's IP exceeds the normal threshold for the first time, the system will send a warning to the user. Notify the user of temporary restrictions triggered by abnormal access frequency and remind the user to adjust the request frequency within the specified time; ③ The adjustment coefficient defines a temporary threshold interval that is lower than the normal threshold but higher than the blocking condition, allowing the user to continue accessing within this threshold interval. If the user adjusts the request behavior within the time window and the request frequency does not exceed the adjusted threshold, the system will not take further action and restore the user's threshold to the original setting at the end of the window; ④On the contrary, if the user ignores the warning and still exceeds the adjusted threshold, the system will take stricter measures, temporarily block the user's IP access rights, and record the relevant events for future review.

[0075] The user-level over-threshold detection unit dynamically obtains the adjustment coefficient according to different user needs and adaptively adjusts the threshold to adapt to different traffic patterns and potential attack scenarios. The temporary restriction and notification strategy triggered when the user IP exceeds the threshold for the first time, as well as the automatic recovery mechanism of the user-level request threshold for individual users, make the flow control strategy more flexible and user-friendly, ensuring that malicious behavior can be curbed while avoiding unnecessary impact on normal users, enhancing the adaptability and foresight of the system.

[0076] The embodiment of the present invention provides intelligent prediction, monitoring and dynamic adjustment functions for API access, which not only effectively prevents the intrusion of malicious traffic, but also ensures the optimal configuration of system resources and the continuous stability of services. By finely adjusting the access threshold, the service quality is guaranteed, and the system's adaptability to changing traffic demands is improved.

[0077] Compared with the related art, the embodiments of the present invention have the following advantages: 1. System performance optimization: By dynamically adjusting the access frequency of the microservice backend interface, the system can adapt to different workloads more intelligently, thereby improving the performance of microservices. This helps to improve the system's response speed and reduce latency, and maximize the use of system resources to improve user experience; 2. Resource utilization efficiency: The proposed dynamic buffer current limiting method not only ensures the high efficiency of system resource utilization under different load levels, but also improves the overall operation efficiency. This intelligent resource management helps to reduce hardware investment and maintenance costs, while ensuring higher energy and computing efficiency, thereby improving the effective utilization of resources; 3. Adaptability: The system is adaptive and can automatically adjust when the system environment changes without manual intervention. This adaptability is particularly important for modern distributed systems facing constantly changing workloads and environmental conditions; 4. Real-time performance: Compared with traditional static adjustment, the system can predict and adjust the system load in real time to ensure rapid response to changes. This helps to avoid system performance degradation under high load and improves system stability and availability; 5. Data-driven decision-making: Through machine learning algorithms, the system can learn from historical data and make intelligent decisions based on the data. This provides a more scientific and precise way to manage and adjust the access frequency of the system, thereby improving the overall system management level.

[0078] The interface access control device provided by the present invention is described below. The interface access control device described below and the interface access control method described above can be referenced to each other.

[0079] refer to Figure 4 The interface access control device provided by the present invention includes an acquisition module 401, an adjustment module 402 and an access control module 403: The acquisition module 401 is used to acquire the request frequency of the user accessing the application programming interface API interface; An adjustment module 402 is used for adjusting the user-level request threshold according to the user-level threshold adjustment coefficient if the request frequency is greater than the user-level request threshold, and sending adjustment information of the request frequency to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is the upper limit of the number of requests for each user IP; The access control module 403 is used to allow the user to access the API interface if the request frequency is less than the adjusted user-level request threshold within a preset time.

[0080] The interface access control device provided by the embodiment of the present invention obtains the request frequency of the user accessing the application programming interface API interface; if the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and the adjustment information of the request frequency is sent to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is the upper limit of the number of requests for each user IP; if the request frequency is less than the adjusted user-level request threshold within a preset time, the user is allowed to access the API interface. When the user's request frequency fluctuates, the present invention reduces the user-level request threshold by adjusting the coefficient, thereby giving the system more protection space, and also provides warnings and self-adjustment opportunities for user behavior. In addition, the user's traffic is accurately limited through an adaptive adjustment strategy to prevent resource abuse while ensuring the availability of services to other users.

[0081] In one embodiment, the user-level request threshold is determined based on: Obtain historical access data for each API interface and each user IP; input the historical access data into an access prediction model to obtain access prediction results of the API interface within a future set time period output by the access prediction model; and determine the user-level request threshold based on the access prediction results.

[0082] In one embodiment, the user-level threshold adjustment coefficient is determined based on the following method: The user-level threshold adjustment coefficient is determined based on the user's current request frequency, the user's historical average request frequency, the system's current load ratio, the access prediction result, the basic adjustment coefficient, the impact of the adjusted historical request frequency and the predicted trend on the adjustment coefficient; the user-level threshold adjustment coefficient is used to adjust the user-level request threshold when the request frequency fluctuates.

[0083] In one embodiment, the access control module 403 is further configured to: Based on the access prediction result, a global request threshold is determined; the global request threshold is the maximum number of requests allowed by the system or specific interface within a preset time window; if the request frequency of the system or the specific interface is greater than the global request threshold, the user's access to the API interface is suspended.

[0084] In one embodiment, the acquisition module 401 is specifically used to: The entire timeline is divided according to the preset time window length to obtain multiple time windows; each time window is divided to obtain multiple sub-time windows; according to the timestamps of the historical access requests of the API interface, the sub-time window to which each historical access request belongs is determined to record the number of requests in each sub-time window; according to the API interface and the user IP, the requests in each sub-time window are classified and counted to obtain the request frequency of the user accessing the API interface in the current sub-time window.

[0085] In one embodiment, the adjustment module 402 is further configured to: If the request frequency is less than the adjusted user-level request threshold within the preset time, the adjusted user-level request threshold is restored to the original setting after the current time window ends.

[0086] In one embodiment, the adjustment module 402 is further configured to: If the request frequency is greater than or equal to the adjusted user-level request threshold within a preset time, the user's access to the API interface is suspended.

[0087] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 complete mutual communication through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the interface access control method, which includes: obtaining the request frequency of the user to access the application programming interface API interface; if the request frequency is greater than the user-level request threshold, adjusting the user-level request threshold according to the user-level threshold adjustment coefficient, and sending the adjustment information of the request frequency to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is the upper limit of the number of requests for each user IP; if the request frequency is less than the adjusted user-level request threshold within a preset time, the user is allowed to access the API interface.

[0088] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0089] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the interface access control method provided by the above methods, which includes: obtaining the request frequency of the user to access the application programming interface API interface; if the request frequency is greater than the user-level request threshold, adjusting the user-level request threshold according to the user-level threshold adjustment coefficient, and sending the adjustment information of the request frequency to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is the upper limit of the number of requests for each user IP; if the request frequency is less than the adjusted user-level request threshold within a preset time, the user is allowed to access the API interface.

[0090] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the interface access control method provided by the above-mentioned methods, the method comprising: obtaining the request frequency of a user accessing an application programming interface API interface; if the request frequency is greater than a user-level request threshold, adjusting the user-level request threshold according to a user-level threshold adjustment coefficient, and sending adjustment information of the request frequency to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is an upper limit on the number of requests for each user IP; if the request frequency is less than the adjusted user-level request threshold within a preset time, the user is allowed to access the API interface.

[0091] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0092] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An interface access control method, characterized in that: include: Obtain the request frequency of users accessing the application programming interface API interface; If the request frequency is greater than the user-level request threshold, adjusting the user-level request threshold according to the user-level threshold adjustment coefficient, and sending adjustment information of the request frequency to the user; The adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is the upper limit of the number of requests for each user IP; If the request frequency is less than the adjusted user-level request threshold within the preset time, the user is allowed to access the API interface.

2. The interface access control method according to claim 1, characterized in that: The user-level request threshold is determined based on the following: Obtain historical access data for each API interface and each user IP; Input the historical access data into an access prediction model to obtain an access prediction result of the API interface within a future set time period output by the access prediction model; Based on the access prediction result, the user-level request threshold is determined.

3. The interface access control method according to claim 2, characterized in that: The user-level threshold adjustment coefficient is determined based on the following method: Determine the user-level threshold adjustment coefficient according to the user's current request frequency, the user's historical average request frequency, the system's current load ratio, the access prediction result, the basic adjustment coefficient, the adjustment of the historical request frequency and the impact of the prediction trend on the adjustment coefficient; The user-level threshold adjustment coefficient is used to adjust the user-level request threshold when the request frequency fluctuates.

4. The interface access control method according to claim 2, characterized in that: After inputting the historical access data into the access prediction model to obtain the access prediction result of the API interface within a future set time period output by the access prediction model, the method further includes: Based on the access prediction result, a global request threshold is determined; the global request threshold is the maximum number of requests allowed by the system or a specific interface within a preset time window; If the request frequency of the system or the specific interface is greater than the global request threshold, the user's access to the API interface is suspended.

5. The interface access control method according to claim 1, characterized in that: The obtaining of the request frequency of the user accessing the application programming interface API interface includes: The entire time axis is divided according to the preset time window length to obtain multiple time windows; Dividing each of the time windows to obtain a plurality of sub-time windows; Determine the sub-time window to which each historical access request belongs according to the timestamps of the historical access requests of the API interface, so as to record the number of requests in each sub-time window; According to the API interface and the user IP, the requests in each sub-time window are classified and counted to obtain the request frequency of the user accessing the API interface in the current sub-time window.

6. The interface access control method according to claim 1, characterized in that: If the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and after the adjustment information of the request frequency is sent to the user, the method further includes: If the request frequency is less than the adjusted user-level request threshold within the preset time, the adjusted user-level request threshold is restored to the original setting after the current time window ends.

7. The interface access control method according to claim 1, characterized in that: If the request frequency is greater than the user-level request threshold, the user-level request threshold is adjusted according to the user-level threshold adjustment coefficient, and after the adjustment information of the request frequency is sent to the user, the method further includes: If the request frequency is greater than or equal to the adjusted user-level request threshold within a preset time, the user's access to the API interface is suspended.

8. An interface access control device, characterized in that: include: An acquisition module is used to obtain the request frequency of users accessing the application programming interface API interface; An adjustment module, for adjusting the user-level request threshold according to a user-level threshold adjustment coefficient if the request frequency is greater than the user-level request threshold, and sending adjustment information of the request frequency to the user; the adjustment information is used to instruct the user to adjust the request frequency; the user-level request threshold is an upper limit of the number of requests for each user IP; The access control module is used to allow the user to access the API interface if the request frequency is less than the adjusted user-level request threshold within a preset time.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the interface access control method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the interface access control method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the interface access control method according to any one of claims 1 to 7 is implemented.

Images