Information security risk assessment method and system based on API

Abstract

The invention discloses an information security risk assessment method based on an API. The method comprises the steps that API assets in an enterprise are obtained through flow analysis; identifying and positioning the log file or sensitive data in the file by using a sensitive data identification model; integrating the vulnerability rule set, and detecting vulnerability vulnerabilities existing on the API through an API vulnerability detection model; a behavior risk automatic monitoring engine is set, and real-time monitoring and early warning are carried out on the behavior of abnormally calling the AP I to obtain data; constructing a network attack monitoring model; drawing an API risk link relationship based on a risk monitoring model trained by historical monitoring data, and speculating a suspicious data leakage path in combination with clue association ranking analysis; performing comprehensive trace reserving on the API data use behavior; and calculating the risk by using a matrix method, and generating an API information security risk assessment report. Through the method, a comprehensive API security risk assessment system can be established, API security risks can be effectively identified and managed, and enterprise data security is protected.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an API-based information security risk assessment method and system. Background Art

[0002] API is an important channel for data transmission. Protecting the security of API interfaces is directly related to the security of data, including the protection of sensitive information such as user personal information and transaction data. Usually, API interfaces may face malicious attacks such as DDoS attacks and SQL injections, which may lead to serious consequences such as system paralysis and data tampering. These API security issues may lead to business interruption, so ensuring API security is crucial to maintaining business continuity.

[0003] Since enterprises generally lack awareness of the importance and particularity of API security, API security protection methods are uneven and systematic security construction is seriously lagging behind. Security vendors are still in the stage of continuous exploration of comprehensive and effective API protection technology. It is necessary to guide and encourage enterprises and security vendors to accelerate the research and practice of new technologies and methods for API security. There are a large number of historical legacy applications in many enterprises. The APIs used by these applications are often unauthenticated, allowing attackers to easily access and exploit these APIs. In addition, the API lacks an effective data desensitization strategy, which may lead to illegal access to sensitive data during transmission. These APIs may have loopholes and vulnerabilities, which will lead to illegal acquisition of data and become an important target of external network attacks.

[0004] Therefore, there is an urgent need for an API-based information security risk assessment method to monitor and evaluate the API risks of enterprises and protect the security of information data. Summary of the invention

[0005] The purpose of the present invention is to provide an information security risk assessment method based on API to solve one or more of the above-mentioned technical problems:

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] In a first aspect, the present invention provides an information security risk assessment method based on API, comprising: using traffic analysis to obtain API assets within an enterprise, and classifying and marking the API assets; using a sensitive data identification model to identify and locate sensitive data in a log file or file, and encrypting the sensitive data; integrating a vulnerability rule set, detecting vulnerability loopholes existing on the API through an API vulnerability detection model, and verifying and analyzing the vulnerability loophole characteristics; wherein the rule dimensions of the vulnerability rule set include covering data exposure, data permissions, security specifications, high-risk interfaces, and password authentication; setting a behavior risk automatic monitoring engine, and performing real-time monitoring and early warning on abnormal calls to API to obtain data, so as to obtain behavior risks; constructing a network attack monitoring model to monitor the network attack risks of all APIs, and draw attack routes and evaluate the impact of events; based on a risk monitoring model trained with historical monitoring data, drawing API risk link relationships, combining clue association ranking analysis, and inferring suspicious data leakage paths; The use of I data is comprehensively recorded to quickly locate the source of leakage after a leakage occurs; and the risk is calculated using the matrix method, combining the possibility and impact to assess the severity of the risk and generate an API information security risk assessment report.

[0008] In a second aspect, the present invention provides an information security risk assessment system based on API, including: an API asset acquisition and management module: used to use traffic analysis to acquire API assets within an enterprise, and classify and mark API assets; a sensitive data identification and protection module: used to use sensitive data identification technology to identify and locate sensitive data in log files or files, and encrypt sensitive data; an API vulnerability assessment module: used to integrate a weakness rule set, detect vulnerability vulnerabilities existing on the API through an API vulnerability detection model, and verify and analyze the vulnerability vulnerability characteristics; wherein the rule dimensions of the weakness rule set include covering data exposure, data permissions, security specifications, high-risk interfaces, and password authentication; a behavior risk monitoring and abnormal event management module: used to set a behavior risk automatic monitoring engine, and perform real-time monitoring and early warning on abnormal calls to API to obtain data, so as to obtain behavior risks; an API attack monitoring module: used to build a network attack monitoring model to monitor the network attack risks of all APIs, and draw attack routes and evaluate the impact of events; a risk monitoring model construction module: used to draw an API based on a risk monitoring model trained with historical monitoring data I risk link relationship, combined with clue association ranking analysis, to infer suspicious data leakage paths; Risk event tracing analysis module: used to comprehensively record API data usage behavior, so as to quickly locate the source of leakage after a leakage incident occurs; Risk assessment report module: used to calculate risks using the matrix method, combine possibility and impact to assess the severity of risks, and generate API information security risk assessment reports.

[0009] Through the API-based information security risk assessment method provided above, the embodiment of the present invention provides a comprehensive API security protection assessment system by automatically combing API assets, real-time monitoring of API vulnerabilities, behavioral risks and network attack risks, and combining risk link characterization and data leakage path speculation. This solution can effectively reduce the risk of data leakage, improve the response speed to API attacks, and quickly locate the source of leakage when a data leakage incident occurs. Through this comprehensive technical means, enterprises can promptly discover and respond to potential data leakage risks, protect the data assets of the enterprise, and ensure business continuity and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The present invention will be further described below in conjunction with the accompanying drawings.

[0011] Figure 1 An exemplary flow chart of an information security risk assessment method based on an API according to some embodiments of the present invention is shown;

[0012] Figure 2An exemplary structural block diagram of an information security risk assessment system based on API according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0013] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0014] Figure 1 An exemplary flow chart of an API-based information security risk assessment method 100 according to some embodiments of the present invention is shown;

[0015] like Figure 1 As shown, in method 100, step 101 is included: using traffic analysis to obtain API assets within the enterprise, and classifying and marking the API assets. All API assets within the enterprise, including public, private, partner-oriented APIs, as well as shadow APIs and zombie APIs. Classify and grade the discovered APIs to form a full list of APIs, and automatically identify the exposed sensitive data contained in the API request and return content, and classify the exposed surface. And take measures to timely update the details of sensitive data exposure.

[0016] In one embodiment, traffic analysis is used to obtain API assets within an enterprise, and the implementation steps may include:

[0017] Collect API traffic data, including HTTP request and response headers, request methods, URL paths, and request bodies. Specifically, the collection method can use web crawlers, proxy servers, and other technical means to conduct a comprehensive scan of the enterprise's internal network to discover existing API interfaces. Then, based on statistical algorithms, preliminarily classify the APIs in the communication traffic, usually pre-classified according to the same business system.

[0018] The collected data is cleaned to remove invalid or redundant information and extract key features, including API endpoints, request parameters, and response status codes.

[0019] Through in-depth analysis of discovered API interfaces, we can obtain information such as their functions, parameters, and return values ​​through static code analysis, dynamic debugging, and other technologies.

[0020] The improved dictionary tree structure algorithm is used to aggregate and classify the URL paths of APIs. The traditional dictionary tree structure is suitable for fast retrieval of strings, but in the aggregation and classification of API URL paths, it needs to be improved to meet the needs of risk assessment. First, the URL part of the API is converted into a tree structure using the Trie (dictionary tree) algorithm, with / as the node separator, and the relevant dimensions of the API aggregation range are statistically determined, such as the distance from the tail node to the root node (URL length), the tree structure with the same nodes (URL same path), and the variability of nodes at the same depth. Secondly, an improved dictionary tree node structure can be defined, which contains additional information, such as node depth, path frequency, etc.

[0021] Furthermore, in one embodiment, an improved dictionary tree structure algorithm is used to aggregate and classify URL paths of APIs, including: defining an improved dictionary tree node structure, wherein the dictionary tree node structure includes node depth and path frequency.

[0022] Then, the URL paths of the API are aggregated to group the URL paths with the same prefix into one category; the aggregation degree DP formula includes:

[0023] Where n is the number of URL paths with the same prefix, and f i is the frequency of the ith path.

[0024] Then, the edit distance is used to calculate the similarity between the paths, and aggregation is performed based on the similarity. The similarity SM formula includes:

[0025] Among them, p1 and p2 are two API paths, and Levenshtein(p1, p2) is the edit distance, which represents the minimum number of operations required to transform path p1 into path p2.

[0026] Further, features are extracted from the aggregation results. Features may include node depth, path frequency, path similarity, path length, etc. Then, the classification algorithm is used to classify the API. The specific API classification can be classified and managed according to features such as API functions and call frequency, so as to facilitate subsequent security control and optimization. Common classification methods include business API, management API, data API, third-party API, etc.

[0027] For API classification, the following steps can be used:

[0028] First, the extracted features are used to train the random forest model. Second, for each API path, features are extracted and input into the model. Finally, the model outputs the classification results and assigns the API path to the corresponding category.

[0029] In one embodiment, API assets are categorized and labeled, including:

[0030] Using machine learning models, such as random forests, the identified APIs are classified and labeled based on the multi-dimensional characteristics of API assets, including functions, usage scenarios, and sensitivity factors; the API asset labels include the system to which the API belongs, the type of environment, the type of business, and whether it is an internal or external API. By tokenizing API assets, we can prepare for the subsequent classification management and security level of API assets.

[0031] Furthermore, a machine learning model is trained based on the preprocessed feature data to build an asset recognition model.

[0032] In order to help those skilled in the art better understand, the present invention provides an embodiment scenario for an enterprise to quickly identify and classify a large number of API assets. For example, in an e-commerce platform, API paths may include different categories such as product query, order management, user information, etc. Through the above method, these API assets can be automatically discovered and classified, thereby improving the efficiency of API management and security protection.

[0033] Through the technical means provided by the present invention, the accuracy of API asset discovery is improved, and the classification and management capabilities of API assets are enhanced. This method can be effectively applied to large enterprises with complex API structures to improve the ability to manage and protect their API assets.

[0034] Further, in step 102, the sensitive data recognition model is used to identify and locate sensitive data in the log file or file, and the sensitive data is encrypted. A predetermined number, such as 100 sensitive data labels, can be set. Through the built-in data classification and grading template, customized sensitive detection rules are supported to prevent sensitive information leakage. In the process of encrypting sensitive data, industry standard encryption algorithms, such as AES, can be used whether in transmission or when stored in the database.

[0035] 19 types of sensitive parameter information such as ID cards and mobile phone numbers can be intelligently identified using built-in rules. For example, sensitive fields such as mobile phone numbers and ID card numbers can be matched through regular expressions, and sensitive information in documents can be identified through NLP technology. These rules cover personal identity information, property information, Internet access information, location information and other information types, and support custom sensitive detection rules to prevent sensitive information leakage and ensure data security.

[0036] Sensitive data can be located by analyzing the API access log in real time to locate requests and responses containing sensitive data. Regular expression matching technology can be used to identify sensitive information patterns that appear in the log. During the transmission process, the HTTPS protocol can be used to keep sensitive data (such as personal identity information, financial data, medical records, etc.) in encrypted form. The use of the HTTPS protocol can also ensure end-to-end encryption of the API communication link to prevent man-in-the-middle attacks.

[0037] By effectively identifying, locating and encrypting sensitive data in the API, the risk of data leakage is reduced and the API information security protection capability is improved.

[0038] Further, in step 103, the vulnerability rule set is integrated, and the vulnerability vulnerabilities existing on the API are detected through the API vulnerability detection model, and the vulnerability characteristics are verified and analyzed; wherein, the rule dimensions of the vulnerability rule set include covering data exposure, data permissions, security specifications, high-risk interfaces, and password authentication.

[0039] Integrate OWASP API to publish security risk list, and include a predetermined number of weakness rules, such as 50+, covering data exposure, data permissions, security specifications, high-risk interfaces, password authentication and other rule dimensions. Real-time and automatic vulnerability assessment of API, real-time monitoring of authentication and desensitization compliance.

[0040] In one embodiment, the weakness rule set R includes rules of multiple dimensions:

[0041] R={r1,r2,...,r n}, where r i represents the i-th rule, each rule r i Can contain the following parameters: data exposure rule d i1 , data permission rules d i2 , Safety Regulation Rules d i3 , high-risk interface rule d i4 , password authentication rule d i5 .

[0042] In one embodiment, the API vulnerability detection model includes:

[0043] Leverage historical data to train machine learning models to identify anomalous patterns and potential vulnerabilities in API traffic.

[0044] Scan API traffic to match vulnerability patterns defined in the weakness rule set through rule matching algorithms and machine learning models (such as recurrent neural networks (RNNs) to process time series data of API call sequences and extract features). These rules can be regular expressions, code patterns, or security checklists. Through machine learning models, common attack behaviors on API interfaces are learned, API interface attack behaviors and abnormal access behaviors are identified, and traceability is supported to the subject of data leakage.

[0045] Perform in-depth analysis of detected potential vulnerabilities and classify sensitive data using clustering algorithms and word embedding techniques to identify high-risk inputs.

[0046] Threats are graded based on the severity and potential impact of the vulnerability and the corresponding response measures are automatically triggered. The threat can be scored using the logistic regression model L:

[0047] L(X)=σ(WX+b), where σ is the sigmoid function, W and b are model parameters, and X is the feature vector.

[0048] After the API weakness is fixed, the model verifies the repair effect through continuous traffic monitoring to ensure that the vulnerability is effectively addressed and provides feedback to optimize the detection algorithm.

[0049] In one embodiment, in the above-mentioned vulnerability rule set verification and analysis, for each API request and response, a rule matching algorithm, such as regular expression matching, is used to check whether there is a vulnerability pattern defined in the vulnerability rule set. A statistical analysis method, such as the TF-IDF algorithm, is used to mine potential sensitive keywords and expand them to the rule base to make up for the omissions caused by incomplete keywords. A clustering algorithm, such as k-means, is used to classify sensitive data, screen out suspected risky parts, input threat classification models, and perform operations according to different levels.

[0050] In the vulnerability feature analysis, word vectors are trained through the word2vec model and used as features to input into the k-means clustering algorithm for filtering, and the suspected risky parts are screened out and input into the threat classification model. According to different levels of graded operations, API activities are monitored and analyzed in real time to identify abnormal and malicious behaviors.

[0051] Through the embodiments provided by the present invention, vulnerability loopholes on the API are discovered, and the characteristics of these loopholes are verified and analyzed, ultimately achieving continuous improvement of API information security and vulnerability repair.

[0052] Further, the process proceeds to step 104: setting up an automatic behavior risk monitoring engine to conduct real-time monitoring and early warning of abnormal API calls to obtain data to obtain behavior risks.

[0053] Through the built-in behavior risk automatic monitoring engine, real-time monitoring and early warning of abnormal user calls to APIs to obtain data can be carried out to detect behavioral risks such as over-demand pulling and data crawling. Rate limiting measures are implemented to help prevent API abuse or crashes. By continuously detecting various security risks in APIs, covering risk events such as abnormal permissions, abnormal accounts, abuse of resources, abnormal business, sensitive abnormalities, and Web attacks, it helps enterprises to handle risks in a graded and classified manner and realize a closed loop of abnormal event management and control.

[0054] In one embodiment, a behavior risk automatic monitoring engine is set up to monitor and warn abnormal API calls to obtain data in real time to obtain behavior risks, including:

[0055] Monitor interface access behaviors based on application traffic analysis to monitor the risk of sensitive data flow in API interfaces. Based on historical and real-time data of user behaviors and contextual information of API calls, a behavioral baseline model based on user behavior analysis and machine learning can be established. The formula includes:

[0056] B(t)=α·H(t)+β·R(t)+γ·C(t),

[0057] Among them, B(t) represents the behavior baseline at time t, and H(t) represents the historical behavior pattern, which is established by analyzing the user's past behavior data, such as request frequency, request path, request time, etc. R(t) represents real-time behavior data, including real-time monitored request frequency and request type data. Through behavioral data, the latest changes in user behavior can be obtained and the behavior baseline can be adjusted in time. C(t) represents contextual information, including the business scenario of the API, data sensitivity, and risk level, which can accurately identify abnormal behavior. α, β, and γ are weight coefficients, indicating the degree of influence of different factors on the behavior baseline.

[0058] Furthermore, an unsupervised learning algorithm is used to conduct attack learning on the API interface to identify the attack risks of the API.

[0059] Then, based on application traffic analysis and graph model technology, the requests in the API traffic log are path-translated and classified to identify sensitive data in the API interface and to perform inventory and classification. In addition, the constructed behavior analysis model is combined with the actual interface traffic to adjust the model baseline to provide early warnings for risky behaviors. For different risky behavior scenarios such as unauthorized access, illegal crawling, data exposure, and interface exposure, the behavior analysis model is constructed and the model baseline is flexibly adjusted in combination with the actual interface traffic situation. The formula includes:

[0060] R=h(A,L,H), where R represents the behavioral risk score, A represents account behavior, such as the account's API call behavior, L represents abnormal login behavior, such as frequent failed login attempts; H represents the historical behavior pattern, which is used to compare with the current behavior and identify anomalies.

[0061] In actual scenarios, the automatic risk monitoring engine can be deployed in the API gateway or WAF (Web Application Firewall) to monitor and analyze API calling behaviors in real time. Through machine learning algorithms, the weight coefficients α, β, and γ are automatically adjusted to adapt to the ever-changing business environment and user behavior. When the detected API calling behavior deviates significantly from the established behavioral baseline B(t), the system will trigger an early warning to indicate possible security risks. The method provided in this embodiment can promptly detect and respond to abnormal API calling behaviors and improve the security of the API.

[0062] By using the automatic behavior risk monitoring engine provided by the embodiment of the present invention, real-time monitoring and early warning are performed on abnormal API calls to obtain data behaviors to obtain behavior risks.

[0063] Furthermore, in step 105, a network attack monitoring model is constructed to monitor the network attack risks of all APIs, draw attack routes, and evaluate the impact of the incident.

[0064] In one embodiment, a network attack monitoring model is constructed to monitor the network attack risks of all APIs, draw attack routes, and evaluate the impact of events, including:

[0065] The monitoring formula of the network attack risk model is:

[0066]

[0067] Where R(t) represents the overall network attack risk score at time t, r t (t) represents the score of the i-th risk indicator at time t, which can be the abnormal access frequency of the API, data leakage risk, Web attack risk, etc. Each indicator is calculated by real-time monitoring of API activities. i is the weight of the ith risk indicator, indicating the degree of influence of the indicator on the overall risk score. It can be optimized based on historical data, reflecting the importance of different risk indicators.

[0068] In the process of drawing the attack route, an embodiment can use an attack graph-based method to describe the transitive relationship between nodes of the intrusion behavior and map out the maximum possibility of attacking from a certain host or vulnerability. This embodiment can represent the attack path in the network by constructing a directed graph, where nodes represent network assets and edges represent vulnerabilities or attack methods that attackers may exploit.

[0069] The formula for drawing the attack route is:

[0070] P = argmax p∈Π (∑ (i,j)∈p ω ij ),

[0071] Where P represents the predicted attack path, Π is the set of all possible paths, and ω ij is the weight of the edge from node i to node j, indicating the possibility of the path being exploited by an attacker; the weight can be determined comprehensively based on factors such as the severity of the vulnerability, the difficulty of exploitation, and historical attack data.

[0072] In the process of evaluating the impact of an event, an embodiment can combine a graph theory algorithm and a machine learning model to evaluate the impact of an event. First, a graph theory algorithm is used to determine the attack path, and then the impact of each affected node is evaluated through a machine learning model.

[0073] The specific event impact assessment formula includes:

[0074]

[0075] Among them, I represents the overall event impact area, K is the number of affected nodes, and α k is the influence weight of the kth node, which can be determined by factors such as the business importance of the node and the sensitivity of the data. k is the influence score of the kth node, which can be predicted by the machine learning model based on historical data.

[0076] A specific implementation scenario example is given below to help those skilled in the art better understand the solution of the present invention.

[0077] Assume that there is an enterprise network environment that contains multiple API services and network assets. We need to monitor the network attack risks of these APIs and assess the impact of attack incidents. Specifically, we can take the following steps:

[0078] 1. Data collection: Deploy a network monitoring system to collect network traffic and log data.

[0079] 2. Attack graph construction: Based on the collected data, an attack graph is constructed, which contains network assets and possible attack paths.

[0080] 3. Attack path prediction: Use an improved attack route drawing algorithm to predict possible attack paths and calculate the weight of each path.

[0081] 4. Impact assessment: For each affected node, use a machine learning model to evaluate its impact score and calculate the overall event impact.

[0082] Through the above method, the network attack risks of all APIs can be automatically monitored, the attack routes can be mapped, and the impact of the incident can be quickly assessed, thereby improving the efficiency and response speed of API security management.

[0083] Further, the process proceeds to step 106: based on the risk monitoring model trained with historical monitoring data, the API risk link relationship is drawn, and combined with the clue association ranking analysis, the suspicious data leakage path is inferred.

[0084] For abnormal risk events of API, we extract and record sensitive data, record data access behavior, and actively conduct correlation retrieval and analysis of related events to conduct accurate audit and backtracking of data behavior.

[0085] In one embodiment, based on the risk monitoring model trained with historical monitoring data, the API risk link relationship is drawn, and combined with the clue association ranking analysis, the suspicious data leakage path is inferred, including:

[0086] The risk monitoring model draws the risk link relationship formula as follows:

[0087]

[0088] Among them, R represents the strength of the risk link relationship, W is a weight vector, which can be obtained through machine learning algorithms (such as random forests or neural networks) training, reflecting the influence of different features on the strength of the risk link relationship. F is a feature vector, including API call frequency, data sensitivity, user authority level, abnormal behavior pattern, and b is a bias term used to adjust the risk baseline.

[0089] Clue association ranking analysis, this algorithm can evaluate the importance of nodes (APIs or data flows). The formula is:

[0090]

[0091] Among them, PR(v) is the PageRank value of node v, which indicates the importance of the node in the risk link, d is the damping coefficient, which is used to simulate the user's random jump behavior. N is the total number of nodes in the graph, reflecting the scale of the system. v It is the set of nodes pointing to node v, indicating the direction of data flow. L(u) is the number of outgoing edges of node u, indicating the number of outgoing data flows from node u.

[0092] Based on the risk link relationship model and clue association ranking analysis, the suspicious data leakage path is inferred.

[0093] In actual applications, I can deploy these models in the API gateway or data security platform to monitor API call behavior and data flow in real time. Through the above model, the API risk link relationship diagram can be automatically drawn to evaluate the risk intensity of each node, and combined with the clue association ranking analysis, the most likely data leakage path can be inferred. When a high-risk leakage path is detected, the system can automatically trigger an early warning mechanism to notify the security team for further investigation and response. This approach can help enterprises discover and respond to potential data leakage risks in a timely manner and protect the company's data assets.

[0094] Furthermore, the process proceeds to step 107: comprehensively record the API data usage behavior to quickly locate the leakage source after a leakage event occurs.

[0095] In one embodiment, comprehensive traces of API data usage are kept to quickly locate the source of a leak after it occurs, including:

[0096] By extracting traces of sensitive data and recording data access behavior, we can proactively perform correlation retrieval and analysis of related events after a leakage incident occurs, so as to conduct accurate audit backtracking of data behavior.

[0097] By setting up audit tables and event logs, detailed information about each data operation is recorded, including the operator, operation time, and data status before and after the modification. This method provides a detailed record of data behavior and is the basis for audit backtracking.

[0098] In one embodiment, using an optimized local outlier factor (LOF) algorithm and machine learning techniques such as random forests to analyze user behavior and identify abnormal patterns that may indicate an attack, the accuracy of alarms can be improved and illegal operations can be detected in real time.

[0099] The above-mentioned sensitive data identification and automatic traceability record data access behavior in detail, and the use of machine learning algorithms to perform correlation retrieval and analysis of related events to achieve accurate audit backtracking of data behavior. This solution can quickly locate the source of the leak after a data leak occurs, and accurately restore the historical state of data changes through technical means such as timestamps, audit tables, and event logs, providing strong technical support for the investigation and response of data security incidents. This method not only improves the protection capabilities of data security, but also enhances the company's ability to respond to and trace data leakage risks.

[0100] Step 108: Use the matrix method to calculate risks, combine likelihood and impact to assess the severity of risks, and generate an API information security risk assessment report.

[0101] Construct a two-dimensional matrix, taking the frequency of threat occurrence and the severity of vulnerability as two dimensions, and determine the possibility of security incidents through the principle of matrix method.

[0102] In one embodiment, the formula may be used:

[0103] Z(ij)=a·X(i)+b·Y(j), where X(i) represents the frequency of threat occurrence, Y(j) represents the severity of vulnerability, and a and b are coefficients determined according to the specific situation and the function increment.

[0104] The matrix method is used to calculate the risk value by combining the levels of possibility and impact. For example, if the possibility of a security incident is level 1 and the impact is level 2, the risk value is determined to be level 3 according to the risk matrix.

[0105] The risk assessment report should include risk analysis models, risk calculation methods, risk analysis and evaluation, etc. The report should describe in detail the current risk status, safety hazards and areas that need to be rectified.

[0106] By combining the two key factors of possibility and impact through the matrix method, a structured risk assessment framework is provided. The solution provided by the present invention can not only assess the risk of a single API, but also identify and compare the risk levels of different APIs in the entire information system, generate a detailed risk assessment report, and provide decision makers with a basis for risk management and mitigation measures. This method improves the accuracy and efficiency of risk assessment and helps enterprises better understand and manage the security of their API assets.

[0107] In summary, the technical solution of the API-based information security risk assessment method provided by some embodiments of the present invention provides a comprehensive API security protection system by automatically combing API assets, real-time monitoring of API vulnerabilities, behavioral risks and network attack risks, combined with risk link characterization and data leakage path speculation. This solution can effectively reduce the risk of data leakage, improve the response speed to API attacks, and quickly locate the source of leakage when a data leakage incident occurs. Through this comprehensive technical means, enterprises can promptly discover and respond to potential data leakage risks, and assess information security risks, thereby protecting the company's data assets and ensuring business continuity and security.

[0108] Figure 2 FIG. 2 shows an exemplary structural block diagram of an API-based information security risk assessment system 200 according to an embodiment of the present invention.

[0109] like Figure 2 As shown, in the system 200, it includes:

[0110] API asset acquisition and management module 201: used to acquire API assets within the enterprise using traffic analysis, and to classify and mark API assets.

[0111] Sensitive data identification and protection module 202: used to identify and locate sensitive data in log files or files using sensitive data identification technology, and encrypt the sensitive data.

[0112] API vulnerability assessment module 203: used to integrate the vulnerability rule set, detect the vulnerability loopholes existing on the API through the API vulnerability detection model, and verify and analyze the vulnerability loophole characteristics; wherein the rule dimensions of the vulnerability rule set include covering data exposure, data permissions, security specifications, high-risk interfaces, and password authentication.

[0113] The behavior risk monitoring and abnormal event control module 204 is used to set up an automatic behavior risk monitoring engine to monitor and warn abnormal calls to APIs to obtain data in real time to obtain behavior risks.

[0114] API attack monitoring module 205: used to build a network attack monitoring model to monitor the network attack risks of all APIs, draw attack routes and evaluate the impact of events.

[0115] Risk monitoring model building module 206: used to build a risk monitoring model based on historical monitoring data training, draw API risk link relationships, and combine clue association ranking analysis to infer suspicious data leakage paths.

[0116] Risk event tracing analysis module 207: used to record comprehensive traces of API data usage behavior to quickly locate the source of leakage after a leakage event occurs.

[0117] Risk assessment report module 208: used to calculate risks using a matrix method, combining likelihood and impact to assess the severity of risks, so as to generate an API information security risk assessment report.

[0118] It can be understood that the information security risk assessment system based on API is the aforementioned Figure 1 A specific implementation of the method, therefore the above combined Figure 1 The features described above can be similarly applied here. No further elaboration is given here.

[0119] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. An information security risk assessment method based on API, characterized in that: include: Using traffic analysis to obtain API assets within the enterprise, and classifying and tagging the API assets; Using a sensitive data identification model, identifying and locating sensitive data in a log file or file, and encrypting the sensitive data; Integrate the vulnerability rule set, detect the vulnerability vulnerabilities existing on the API through the API vulnerability detection model, and verify and analyze the vulnerability characteristics; wherein the rule dimensions of the vulnerability rule set include covering data exposure, data permissions, security specifications, high-risk interfaces, and password authentication; Set up an automatic behavior risk monitoring engine to monitor and warn of abnormal calls to APIs to obtain data in real time to obtain behavior risks; Build a network attack monitoring model to monitor the network attack risks of all APIs, draw attack routes and assess the impact of incidents; Based on the risk monitoring model trained with historical monitoring data, the API risk link relationship is drawn, and the suspicious data leakage path is inferred by combining the clue association ranking analysis; Comprehensively record API data usage to quickly locate the source of a leak after it occurs; and Use the matrix method to calculate risks, combine likelihood and impact to assess the severity of risks, and generate an API information security risk assessment report.

2. The method according to claim 1, characterized in that The steps of using traffic analysis to obtain API assets within the enterprise include: Collecting API traffic data, including HTTP request and response headers, request methods, URL paths, and request bodies; Clean the collected data, remove invalid or redundant information, and extract key features, including API endpoints, request parameters, and response status codes; The improved dictionary tree structure algorithm is used to aggregate and classify the URL paths of APIs; Train the machine learning model based on the preprocessed feature data to build an asset recognition model.

3. The method according to claim 2, characterized in that The method of aggregating and classifying URL paths of APIs using an improved dictionary tree structure algorithm includes: An improved dictionary tree node structure is defined, wherein the dictionary tree node structure includes node depth and path frequency; The URL paths of the API are aggregated to classify URL paths with the same prefix into one category; the aggregation degree DP formula includes: Where n is the number of URL paths with the same prefix, and f i is the frequency of the ith path; The similarity between paths is calculated using the edit distance, and aggregation is performed based on the similarity. The similarity SM formula includes: Where p1 and p2 are two API paths, Levenshtein(p1, p2) is the edit distance, which represents the minimum number of operations required to transform path p1 into path p2; Extract features from the aggregation results and then use classification algorithms to classify the APIs; Use the extracted features to train a random forest model; For each API path, extract features and input them into the model; The model outputs classification results and assigns API paths to corresponding categories.

4. The method according to claim 1, characterized in that: The API assets are classified and labeled, including: Using machine learning models, the identified APIs are classified and labeled according to the multi-dimensional factor characteristics of API assets, including functions, usage scenarios, and sensitivity factors; API asset labels include the system to which the API belongs, the environment type, the business type, and whether it is an internal or external API.

5. The method according to claim 1, characterized in that The API vulnerability detection model includes: Use historical data to train machine learning models to identify anomalous patterns and potential vulnerabilities in API traffic; Scan API traffic to match vulnerability patterns defined in the vulnerability rule set using rule matching algorithms and machine learning models; Conduct in-depth analysis of detected potential vulnerabilities and classify sensitive data using clustering algorithms and word embedding techniques to identify high-risk inputs; Rank threats based on the severity and potential impact of a vulnerability and automatically trigger appropriate responses; and After the API vulnerability is fixed, the model verifies the repair effect through continuous traffic monitoring to ensure that the vulnerability is effectively addressed and provides feedback to optimize the detection algorithm.

6. The method according to claim 1, characterized in that The automatic behavior risk monitoring engine is set up to monitor and warn abnormal API calls to obtain data in real time to obtain behavior risks, including: Monitor interface access behaviors based on application traffic analysis to monitor the risk of sensitive data flow in the API interface. The formula includes: B(t)=α·H(t)+β·R(t)+γ·C(t), Among them, B(t) represents the behavior baseline at time t, H(t) represents the historical behavior pattern, which is established by analyzing the user's past behavior data, R(t) represents real-time behavior data, including the request frequency and request type data monitored in real time, C(t) represents context information, including the business scenario, data sensitivity, and risk level of the API, and α, β, and γ are weight coefficients, indicating the degree of influence of different factors on the behavior baseline; Through unsupervised learning algorithms, attack learning is performed on API interfaces to identify API attack risks; Based on application traffic analysis and graph model technology, the requests in the API traffic log are path-escaped and classified to identify sensitive data in the API interface and perform inventory and classification; and Through the constructed behavior analysis model, combined with the actual interface traffic, the model baseline is adjusted to warn of risky behaviors. The formula includes: R=h(A,L,H), where R represents the behavioral risk score, A represents the account behavior, L represents the login anomaly, and H represents the historical behavior pattern.

7. The method according to claim 1, characterized in that The network attack monitoring model is constructed to monitor the network attack risks of all APIs, draw attack routes and evaluate the impact of events, including: The monitoring formula of the network attack risk model is: Where R(t) represents the overall network attack risk score at time t, r t (t) represents the score of the i-th risk indicator at time t, ω i is the weight of the ith risk indicator, indicating the degree of influence of this indicator on the overall risk score; The formula for drawing the attack route is: P=argmax p∈Π (S (i,j)∈p oh ij ), Where P represents the predicted attack path, Π is the set of all possible paths, and ω ij is the weight of the edge from node i to node j, indicating the possibility that the path can be exploited by an attacker; The event impact assessment formula is: Among them, I represents the overall event impact area, K is the number of affected nodes, and α k is the influence weight of the kth node, I k is the influence score of the kth node.

8. The method according to claim 1, characterized in that The risk monitoring model trained based on historical monitoring data draws the API risk link relationship, combines clue association ranking analysis, and infers suspicious data leakage paths, including: The risk monitoring model draws the risk link relationship formula as follows: Among them, R represents the strength of the risk link relationship, W is the weight vector, F is the feature vector, including API call frequency, data sensitivity, user authority level, abnormal behavior pattern, and b is the bias term used to adjust the risk baseline; The clue correlation ranking analysis formula is: Where PR(v) is the PageRank value of node v, indicating the importance of the node in the risk link, d is the damping coefficient, N is the total number of nodes in the graph, and B v is the set of nodes pointing to node v, indicating the direction of data flow, L(u) is the number of outgoing edges of node u, indicating the number of outgoing data flows from node u; Based on the risk link relationship model and clue association ranking analysis, the suspicious data leakage path is inferred.

9. The method according to claim 1, characterized in that: The API data usage behavior is fully recorded to quickly locate the source of the leak after a leak occurs, including: By extracting traces of sensitive data and recording data access behavior, we can proactively perform correlation retrieval and analysis of related events after a leakage incident occurs, so as to conduct accurate audit backtracking of data behavior.

10. An information security risk assessment system based on API, characterized in that: include: API asset acquisition and management module: used to use traffic analysis to acquire API assets within the enterprise, and to classify and label API assets; Sensitive data identification and protection module: used to identify and locate sensitive data in log files or files using sensitive data identification technology, and encrypt sensitive data; API vulnerability assessment module: used to integrate the vulnerability rule set, detect the vulnerability vulnerabilities existing on the API through the API vulnerability detection model, and verify and analyze the vulnerability characteristics; wherein the rule dimensions of the vulnerability rule set include covering data exposure, data permissions, security specifications, high-risk interfaces, and password authentication; Behavior risk monitoring and abnormal event control module: used to set up an automatic behavior risk monitoring engine, conduct real-time monitoring and early warning of abnormal API calls to obtain data, and obtain behavior risks; API attack monitoring module: used to build a network attack monitoring model to monitor the network attack risks of all APIs, draw attack routes and evaluate the impact of events; Risk monitoring model building module: used to train risk monitoring models based on historical monitoring data, draw API risk link relationships, and combine clue association ranking analysis to infer suspicious data leakage paths; Risk event tracing analysis module: used to comprehensively record API data usage behavior, so as to quickly locate the source of leakage after a leakage incident occurs; Risk Assessment Report Module: Used to calculate risks using the matrix method, combining likelihood and impact to assess the severity of risks, and to generate an API information security risk assessment report.

Images