Client back-end interface calling security judgment method based on intellectualization

Abstract

The invention relates to the technical field of interface security verification, and discloses an intelligentization-based client back-end interface calling security judgment method, which comprises the following steps of: S101, acquiring an operation log of a user according to a preset time interval t in a preset time period T; s102, performing data cleaning on the operation log of the user to generate a feature sequence; s103, inputting the feature sequence into an expiration time evaluation model, wherein an output value represents the token expiration time; step S104, refreshing the expiration time of the token in the cache according to the token expiration time output by the expiration time evaluation model; according to the method, the nonlinear mapping relation between the operation log and the token expiration time is established through the expiration time evaluation model, and pressure on the server is avoided while the security of the token is ensured through the combination of asymmetric encryption and the identifier, so that the user experience is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of interface security verification, and more specifically, to a method for determining security of calling a client-side back-end interface based on intelligence. Background Art

[0002] The existing security judgment method for calling the client-side backend interface is mainly that after the client user successfully logs in, the server will generate a token and store it in the server's cache, set a TTL (expiration time) for it, and return it to the client. After the client receives the token, it will store it locally on the client. When the client user sends a backend interface request again, the token will be attached to the Authorization header in the HTTP request. After the server receives the HTTP request, it will first parse the token through the interceptor and perform token verification, including: TTL verification, blacklist verification and permission verification. After the verification passes, the server responds to the client request and returns the data resource. When the TTL of the token is less than the preset time threshold, the TTL of the token is refreshed to ensure normal use by the user, otherwise the user is prompted to log in again.

[0003] However, the expiration time of the token in the above scheme is set to a fixed value, and does not take into account the impact of user behavior patterns on the security call of the back-end interface. For example, if the expiration time of the token is set too long, once the token is stolen by an attacker, there is a time window to use the token for unauthorized access. However, if the expiration time of the token is set too short, the user may need to re-login frequently, resulting in a decrease in user experience. Summary of the invention

[0004] The present invention provides an intelligent client-side back-end interface calling security judgment method to solve the technical problems in the above-mentioned background technology.

[0005] The present invention provides a method for determining security of client backend interface calls based on intelligence, comprising the following steps:

[0006] Step S101, collecting user operation logs at preset time intervals t within a preset time period T;

[0007] Step S102, performing data cleaning on the user's operation log to generate a feature sequence;

[0008] The feature sequence includes N sequence units, and the i-th sequence unit represents the operation data of the user in the i-th time period, where N = T / t, 1≤i≤N;

[0009] Operation data includes: number of logins, number of interface calls, number of IP address changes, and number of device changes;

[0010] Step S103, inputting the feature sequence into the expiration time evaluation model, and the output value represents the token expiration time;

[0011] Step S104: Refresh the expiration time of the token in the cache according to the token expiration time output by the expiration time evaluation model.

[0012] Furthermore, T and t are both custom parameters.

[0013] Furthermore, the operation data also includes: the number of successful interface calls, the number of failed interface calls and the number of important interface calls, wherein the important interface is a custom parameter, and the name or unique code of the important interface is stored in the cache.

[0014] Furthermore, data cleaning is performed on the user's operation log to generate a feature sequence, including the following steps:

[0015] Step S201, determining the start time and end time of the time period corresponding to each sequence unit of the feature sequence;

[0016] Step S202, obtaining the number of logins, the number of interface calls, the number of successful interface calls, and the number of failed interface calls through a query tool provided by a database storing operation logs according to the start time and end time of each sequence unit;

[0017] Step S203, obtaining the number of important interface call times by traversing the names or unique codes of important interfaces in the cache;

[0018] Step S204, using the feature that the set does not allow duplicate elements, obtain the number of IP address changes and the number of device changes;

[0019] Step S205: when there are missing values ​​in the operation data of each sequence unit of the feature sequence, the operation data of the nearest sequence unit is directly taken for filling processing.

[0020] Furthermore, the expiration time evaluation model includes N hidden layers, the i-th hidden layer inputs the i-th sequence unit of the feature sequence and outputs the updated feature;

[0021] The updated features output by the Nth hidden layer are input into the classifier, and the classification space of the classifier represents the token expiration time.

[0022] Furthermore, the calculation formula of the i-th hidden layer includes:

[0023] F i =sigmoid(x i W f1 +h i-1 W f2 +b f);

[0024] I i =sigmoid(x i W I1 +h i-1 W I2 +b I );

[0025]

[0026] O i =sigmoid(x i W O1 +h i-1 W O2 +b O );

[0027] h i =O i ⊙tanh(C i );

[0028] where x i represents the i-th sequence unit of the feature sequence input to the i-th hidden layer, h i and h i-1 Represent the updated features of the output of the i-th and i-1-th hidden layers, respectively, and F i , W f1 , W f2 and b f Respectively represent the forget gate of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the forget gate, I i , W I1 , W I2 and b I Respectively represent the input gate of the i-th and hidden layers, the first weight parameter, the second weight parameter and the bias parameter corresponding to the input gate, W C1 , W C2 and b C They represent the first intermediate state of the i-th hidden layer, the first weight parameter corresponding to the first intermediate state, the second weight parameter and the bias parameter, respectively. i , W C1 , W C2 and b C denote the second intermediate state of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the second intermediate state, respectively. i , W O1 , W O2 and b OThey respectively represent the output gate of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the output gate, ⊙ represents the Hadamard product, sigmoid represents the sigmoid activation function, tanh represents the tanh activation function, h0 is assigned to 0, and C0 is assigned to 0.

[0029] Furthermore, each hidden layer of the expiration time evaluation model is connected through a residual connection, and the calculation formula of the residual connection between the i-1th hidden layer and the i-th hidden layer is as follows:

[0030] h i =ReLU(O i *W i +b i )+O i-1 ;

[0031] where h i represents the updated features of the output of the i-th hidden layer, O i and O i-1 denote the output gates of the i-th and i-1-th hidden layers, respectively, and W i and b i They represent the weight parameter and bias parameter of the i-th hidden layer respectively, O0 is assigned 0, and tanh represents the tanh activation function.

[0032] Furthermore, sample labels of training samples used to train the expiration time evaluation model are set by investigating user satisfaction.

[0033] Furthermore, during the training process of the expiration time evaluation model, the difference between the value output by the expiration time evaluation model in each iteration and the value of the sample label of the training sample is specified as the loss function, and the weight parameters and bias parameters of the expiration time evaluation model are updated by the gradient descent algorithm.

[0034] Furthermore, after the client user successfully logs in, the token is encrypted using an asymmetric encryption algorithm, and an identifier for the token is set to 0. The backend interface is called for the first time within the token expiration time to decrypt the token, and the identifier of the token is assigned to 1.

[0035] The beneficial effects of the present invention are as follows: the present invention establishes a nonlinear mapping relationship between the operation log and the token expiration time through an expiration time evaluation model, and ensures the security of the token through asymmetric encryption combined with an identifier while avoiding pressure on the server, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a flow chart of the intelligent client backend interface calling security judgment method of the present invention;

[0037] Figure 2 It is a flow chart of the present invention for performing data cleaning on the user's operation log to generate a feature sequence. DETAILED DESCRIPTION

[0038] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that the discussion of these embodiments is only to enable those skilled in the art to better understand and implement the subject matter described herein, and the functions and arrangements of the elements discussed may be changed without departing from the scope of protection of the contents of this specification. Each example may omit, replace or add various processes or components as needed. In addition, the features described relative to some examples may also be combined in other examples.

[0039] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in one or more embodiments of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0040] like Figure 1-Figure 2 As shown, the security judgment method based on the intelligent client backend interface call includes the following steps:

[0041] Step S101, collecting user operation logs at preset time intervals t within a preset time period T;

[0042] Step S102, performing data cleaning on the user's operation log to generate a feature sequence;

[0043] The feature sequence includes N sequence units, and the i-th sequence unit represents the operation data of the user in the i-th time period, where N = T / t, 1≤i≤N;

[0044] Operation data includes: number of logins, number of interface calls, number of IP address changes, and number of device changes;

[0045] Step S103, inputting the feature sequence into the expiration time evaluation model, and the output value represents the token expiration time;

[0046] Step S104: Refresh the expiration time of the token in the cache according to the token expiration time output by the expiration time evaluation model.

[0047] In one embodiment of the present invention, T and t are both custom parameters. Preferably, T is set to 10 minutes and t is set to 1 minute, then N is equal to 10, and the first sequence unit of the feature sequence represents the user's operation data within the first minute, the second sequence unit represents the user's operation data from the first minute to the second minute, and so on.

[0048] In one embodiment of the present invention, the operation data also includes: the number of successful interface calls, the number of failed interface calls and the number of important interface calls, where the important interface is a custom parameter, and the name or unique code of the important interface is stored in the cache, and the unique code can be a UUID or a snowflake algorithm ID.

[0049] In one embodiment of the present invention, Figure 2 As shown, data cleaning of the user's operation log is performed to generate a feature sequence, including the following steps:

[0050] Step S201, determining the start time and end time of the time period corresponding to each sequence unit of the feature sequence;

[0051] Step S202, obtaining the number of logins, the number of interface calls, the number of successful interface calls, and the number of failed interface calls through a query tool provided by a database storing operation logs according to the start time and end time of each sequence unit;

[0052] Step S203, obtaining the number of important interface call times by traversing the names or unique codes of important interfaces in the cache;

[0053] Step S204, using the feature that the set does not allow duplicate elements, obtain the number of IP address changes and the number of device changes;

[0054] For example, before data cleaning, a set of IP addresses and a set of devices are established. Finally, the number of IP address changes and the number of device changes can be obtained by counting the length of the set. After data cleaning, the two sets can be cleared.

[0055] Step S205: when there are missing values ​​in the operation data of each sequence unit of the feature sequence, the operation data of the nearest sequence unit is directly taken for filling processing.

[0056] It should be noted that the database storing the operation logs may be MySQL, Oracle, or Elasticsearch. For example, when the database storing the operation logs is MySQL, the corresponding query statement is: Select operation data from operation logs between start time and end time.

[0057] In one embodiment of the present invention, the expiration time assessment model includes N hidden layers, the i-th hidden layer inputs the i-th sequence unit of the feature sequence and outputs the updated feature;

[0058] The updated features output by the Nth hidden layer are input into the classifier, and the classification space of the classifier represents the token expiration time.

[0059] In one embodiment of the present invention, the calculation formula of the i-th hidden layer includes:

[0060] F i =sigmoid(x i W f1 +h i-1 W f2 +b f );

[0061] I i =sigmoid(x i W I1 +h i-1 W I2 +b I );

[0062]

[0063] O i =sigmoid(x i W O1 +h i-1 W O2 +b O );

[0064] h i =O i ⊙tanh(C i );

[0065] where x i represents the i-th sequence unit of the feature sequence input to the i-th hidden layer, h i and h i-1 Represent the updated features of the output of the i-th and i-1-th hidden layers, respectively, and F i , W f1 , W f2 and b fRespectively represent the forget gate of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the forget gate, I i , W I1 , W I2 and b I Respectively represent the input gate of the i-th and hidden layers, the first weight parameter, the second weight parameter and the bias parameter corresponding to the input gate, W C1 , W C2 and b C They represent the first intermediate state of the i-th hidden layer, the first weight parameter corresponding to the first intermediate state, the second weight parameter and the bias parameter, respectively. i , W C1 , W C2 and b C denote the second intermediate state of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the second intermediate state, respectively. i , W O1 , W O2 and b O They respectively represent the output gate of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the output gate, ⊙ represents the Hadamard product, sigmoid represents the sigmoid activation function, tanh represents the tanh activation function, h0 is assigned to 0, and C0 is assigned to 0.

[0066] In one embodiment of the present invention, each hidden layer of the expiration time evaluation model is connected by a residual connection, and the calculation formula of the residual connection between the i-1th hidden layer and the ith hidden layer is as follows:

[0067] h i =ReLU(O i *W i +b i )+O i-1 ;

[0068] where h i represents the updated features of the output of the i-th hidden layer, O i and O i-1 denote the output gates of the i-th and i-1-th hidden layers, respectively, and W i and b i They represent the weight parameter and bias parameter of the i-th hidden layer respectively, O0 is assigned 0, and tanh represents the tanh activation function.

[0069] It should be noted that after each hidden layer, the output information of the previous hidden layer is directly added to the output of the current hidden layer, which can help the gradient propagate better in the deep network and reduce the gradient disappearance problem.

[0070] In one embodiment of the present invention, sample labels of training samples used to train the expiration time assessment model are set through evaluation by relevant technical experts.

[0071] In one embodiment of the present invention, the sample labels of training samples used to train the expiration time evaluation model can also be set by investigating user satisfaction. For example, the user satisfaction value range is 0 to 10, different times are set for the tokens of 10 users, and the satisfaction of the 10 users within a preset time period T is investigated, and the time with the highest satisfaction is selected as the sample label of the training sample.

[0072] In one embodiment of the present invention, during the training process of the expiration time assessment model, the difference between the value output by the expiration time assessment model in each iteration and the value of the sample label of the training sample is specified as the loss function, and the weight parameters and bias parameters of the expiration time assessment model are updated by the gradient descent algorithm.

[0073] In one embodiment of the present invention, after the client user successfully logs in, the token is encrypted using an asymmetric encryption algorithm, and an identifier for the token is set to 0. The backend interface is called for the first time within the token expiration time to decrypt the token, and the identifier of the token is assigned to 1, indicating that the token has been verified. While ensuring the security of the token, frequent decryption is prevented from causing pressure on the server.

[0074] It should be noted that using an asymmetric encryption algorithm to encrypt a token can improve the security of the token, because an asymmetric encryption algorithm involves a public key and a private key, the public key is used for encryption, and the private key is used for decryption. Since the private key is generally stored on the server side, even if the token is intercepted, the attacker cannot easily decrypt the token, thereby enhancing the security of the system; and by setting an identifier to track whether the token has completed the first decryption and verification, it is possible to avoid repeated decryption operations within the validity period of the token. The benefit of this is that it reduces the computing burden on the server side, because decryption operations, especially decryption under asymmetric encryption algorithms, are usually more time-consuming and computationally intensive than symmetric encryption algorithms. By avoiding unnecessary decryption, the CPU usage of the server can be effectively reduced and system performance can be improved.

[0075] In one embodiment of the present invention, the expiration time evaluation model can be deployed as a separate service independently of other applications, and only involves log reading and cache reading and writing of other applications, thereby avoiding coupling with other applications.

[0076] The above describes an embodiment of the present embodiment, but the present embodiment is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present embodiment, ordinary technicians in this field can also make many forms, all of which are within the protection of the present embodiment.

Claims

1. Based on the intelligent client backend interface calling security judgment method, it is characterized by: The following steps are involved: Step S101, collecting user operation logs at preset time intervals t within a preset time period T; Step S102, performing data cleaning on the user's operation log to generate a feature sequence; The feature sequence includes N sequence units, and the i-th sequence unit represents the operation data of the user in the i-th time period, where N = T / t, 1≤i≤N; Operation data includes: number of logins, number of interface calls, number of IP address changes, and number of device changes; Step S103, inputting the feature sequence into the expiration time evaluation model, and the output value represents the token expiration time; Step S104: Refresh the expiration time of the token in the cache according to the token expiration time output by the expiration time evaluation model.

2. The intelligent client-side back-end interface calling security judgment method according to claim 1 is characterized in that: T and t are both custom parameters.

3. The intelligent client-side back-end interface calling security judgment method according to claim 1 is characterized in that: The operation data also includes: the number of successful interface calls, the number of failed interface calls and the number of important interface calls, where the important interface is a custom parameter, and the name or unique code of the important interface is stored in the cache.

4. The intelligent client-side back-end interface calling security judgment method according to claim 3 is characterized in that: Cleaning the user's operation log to generate a feature sequence includes the following steps: Step S201, determining the start time and end time of the time period corresponding to each sequence unit of the feature sequence; Step S202, obtaining the number of logins, the number of interface calls, the number of successful interface calls, and the number of failed interface calls through a query tool provided by a database storing operation logs according to the start time and end time of each sequence unit; Step S203, obtaining the number of important interface call times by traversing the names or unique codes of important interfaces in the cache; Step S204, using the feature that the set does not allow duplicate elements, obtain the number of IP address changes and the number of device changes; Step S205: when there are missing values ​​in the operation data of each sequence unit of the feature sequence, the operation data of the nearest sequence unit is directly taken for filling processing.

5. The intelligent client-side back-end interface calling security judgment method according to claim 1 is characterized in that: The expiration time evaluation model includes N hidden layers, the i-th hidden layer inputs the i-th sequence unit of the feature sequence and outputs the updated feature; The updated features output by the Nth hidden layer are input into the classifier, and the classification space of the classifier represents the token expiration time.

6. The intelligent client-side back-end interface calling security judgment method according to claim 5 is characterized in that: The calculation formula for the i-th hidden layer includes: F i =sigmoid ( x i W f1 +h i-1 W f2 +b f ); I i =sigmoid(x i W I1 +h i-1 W I2 +b I ); O i =sigmoid ( x i W O1 +h i-1 W O2 +b O ); h i =O i ⊙tanh(C i ); where x i represents the i-th sequence unit of the feature sequence input to the i-th hidden layer, h i and h i-1 Represent the updated features of the output of the i-th and i-1-th hidden layers, respectively, and F i , W f1 , W f2 and b f Respectively represent the forget gate of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the forget gate, I i , W I1 , W I2 and b I Respectively represent the input gate of the i-th and hidden layers, the first weight parameter, the second weight parameter and the bias parameter corresponding to the input gate, W C1 , W C2 and b C They represent the first intermediate state of the i-th hidden layer, the first weight parameter corresponding to the first intermediate state, the second weight parameter and the bias parameter, respectively. i , W C1 , W C2 and b C denote the second intermediate state of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the second intermediate state, respectively. i , W O1 , W O2 and b O They respectively represent the output gate of the i-th hidden layer, the first weight parameter, the second weight parameter and the bias parameter corresponding to the output gate, ⊙ represents the Hadamard product, sigmoid represents the sigmoid activation function, tanh represents the tanh activation function, h0 is assigned to 0, and C0 is assigned to 0.

7. The intelligent client-side back-end interface calling security judgment method according to claim 6 is characterized in that: Each hidden layer of the expiration time evaluation model is connected by a residual connection. The calculation formula of the residual connection between the i-1th hidden layer and the i-th hidden layer is as follows: h i =ReLU(O i *W i +b i )+O i-1 ; where h i represents the updated features of the output of the i-th hidden layer, O i and O i-1 denote the output gates of the i-th and i-1-th hidden layers, respectively, and W i and b i They represent the weight parameter and bias parameter of the i-th hidden layer respectively, O0 is assigned 0, and tanh represents the tanh activation function.

8. The intelligent client-side back-end interface calling security judgment method according to claim 1 is characterized in that: The sample labels of the training samples used to train the expiration time evaluation model are set by surveying user satisfaction.

9. The intelligent client-side back-end interface calling security judgment method according to claim 8 is characterized in that: During the training process of the expiration time evaluation model, the difference between the value output by the expiration time evaluation model in each iteration and the value of the sample label of the training sample is specified as the loss function, and the weight parameters and bias parameters of the expiration time evaluation model are updated by the gradient descent algorithm.

10. The intelligent client-side back-end interface calling security judgment method according to claim 1, characterized in that: After the client user successfully logs in, the token is encrypted using an asymmetric encryption algorithm, and the identifier of the token is set to 0. The backend interface is called for the first time within the token expiration time to decrypt the token, and the identifier of the token is assigned to 1.

Images