API access behavior intelligent identification method, system and device and medium
By building a dynamic update model and recurrent neural network based on business functions, the problems of lag and narrow recognition range of static rule bases are solved, and intelligent recognition of API access behaviors and efficient anomaly detection are achieved.
Patent Information
- Application Number
- CN202511053191.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-30
- Publication Date
- 2025-10-14
AI Technical Summary
In the existing technology, the static API access identification rule base relies on manual maintenance, lacks dynamic adaptability, cannot identify unknown and heterogeneous API access behaviors, has a high false alarm rate, and is difficult to deal with new attack patterns.
By building a dynamic update model based on business functions, combining recurrent neural networks to model API call data, and using similarity calculation and neural networks to identify abnormal patterns, the ability to recognize time series is enhanced.
It realizes intelligent recognition of API access behavior, improves the dynamic adaptability of the recognition system, reduces the false positive and false negative rates, and improves the accuracy and credibility of complex behavior detection.
Smart Images
Figure CN120781096A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of grid-connected monitoring data accurate checking, and particularly relates to an API access behavior intelligent identification method, system, device and medium. BACKGROUND
[0002] The static API access identification rule library has limitations and hysteresis, relies on manual experience to maintain and update, and greatly reduces the timeliness of the identification system. The prior art relies on a pre-set API access identification rule library, can only identify limited normal API access modes, lacks deep modeling of the time sequence characteristics, context association and other business dimensions of API access behavior, lacks dynamic adaptation to specific business scenarios, cannot be familiar with the business access trends and access characteristics of each system, cannot effectively distinguish abnormal risk access behaviors that deviate from the access rules, cannot adapt to new API attack modes, and greatly improves the false positive rate of the identification system.
[0003] Heterogeneous behavior processing is inefficient, and unknown behavior identification is blind. Conventional rule-based access learning behavior algorithms are difficult to learn comprehensively for unknown and heterogeneous access behaviors, are difficult to process multi-source heterogeneous API access behaviors, cannot effectively learn unknown service modes, have low classification precision, weak generalization ability, lack intelligent learning ability, and cannot efficiently and accurately identify abnormal API calling behaviors. SUMMARY
[0004] In view of the above existing problems, the present application is proposed.
[0005] To solve the above technical problems, the present application provides the following technical solutions.
[0006] In a first aspect, the present application provides an API access behavior intelligent identification method, comprising:
[0007] According to the business function and use purpose of the API, the API historical behavior data after cleaning is statistically learned and patterned to construct a normal behavior model with dynamic updating capability;
[0008] The real-time API calling data is similarity calculated with the normal behavior model to evaluate whether the real-time API calling data deviates from the expected behavior mode;
[0009] Based on the similarity calculation of the statistical rule, a recurrent neural network is introduced to model the sequence behavior, which is used to enhance the identification ability of the time sequence abnormal mode.
[0010] As a preferred scheme of the API access behavior intelligent identification method, wherein: the API historical behavior data after cleaning is statistically learned and patterned according to the business function and use purpose of the API, a business-oriented normal behavior model is constructed, including,
[0011] Input the collected historical API call log;
[0012] According to the data information of the interface, the call log is divided into different business scenario sets;
[0013] Statistical modeling is performed on each business scenario structured field;
[0014] After completing the statistical modeling, based on the distribution of each feature, the typical call behavior mode under the business scenario is obtained;
[0015] The statistical value is adjusted by using an updating strategy, and the behavior mode is dynamically updated;
[0016] Each business scenario outputs a normal behavior model.
[0017] The beneficial effects of the preferred technical scheme in the embodiment of the present application are that the scheme can combine static rules and business scenario model for collaborative verification, effectively reduce the false positive and false negative rates, and improve the credibility of complex behavior detection.
[0018] As a preferred scheme of the API access behavior intelligent identification method, wherein: the real-time API call data and the normal behavior model are similarity calculated to evaluate whether it deviates from the expected behavior mode, including,
[0019] Input the API call log to be tested and the normal behavior model under the business scenario;
[0020] The similarity of the structured field and the unstructured field is calculated;
[0021] The structured field similarity and the unstructured field similarity are weighted and combined to obtain the final behavior similarity score.
[0022] The beneficial effects of the preferred technical scheme in the embodiment of the present application are that the scheme can automatically learn the implicit pattern in the API call sequence, and improve the nonlinear recognition ability of complex behavior sequence.
[0023] As a preferred scheme of the API access behavior intelligent identification method, wherein: based on the similarity calculation of the statistical rule, a sequence behavior modeling module based on a recurrent neural network is introduced to enhance the recognition ability of the time sequence abnormal mode, including,
[0024] Input the API call sequence arranged in time sequence;
[0025] Design a recurrent neural network structure;
[0026] Train and optimize the normal behavior model to improve the model performance;
[0027] Cooperate the prediction result of the recurrent neural network with the static rule base and the business scenario model to improve the detection reliability.
[0028] The preferred technical solutions in the embodiments of the present application have the beneficial effects that the scheme can automatically learn the implicit patterns in the API calling sequence, and improve the nonlinear recognition ability for complex behavior sequences.
[0029] As a preferred scheme of the API access behavior intelligent identification method, the statistical modeling of each business scenario structured field is represented as,
[0030]
[0031]
[0032] Wherein, p i represents the number of parameters of the i-th calling record, N is the total number of samples, μ p represents the average value of the number of parameters of the calling record, σ p represents the standard deviation of the number of parameters of the calling record.
[0033]
[0034] Wherein, N c represents the number of occurrences of the state code c, N is the total number of calls, f(c) represents the frequency of the state code c;
[0035] Divide the response time into multiple time interval [T1, T2, …, T m ], and generate a histogram H t by counting the frequency of each interval.
[0036] As a preferred scheme of the API access behavior intelligent identification method, the structured field similarity and the unstructured field similarity are weighted and combined to obtain the final behavior similarity score, which is represented as,
[0037] S total = β·S struct + (1-β)·S text
[0038] Wherein, β is the fusion coefficient of structure and text, S total is the comprehensive evaluation result, and S structStructured field similarity, S text Unstructured field similarity.
[0039] As a preferred scheme of the API access behavior intelligent identification method, the design of the recurrent neural network structure comprises,
[0040] Input layer: receiving the normalized call sequence;
[0041] Hidden layer: using multiple recurrent neural network units to learn the historical dependence and potential patterns of the call behavior step by step;
[0042] Output layer: outputting the abnormal behavior probability
[0043] The training target is to minimize the prediction error, and the classification scenario uses a cross-entropy loss function, which is represented as,
[0044]
[0045] Wherein, y is the actual label, is the model prediction result.
[0046] In a second aspect, the application provides an API access behavior intelligent identification system, comprising:
[0047] The first module statistically learns and inductively summarizes the cleaned API historical behavior data according to the business functions and use purposes of the API, and constructs a normal behavior model with dynamic updating capability;
[0048] The calculation module calculates the similarity between the real-time API call data and the normal behavior model, and evaluates whether the real-time API call data deviates from the expected behavior pattern;
[0049] The modeling module introduces recurrent neural network-based sequence behavior modeling based on the similarity calculation of the statistical rules, and is used to enhance the identification ability of the time sequence abnormal pattern.
[0050] In a third aspect, the application provides an electronic device, comprising:
[0051] A memory and a processor;
[0052] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions, which realize the steps of the API access behavior intelligent identification method when executed by the processor.
[0053] In a fourth aspect, the present application provides a computer readable storage medium storing computer executable instructions, which, when executed by a processor, implement the steps of the API access behavior intelligent identification method.
[0054] Compared with the prior art, the present application has the following beneficial effects:
[0055] Firstly, the present application is based on the special API access identification rule library in the digital power grid scenario, and learns and deeply models the targeted access behavior of multiple business scenarios, deeply familiarizes with the business access trend and access characteristics of each system, provides a solution basis for abnormal risk access deviating from the access rule, realizes the automatic and intelligent API access behavior identification, improves the dynamic adaptability of the identification system, can quickly respond to business changes and newly emerging access modes, while greatly improving the accuracy of identifying abnormal access behavior, effectively reducing the false positive and false negative rates.
[0056] Secondly, based on the API access rule library in the digital power grid scenario, the combination of behavior similarity calculation and neural network technology is used. For the real-time acquired API access behavior data, firstly, the similarity algorithm selected with care is used, such as the Euclidean distance algorithm for structured data and the natural language processing similarity algorithm for unstructured log text, to calculate the similarity with the pre-defined normal behavior model. At the same time, with the help of recurrent neural network (RNN) and its variants, such as long short-term memory network (LSTM) and gated recurrent unit (GRU), the API call sequence is deeply modeled, and the time series characteristics and complex patterns therein are fully learned. Through the synergistic effect of the two, the classification accuracy is greatly improved, and the normal and abnormal API access behaviors can be accurately distinguished. In addition, the powerful generalization ability of the neural network enables the model to intelligently learn the newly emerging access behavior patterns, and efficiently and accurately identify the abnormal API access behavior. BRIEF DESCRIPTION OF DRAWINGS
[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.
[0058] Figure 1 The overall flowchart of the API access behavior intelligent identification method of an embodiment of the present application. DETAILED DESCRIPTION
[0059] In order to make the above objectives, characteristics and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present application.
[0060] Embodiment 1, as an embodiment of the present application, provides an API access behavior intelligent identification method, comprising:
[0061] S1: According to the business function and use purpose of the API, the statistical learning and pattern induction of the cleaned API historical behavior data are performed, and a normal behavior model with dynamic updating capability is constructed;
[0062] S2: Similarity calculation is performed between real-time API calling data and the normal behavior model, and whether the real-time API calling data deviates from the expected behavior mode is evaluated;
[0063] S3: Based on the similarity calculation of the statistical rule, a recurrent neural network is introduced to model the sequence behavior, which is used to enhance the identification ability of the time sequence abnormal mode.
[0064] It should be noted that the present application provides an API access behavior intelligent identification method, which performs statistical learning on API behavior data through S1 and constructs a dynamically updated normal behavior model, replacing the static rule library relying on manual maintenance, greatly improving the timeliness of the identification system. Secondly, S2 performs similarity calculation between real-time calling and dynamic model, which not only breaks through the limitations of the static rule identification mode, but also preliminarily evaluates the behavior deviation and reduces false positives. More importantly, S3 introduces an RNN module to model the sequence behavior, which makes up for the lack of deep modeling of time sequence features and context association in the prior art, significantly enhances the adaptability and identification ability of the identification system to complex, time sequence anomalies and new attack modes, and thus overcomes the problems of static rules such as lag, narrow recognition range and low efficiency in processing unknown heterogeneous behaviors.
[0065] Embodiment 2, referring to Figure 1 , as an embodiment of the present application, based on the above embodiment, an API access behavior intelligent identification method is provided.
[0066] It should be noted that, as Figure 1 is the overall flowchart of the technical solution.
[0067] It should be noted that the data processing is performed on the API historical behavior data, and the specific embodiments are as follows:
[0068] According to the API security policy, business compliance requirements and past security event experience, a series of special API access identification rules based on digital power grid scenarios are formulated, such as limiting the maximum number of calls of a specific API within a unit time (to prevent malicious brushing, etc.), stipulating the access rights of a specific caller to sensitive APIs (only authorized internal systems can call core business APIs), and defining the legal range of API request parameters (such as the age parameter must be a positive integer and comply with business logic). Efficient database storage rules such as redis are used to take advantage of their high-speed read-write characteristics to achieve fast query and matching of rules, ensuring real-time API access verification efficiency.
[0069] Log collection tools and traffic monitoring equipment are deployed in various business systems of the power grid system to capture network data, extract traffic data related to business access, and record API call information, including call time, caller identity, called API name, request parameters, response status code, response time, request frequency, etc.
[0070] Clean up data, remove duplicate call records, correct errors or abnormal data (such as excessively long response time, illegal request parameter values), fill in or discard incomplete data, and ensure data quality. Unified data format, convert response time, data transmission volume and other indicators of different APIs into a unified dimension, facilitating subsequent analysis and model training. Extract API features, extract key features such as API call frequency (number of calls per unit time), call interval, parameter combination features (common parameter combinations for specific APIs), call chain depth (API call level involved), etc. for modeling to provide effective data input.
[0071] In the embodiments of the present application, the API historical behavior data after cleaning in step S1 is statistically learned and patterned according to the business function and use purpose of the API to build a normal behavior model with dynamic updating capability, and the specific implementation methods are A1-A6:
[0072] It should be noted that this step aims to statistically learn and pattern the API historical behavior data after cleaning according to the business function and use purpose of the API to build a business-oriented normal behavior model with dynamic updating capability, supporting subsequent behavior deviation detection.
[0073] A1: Input the collected historical API call logs.
[0074] A2: Divide the call logs into different business scenario sets according to the data information of the interface.
[0075] A3: Statistically model each business scenario structured field.
[0076] A4: After completing the statistical modeling, based on the distribution of each feature, the typical calling behavior mode in the business scenario is obtained.
[0077] A5: Adopting updating strategy to adjust statistical value, dynamically updating behavior mode.
[0078] A6: Each business scenario will output normal behavior model.
[0079] It should be noted that the specific implementation of step A1 is:
[0080] The historical API calling log collected by the system is used as the input of this step, mainly including: structured fields: such as the number of request parameters, status code, response time, request body length, etc.; Context fields: such as user ID, terminal type, timestamp, interface path; Optional fields: such as error information or calling log text.
[0081] It should be noted that the specific implementation of step A2 is:
[0082] The system divides the calling log into different business scenario sets according to the function label of the interface, module attribution or path structure:
[0083] S1, S2, …, S n
[0084] Each scenario S k is a set of calls with the same business goal, and the internal behavior structure has strong consistency.
[0085] Further, the specific calculation method of step A3 is:
[0086] For each business scenario S k , the system performs statistical modeling on its structured fields, and the common features include:
[0087] The mean and standard deviation of the number of parameters are represented as:
[0088]
[0089] Where p i represents the number of parameters of the i-th calling record, and N is the total number of samples.
[0090] It should be noted that μ p represents the average number of parameters in the calling request in this scenario, reflecting the interface complexity; σ p represents the fluctuation of the number of parameters, which is used to set the normal fluctuation range later.
[0091] The frequency distribution of the status code is represented as:
[0092]
[0093] where N c represents the number of occurrences of status code c, and N is the total number of calls.
[0094] It should be noted that f(c) is used to measure the probability of the occurrence of a certain status code in this business scenario, and is used to identify common and abnormal return conditions.
[0095] The response time distribution is represented as:
[0096] The response time is divided into multiple time interval [T1, T2, …, T m ], and the frequency of each interval is counted to generate a histogram H t .
[0097] It should be noted that the normal delay range of the interface response is used to assist in identifying response timeout behavior.
[0098] Further, the specific calculation method of step A4 is:
[0099] After completing the statistical modeling, the system will extract the typical call behavior pattern in this business scenario based on the distribution of each feature, which is used as a comparison benchmark for subsequent abnormality judgment. The so-called “behavior pattern” refers to the summary of the value range, combination relationship and typical trend of one or more key fields, reflecting the main characteristics of normal access behavior.
[0100] For example, for the parameter quantity feature in API call, the system extracts the following rules according to the mean and standard deviation:
[0101] μ p -2σ p ≤p i ≤μ p +2σ p
[0102] where μ p represents the average value of the parameter quantity in the historical call records of a certain business scenario. It reflects the typical number level of parameters in API requests under normal circumstances. σ p represents the standard deviation of the parameter quantity, which is used to measure the fluctuation degree of the parameter quantity in the historical data. The larger the value, the greater the dispersion. p i represents the actual number of parameters in the API call to be detected. μ p +2σ p represents the confidence interval range of the feature under the assumption of normal distribution (about 95.4% of the samples are covered), which is the concentrated area of most normal behaviors.
[0103] It should be noted that if p iIf the value is out of the interval, it is considered as a behavior deviation in the dimension of "number of parameters", which can be one of the bases for potential anomaly.
[0104] In the embodiments of the present application, step A5 adopts an updating strategy to adjust the statistical value and dynamically update the behavior pattern, and an incremental updating mechanism is adopted, and the specific implementation is as follows:
[0105] With the continuous entry of new calling data, the system needs to dynamically update the behavior model to adapt to the business changes. The following sliding updating strategy is adopted to adjust the statistical value:
[0106]
[0107] It should be noted that, represents the new sample p N+1 The method of updating the parameter mean after arrival, λ is the updating factor (generally set to 0.01-0.1), which can maintain the freshness and stability of the model without saving historical data.
[0108] Other statistics (such as response time distribution, status code frequency) can also be adjusted in a similar way.
[0109] In an optional embodiment, the updating strategy in step A5 can also adopt a periodic batch update, and the system sets a fixed time interval (such as every day, every week or every month), and then collects all new API calling data in the period, recalculates all statistics (such as mean, standard deviation, frequency distribution, etc.) based on these new data, and completely replaces the old behavior model. It is suitable for scenarios where the business mode is relatively stable and changes infrequently. For example, some background batch processing task interfaces, whose calling mode changes little in a long period, periodic updating can ensure that the model reflects the latest situation, and will not bring too much overhead due to frequent calculation.
[0110] In another optional embodiment, the updating strategy in step A5 can also adopt an event-triggered update, which triggers the update of the behavior model only when some specific events are detected. The triggering of the update of the behavior model can be detecting a certain number of abnormal calls, detecting changes in business logic, deploying a new version of the application, or reaching a preset threshold of the number of calls, etc. It is suitable for scenarios that need to quickly respond to business changes or abnormal situations. For example, when the development team updates the function of an API, causing changes in its calling parameters or return status code, the system can detect such changes and immediately update the model to ensure that the model will not be invalidated due to old data.
[0111] Further, the specific implementation of step A6 is as follows:
[0112] Each business scenario will output a normal behavior model, including: structured feature statistics (mean, standard deviation, distribution histogram, etc.); normal behavior feature range and combination rules (such as parameter range, response threshold, state code set); model version number, update time and data volume identifier.
[0113] The model will serve as the input reference for the "behavior similarity calculation" module.
[0114] In the embodiments of the present application, the similarity calculation between real-time API call data and normal behavior model in step S2 evaluates whether the real-time API call data deviates from the expected behavior pattern, including steps B1-B3:
[0115] B1: input the API call log to be tested and the normal behavior model under the business scenario.
[0116] B2: calculate the similarity of structured fields and unstructured fields.
[0117] B3: weight and combine the structured field similarity and the unstructured field similarity to obtain the final behavior similarity score.
[0118] It should be noted that the similarity calculation between real-time API call data and the "normal behavior model" generated in the previous stage evaluates whether it deviates from the expected behavior pattern, which serves as the basis for subsequent anomaly determination. By calculating the similarity of structured parameters and log texts respectively and integrating them into a comprehensive score, the behavior consistency between each call and the business scenario model can be accurately described.
[0119] It should be noted that the specific implementation of step B1 is:
[0120] The input of this stage includes: the current API call record R to be detected, including structured fields (such as parameter quantity, response code, latency, etc.) and unstructured fields (such as error information, call log text); the normal behavior model under the corresponding business scenario, which contains the statistical distribution of structured fields and text semantic representation.
[0121] In the embodiments of the present application, the specific implementation of step B2 is:
[0122] Preferably, in the embodiments of the present application, the structured field similarity calculation is specifically implemented as:
[0123] The structured field vector in the call record is denoted as x, the mean vector of the scenario model is denoted as μ, and the standard deviation is denoted as d. The system calculates the deviation between the two:
[0124] Euclidean distance (numerical difference):
[0125]
[0126] It should be noted that d E (x, μ) is used to measure the overall distance between real-time invocation and model mean, the smaller the value, the closer to normal behavior.
[0127] Normalized cosine similarity, denoted as:
[0128]
[0129] It should be noted that S cos Reflects the directional similarity between two vectors, ranging from [-1, 1], the larger the value, the stronger the directional consistency, that is, the more similar the behavior patterns.
[0130] Finally, the structured similarity, denoted as:
[0131]
[0132] It should be noted that by weighting and fusing distance and direction, the stability of evaluation is improved.d max is a normalization factor to prevent numerical dominance in scoring.
[0133] Preferably, in the embodiments of the present application, the unstructured field similarity calculation is denoted as:
[0134] If the invocation log contains error information or unstructured text T, the system first converts it to a word vector representation v T , and then compares it with the typical error semantic vector v M in the model.
[0135]
[0136] It should be noted that S text is the semantic similarity of the text content, the larger the value, the more consistent the invocation is with the historical normal behavior in terms of error or log information, and vice versa, which may be an abnormal situation.
[0137] In an optional embodiment, the structured field similarity calculation can also use Mahalanobis distance to calculate the Mahalanobis distance between the real-time invocation vector and the model mean vector. Mahalanobis distance takes into account the covariance structure of the data, which can better handle the correlation between features and is more sensitive to external outliers. It is suitable for scenarios where there is strong correlation between API invocation parameters. For example, for some financial transaction APIs, the value of parameter A usually determines the optional range of parameter B, so using Mahalanobis distance can more accurately measure the degree of deviation.
[0138] In another optional embodiment, the unstructured field similarity calculation can also use sentence embedding similarity based on pre-trained language models such as BERT, when there is a need for in-depth understanding of the semantics of the log text, rather than just word matching. For example, when the error information returned by the API, although the words are different, expresses the same underlying problem (such as "connection timeout" vs. "unable to establish TCP connection"), BERT and other models can capture this semantic similarity.
[0139] Further, the specific implementation of step B3 is:
[0140] The structured similarity and the text similarity are weighted and combined to obtain a final behavior similarity score:
[0141] S total = β· S struct + (1-β)· S text
[0142] Note: β is the fusion coefficient of structure and text (for example, β = 0.7 indicates that the structure feature is dominant). S text is the comprehensive evaluation result, which is the core index of whether it is abnormal.
[0143] It should be noted that the output of this stage is the similarity score S total between the current API call behavior and the model, which is used for the threshold judgment link in the next stage. At the same time, the system saves the score and the intermediate items for log backtracking and model correction.
[0144] In the embodiments of the present application, based on the similarity calculation based on statistical rules in step S3, a sequence behavior modeling module based on recurrent neural network is introduced to enhance the recognition ability of time series abnormal patterns, including steps C1-C4:
[0145] C1: input the API call sequence arranged in time sequence.
[0146] C2: design a recurrent neural network structure.
[0147] C3: train and optimize the normal behavior model to improve the model performance.
[0148] C4: cooperatively verify the prediction results of the recurrent neural network with the static rule base and the business scenario model to improve the detection reliability.
[0149] It should be noted that based on the behavior similarity calculation based on statistical rules, a sequence behavior modeling module based on neural network is introduced to enhance the recognition ability of time series abnormal patterns. Both can be independently judged, or can be combined to improve the overall detection accuracy and adaptability to variant behaviors of the system.
[0150] By receiving the calling feature sequence in the input layer, learning the context dependence in the hidden layer, and outputting the abnormality judgment result in the output layer, accurate recognition of complex behaviors is achieved.
[0151] Further, the specific implementation of step C1 is:
[0152] The input is a time-ordered API calling sequence, in the form of:
[0153] X = {x1, x2, …, x T}
[0154] Where each x T represents a feature vector of an API call, including structured fields (such as the number of parameters, response time, status code) and possible text information encoding. All inputs will be normalized and vectorized before entering the neural network.
[0155] In the embodiments of the present application, the specific implementation of step C2 is:
[0156] The multi-layer RNN variant (LSTM) structure is used, which is divided into the following parts:
[0157] Input layer: receives the normalized calling sequence X;
[0158] Hidden layer: uses multiple LSTM units to gradually learn the historical dependence and potential patterns of calling behavior;
[0159] Output layer: outputs the probability of abnormal behavior Behavior prediction output can also be selected Used to evaluate the behavior deviation.
[0160] The training target is to minimize the prediction error, and the cross-entropy loss function is used in the classification scenario:
[0161]
[0162] It should be noted that y is the actual label (abnormal or not), is the model prediction result.
[0163] In an optional embodiment, the design of the recurrent neural network structure in step C2 can also be a GRU (Gated Recurrent Unit), which is another popular variant of RNN with a simpler structure (usually only one update gate and one reset gate) and potentially higher computational efficiency, while still effectively capturing long-term dependencies in the sequence. It is suitable for scenarios where there are certain limitations on computational resources or training time, but still need to capture the dependencies of time series. For example, real-time monitoring of API calls on edge devices, or processing of microservice API call sequences that require fast response, frequent model updates, but limited computing power.
[0164] In another optional embodiment, the design of the recurrent neural network structure in step C2 can also adopt a bidirectional structure. This means that the network will maintain two directions of hidden state: one is processed from the beginning of the sequence to the end, and the other is processed from the end of the sequence to the beginning. The final output combines past and future context information. It is suitable for scenarios where the abnormality of the current behavior depends not only on the past behavior, but also on the behavior of the immediately following behavior. For example, when analyzing multiple API sequences called by a user in a session to determine the abnormality of a certain intermediate step, the calling situation before and after it needs to be referred to.
[0165] In the embodiments of the present application, step C3 uses historical call sequence data to train the neural network, and the specific implementation of policy performance improvement is:
[0166] Optimizer selection: use common optimization algorithms such as SGD or Adam to iteratively update model parameters;
[0167] Regularization mechanism: add L1 or L2 regularization terms to the loss function to suppress overfitting, or add Dropout layers in the network to randomly mask neurons;
[0168] Data augmentation techniques: generate extended samples by slightly perturbing the call sequence (such as time shifting, frequency scaling), to improve the generalization ability of the model.
[0169] In an optional embodiment, step C3 trains and optimizes the normal behavior model to improve model performance, which can also use a dynamic learning rate adjustment strategy. Instead of using a fixed learning rate during training, the learning rate is dynamically adjusted based on the performance of the model on the validation set. For example, when the validation loss no longer decreases, the learning rate is reduced for more fine-tuned parameter adjustment; or use periodic learning rate decay. This helps the model converge quickly in the early stages of training, and avoids getting stuck in local optima in the later stages.
[0170] In another optional embodiment, step C3 trains and optimizes the normal behavior model, and the model performance can also be improved by ensemble learning, which is suitable for scenarios where the model performance requirement is extremely high and the computing resources are allowed. For example, in API behavior analysis that needs extremely high accuracy to prevent critical system risks.
[0171] The specific implementation of step C4 is:
[0172] To enhance the detection reliability, the system cooperatively verifies the prediction results of the neural network with the static rule library and the business scenario model:
[0173] When neither the rule model nor the statistical model identifies an anomaly, but the neural network model outputs a high risk probability, the system marks the event as "potential anomaly"; the security analysis module can further confirm whether the event belongs to a new type of attack or business variation; once confirmed, the sample can be used to update the rule model and the neural network model in reverse.
[0174] Further, the anomaly prediction probability value P abn corresponding to the current sequence is used for comparison with a threshold value; the optional prediction output is used for deviation analysis with the actual behavior; at the same time, the model confidence and the key activation path are output, which are used for subsequent explanation and tracking.
[0175] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all should be covered in the scope of the claims of the present application.
[0176] Embodiment 3, the above is a schematic scheme of an API access behavior intelligent identification method. It should be noted that the technical scheme of the API access behavior intelligent identification system and the technical scheme of the API access behavior intelligent identification method described above belong to the same concept. The technical scheme of the API access behavior intelligent identification system in this embodiment is not described in detail, and the description of the technical scheme of the API access behavior intelligent identification method can be referred to.
[0177] The embodiment also provides an API access behavior intelligent identification system, which comprises:
[0178] The first module statistically learns and inductively models the cleaned API historical behavior data according to the business functions and use purposes of the API, and constructs a normal behavior model with dynamic updating capability;
[0179] A computing module performs similarity calculation on the real-time API call data and the normal behavior model to evaluate whether the real-time API call data deviates from the expected behavior mode;
[0180] A modeling module introduces a recurrent neural network based modeling of sequence behavior on the basis of similarity calculation based on statistical rules, to enhance the recognition ability of time sequence abnormal patterns.
[0181] The embodiment also provides an electronic device suitable for the case of intelligent identification of API access behavior, including a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the method for intelligent identification of API access behavior proposed in the above embodiment.
[0182] The embodiment also provides a storage medium having a computer program stored thereon, and the program is executed by a processor to realize the method for intelligent identification of API access behavior proposed in the above embodiment.
[0183] The storage medium proposed in the embodiment and the method for intelligent identification of API access behavior proposed in the above embodiment belong to the same inventive concept, and the technical details not described in the embodiment can be referred to the above embodiment, and the embodiment has the same beneficial effects as the above embodiment.
[0184] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary general hardware, and of course can also be realized by hardware. Based on such understanding, the technical solutions of the present application or the part that contributes to the prior art can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH memory, a hard disk or an optical disk, and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods of various embodiments of the present application.
[0185] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced by equivalents without departing from the spirit and scope of the present application, and all of them should be covered in the scope of the claims of the present application.
Claims
1. A method for intelligently identifying API access behavior, characterized in that: include: Based on the API's business functions and usage purposes, statistical learning and pattern induction are performed on the cleaned API historical behavior data to build a normal behavior model with dynamic update capabilities; Calculate the similarity between real-time API call data and normal behavior models to assess whether the real-time API call data deviates from the expected behavior pattern; On the basis of similarity calculation based on statistical rules, a recurrent neural network is introduced to model sequence behavior to enhance the ability to recognize abnormal patterns in time series.
2. The method for intelligently identifying API access behavior according to claim 1, wherein: According to the API's business functions and usage purposes, statistical learning and pattern induction are performed on the cleaned API historical behavior data to build a business-oriented normal behavior model, including: Input the collected historical API call logs; Based on the data information of the interface, the call log is divided into different business scenario sets; Conduct statistical modeling on structured fields for each business scenario; After completing statistical modeling, we can obtain typical call behavior patterns in business scenarios based on the distribution of each feature. Adopt update strategies to adjust statistical values and dynamically update behavior patterns; Each business scenario will output a normal behavior model.
3. The method for intelligently identifying API access behavior according to claim 2, wherein: The similarity calculation between the real-time API call data and the normal behavior model is performed to evaluate whether it deviates from the expected behavior pattern, including: Input the API call log to be tested and the normal behavior model under the business scenario; Calculate the similarity between structured and unstructured fields; The structured field similarity and unstructured field similarity are weighted and combined to obtain the final behavioral similarity score.
4. The method for intelligently identifying API access behavior according to claim 3, wherein: On the basis of the similarity calculation based on statistical rules, a sequence behavior modeling module based on recurrent neural network is introduced to enhance the recognition ability of abnormal patterns in time series, including: Input a chronological sequence of API calls; Design recurrent neural network architecture; Train and optimize normal behavior models to improve model performance; The prediction results of the recurrent neural network are collaboratively verified with the static rule base and business scenario model to improve detection credibility.
5. The method for intelligently identifying API access behavior according to claim 4, wherein: The statistical modeling of each business scenario structured field is expressed as: Among them, p i Indicates the number of parameters of the i-th call record, N is the total number of samples, μ p Denote the average number of parameters recorded in the call, σ p represents the standard deviation of the number of arguments recorded for the calls; Among them, N c Indicates the number of occurrences of status code c, N is the total number of calls, and f(c) is the frequency of occurrence of status code c; Divide the response time into multiple time intervals [T1, T2, ..., T m ], count the frequency of each interval to generate a histogram H t .
6. The method for intelligently identifying API access behavior according to claim 5, wherein: The structured field similarity and the unstructured field similarity are weighted and combined to obtain the final behavior similarity score, which is expressed as: S total =β·S struct +(1-β)·S text Among them, β is the fusion coefficient of structure and text, S total is the comprehensive evaluation result, S struct Expressed as structured field similarity, S text Expressed as unstructured field similarity.
7. The method for intelligently identifying API access behavior according to claim 6, wherein: The designed recurrent neural network structure, include, Input layer: receives the normalized call sequence; Hidden layer: uses multiple recurrent neural network units to gradually learn the historical dependencies and potential patterns of call behavior; Output layer: output abnormal behavior probability The training goal is to minimize the prediction error. The classification scenario uses the cross entropy loss function, which is expressed as, Among them, y is the actual label, Predict the results for the model.
8. An API access behavior intelligent recognition system, applying the method according to any one of claims 1 to 7, characterized in that: include: The first module conducts statistical learning and pattern induction on the cleaned API historical behavior data based on the API's business functions and usage purposes, and builds a normal behavior model with dynamic update capabilities; The calculation module calculates the similarity between the real-time API call data and the normal behavior model to evaluate whether the real-time API call data deviates from the expected behavior pattern; The modeling module, based on the similarity calculation of statistical rules, introduces the modeling of sequence behavior based on recurrent neural networks to enhance the ability to recognize abnormal patterns in time series.
9. An electronic device comprising: memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method for intelligently identifying API access behavior described in any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the method for intelligently identifying API access behavior as described in any one of claims 1 to 7.