API abnormal access detection method, computer equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of information security, in particular to an API abnormal access detection method, computer equipment and a storage medium. The method comprises the steps that an access request received by a target API in a target time window is acquired, the access request carries key information, and the key information comprises a timestamp; updating the key information to a target bitmap corresponding to the target time window based on the timestamp; obtaining a historical bitmap based on the target time sequence database; calculating a target confidence score based on the target bitmap and the historical bitmap; and if the target confidence score is greater than a preset confidence threshold, determining that the target API has abnormal access. According to the embodiment of the invention, the key information of the API access request is compressed and stored in the time sequence database through the bitmap, the required storage space is reduced, the bitmap operation efficiency is high, the target confidence score is calculated by comparing the bitmap of the target time window with the bitmap of the historical reference window, the false alarm and the missing report are reduced, and the user experience is improved. And rapid real-time detection and response to the abnormal access of the API are realized.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an API abnormal access detection method, computer device, and storage medium. Background Technology

[0002] In the field of information security technology, real-time detection and protection against abnormal API (Application Programming Interface) access behavior is crucial for ensuring system security and stability. Currently, the industry mainly employs the following technical solutions: First, access control policies based on fixed thresholds, which implement control by setting static access frequency limits. While simple to implement, these policies struggle to adapt to dynamic changes in business traffic and are prone to false positives and false negatives. Second, statistical detection methods based on log aggregation and batch analysis, which utilize offline analysis platforms for periodic modeling. Although they support multi-dimensional analysis, they suffer from high processing latency and cannot meet the requirements for second-level real-time response. Third, behavioral modeling solutions based on machine learning or rule engines can model and identify access characteristics; however, they typically rely on large amounts of historical data and complex optimization, resulting in high computational overhead and making them unsuitable for high-concurrency, high-real-time scenarios. Furthermore, common storage solutions, such as counting mechanisms based on Redis or relational databases, also face the challenge of linearly expanding storage space with concurrency and difficulty in maintaining fine-grained access records over long periods.

[0003] In summary, existing technologies still have several prominent problems: high data storage costs and low query performance make it difficult to support long-term storage of massive amounts of accessed data while achieving efficient compression and fast querying; they lack dynamic anomaly analysis capabilities across multiple time dimensions (such as seconds, minutes, hours, and days), making it impossible to automatically correlate and compare with historical behavior; alarm thresholds are mostly statically set, lacking an adaptive adjustment mechanism based on business fluctuations and interface differences, leading to frequent false alarms and missed alarms; most solutions lack real-time performance, with high analysis latency, making it difficult to complete detection and response within seconds, thus hindering the construction of real-time risk control and automated protection systems. Summary of the Invention

[0004] One objective of this application is to provide an API abnormal access detection method, computer device, and storage medium to solve the technical problem that the API abnormal access analysis in the prior art has a high latency and is difficult to complete detection and response within a second.

[0005] In a first aspect, embodiments of this application provide an API abnormal access detection method, the method comprising: Obtain access requests received by the target API within the target time window, wherein the access requests carry key information, including timestamps; Based on the timestamp, the key information of each access request is updated to the target bitmap corresponding to the target time window, and the target bitmap is stored in the target time series database; A historical bitmap is obtained based on the target time series database. The historical bitmap is the bitmap corresponding to the historical reference window. The historical reference time window is equal to the target time window in the time dimension. Calculate the target confidence score based on the target bitmap and the historical bitmap; If the target confidence score is greater than the preset confidence threshold, then it is determined that the target API has abnormal access.

[0006] Optionally, the key information further includes multiple access fields, the target bitmap includes multiple access dimension bitmaps, one access field corresponds to one access dimension bitmap, and updating the key information of each request to the target bitmap corresponding to the target time window based on the timestamp includes: The target time window corresponding to each access request is determined based on the timestamp. Determine the corresponding access dimension bitmap based on each of the access fields within the target time window; Each access field is mapped to a bit index of the corresponding access dimension bitmap based on a hash algorithm.

[0007] Optionally, the historical bitmap includes multiple historical access dimension bitmaps, and the step of calculating the target confidence score based on the target bitmap and the historical bitmap includes: For each access dimension, multiple access feature values ​​are calculated based on the access dimension bitmap and the historical access dimension bitmap, whereby the access dimension is used to characterize the access fields stored in the access dimension bitmap. The target confidence score is calculated based on each of the access feature values ​​and a weighted linear model.

[0008] Optionally, calculating the target confidence score based on each of the access feature values ​​and a weighted linear model includes: For each access dimension, determine whether to trigger the corresponding abnormal access rule based on each access feature value; The access feature value that triggers the abnormal access rule and the weighted linear model are selected to calculate the comprehensive confidence score; The comprehensive confidence score is normalized to obtain the target confidence score.

[0009] Optionally, different abnormal access rules correspond to different preset weights, and the selection of the access feature value that triggers the abnormal access rule and the calculation of the comprehensive confidence score by the weighted linear model include: Obtain the preset weights corresponding to all abnormal access rules; Based on the weighted linear model, the access feature values ​​that trigger the abnormal access rule and the corresponding preset weights are selected and summed to obtain the comprehensive confidence score.

[0010] Optionally, the access feature values ​​include cardinality, contrast factor, and Z-score, and the calculation of multiple access feature values ​​based on the access dimension bitmap and the historical access dimension bitmap includes: For each access dimension, calculate the cardinality of the access dimension bitmap; Calculate the historical cardinality of the historical access dimension bitmap, where the historical cardinality is the cardinality corresponding to the historical access dimension bitmap; The comparison multiple is calculated based on the base number and the historical base number; Obtain the mean and standard deviation of the historical bases described in multiple historical dimension bitmaps; The Z-score is calculated based on the base number and the average and standard deviation of the historical base numbers.

[0011] Optionally, determining whether to trigger the corresponding abnormal access rule based on the access feature value includes: For each access dimension, the cardinality is compared with the cardinality threshold. If the cardinality is greater than the cardinality threshold, the corresponding abnormal access rule is triggered. The comparison factor is compared with the factor threshold. If the comparison factor is greater than the factor threshold, the corresponding abnormal access rule is triggered. The Z-score is compared with the Z-score threshold. If the Z-score is greater than the Z-score threshold, the corresponding abnormal access rule is triggered.

[0012] Optionally, the historical reference window includes a first reference window and / or a second reference window and / or a third reference window, and the step of obtaining the historical bitmap based on the target time series database includes: Based on the target time series database, obtain the historical bitmap corresponding to the first reference window, where the first reference window is a time window with the same time dimension preceding the first time interval; and / or, Based on the target time series database, obtain the historical bitmap corresponding to the second reference window, where the second reference window is a time window with the same time dimension as the previous second time interval; and / or, Based on the target time series database, obtain the historical bitmap corresponding to the third reference window. The third reference window is a time window with the same time dimension and the previous third time interval.

[0013] Secondly, embodiments of this application provide a computer device including a memory and a processor. The memory is connected to the processor, and the processor is configured to execute one or more computer programs stored in the memory. When the processor executes the one or more computer programs, it causes the computer device to implement the method described above.

[0014] Thirdly, embodiments of this application provide a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor, cause the processor to perform the method described above.

[0015] Fourthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described above.

[0016] The embodiments of this application can achieve the following technical effects: In the API abnormal access detection method provided in the embodiments of this application, the method includes: obtaining access requests received by the target API within a target time window, wherein the access requests carry key information, including a timestamp; updating the key information of each access request to the target bitmap corresponding to the target time window based on the timestamp, wherein the target bitmap is stored in a target time series database; obtaining a historical bitmap based on the target time series database, wherein the historical bitmap is a bitmap corresponding to a historical reference window, and the historical reference time window is equal to the target time window in the time dimension; calculating a target confidence score based on the target bitmap and the historical bitmap; and determining that the target API has abnormal access if the target confidence score is greater than a preset confidence threshold.

[0017] This application embodiment uses a bitmap data structure to store key information of API access requests in a time-series database. The bitmap compresses and stores this key information, significantly reducing the storage space required for massive, high-frequency request data. Simultaneously, the high efficiency of bitmap operations ensures real-time query and analysis performance. By comparing the bitmap of the target time window with the bitmap of a corresponding historical reference window in the time dimension to calculate the target confidence score, dynamic and adaptive anomaly detection is achieved. This breaks the limitation of relying on fixed thresholds and can sensitively identify abnormal accesses that deviate from historical access patterns, reducing false positives and false negatives. This application embodiment, using a time-series database and efficient bitmap operations, enables the entire process from data updates and historical data acquisition to target confidence score calculation to be completed in a very short time, achieving rapid real-time detection and response to abnormal API access, meeting the real-time risk control needs of high-concurrency scenarios. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This application provides an embodiment of an API abnormal access detection system. Figure 2 A flowchart illustrating an API abnormal access detection method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an API abnormal access detection device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0021] It should be noted that, unless there is a conflict, the various features in the embodiments of this application can be combined with each other, all of which are within the protection scope of this application. Furthermore, although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than the module division in the device or the order in the flowchart. Moreover, the terms "first," "second," and "third" used in this application do not limit the data or execution order, but only distinguish identical or similar items with essentially the same function and effect.

[0022] Please see Figure 1 , Figure 1 This is a schematic diagram of the architecture of an API abnormal access detection system provided in an embodiment of this application. The API abnormal access detection system 100 provided in this embodiment includes a server 11 and a computer device 12, and the server 11 and the computer device 12 are communicatively connected.

[0023] The API anomaly access detection system 100 is applied in various scenarios. For example, in an enterprise API access security audit scenario, server 11, acting as an API gateway or business backend server, is deployed at the network access layer to receive and forward all API access requests from internal and external sources, forming the real-time data source to be detected. Computer device 12 is communicatively connected to server 11, acting as an API anomaly access detection and analysis device. It receives the access request stream in real time, executes a preset API anomaly access detection method, processes the requests in real time, stores them in bitmap format, and performs dynamic confidence analysis to identify API abuse behavior and trigger alarms.

[0024] For another example, in a high-concurrency business interface protection scenario, server 11 is the core application server that carries high-concurrency businesses such as e-commerce activities, points distribution, and financial call interfaces, and it faces high-frequency API call pressure. Computer device 12 uses bitmaps in the time-series database to perform second-level comparison and confidence score calculation, quickly detects abnormal access behaviors such as batch calls or script abuse, and achieves real-time protection at the business level.

[0025] For another example, in a cloud service platform API security protection scenario, server 11 is used to deploy a cloud service platform gateway, microservice architecture, or unified identity authentication center, responsible for unified API access and proxying. Computer device 12 collaborates with multiple servers 11 to continuously aggregate and analyze access trend changes of different APIs and calling entities, and realizes access trend analysis and adaptive response strategy generation through preset API abnormal access detection methods.

[0026] The hardware operating environment deployment of the API abnormal access detection system provided in this application includes traffic collection, storage layer, computing layer, optional acceleration, and deployment mode. Specifically, traffic collection is deployed on the API gateway / edge proxy (such as Nginx, Envoy, or API gateway) or server-side access link, supporting replica mirroring / log forwarding.

[0027] Storage layer: Time series databases (such as InfluxDB, ClickHouse time series tables, OpenTSDB, or dedicated TSDB) serve as bitmap time series carriers and have high-concurrency write capabilities (≥10k TPS).

[0028] Computation layer: stream processing / offline batch processing clusters (such as using Flink / Storm / Kafka Streams for real-time aggregation) and online services (for querying and confidence score calculation).

[0029] Optional acceleration: Use a memory-based cache (such as Redis) to store bitmaps from the most recent few minutes to accelerate real-time bitmap reading.

[0030] Deployment modes: Supports single-machine cluster deployment and horizontal scaling (such as sharding by API or tenant).

[0031] Please see below. Figure 2 , Figure 2 This is a flowchart illustrating an API abnormal access detection method provided in an embodiment of this application. The API abnormal access detection method provided in this embodiment includes the following steps: S21: Obtain the access requests received by the target API within the target time window. The access requests carry key information, including timestamps.

[0032] In step S21, specifically, the system deploys a collection agent on the API gateway or business service node, employing a real-time monitoring mode. When an access request arrives and matches the target API identifier (API id), the collection process is triggered. The collection process supports batch collection, allowing for segmented batch capture of consecutive access requests within the same time window. Access requests carry key information, which is extracted according to a standardized field system. This key information includes, but is not limited to, timestamp, target API identifier (API id), source IP (src IP), identity token / ID, user agent, and parameter digest fields. The system packages the extracted fields into events according to a preset standardized format, and each event is associated with the target API identifier and the target time window identifier.

[0033] It should be noted that the system maintains one or more bitmaps using an API identifier × time window identifier. For example, API_A×2025-11-06T10:05:00~10:05:09 indicates that the target API window of the bitmap is API_A and the target time window is 2025-11-06T10:05:00~10:05:09. This target time window is a 10-second time dimension window. This application embodiment includes multiple time dimension time windows; different APIs can have different time dimension time windows set, such as minute, hour, day, and week time windows. It should be noted that this application embodiment uses a short window (e.g., 10 seconds) to capture sudden abuse behavior and a long window (1 day / 1 week) to identify periodic traffic and normal business peaks. Combining both can avoid misjudging normal business traffic as abnormal access or attacks. The system stores the fields in the events within the time window using bitmap encoding with extremely low storage space.

[0034] Bitmaps are data structures that use binary bits (0 or 1) to represent data states. By compressing massive amounts of access records into binary sequences for storage, bitmaps can significantly reduce storage space usage. Furthermore, bitwise AND, OR, and NOT logical operations are extremely fast, supporting real-time and efficient comparison and statistical analysis. This application supports multiple bitmap types, such as ordinary bitmaps, sparse compressed bitmaps (RoaringBitmap), and scalable bitmaps. This application selects the appropriate type based on the API's access frequency to balance memory usage and query performance. Compared to storing log entries one by one in existing technologies, bitmaps can achieve approximately 10 times storage compression in high-concurrency scenarios; the specific compression ratio depends on the cardinality / bitmap length.

[0035] In some embodiments, RoaringBitmap, Compressed BitSet, or APS (Adaptive Probabilistic Structures) can be used as alternative implementations of bitmaps. In scenarios with extremely high cardinality (high concurrency, extremely large cardinality), Count-Min Sketch or HyperLogLog can be used as alternative implementations for cardinality estimation. A combination of Bloom filter and counter (such as CountingBloom) can also be used as an alternative implementation for handling deduplication and fast existence determination.

[0036] S22: Update the key information of each access request to the target bitmap corresponding to the target time window based on the timestamp. The target bitmap is stored in the target time series database.

[0037] In step S22, specifically, the key information also includes multiple access fields, and the target bitmap includes multiple access dimension bitmaps, with one access field corresponding to one access dimension bitmap. Specifically, the access fields include the source IP (src IP), identity token / ID, and user agent. The access dimension bitmaps include an IP dimension bitmap, an identity token / ID dimension bitmap, and a user agent (UA) dimension bitmap. The IP dimension bitmap stores the source IP of events within the target time window, the identity token / ID dimension bitmap stores the identity token of events within the target time window, and the UA dimension bitmap stores the user agent of events within the target time window.

[0038] The system determines the target time window for each access request based on the timestamp. Specifically, the system matches the timestamp within an event with preset time windows (such as 10s, 1min, and 1h) to determine if the timestamp falls within the start and end time range of a specific time window. For example, if the timestamp of an event is 2025-11-06T10:05:03, it can be understood that the event falls within the 10-second time window 2025-11-06T10:05:00~10:05:09 and the 1-minute time window 2025-11-06T10:05:00~10:06:00. If the timestamp matches multiple time windows simultaneously, the event must be associated with all matching time windows.

[0039] The system determines the corresponding access dimension bitmap based on each access field. Specifically, the system determines the access dimension bitmap corresponding to each access field (source IP, identity status, user agent) based on the access fields of events within the target time window, realizing a mapping of "access field - access dimension - access dimension bitmap," that is, the source IP corresponds to the IP dimension bitmap, the identity status corresponds to the identity status dimension bitmap, and the user agent corresponds to the UA dimension bitmap. The system combines the target time window identifier, the target API identifier, and the target dimension identifier to locate the access dimension bitmap of [target API identifier × target time window identifier × target dimension identifier]. The target dimension identifier is one of the source IP, identity status, and user agent.

[0040] The system maps each access field to a bit index in the corresponding access dimension bitmap based on a hash algorithm. Specifically, the system first preprocesses each access field. For example, it converts the IP address of the access source IP to the IPv4 / IPv6 standard format; it normalizes the User Agent (UA) and generates a UA fingerprint; and it parses the identity state to obtain identity information in a unified format.

[0041] The system maps each preprocessed access field to its corresponding bit index in the access dimension bitmap based on a preset hash algorithm. Specifically, the preset hash algorithm includes, but is not limited to, high-speed hash functions such as consistent hashing and SipHash. The system obtains the hash value corresponding to each preprocessed access field based on the preset hash algorithm, and then takes the modulo of the hash value with the bitmap length to obtain the bit index corresponding to that access field. In this embodiment, the bitmap length L can be set to 2. 20 Up to 2 26 Within the range.

[0042] It should be noted that after obtaining the bit index of the access dimension bitmap, a set-bit operation (i.e., setting it to 1) needs to be performed on the access dimension bitmap. For example, if the same access field appears multiple times (such as multiple accesses from the same IP address), only one set-bit operation needs to be performed to ensure the deduplication property of the bitmap. The system supports merging bit indexes of batch access requests, setting multiple bit indices of the same access dimension bitmap to 1 in batches to improve update efficiency. The value of the bit pointed to by each bit index is 1 or 0, and the radix of the bitmap refers to the number of bits in the bitmap that are 1.

[0043] The system serializes the bitmap and writes it to the target time-series database at preset intervals (e.g., every 1 second). The writing process follows transactional or eventual consistency strategies to ensure data integrity and time-series accuracy. The target time-series database is partitioned and stored according to [API identifier × time window identifier × dimension identifier]. The target time-series database is a preset time-series database that serves as the carrier of the bitmap time series. For example, the time-series database (TSDB) can be set to InfluxDB, ClickHouse time-series tables, OpenTSDB, or a dedicated TSDB. The time-series database has high-concurrency write capability (≥10kTPS).

[0044] S23: Obtain the historical bitmap based on the target time series database. The historical bitmap is the bitmap corresponding to the historical reference window. The historical reference time window and the target time window are equal in time dimension.

[0045] In step S23, specifically, for the target time window of the target API, the system retrieves its corresponding historical reference window from the target time series database. The historical reference window includes, but is not limited to, the time window with the same time dimension as the previous second, the time window with the same time dimension as the previous day, and the time window with the same time dimension as the previous week. For example, if the target time window is 2025-11-06T10:05:00~10:05:09, it can be understood that its time dimension is 10 seconds. Then, the time window with the same time dimension as the previous second is 2025-11-06T10:04:59~10:05:08, the time window with the same time dimension as the previous day is 2025-11-05T10:05:00~10:05:09, and the time window with the same time dimension as the previous week is 2025-10-31T10:05:00~10:05:09.

[0046] It should be noted that the embodiments of this application support sliding window storage bitmaps. For example, a 10-second time window can be used to slide and capture access requests in 1-second increments and store the bitmaps to enhance detection sensitivity. The historical reference window often selects a time window with the same time dimension as the previous second. In some embodiments, an exponentially decaying weighted window can also be used for anomaly smoothing detection. For special services, adaptive window length is supported (e.g., the time dimension of the time window can be automatically adjusted periodically based on historical traffic).

[0047] The system reads the historical bitmap from the historical reference window. This historical bitmap includes multiple historical access dimension bitmaps, which are the access dimension bitmaps corresponding to the historical reference window. These access dimension bitmaps include IP dimension bitmaps, identity / state dimension bitmaps, and UA dimension bitmaps. It can be understood that the target time-series database is partitioned and stored according to [API identifier × time window identifier × dimension identifier]. Based on the target API identifier and the time window identifier corresponding to the historical reference window, the system can read the corresponding historical access dimension bitmap from the target time-series database.

[0048] S24: Calculate the target confidence score based on the target bitmap and historical bitmaps.

[0049] In step S24, specifically, the target bitmap includes multiple access dimension bitmaps corresponding to the target time window. Specifically, the access dimension bitmap includes an IP dimension bitmap, an identity state dimension bitmap, and a UA dimension bitmap. The historical bitmap includes multiple historical access dimension bitmaps corresponding to the historical reference window. The historical access dimension bitmap includes the IP dimension bitmap, identity state dimension bitmap, and UA dimension bitmap corresponding to the historical reference window.

[0050] For each access dimension, the system calculates multiple access feature values ​​based on the access dimension bitmap and the historical access dimension bitmap. The access dimension represents the access fields stored in the access dimension bitmap. Access fields include the source IP address, identity status, and user agent. For example, for each dimension (such as the source IP address), the system calculates multiple access feature values ​​based on the IP dimension bitmap corresponding to the target time window and the IP dimension bitmap corresponding to the historical reference window. The access dimension represents the access fields stored in the access dimension bitmap. The historical reference window can be a time window with the same time dimension as the previous second and / or a time window with the same time dimension as the previous day and / or a time window with the same time dimension as the previous week.

[0051] Similarly, for each dimension (such as identity state), the system calculates multiple access feature values ​​based on the identity state dimension bitmap corresponding to the target time window and the identity state dimension bitmap corresponding to the historical reference window. For each dimension (such as user agent), the system calculates multiple access feature values ​​based on the UA dimension bitmap corresponding to the target time window and the UA dimension bitmap corresponding to the historical reference window.

[0052] Access feature values ​​include cardinality, contrast ratio, and Z-score. The system calculates multiple access feature values ​​based on the access dimension bitmap and historical access dimension bitmaps, including the following steps: For each access dimension, calculate the cardinality of the access dimension bitmap; calculate the historical cardinality of the historical access dimension bitmaps, where the historical cardinality is the cardinality corresponding to the historical access dimension bitmaps; calculate the contrast ratio based on the cardinality and historical cardinality; obtain the average and standard deviation of the historical cardinality from multiple historical dimension bitmaps; and calculate the Z-score based on the cardinality and the average and standard deviation of the historical cardinality. Cardinality refers to the number of bits in the bitmap that are 1. Bits that are 1 in the bitmap represent the deduplicated access fields stored in the bitmap, such as the access source IP, identity status, and user agent.

[0053] For example, for the access dimension of the source IP, the system calculates the cardinality of the IP dimension bitmap corresponding to the target time window. Specifically, the system quickly calculates the cardinality of the IP dimension bitmap corresponding to the target time window through bitmap operations. For example, if the IP dimension bitmap is a bitmap type, popcount() is used to obtain the cardinality of the IP dimension bitmap. As another example, if the IP dimension bitmap is a RoaringBitmap type bitmap, getCardinality() is used to obtain the cardinality of the IP dimension bitmap. The historical cardinality is the cardinality corresponding to the historical access dimension bitmap. Similarly, the system calculates the cardinality of the IP dimension bitmap corresponding to the historical reference window, which will not be elaborated further here.

[0054] The system calculates the comparison ratio based on the cardinality of the IP dimension bitmap corresponding to the target time window and the cardinality of the IP dimension bitmap corresponding to the historical reference window. Specifically, the comparison ratio is the quotient of the cardinality of the IP dimension bitmap corresponding to the target time window divided by the cardinality of the IP dimension bitmap corresponding to the historical reference window. The formula for calculating the comparison ratio is as follows:

[0055] Where r represents the comparison factor, This indicates the cardinality of the access dimension bitmap corresponding to the target time window. This indicates the cardinality of the access dimension bitmap corresponding to the history reference window.

[0056] It should be noted that when calculating the cardinality of the IP dimension bitmap corresponding to the historical reference window, if multiple IP dimension bitmaps corresponding to historical reference windows are selected for the calculation, for example, if a time window with the same time dimension from the previous second and a time window with the same time dimension from the previous day are selected, then the average of the cardinality of the IP dimension bitmaps corresponding to the two historical reference windows needs to be calculated, and the average value is used as the cardinality corresponding to the historical reference window.

[0057] The system calculates the cardinality of the IP dimension bitmaps corresponding to multiple historical reference windows, and then calculates the mean and standard deviation of the cardinality of these cardinality values. Based on the cardinality of the IP dimension bitmap corresponding to the target time window, and the mean and standard deviation of the cardinality of the IP dimension bitmaps corresponding to multiple historical reference windows, the system calculates the Z-score. The Z-score calculation formula is as follows:

[0058] Where z represents the Z-score. It is the cardinality of the access dimension bitmap corresponding to the target time window. This represents the average cardinality of the bitmap corresponding to multiple historical reference windows. The standard deviation of the cardinality of the bitmap corresponding to the access dimensions of multiple historical reference windows.

[0059] It should be noted that various historical reference windows include, but are not limited to, time windows with the same time dimension as the previous second, the same time dimension as the previous day, and the same time dimension as the previous week. You can also select time windows with the same time dimension for other time intervals.

[0060] Understandably, for the two access dimensions of identity state and user agent, the system will similarly use the aforementioned method to calculate the corresponding multiple access feature values, namely cardinality, contrast factor and Z-score, which will not be elaborated further here.

[0061] The system determines whether to trigger the corresponding abnormal access rule based on the access feature value. Specifically, for each access dimension, the system compares the cardinality with the cardinality threshold. If the cardinality is greater than the cardinality threshold, the corresponding abnormal access rule is triggered. The system also compares the comparison multiple with the multiple threshold. If the comparison multiple is greater than the multiple threshold, the corresponding abnormal access rule is triggered. Finally, the system compares the Z-score with the Z-score threshold. If the Z-score is greater than the Z-score threshold, the corresponding abnormal access rule is triggered.

[0062] For example, regarding the access dimension of the source IP, the system compares the cardinality of the IP dimension bitmap corresponding to the target time window with a cardinality threshold. If the cardinality of the IP dimension bitmap corresponding to the target time window is greater than the cardinality threshold, the corresponding abnormal access rule is triggered. The cardinality threshold can be set according to the time dimension of the time window. For example, in this embodiment, the cardinality threshold for a 10-second time window is set to 100.

[0063] The system compares the comparison multiple of the access source IP (access dimension) with a multiple threshold. If the comparison multiple is greater than the multiple threshold, the corresponding abnormal access rule is triggered. The multiple threshold can be set according to the time dimension of the time window. For example, in this embodiment, the multiple threshold for a 10-second time window is set to 4.

[0064] The system compares the Z-score of the access source IP (access dimension) with the Z-score threshold. If the comparison multiple is greater than the Z-score threshold, the corresponding abnormal access rule is triggered. The Z-score threshold can be set according to the time dimension of the time window. For example, in this embodiment, the multiple threshold for a 10-second time window is set to 3.

[0065] Understandably, for the two access dimensions of identity and user agent, the system will similarly use the same method described above to determine whether to trigger the corresponding abnormal access rules based on the access feature values ​​(cardinality, comparison multiple, Z-score), which will not be elaborated further here.

[0066] It should be noted that the system has preset a base threshold, a multiple threshold, and a Z-score threshold for each API. The base threshold, multiple threshold, and Z-score threshold are different for different APIs. For example, the corresponding threshold for high-risk APIs will be lower than that for normal APIs, thereby improving the sensitivity of abnormal access detection.

[0067] Different abnormal access rules correspond to different preset weights. The system will obtain the preset weights corresponding to all abnormal access rules. Specifically, the system is configured with an abnormal access rule-preset weight mapping table. For example, the abnormal access rule-preset weight mapping table is shown in Table 1: Table 1

[0068] As shown in Table 1, the total weight of all default access rules is equal to 1. The default weights assigned to each default access rule are configured empirically or obtained through training with historical data. The system can obtain the default weights corresponding to all default access rules through the default access rule-default weight mapping table.

[0069] The system uses a weighted linear model to select the access feature values ​​that trigger abnormal access rules and their corresponding preset weights, then performs a weighted sum to obtain a comprehensive confidence score. Specifically, the system obtains all access feature values ​​(such as cardinality, contrast ratio, and Z-score) that trigger abnormal access rules, normalizes these feature values ​​to obtain isolated scores, and then multiplies all isolated scores by the preset weights of the corresponding abnormal access rules and performs a weighted sum to obtain the comprehensive confidence score. The system then normalizes the comprehensive confidence score, for example, using the Sigmoid function or min-max normalization, to obtain the target confidence score.

[0070] In some embodiments, machine learning models (such as logistic regression, LightGBM, or online learning models) can be used instead of weighted linear models to learn weights and interactions with complex nonlinear features from historical labeled samples. Bayesian networks or probabilistic graphical models can also be used to integrate rule-based judgments across various access dimensions to obtain more stringent probabilistic alarm decisions.

[0071] S25: If the target confidence score is greater than the preset confidence threshold, it is determined that there is abnormal access to the target API.

[0072] In step S25, specifically, the preset confidence threshold is set to 0.8, that is, if the target confidence score is greater than the preset confidence threshold, it is determined that there is abnormal access to the target API.

[0073] In some embodiments, a first confidence threshold and a second confidence threshold are also included. The first confidence threshold is set to 0.4, and the second confidence threshold is set to 0.6. If the confidence level is greater than or equal to the first confidence threshold and less than the second confidence threshold, the target API is determined to be low-risk, and a low-risk alarm is triggered (such as SMS, email, or work order). If the confidence level is greater than or equal to the second confidence threshold and less than the preset confidence threshold, the target API is determined to be medium-risk, and a medium-risk alarm is triggered. The system will perform secondary precise detection on APIs that trigger medium- and low-risk alarms (such as backtracking detailed logs or temporarily enabling record-by-record) to reduce false alarms. If the confidence level is greater than or equal to the preset confidence threshold, the target API is determined to be high-risk, and abnormal access to the target API is detected. An alarm is immediately triggered, and a synchronous callback is sent to the gateway to perform emergency handling such as rate limiting and blocking.

[0074] This application embodiment uses a bitmap data structure to store key information of API access requests in a time-series database. The bitmap compresses and stores this key information, significantly reducing the storage space required for massive, high-frequency request data. Simultaneously, the high efficiency of bitmap operations ensures real-time query and analysis performance. By comparing the bitmap of the target time window with the bitmap of a corresponding historical reference window in the time dimension to calculate the target confidence score, dynamic and adaptive anomaly detection is achieved. This breaks the limitation of relying on fixed thresholds and can sensitively identify abnormal accesses that deviate from historical access patterns, reducing false positives and false negatives. This application embodiment, using a time-series database and efficient bitmap operations, enables the entire process from data updates and historical data acquisition to target confidence score calculation to be completed in a very short time, achieving rapid real-time detection and response to abnormal API access, meeting the real-time risk control needs of high-concurrency scenarios.

[0075] In some embodiments, the key information also includes multiple access fields, and the target bitmap includes multiple access dimension bitmaps, with one access field corresponding to one access dimension bitmap. The key information of each request is updated to the target bitmap corresponding to the target time window based on the timestamp, including the following steps.

[0076] S221: Determine the target time window for each access request based on the timestamp.

[0077] S222: Determine the corresponding access dimension bitmap based on each access field within the target time window.

[0078] S223: Based on a hash algorithm, map each access field to the bit index of the corresponding access dimension bitmap.

[0079] In step S221, specifically, the access fields include the source IP (src IP), identity token / ID, and user agent. The access dimension bitmap includes an IP dimension bitmap, an identity token / ID dimension bitmap, and a user agent (UA) dimension bitmap. The IP dimension bitmap stores the source IP of events within the target time window, the identity token / ID dimension bitmap stores the identity token of events within the target time window, and the UA dimension bitmap stores the user agent of events within the target time window.

[0080] The system determines the target time window for each access request based on the timestamp. Specifically, the system matches the timestamp within an event with preset time windows (such as 10s, 1min, and 1h) to determine if the timestamp falls within the start and end time range of a specific time window. For example, if the timestamp of an event is 2025-11-06T10:05:03, it can be understood that the event falls within the 10-second time window 2025-11-06T10:05:00~10:05:09 and the 1-minute time window 2025-11-06T10:05:00~10:06:00. If the timestamp matches multiple time windows simultaneously, the event must be associated with all matching time windows.

[0081] In step S222, specifically, the system determines the access dimension bitmap corresponding to each access field (access source IP, identity state, user agent) based on the access fields of the events within the target time window, realizing the mapping of "access field - access dimension - access dimension bitmap", that is, the access source IP corresponds to the IP dimension bitmap, the identity state corresponds to the identity state dimension bitmap, and the user agent corresponds to the UA dimension bitmap. The system combines the target time window identifier, the target API identifier, and the target dimension identifier to locate the access dimension bitmap of [target API identifier × target time window identifier × target dimension identifier]. The target dimension identifier is one of the access source IP, identity state, and user agent.

[0082] In step S223, specifically, the system first preprocesses each access field. For example, it converts the IP address of the access source IP into the IPv4 / IPv6 standard format; normalizes the User Agent (UA) and generates a UA fingerprint; and parses the identity state to obtain identity information in a unified format.

[0083] The system maps each preprocessed access field to its corresponding bit index in the access dimension bitmap based on a preset hash algorithm. Specifically, the preset hash algorithm includes, but is not limited to, high-speed hash functions such as consistent hashing and SipHash. The system obtains the hash value corresponding to each preprocessed access field based on the preset hash algorithm, and then takes the modulo of the hash value with the bitmap length to obtain the bit index corresponding to that access field. In this embodiment, the bitmap length L can be set to 2. 20 Up to 2 26 Within the range.

[0084] It's important to note that after obtaining the bit index of the access dimension bitmap, a set-bit operation (i.e., setting it to 1) needs to be performed on the access dimension bitmap. For example, if the same access field appears multiple times (e.g., multiple accesses from the same IP address), only one set-bit operation is needed to ensure the bitmap's deduplication properties. The system supports merging bit indices for batch access requests, setting multiple bit indices of the same access dimension bitmap to 1 in batches to improve update efficiency. A bitmap is a data structure that uses binary bits (0 or 1) to represent data status. The value of the bit pointed to by each bit index is 1 or 0, and the radix of the bitmap refers to the number of bits in the bitmap that are 1.

[0085] The system serializes the bitmap and writes it to the target time-series database at preset intervals (e.g., every 1 second). The writing process follows transactional or eventual consistency strategies to ensure data integrity and time-series accuracy. The target time-series database is partitioned and stored according to [API identifier × time window identifier × dimension identifier]. The target time-series database is a preset time-series database that serves as the carrier of the bitmap time series. For example, the time-series database (TSDB) can be set to InfluxDB, ClickHouse time-series tables, OpenTSDB, or a dedicated TSDB. The time-series database has high-concurrency write capability (≥10kTPS).

[0086] It should be noted that bitmap snapshots and TSDB time series can provide a highly compressed and verifiable chain of evidence for subsequent manual auditing / judicial evidence collection (the corresponding timestamps of the bitmap and the original data samples can be exported), which facilitates evidence preservation and retrospection.

[0087] In some embodiments, the historical bitmap includes multiple historical access dimension bitmaps. Calculating a target confidence score based on the target bitmap and the historical bitmap includes the following steps: S241: For each access dimension, calculate multiple access feature values ​​based on the access dimension bitmap and the historical access dimension bitmap. The access dimension is used to characterize the access fields stored in the access dimension bitmap.

[0088] S242: Calculate the target confidence score based on each access feature value and a weighted linear model.

[0089] In step S241, specifically, for each access dimension, the system calculates multiple access feature values ​​based on the access dimension bitmap and the historical access dimension bitmap. The access dimension is used to characterize the access fields stored in the access dimension bitmap. Access fields include the source IP address, identity status, and user agent. For example, for each dimension (such as the source IP address), the system calculates multiple access feature values ​​based on the IP dimension bitmap corresponding to the target time window and the IP dimension bitmap corresponding to the historical reference window. The access dimension is used to characterize the access fields stored in the access dimension bitmap. The historical reference window can be a time window with the same time dimension as the previous second and / or a time window with the same time dimension as the previous day and / or a time window with the same time dimension as the previous week.

[0090] Similarly, for each dimension (such as identity state), the system calculates multiple access feature values ​​based on the identity state dimension bitmap corresponding to the target time window and the identity state dimension bitmap corresponding to the historical reference window. For each dimension (such as user agent), the system calculates multiple access feature values ​​based on the UA dimension bitmap corresponding to the target time window and the UA dimension bitmap corresponding to the historical reference window.

[0091] In step S242, specifically, the system determines whether the corresponding abnormal access rule is triggered based on each access feature value. The system then uses a weighted linear model to select the access feature values ​​that trigger the abnormal access rule and their corresponding preset weights, performs a weighted summation to obtain a comprehensive confidence score, and then normalizes the comprehensive confidence score to obtain the target confidence score.

[0092] In some embodiments, the target confidence score is calculated based on each access feature value and a weighted linear model, including the following steps: S2421: For each access dimension, determine whether to trigger the corresponding abnormal access rule based on each access feature value.

[0093] S2422: Select the access feature value that triggers the abnormal access rule and calculate the comprehensive confidence score using a weighted linear model.

[0094] S2423: Normalize the overall confidence score to obtain the target confidence score.

[0095] In step S2421, the access feature values ​​include cardinality, contrast ratio, and Z-score. For each access dimension, the system calculates the cardinality of the access dimension bitmap and the historical cardinality of the historical access dimension bitmap. The historical cardinality is the cardinality corresponding to the historical access dimension bitmap, and the contrast ratio is calculated based on the cardinality and the historical cardinality. The system obtains the average and standard deviation of the historical cardinality from multiple historical dimension bitmaps, and calculates the Z-score based on the cardinality and the average and standard deviation of the historical cardinality. For each access dimension, the system compares the cardinality with a cardinality threshold. If the cardinality is greater than the cardinality threshold, the corresponding abnormal access rule is triggered. The system compares the contrast ratio with a contrast ratio threshold. If the contrast ratio is greater than the contrast ratio threshold, the corresponding abnormal access rule is triggered. The system compares the Z-score with a Z-score threshold. If the Z-score is greater than the Z-score threshold, the corresponding abnormal access rule is triggered.

[0096] In step S2422, different abnormal access rules correspond to different preset weights. The system will obtain the preset weights corresponding to all abnormal access rules. Specifically, the system is configured with an abnormal access rule-preset weight mapping table, as shown in Table 1 above. The system can obtain the preset weights corresponding to all abnormal access rules through the abnormal access rule-preset weight mapping table.

[0097] The system uses a weighted linear model to select the access feature values ​​that trigger abnormal access rules and their corresponding preset weights, then performs a weighted summation to obtain a comprehensive confidence score. Specifically, the system obtains all access feature values ​​(such as cardinality, comparison multiple, and Z-score) that trigger abnormal access rules and normalizes these values ​​to obtain an isolated score. This embodiment uses a min-max normalization algorithm to normalize all access feature values ​​that trigger abnormal access rules. For example, the preset effective range for Z-scores is [0, 5], meaning a Z-score greater than 5 is counted as 5, and a Z-score less than 0 is counted as 0. If the Z-score for the identity access dimension of the target API is 3.5 (abnormal access rules have been triggered), the isolated score obtained after normalization using the min-max normalization algorithm is 0.7.

[0098] The system will multiply all isolated scores by the preset weights of the corresponding abnormal access rules and sum them to obtain a comprehensive confidence score.

[0099] Understandably, the system records the access characteristic value of an untriggered abnormal access rule as 0, and its product with the corresponding preset weight is 0.

[0100] In step S2423, the system will further normalize the comprehensive confidence score, for example, by using the Sigmoid function or min-max normalization, to obtain the target confidence score.

[0101] This application's embodiments overcome the shortcomings of traditional solutions, such as static thresholds and single dimensions, by using parallel comparison across multiple time windows and fusion of multi-dimensional confidence scores. Multi-time window comparison can simultaneously capture abnormal access patterns of different modes, such as instantaneous bursts and continuous low-frequency attacks, improving the comprehensiveness and recall rate of detection. Multi-dimensional confidence score fusion combines features such as IP address, identity status, and user agent for comprehensive judgment, avoiding false positives caused by fluctuations in a single indicator, and achieving high-precision abnormal access identification with a low false alarm rate.

[0102] In some embodiments, access feature values ​​include cardinality, contrast ratio, and Z-score. Multiple access feature values ​​are calculated based on an access dimension bitmap and a historical access dimension bitmap, including: S2411: For each access dimension, calculate the cardinality of the access dimension bitmap.

[0103] S2412: Calculate the historical cardinality of the historical access dimension bitmap. The historical cardinality is the cardinality corresponding to the historical access dimension bitmap.

[0104] S2413: Calculate the comparison multiple based on the base and historical base.

[0105] S2414: Get the mean and standard deviation of the historical cardinality in multiple historical dimension bitmaps.

[0106] S2415: Calculate the Z-score based on the base and the mean and standard deviation of historical bases.

[0107] In step S2411, specifically, the system quickly calculates the cardinality of the access dimension bitmap corresponding to the target time window using bitmap operations. For example, for the access dimension of the source IP, the system calculates the cardinality of the IP dimension bitmap corresponding to the target time window. Specifically, the system quickly calculates the cardinality of the IP dimension bitmap corresponding to the target time window using bitmap operations. For example, if the IP dimension bitmap is a bitmap type, popcount() is used to obtain the cardinality of the IP dimension bitmap; further, if the IP dimension bitmap is a RoaringBitmap type bitmap, getCardinality() is used to obtain the cardinality of the IP dimension bitmap. Similarly, for the access dimension of identity status, the system quickly calculates the cardinality of the identity status dimension bitmap corresponding to the target time window using bitmap operations. For the access dimension of user agent, the system quickly calculates the cardinality of the UA dimension bitmap corresponding to the target time window using bitmap operations.

[0108] In step S2412, the historical cardinality is the cardinality corresponding to the historical access dimension bitmap. The historical access dimension bitmap is the access dimension bitmap corresponding to the historical reference window. That is, the system will quickly calculate the cardinality of the access dimension bitmap corresponding to the historical reference window through bitmap operations. It can be understood that the system will calculate the cardinality of the IP dimension bitmap, identity state dimension bitmap, and UA dimension bitmap corresponding to the historical reference window respectively through bitmap operations.

[0109] In step S2413, specifically, the system calculates a comparison multiple based on the cardinality of the access dimension bitmap corresponding to the target time window and the cardinality of the access dimension bitmap corresponding to the historical reference window. For example, for the access source IP as an access dimension, the system calculates the comparison multiple based on the cardinality of the IP dimension bitmap corresponding to the target time window and the cardinality of the IP dimension bitmap corresponding to the historical reference window. Specifically, the comparison multiple is calculated by dividing the cardinality of the IP dimension bitmap corresponding to the target time window by the cardinality of the IP dimension bitmap corresponding to the historical reference window. The formula for calculating the comparison multiple is as follows:

[0110] Where r represents the comparison factor, This indicates the cardinality of the access dimension bitmap corresponding to the target time window. This indicates the cardinality of the access dimension bitmap corresponding to the history reference window.

[0111] Similarly, for the identity state access dimension, the system calculates the corresponding contrast ratio based on the cardinality of the identity state dimension bitmap corresponding to the target time window and the cardinality of the identity state dimension bitmap corresponding to the historical reference window. For the user agent access dimension, the system calculates the corresponding contrast ratio based on the cardinality of the UA dimension bitmap corresponding to the target time window and the cardinality of the UA dimension bitmap corresponding to the historical reference window.

[0112] In step S2414, specifically, the system calculates the cardinality of the access dimension bitmaps corresponding to multiple historical reference windows, and calculates the average and standard deviation of the cardinality of the access dimension bitmaps corresponding to multiple historical reference windows. Historical reference windows include, but are not limited to, time windows of the same time dimension from the previous second, the same time dimension from the previous day, and the same time dimension from the previous week. The system calculates the cardinality of the aforementioned historical reference windows, and calculates the average and standard deviation of the cardinality of the aforementioned historical reference windows. For example, for the access source IP as an access dimension, the system calculates the cardinality of the IP dimension bitmaps corresponding to multiple historical reference windows, and calculates the average and standard deviation of the cardinality of the IP dimension bitmaps corresponding to multiple historical reference windows. For the identity status as an access dimension, the system calculates the cardinality of the identity status dimension bitmaps corresponding to multiple historical reference windows, and calculates the average and standard deviation of the cardinality of the identity status dimension bitmaps corresponding to multiple historical reference windows. For the user agent as an access dimension, the system calculates the cardinality of the UA dimension bitmaps corresponding to multiple historical reference windows, and calculates the average and standard deviation of the cardinality of the UA dimension bitmaps corresponding to multiple historical reference windows.

[0113] In step S2415, the specific formula for calculating the Z-score is as follows:

[0114] Where z represents the Z-score. It is the cardinality of the access dimension bitmap corresponding to the target time window. This represents the average cardinality of the bitmap corresponding to multiple historical reference windows. The standard deviation of the cardinality of the bitmap corresponding to the access dimensions of multiple historical reference windows.

[0115] For example, the system calculates the Z-score based on the cardinality of the IP dimension bitmap corresponding to the target time window, the average cardinality of the IP dimension bitmaps corresponding to multiple historical reference windows, and the standard deviation. Similarly, for the identity status access dimension, the system calculates the corresponding Z-score based on the cardinality of the identity status dimension bitmap corresponding to the target time window, the average cardinality of the identity status dimension bitmaps corresponding to multiple historical reference windows, and the standard deviation. For the user agent access dimension, the system calculates the corresponding Z-score based on the cardinality of the UA dimension bitmap corresponding to the target time window, the average cardinality of the UA dimension bitmaps corresponding to multiple historical reference windows, and the standard deviation.

[0116] In some embodiments, determining whether to trigger a corresponding abnormal access rule based on access feature values ​​includes the following steps: for each access dimension, comparing the cardinality with a cardinality threshold; if the cardinality is greater than the cardinality threshold, triggering the corresponding abnormal access rule; comparing the comparison multiple with a multiple threshold; if the comparison multiple is greater than the multiple threshold, triggering the corresponding abnormal access rule; comparing the Z-score with a Z-score threshold; if the Z-score is greater than the Z-score threshold, triggering the corresponding abnormal access rule.

[0117] Specifically, for the access source IP as the access dimension, the system compares the cardinality of the IP dimension bitmap corresponding to the target time window with a cardinality threshold. If the cardinality of the IP dimension bitmap corresponding to the target time window is greater than the cardinality threshold, the corresponding abnormal access rule is triggered. The cardinality threshold can be set according to the time dimension of the time window. For example, in this embodiment, the cardinality threshold for a 10-second time window is set to 100.

[0118] The system compares the comparison multiple of the access source IP (access dimension) with a multiple threshold. If the comparison multiple is greater than the multiple threshold, the corresponding abnormal access rule is triggered. The multiple threshold can be set according to the time dimension of the time window. For example, in this embodiment, the multiple threshold for a 10-second time window is set to 4.

[0119] The system compares the Z-score of the access source IP (access dimension) with the Z-score threshold. If the comparison multiple is greater than the Z-score threshold, the corresponding abnormal access rule is triggered. The Z-score threshold can be set according to the time dimension of the time window. For example, in this embodiment, the multiple threshold for a 10-second time window is set to 3.

[0120] Understandably, for the two access dimensions of identity status and user agent, the system will similarly use the aforementioned method to determine whether to trigger the corresponding abnormal access rules based on cardinality, comparison multiple, and Z-score. The cardinality threshold, multiple threshold, and Z-score threshold for the three access dimensions are the same, which will not be elaborated further here.

[0121] In some embodiments, the historical reference window includes a first reference window and / or a second reference window and / or a third reference window. Obtaining a historical bitmap based on a target time series database includes: obtaining a historical bitmap corresponding to the first reference window based on the target time series database, wherein the first reference window is a time window with the same time dimension as the first time interval; and / or obtaining a historical bitmap corresponding to the second reference window based on the target time series database, wherein the second reference window is a time window with the same time dimension as the second time interval; and / or obtaining a historical bitmap corresponding to the third reference window based on the target time series database, wherein the third reference window is a time window with the same time dimension as the third time interval.

[0122] Specifically, the first time interval is one second, the second time interval is one day, and the third time interval is one week. That is, the first reference window is a time window of the previous second and the same time dimension, and the second reference window is a time window of the previous day and the same time dimension. The historical bitmap includes multiple historical access dimension bitmaps, which are access dimension bitmaps corresponding to the historical reference windows. The access dimension bitmaps include IP dimension bitmaps, identity state dimension bitmaps, and UA dimension bitmaps.

[0123] The system will retrieve the historical reference window corresponding to the target time window from the target time series database, and then read the corresponding IP dimension bitmap, identity state dimension bitmap and UA dimension bitmap based on the historical reference window.

[0124] Specifically, the system retrieves the historical bitmap corresponding to the first reference window from the target time-series database. For example, if the target time window is 2025-11-06T10:05:00~10:05:09, with a time dimension of 10 seconds, then the first reference window is 2025-11-06T10:04:59~10:05:08. The system will read the corresponding IP dimension bitmap, identity state dimension bitmap, and UA dimension bitmap from the target time-series database based on the first reference window 2025-11-06T10:04:59~10:05:08; and / or, The system will retrieve the historical bitmap corresponding to the second reference window based on the target time series database. For example, if the target time window is 2025-11-06T10:05:00~10:05:09, with a time dimension of 10 seconds, then the second reference window is 2025-11-05T10:05:00~10:05:09. The system will read the corresponding IP dimension bitmap, identity state dimension bitmap, and UA dimension bitmap from the target time series database based on the second reference window 2025-11-05T10:05:00~10:05:09; and / or, The system will retrieve the historical bitmap corresponding to the third reference window based on the target time series database. For example, if the target time window is 2025-11-06T10:05:00~10:05:09, and its time dimension is 10 seconds, then the third reference window is 2025-10-31T10:05:00~10:05:09. The system will read the corresponding IP dimension bitmap, identity state dimension bitmap, and UA dimension bitmap from the target time series database based on the third reference window 2025-10-31T10:05:00~10:05:09.

[0125] It is understood that historical reference windows include, but are not limited to, time windows of the same time dimension from the previous second, the previous day, and the previous week. In some embodiments, time windows of the same time dimension from other time intervals can also be selected as historical reference windows. The target time series database is partitioned and stored according to [API identifier × time window identifier × dimension identifier]. Based on the target API identifier and the time window identifier corresponding to the historical reference window, the system can read the corresponding IP dimension bitmap, identity state dimension bitmap, and UA dimension bitmap from the target time series database.

[0126] It should be noted that the target time series database supports storing bitmaps for 7 days or longer of historical time. The database possesses efficient time series retrieval and compression capabilities, supporting bitmap reading and performing bitwise operations such as union, intersection, and difference on arbitrary time intervals for rapid comparison. The system is partitioned by API or by time window, facilitating parallel writing and query expansion of the target time series database.

[0127] In some embodiments, hierarchical storage can be adopted, such as storing bitmap data from the most recent N hours in memory / Redis, and storing bitmap data older than N hours after compression by a time-series database on disk, which facilitates historical backtracking and saves costs.

[0128] In some embodiments, in addition to time-series databases, columnar databases (ClickHouse), object storage with indexes, or dedicated time-series databases can also be used as bitmap carriers and historical backtracking storage. In a cloud environment, cloud-native time-series services or object storage with Lambda computing can be used for on-demand loading and analysis.

[0129] In some embodiments, to address the risk of adversaries circumventing single-dimensional bitmap detection by distributing multiple IPs and multiple UAs, multi-dimensional joint judgment and parameter fingerprinting are added as countermeasures. First, multi-dimensional joint judgment integrates bitmap data from multiple dimensions such as IP, identity state, and UA to establish cross-dimensional correlation analysis, avoiding detection failures caused by single-dimensional distributed access. Second, parameter fingerprinting hashes request parameters to generate unique parameter fingerprints, associating identical parameter fingerprints from distributed accesses to accurately identify origin-based evasion behaviors and ensure detection integrity.

[0130] In some embodiments, event collection can also be performed at the edge proxy, CDN, or application server; non-intrusive monitoring can also be achieved based on passive mirroring (SPAN) or network TAP. For encrypted traffic scenarios, feature extraction is performed by combining gateway certificate termination and metadata (SNI, ALPN, TLS fingerprint).

[0131] It should be noted that in the above embodiments, there is no necessarily a certain order between the steps. Those skilled in the art can understand from the description of the embodiments of this application that the above steps may have different execution orders in different embodiments, that is, they may be executed in parallel or in turn, etc.

[0132] As another aspect of the embodiments of this application, this application provides an API abnormal access detection device. The API abnormal access detection device can be a software module, which includes several instructions stored in a memory. A processor can access the memory and execute the instructions to complete the API abnormal access detection method described in the various embodiments above.

[0133] In some implementations, the API abnormal access detection device can also be built from hardware devices. For example, the API abnormal access detection device can be built from one or more chips, and the chips can work together to complete the API abnormal access detection method described in the various implementations above. As another example, the API abnormal access detection device can also be built from various logic devices, such as general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), microcontrollers, ARM (Acorn RISC Machine) or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination of these components.

[0134] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of an API abnormal access detection device provided in an embodiment of this application. The API abnormal access detection device 300 provided in this embodiment includes a request acquisition module 301, a bitmap update module 302, a historical bitmap acquisition module 303, a confidence calculation module 304, and an abnormal access determination module 305.

[0135] The request acquisition module 301 is used to acquire access requests received by the target API within the target time window. The access requests carry key information, including timestamps. The bitmap update module 302 is used to update the key information of each access request to the target bitmap corresponding to the target time window based on the timestamp, and the target bitmap is stored in the target time series database; The historical bitmap acquisition module 303 is used to acquire a historical bitmap based on the target time series database. The historical bitmap is a bitmap corresponding to a historical reference window, and the historical reference time window is equal to the target time window in the time dimension. The confidence calculation module 304 is used to calculate the target confidence score based on the target bitmap and the historical bitmap; The abnormal access determination module 305 is used to determine that the target API has abnormal access if the target confidence score is greater than a preset confidence threshold.

[0136] Key information also includes multiple access fields, and the target bitmap includes multiple access dimension bitmaps. Each access field corresponds to one access dimension bitmap. The bitmap update module 302 is further specifically used to: determine the target time window corresponding to each access request based on the timestamp; determine the corresponding access dimension bitmap based on each access field within the target time window; and map each access field to the bit index of the corresponding access dimension bitmap based on a hash algorithm.

[0137] The confidence calculation module 304 is further specifically used for: calculating multiple access feature values ​​for each access dimension based on the access dimension bitmap and the historical access dimension bitmap, wherein the access dimension is used to characterize the access fields stored in the access dimension bitmap; and calculating the target confidence score based on each access feature value and a weighted linear model.

[0138] The confidence calculation module 304 is further specifically used for: determining whether a corresponding abnormal access rule is triggered based on each access feature value for each access dimension; selecting the access feature value that triggers the abnormal access rule and the weighted linear model to calculate a comprehensive confidence score; and normalizing the comprehensive confidence score to obtain the target confidence score.

[0139] Different abnormal access rules correspond to different preset weights. The confidence calculation module 304 is further specifically used to: obtain the preset weights corresponding to all abnormal access rules; and, based on the weighted linear model, select the access feature value that triggers the abnormal access rule and the corresponding preset weight for weighted summation to obtain the comprehensive confidence score.

[0140] The access feature values ​​include cardinality, contrast ratio, and Z-score. The confidence calculation module 304 is further specifically used for: calculating the cardinality of the access dimension bitmap for each access dimension; calculating the historical cardinality of the historical access dimension bitmap, wherein the historical cardinality is the cardinality corresponding to the historical access dimension bitmap; calculating the contrast ratio based on the cardinality and the historical cardinality; obtaining the average and standard deviation of the historical cardinality in multiple historical dimension bitmaps; and calculating the Z-score based on the cardinality and the average and standard deviation of the historical cardinality.

[0141] The confidence calculation module 304 is also specifically used to: for each access dimension, compare the cardinality with the cardinality threshold, and if the cardinality is greater than the cardinality threshold, trigger the corresponding abnormal access rule; The comparison factor is compared with the factor threshold. If the comparison factor is greater than the factor threshold, the corresponding abnormal access rule is triggered. The Z score is compared with the Z score threshold. If the Z score is greater than the Z score threshold, the corresponding abnormal access rule is triggered.

[0142] The historical reference window includes a first reference window and / or a second reference window and / or a third reference window. The historical bitmap acquisition module 303 is further specifically used for: acquiring the historical bitmap corresponding to the first reference window based on the target time series database, wherein the first reference window is a time window with the same time dimension as the first time interval; and / or, acquiring the historical bitmap corresponding to the second reference window based on the target time series database, wherein the second reference window is a time window with the same time dimension as the second time interval; and / or, acquiring the historical bitmap corresponding to the third reference window based on the target time series database, wherein the third reference window is a time window with the same time dimension as the third time interval.

[0143] It should be noted that the above-described API abnormal access detection device can execute the API abnormal access detection method provided in the embodiments of this application, and has the corresponding functional modules and beneficial effects of the method. Technical details not described in detail in the embodiments of the API abnormal access detection device can be found in the API abnormal access detection method provided in the embodiments of this application.

[0144] See Figure 4 , Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. The computer device includes one or more processors 41 and a memory 42. The memory 42 is connected to one or more processors 41, for example, via a bus.

[0145] Processor 41 is configured to support the computer device in performing the corresponding functions in the methods described in the above method embodiments. Processor 41 may be a central processing unit (CPU), a network processor (NP), a hardware chip, or any combination thereof. The aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0146] Memory 42 is used to store program code, etc. Memory 42 may include volatile memory (VM), such as random access memory (RAM); memory 42 may also include non-volatile memory (NVM), such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); memory 42 may also include combinations of the above types of memory.

[0147] The memory 42 can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as the program instructions / modules corresponding to the API abnormal access detection method in the embodiments of this application. The processor 41 executes various functional applications and data processing of the API abnormal access detection method and API abnormal access detection device by running the non-volatile software programs, instructions, and modules stored in the memory, that is, it realizes the functions of each module or unit of the API abnormal access detection method and API abnormal access detection device provided in the above method embodiments.

[0148] The memory 42 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function. The data storage area may store data created based on the use of the API anomaly access detection device. In some embodiments, the memory 42 may optionally include memory remotely configured relative to the processor, which can be connected to the API anomaly access detection device via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0149] The one or more modules are stored in the memory 42. When executed by the one or more processors 41, they execute the API abnormal access detection method in any of the above method embodiments. For example, they execute the method steps described in the above method embodiments to realize the functions of the modules described in the above device embodiments.

[0150] This application also provides a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the method described in the foregoing embodiments.

[0151] This application provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described above.

[0152] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0153] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. An API exception access detection method, characterized by, The method comprises: obtaining access requests received by a target API within a target time window, the access requests carrying key information including a timestamp; updating the key information of each access request to a target bitmap corresponding to the target time window based on the timestamp, the target bitmap being stored in a target time series database; obtaining a historical bitmap based on the target time series database, the historical bitmap being a bitmap corresponding to a historical reference window, the historical reference time window being equal to the target time window in the time dimension; calculating a target confidence score based on the target bitmap and the historical bitmap; if the target confidence score is greater than a preset confidence threshold, determining that the target API has abnormal access.

2. The method of claim 1, wherein, The key information further comprises a plurality of access fields, and the target bitmap comprises a plurality of access dimension bitmaps, one access field corresponding to one access dimension bitmap, and the updating of the key information of each request to the target bitmap corresponding to the target time window based on the timestamp comprises: determining a target time window corresponding to each access request based on the timestamp; determining a corresponding access dimension bitmap based on each access field within the target time window; mapping each access field to a bit index of the corresponding access dimension bitmap based on a hash algorithm.

3. The method of claim 2, wherein, The historical bitmap comprises a plurality of historical access dimension bitmaps, and the calculating of the target confidence score based on the target bitmap and the historical bitmap comprises: for each access dimension, calculating a plurality of access feature values based on the access dimension bitmap and the historical access dimension bitmap, the access dimension being used to represent the access field stored in the access dimension bitmap; calculating the target confidence score based on each access feature value and a weighted linear model.

4. The method of claim 3, wherein, The calculating of the target confidence score based on each access feature value and a weighted linear model comprises: for each access dimension, judging whether a corresponding abnormal access rule is triggered based on each access feature value; selecting the access feature value and the weighted linear model that trigger the abnormal access rule to calculate a comprehensive confidence score; normalizing the comprehensive confidence score to obtain the target confidence score.

5. The method of claim 4, wherein, Different abnormal access rules correspond to different preset weights, and the selecting of the access feature value and the weighted linear model that trigger the abnormal access rule to calculate a comprehensive confidence score comprises: obtaining the preset weights corresponding to all abnormal access rules; based on the weighted linear model, selecting the access feature value and the corresponding preset weight that trigger the abnormal access rule to perform weighted summation to obtain the comprehensive confidence score.

6. The method of claim 4, wherein, The access feature value comprises a cardinality, a comparison multiple, and a Z-score, and the calculating of a plurality of access feature values based on the access dimension bitmap and the historical access dimension bitmap comprises: for each access dimension, calculating the cardinality of the access dimension bitmap; calculating a historical cardinality of the historical access dimension bitmap, the historical cardinality being a cardinality corresponding to the historical access dimension bitmap; calculating the comparison multiple based on the cardinality and the historical cardinality; obtaining an average value and a standard deviation of the historical cardinalities in the plurality of historical dimension bitmaps; calculating the Z-score based on the cardinality and the average value and the standard deviation of the historical cardinalities.

7. The method of claim 6, wherein, The determining whether to trigger the corresponding abnormal access rule based on the access feature value comprises: comparing the cardinality with a cardinality threshold for each access dimension, and if the cardinality is greater than the cardinality threshold, triggering the corresponding abnormal access rule; comparing the comparison multiple with a multiple threshold, and if the comparison multiple is greater than the multiple threshold, triggering the corresponding abnormal access rule; comparing the Z-score with a Z-score threshold, and if the Z-score is greater than the Z-score threshold, triggering the corresponding abnormal access rule.

8. The method of claim 1, wherein, The historical reference window comprises a first reference window and / or a second reference window and / or a third reference window, and the obtaining the historical bitmap based on the target time series database comprises: obtaining a historical bitmap corresponding to the first reference window based on the target time series database, the first reference window being a time window of a first time interval and a same time dimension; and / or obtaining a historical bitmap corresponding to the second reference window based on the target time series database, the second reference window being a time window of a second time interval and a same time dimension; and / or obtaining a historical bitmap corresponding to the third reference window based on the target time series database, the third reference window being a time window of a third time interval and a same time dimension.

9. A computer device, comprising: The computer device comprises a memory and a processor, the memory being connected to the processor, the processor being used to execute one or more computer programs stored in the memory, and the processor, when executing the one or more computer programs, causes the computer device to implement the method according to any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, the computer program comprising program instructions, and the program instructions, when executed by a processor, cause the processor to execute the method according to any one of claims 1-8.

Images