An API behavior hierarchical perception modeling method, system, device and medium based on multi-modal feature fusion

Abstract

This invention discloses a method, system, device, and medium for hierarchical perception modeling of API behavior based on multimodal feature fusion, belonging to the field of API modeling technology. The method includes: processing API call behavior data through multimodal feature fusion to generate a fused feature matrix and modal weights; performing multi-level semantic encoding based on temporal sequence and dependency relationships to form a behavioral semantic graph and hierarchical feature representation; calculating behavioral deviation to generate risk scores, anomaly lists, and grading results; monitoring new data and adaptively updating the model, outputting model iteration versions and drift reports; and performing interpretable analysis based on risk scores, weight distribution, and semantic graphs to generate a visualized risk association view. This invention improves the accuracy of panoramic understanding and anomaly identification of complex API behaviors through multimodal feature fusion and hierarchical semantic modeling, ensuring stable detection performance in dynamic environments and effectively solving the model degradation problem.

Description

Technical Field

[0001] This invention relates to the field of API modeling technology, and specifically to a hierarchical perception modeling method, system, device, and medium for API behavior based on multimodal feature fusion. Background Technology

[0002] Although research on API interface anomaly detection has gradually increased in recent years, covering a variety of methods from traditional rule matching to machine learning and deep learning, current mainstream technologies still have many problems.

[0003] First, most existing methods generally lack the ability to comprehensively model multi-source heterogeneous information. Especially in API security detection, existing research often only considers data features of a single modality, such as request parameters, response status codes, or call frequency, while neglecting the inherent relationship between request context, user profile, device attributes, and call semantics. As a result, it is difficult to comprehensively characterize API behavior. Secondly, in complex environments involving multiple scenarios and systems, the model's generalization ability is often insufficient. Most methods treat API calls as independent events, performing detection solely based on static features, lacking an understanding of behavioral semantics, call logic, and contextual dependencies. Once the runtime environment changes, the model's performance becomes difficult to maintain stability.

[0004] Another key shortcoming lies in the lack of temporal and contextual features. Most current API detection systems use a single request as the smallest unit of analysis, failing to fully utilize the behavioral dependencies within a continuous call sequence. In summary, existing technologies have significant limitations in multimodal feature fusion, hierarchical behavior perception, temporal logic modeling, and model adaptability, making it difficult to meet the demands for refined perception and intelligent detection of API call behavior in complex dynamic environments. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention provides a method, system, device and medium for hierarchical perception modeling of API behavior based on multimodal feature fusion.

[0006] Therefore, the technical problem solved by this invention is that most current methods still use a single request as the smallest unit of analysis, lack abstract modeling of behavioral patterns, call paths and long-term evolution trends, cannot identify latent anomalies composed of multiple stage actions, and the existing detection frameworks do not provide sufficient support for the adaptability and interpretability of the model.

[0007] To address the aforementioned technical problems, this invention provides the following technical solution: a hierarchical perceptual modeling method for API behavior based on multimodal feature fusion, comprising, It receives multi-dimensional API call behavior source data as input, uses multi-modal feature fusion, and outputs a multi-modal fusion feature matrix and modality weight distribution.

[0008] Using a multimodal fusion feature matrix, a call time sequence, and a call dependency graph as input, hierarchical feature representation and behavioral semantic graph are output through multi-level semantic encoding.

[0009] Based on the hierarchical feature representation, the behavioral deviation from the normal baseline distribution is calculated, and a risk score set, an abnormal behavior list, and a behavior classification result are generated according to the deviation.

[0010] Monitor new API call streams and current model parameters, and output the updated model and drift detection report through adaptive model updates.

[0011] Based on the risk score, modal weights, and behavioral semantic graph, interpretability analysis is performed, and visual analysis results are output to identify key risk features and behavioral associations.

[0012] Based on the visualization analysis results, the updated model version is output through closed-loop optimization, and an evolution trend curve and performance convergence plot are generated.

[0013] As a preferred embodiment of the API behavior hierarchical perception modeling method based on multimodal feature fusion described in this invention, wherein: the multimodal feature fusion includes, Multimodal coding functions are used to extract feature vectors for each modality.

[0014] The feature vectors of each modality are weighted and fused according to their importance to obtain a unified multimodal feature set.

[0015] As a preferred embodiment of the API behavior hierarchical perception modeling method based on multimodal feature fusion described in this invention, the multi-level semantic encoding includes: Layered modeling is performed sequentially, consisting of the base layer, the pattern layer, and the intent layer.

[0016] It captures the structural properties of a single call, learns the call patterns and periodicity, and learns the dependencies and semantic relationships between behaviors, through graph convolution propagation and semantic aggregation.

[0017] As a preferred embodiment of the API behavior hierarchical perception modeling method based on multimodal feature fusion described in this invention, wherein: the calculation of the behavior deviation from the normal baseline distribution includes, Errors reconstructed based on normal behavior models measure the degree of behavioral deviation.

[0018] Risk scores are calculated by combining semantic similarity with contrastive learning loss.

[0019] Anomaly levels are determined using an adaptive threshold mechanism.

[0020] As a preferred embodiment of the API behavior hierarchical perception modeling method based on multimodal feature fusion described in this invention, the adaptive model update includes: The model is updated by calculating the drift of the feature distribution, and the modal weights and model parameters are dynamically adjusted.

[0021] A contrastive learning mechanism is introduced to maintain the normal feature margin or the abnormal feature margin.

[0022] The beneficial effects of this preferred technical solution are that by calculating the feature distribution drift and triggering model updates, it achieves autonomous adaptation to the dynamic API environment, which can effectively alleviate the problem of model performance degradation caused by changes in data distribution; by introducing a contrastive learning mechanism to maintain the feature interval, it enhances the model's ability to distinguish between normal and abnormal behavior.

[0023] As a preferred embodiment of the API behavior hierarchical perception modeling method based on multimodal feature fusion described in this invention, the step of performing interpretability analysis and outputting visual analysis results for identifying key risk features and behavioral correlations includes: Calculate the contribution of each modality feature to the risk score, and identify the key features and behavioral paths that trigger anomalies.

[0024] Generate visual analysis results that can characterize key risk features and behavioral correlations, and output interpretable reports and risk link tracing results.

[0025] The beneficial effects of this preferred technical solution are that by calculating the contribution of features and identifying key behavioral paths, the complex decision-making process inside the model is transformed into intuitive and understandable visual information, which enhances the interpretability and operability of anomaly detection results; its output of visual analysis reports and risk link tracing results can help security operation and maintenance personnel quickly locate the root cause of anomalies and understand attack patterns.

[0026] As a preferred embodiment of the API behavior hierarchical perception modeling method based on multimodal feature fusion described in this invention, the closed-loop optimization includes: Based on the anomaly detection results, interpretability analysis report, and performance monitoring metrics, determine whether to trigger model retraining.

[0027] When performance degradation or data distribution drift is detected, the model update and feature baseline reconstruction process is automatically initiated.

[0028] By adjusting the distribution of input data and model parameters, the model is iterated and an updated model version is output.

[0029] The beneficial effects of this preferred technical solution are that by constructing a closed-loop feedback mechanism based on detection results, interpretation reports, and performance indicators, it achieves fully automated evolution from perception and detection to self-optimization; it can respond in real time to changes in the API environment and new attack methods, and effectively maintain the long-term performance stability and continuous evolution capability of the model by adaptively updating model parameters and reconstructing feature baselines.

[0030] This invention provides an API behavior hierarchical perception modeling system based on multimodal feature fusion.

[0031] To address the aforementioned technical problems, this invention provides the following technical solution: a hierarchical API behavior perception modeling system based on multimodal feature fusion, comprising: a multimodal feature extraction and fusion module, a hierarchical behavior perception modeling module, an anomaly detection and risk assessment module, a model adaptation and continuous learning module, an interpretability analysis and visualization module, and a feedback control and closed-loop optimization module.

[0032] The multimodal feature extraction and fusion module receives multi-dimensional API call behavior source data as input, performs multimodal feature fusion, and outputs a multimodal fusion feature matrix and modality weight distribution.

[0033] The hierarchical behavior perception modeling module takes a multimodal fusion feature matrix, a call time sequence, and a call dependency graph as input, and outputs a hierarchical feature representation and a behavior semantic map through multi-level semantic encoding.

[0034] The anomaly detection and risk assessment module calculates the behavioral deviation from the normal baseline distribution based on the hierarchical feature representation, and generates a risk score set, an abnormal behavior list, and a behavior classification result based on the deviation.

[0035] The model adaptation and continuous learning module monitors new API call streams and current model parameters, and outputs the updated model and drift detection report through adaptive model updates.

[0036] The interpretability analysis and visualization module performs interpretability analysis based on the risk score, modal weights, and behavioral semantic graph, and outputs visualization analysis results to identify key risk features and behavioral associations.

[0037] The feedback control and closed-loop optimization module, based on the visualization analysis results, outputs an updated model version and generates an evolution trend curve and performance convergence graph through closed-loop optimization.

[0038] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the API behavior hierarchical perception modeling method based on multimodal feature fusion.

[0039] The present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the API behavior hierarchical perception modeling method based on multimodal feature fusion.

[0040] The beneficial effects of this invention are as follows: By using multimodal feature fusion and hierarchical semantic modeling, this invention improves the accuracy of panoramic understanding and anomaly identification of complex API behaviors; its introduced adaptive optimization mechanism ensures stable detection performance in dynamic environments, effectively solving the problem of model degradation; at the same time, the enhanced interpretability design and modular structure not only improve the transparency and credibility of security decisions, but also endow them with portability and scalability, providing an efficient, intelligent and sustainably evolving solution for API security protection in multiple scenarios. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 The above is a flowchart of an API behavior hierarchical perception modeling method based on multimodal feature fusion, which is provided as an embodiment of the present invention.

[0043] Figure 2 This is a schematic diagram of a scheme for an API behavior hierarchical perception modeling system based on multimodal feature fusion, provided as an embodiment of the present invention. Detailed Implementation

[0044] To make the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0045] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides a hierarchical perceptual modeling method for API behavior based on multimodal feature fusion, comprising: S1. Receive multi-dimensional API call behavior source data as input, use multi-modal feature fusion, and output multi-modal fusion feature matrix and modality weight distribution.

[0046] S2. Taking the multimodal fusion feature matrix, call time sequence and call dependency graph as input, it outputs hierarchical feature representation and behavioral semantic map through multi-level semantic encoding.

[0047] S3. Calculate the behavioral deviation from the normal baseline distribution based on the hierarchical feature representation, and generate a risk score set, an abnormal behavior list, and a behavior classification result based on the deviation.

[0048] S4. Monitor the new API call flow and current model parameters, and output the updated model and drift detection report through adaptive model updates.

[0049] S5. Based on the risk score, modal weights, and behavioral semantic graph, perform interpretability analysis and output visual analysis results to identify key risk features and behavioral associations.

[0050] S6. Based on the visualization analysis results, through closed-loop optimization, output the updated model version and generate the evolution trend curve and performance convergence graph.

[0051] This invention constructs a complete technical system encompassing multimodal feature fusion, hierarchical behavior perception, adaptive anomaly detection, interpretability analysis, and closed-loop optimization. This system enables deep modeling of API behavior from data-level representation to semantic-level understanding, improving the accuracy, robustness, and interpretability of anomaly detection in complex dynamic environments.

[0052] Example 2, an embodiment of the present invention, provides a hierarchical perception modeling method for API behavior based on multimodal feature fusion, based on the previous embodiment, including: The multi-dimensional API call behavior source data in S1 includes: API Request Dataset (Including URL, parameter fields, call time, request frequency, etc.)

[0053] in, These represent the request characteristics of the API call requests from the 1st to the nth time.

[0054] API response dataset (Includes status codes, delays, structural differences, and exception fields).

[0055] in, Each represents a record of the response behavior corresponding to a different API call request. Used to describe the behavioral characteristics of an API call on the response side.

[0056] Context Dataset (Including user identity, device, IP, region, and role information).

[0057] in, These represent the context behavior records corresponding to different API call requests, each... Used to describe the context and subject characteristics of an API call.

[0058] Historical behavioral baseline set (Record the periodic distribution statistics and characteristic mean).

[0059] in, ={ , , } This represents the comprehensive feature representation of the i-th API call behavior in the multimodal space, used to characterize the overall behavioral state of the call under the constraints of request, response, context, and historical baseline.

[0060] The multimodal feature fusion in S1 includes steps A1-A2: A1. Use a multimodal coding function to extract the feature vectors of each modality.

[0061] A2. Weight and fuse the feature vectors of each modality according to their importance to obtain a unified multimodal feature set.

[0062] In this embodiment, the importance weighting and fusion in A2 involves calculating modal weights through an attention mechanism and performing cross-modal weighted fusion. Specifically, this includes employing a multimodal coding function. Extract feature vectors.

[0063] Where m represents the modality type (request data, response data, morning / afternoon data, historical behavior baseline set): Modal weights are calculated using an attention mechanism. And perform cross-modal weighted fusion.

[0064] Where i represents the nth extracted feature vector: A unified multimodal feature set is obtained .

[0065] Output multimodal fusion feature matrix and modal weight distribution This is used for feature dependency control in subsequent hierarchical models.

[0066] In one alternative implementation, importance weighting and fusion can be achieved through a gating fusion mechanism. Specifically, a gating value is calculated for each modal feature vector. This gating value is dynamically generated based on the current calling context and the statistical dependencies between each modal feature. Finally, the gating weights are used to sum the modal feature vectors to obtain the fused unified feature representation.

[0067] In another alternative implementation, importance weighting and fusion can also be achieved through feature concatenation and fully connected mapping. Specifically, the feature vectors of each modality are first concatenated, and then a multilayer perceptron is used for nonlinear mapping and dimensionality reduction, so that the network can automatically learn and implicitly achieve cross-modal feature weighting and fusion, and output a unified multimodal feature representation.

[0068] Furthermore, the multi-level semantic encoding in S2 includes steps B1-B2: B1. Perform layered modeling of the base layer, pattern layer and intent layer in sequence.

[0069] In S2, the result of S1, i.e., the multimodal feature matrix, needs to be input. It also includes calling time sequence. Call the dependency graph .

[0070] Specifically: Base layer: Captures the structural properties (parameters, delays, field changes) of a single call.

[0071] Pattern layer: Learns call patterns and periodicity through temporal convolution and window aggregation.

[0072] Intent layer: Learns the dependencies and semantic relationships between behaviors based on graph neural networks.

[0073] Semantic aggregation between the three layers is achieved through the graph convolution propagation formula: in, This represents the feature representation of the nodes in the l-th layer. This represents the feature representation of the (l+1)th layer node after semantic propagation and aggregation. Represents the dependency graph of API calls The constructed adjacency matrix is ​​used to characterize the structural dependencies between API call behaviors; Let F represent the feature transformation weight matrix corresponding to the l-th layer; F represents the unified feature matrix obtained by fusing multimodal features. This represents the bias or mapping matrix used to fuse multimodal features; This represents a non-linear activation function.

[0074] B2. Capture the structural attributes of a single call, learn the call patterns and periodicity, and learn the dependencies and semantic relationships between behaviors, through graph convolution propagation and semantic aggregation.

[0075] Specifically, deep semantic aggregation is performed on the aggregation results of the previous layer. in, This represents the behavioral semantic graph representation obtained through deep semantic aggregation; Let l represent the behavioral feature representation corresponding to the l-th level, where l=1 represents the basic layer feature representation, l=2 represents the pattern layer feature representation, and l=3 represents the intent layer feature representation. This represents the weight coefficient of the l-th level feature in the semantic aggregation process, used to characterize the degree of contribution of different level features to the final semantic representation; This represents a semantic aggregation function, used to weight and fuse behavioral feature representations at different levels to generate a unified behavioral semantic graph representation.

[0076] Output hierarchical feature representation Behavioral semantic graph This is used for anomaly identification in the next stage.

[0077] In this embodiment, the behavioral deviation between the calculation in S3 and the normal baseline distribution is calculated by comparing the autoencoder reconstruction error with the semantic similarity loss, specifically including the input hierarchical representation. Normal baseline distribution Reconstructing features The degree of behavioral deviation is measured using the autoencoder reconstruction error, denoted as . in, This represents the refactoring error corresponding to the i-th API call behavior, used to measure the degree of deviation between this behavior and the normal behavior pattern; A hierarchical feature representation of the behavior of the i-th API call; This represents the reconstructed feature representation obtained by reconstructing the hierarchical feature representation using a normal behavior model. Represents the L2 norm operation. This represents the square of the L2 norm.

[0078] The risk score is calculated by combining semantic similarity and contrastive learning loss, and is expressed as follows: in, This represents the risk score corresponding to the i-th API call behavior; This represents the reconstruction error of the i-th API call behavior, used to measure the degree of deviation between this behavior and the normal behavior baseline; The hierarchical feature representation of the behavior of the i-th API call. This represents the reference behavior feature representation corresponding to the i-th API call behavior; Cosine similarity represents the similarity between two sets of feature representations, used to characterize the degree of similarity between different behaviors in the semantic space; and This represents the weighting coefficient used to balance the influence of the reconstruction error term and the semantic similarity term.

[0079] Anomaly levels are determined using an adaptive threshold mechanism.

[0080] Output risk score set List of Abnormal Behaviors Behavioral classification results .

[0081] In one alternative implementation, the deviation of behavior from the normal baseline distribution can be calculated by fitting the decision boundary and measuring the deviation based on a one-class support vector machine (One-Class SVM). Specifically, a one-class support vector machine is trained using historical normal behavior data to construct a hyperplane boundary for normal behavior in the feature space. For the behavior to be detected, the degree of deviation between the behavior and the normal baseline distribution is measured by calculating its distance to the hyperplane or determining whether it falls outside the normal region defined by the hyperplane.

[0082] In another alternative implementation, the deviation of behavior from the normal baseline distribution can also be calculated by estimating the probability distribution and calculating the negative log-likelihood using a Gaussian mixture model. Specifically, a Gaussian mixture model is used to model the probability density of the hierarchical feature representation of normal behavior. For new input behavioral features, the probability density or negative log-likelihood value under the mixture model is calculated, and behaviors with a probability density lower than a preset threshold or a negative log-likelihood value higher than a set threshold are judged as deviations from the normal distribution.

[0083] Furthermore, the calculation of behavioral deviation from the normal baseline distribution in S3 includes steps C1-C3: C1. Reconstructing errors based on normal behavior models measures the degree of behavioral deviation.

[0084] C2. Calculate the risk score by combining semantic similarity and contrastive learning loss.

[0085] C3. Determine the anomaly level through an adaptive threshold mechanism.

[0086] In this embodiment, the normal behavior model in C1 uses an autoencoder; specifically, based on the autoencoder model, the hierarchical features of the input are represented. After encoding and decoding, its reconstructed output is obtained. This reconstruction error Defined as primitive features , and reconstructed features The square of the Euclidean distance between the two (i.e., the square of the L2 norm) is used to measure the degree of deviation between the sample behavior and the normal pattern learned by the model.

[0087] In one alternative implementation, the normal behavior model can be based on probabilistic reconstruction and KL divergence evaluation using a variational autoencoder. Specifically, a probability distribution model of hierarchical features of normal behavior is performed using a variational autoencoder. The mean and variance distribution of the latent space are learned during the encoding stage, and features are reconstructed from this distribution during the decoding stage. The deviation of behavior is comprehensively evaluated by calculating the reconstruction error and combining it with the KL divergence between the latent distribution and the prior distribution.

[0088] In another alternative implementation, the normal behavior model can also be based on anomaly scoring of isolated forests. Specifically, the isolated forest algorithm is used to train historical normal behavior data to construct multiple randomly divided isolated trees. For the behavior feature to be detected, the anomaly score is obtained by calculating its average path length in all isolated trees. This score directly represents the degree of deviation of the behavior from the normal baseline.

[0089] Furthermore, the adaptive model update in S4 includes steps D1-D2: D1. Calculate the feature distribution drift to trigger model updates and dynamically adjust modal weights and model parameters.

[0090] The model mentioned in this invention is the Hierarchical Multimodal API Behavior Perception Model (HM-ABPM). This invention addresses the shortcomings of existing API behavior awareness models in terms of multimodal fusion, hierarchical semantic modeling, and adaptive evolution capabilities. It proposes and optimizes a multimodal hierarchical API behavior awareness model (HM-ABPM) and provides a modeling method based on this model.

[0091] In this step, you need to enter the new API call stream. Current parameter set Abnormal behavior set .

[0092] Calculate the characteristic distribution drift: Update modal weights With model parameters .

[0093] D2. Introduce a contrastive learning mechanism to maintain the normal feature margin or the abnormal feature margin.

[0094] The contrastive learning mechanism maintains the normal / abnormal feature interval as follows: Output the updated model and drift detection report .

[0095] In the embodiments of this application, the interpretability analysis in S5 is to calculate the feature contribution and generate a modal heatmap and call path visualization, and output an interpretability report. Specifically, based on risk scores, modal weights and behavioral semantic graphs, feature contribution is calculated and a modal heatmap and call path visualization are generated, and an interpretability report, a behavioral semantic visualization graph and risk link tracing results are output.

[0096] Enter risk score Modal weights and hierarchical maps .

[0097] Calculate the feature contribution: in, This indicates the degree of influence of the modal features used to characterize the risk assessment result in the i-th API call behavior; This represents the risk score corresponding to the i-th API call behavior; This represents the feature representation of the behavior of the i-th API call in the m-th modality; It represents the partial derivative of the risk score with respect to the corresponding modal feature, and is used to measure the sensitivity of the risk score to changes in modal features.

[0098] Generate modal heatmaps and visualize call paths.

[0099] Mark the key feature nodes that trigger risks.

[0100] Output interpretability report Behavioral semantic visualization maps and risk link tracing results.

[0101] In one alternative implementation, interpretability analysis can be based on feature attribution and global interpretation of SHAP values. Specifically, for the risk scoring model, the SHAP method is used to calculate the contribution value of each modal feature to the final risk score; feature importance ranking charts and local decision dependency charts are generated based on the SHAP values ​​to visualize key features and their positive and negative impacts on the risk score, and a structured interpretability report is output to clearly identify the core features and decision paths on which high-risk determination depends.

[0102] In another alternative implementation, interpretability analysis can also utilize decision tree rule extraction and critical path visualization: based on risk scoring results and hierarchical feature representation, an interpretable alternative model (such as a decision tree or rule set) is trained to extract key decision rules that affect risk levels; the rules are mapped back to the original feature space to generate a risk tracing path diagram based on the rule triggering order, and an interpretable report containing rule descriptions, triggering conditions, and confidence levels is output, realizing a transparent inference link display from features to risk levels.

[0103] Furthermore, S5 involves interpretability analysis and outputting visual analysis results for identifying key risk characteristics and behavioral correlations, including steps E1-E2: E1. Calculate the contribution of each modal feature to the risk score and identify the key features and behavioral paths that trigger anomalies.

[0104] E2. Generate visual analysis results that can characterize key risk features and behavioral correlations, and output interpretable reports and risk link tracing results.

[0105] Furthermore, the closed-loop optimization in S6 includes steps F1-F3: F1. Based on the anomaly detection results, interpretability analysis report, and performance monitoring indicators, determine whether to trigger model retraining.

[0106] Input anomaly detection results, interpretability reports, and performance monitoring metrics. .

[0107] F2. When performance degradation or data distribution drift is detected, the model update and feature baseline reconstruction process is automatically initiated.

[0108] Specifically, automatic retraining is triggered when detection performance deteriorates or drift reports are abnormal.

[0109] By updating the feature baseline Adjust the distribution of input data.

[0110] Output the new version of the model parameters and strategies.

[0111] F3. By adjusting the distribution of input data and model parameters, the model iteration is completed and an updated model version is output.

[0112] Output the updated model version And the evolution trend curve and performance convergence plot.

[0113] Example 3, referring to Figure 2 This embodiment of the present invention provides an API behavior hierarchical perception modeling system based on multimodal feature fusion, including: a multimodal feature extraction and fusion module, a hierarchical behavior perception modeling module, an anomaly detection and risk assessment module, a model adaptation and continuous learning module, an interpretability analysis and visualization module, and a feedback control and closed-loop optimization module.

[0114] The multimodal feature extraction and fusion module receives multi-dimensional API call behavior source data as input, performs multimodal feature fusion, and outputs a multimodal fusion feature matrix and modality weight distribution.

[0115] The hierarchical behavior perception modeling module takes a multimodal fusion feature matrix, a call time sequence, and a call dependency graph as input, and outputs a hierarchical feature representation and a behavior semantic map through multi-level semantic encoding.

[0116] The anomaly detection and risk assessment module calculates the behavioral deviation from the normal baseline distribution based on hierarchical feature representation, and generates a risk score set, an abnormal behavior list, and behavioral classification results based on the deviation.

[0117] The model adaptation and continuous learning module monitors new API call streams and current model parameters, and outputs the updated model and drift detection report through adaptive model updates.

[0118] The interpretability analysis and visualization module performs interpretability analysis based on risk scores, modal weights, and behavioral semantic graphs, and outputs visualization analysis results to identify key risk features and behavioral associations.

[0119] The feedback control and closed-loop optimization module, based on the results of visualization analysis, outputs an updated model version and generates an evolution trend curve and performance convergence plot through closed-loop optimization.

[0120] This embodiment also provides an electronic device applicable to a hierarchical perceptual modeling method for API behavior based on multimodal feature fusion, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the hierarchical perceptual modeling method for API behavior based on multimodal feature fusion proposed in the above embodiment.

[0121] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the API behavior hierarchical perception modeling method based on multimodal feature fusion proposed in the above embodiment.

[0122] The storage medium proposed in this embodiment and the method for implementing a hierarchical perception modeling of API behavior based on multimodal feature fusion proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0123] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0124] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A hierarchical perceptual modeling method for API behavior based on multimodal feature fusion, characterized in that: include, It receives multi-dimensional API call behavior source data as input, uses multi-modal feature fusion, and outputs a multi-modal fusion feature matrix and modality weight distribution; Taking a multimodal fusion feature matrix, a call time sequence, and a call dependency graph as input, the system outputs a hierarchical feature representation and a behavioral semantic graph through multi-level semantic encoding. The behavioral deviation from the normal baseline distribution is calculated based on the hierarchical feature representation, and a risk score set, a list of abnormal behaviors, and behavioral classification results are generated based on the deviation. Monitor new API call streams and current model parameters, and output the updated model and drift detection report through adaptive model updates; Based on risk scores, modal weights, and behavioral semantic graphs, interpretability analysis is performed, and visual analysis results are output to identify key risk features and behavioral associations. Based on the visualization analysis results, the updated model version is output through closed-loop optimization, and an evolution trend curve and performance convergence plot are generated.

2. The API behavior hierarchical perception modeling method based on multimodal feature fusion as described in claim 1, characterized in that: The multimodal feature fusion includes, Multimodal coding functions are used to extract feature vectors for each modality; The feature vectors of each modality are weighted and fused according to their importance to obtain a unified multimodal feature set.

3. The API behavior hierarchical perception modeling method based on multimodal feature fusion as described in claim 2, characterized in that: The multi-level semantic encoding includes, Perform layered modeling of the base layer, pattern layer, and intent layer in sequence; It captures the structural properties of a single call, learns the call patterns and periodicity, and learns the dependencies and semantic relationships between behaviors, through graph convolution propagation and semantic aggregation.

4. The API behavior hierarchical perception modeling method based on multimodal feature fusion as described in claim 3, characterized in that: The calculated deviation from the normal baseline distribution includes, Errors reconstructed based on normal behavior models measure the degree of behavioral deviation. Risk scores are calculated by combining semantic similarity with contrastive learning loss; Anomaly levels are determined using an adaptive threshold mechanism.

5. The API behavior hierarchical perception modeling method based on multimodal feature fusion as described in claim 4, characterized in that: The adaptive model update includes, Calculate feature distribution drift to trigger model updates and dynamically adjust modal weights and model parameters; A contrastive learning mechanism is introduced to maintain the normal feature margin or the abnormal feature margin.

6. The API behavior hierarchical perception modeling method based on multimodal feature fusion as described in claim 4, characterized in that: The process of performing interpretability analysis and outputting visual analysis results to identify key risk characteristics and behavioral correlations includes: Calculate the contribution of each modality feature to the risk score, and identify the key features and behavioral paths that trigger anomalies; Generate visual analysis results that can characterize key risk features and behavioral correlations, and output interpretable reports and risk link tracing results.

7. The API behavior hierarchical perception modeling method based on multimodal feature fusion as described in claim 4, characterized in that: The closed-loop optimization includes, Based on the anomaly detection results, interpretability analysis report, and performance monitoring metrics, determine whether to trigger model retraining; When a performance degradation or data distribution shift is detected, the model update and feature baseline reconstruction process is automatically initiated. By adjusting the distribution of input data and model parameters, the model is iterated and an updated model version is output.

8. A hierarchical API behavior perception modeling system based on multimodal feature fusion, employing the hierarchical API behavior perception modeling method based on multimodal feature fusion as described in any one of claims 1 to 7, characterized in that, include: The module includes multimodal feature extraction and fusion, hierarchical behavior perception modeling, anomaly detection and risk assessment, model adaptation and continuous learning, interpretability analysis and visualization, and feedback control and closed-loop optimization. The multimodal feature extraction and fusion module receives multi-dimensional API call behavior source data as input, performs multimodal feature fusion, and outputs a multimodal fusion feature matrix and modality weight distribution. The hierarchical behavior perception modeling module takes a multimodal fusion feature matrix, a call time sequence, and a call dependency graph as input, and outputs a hierarchical feature representation and a behavior semantic map through multi-level semantic encoding. The anomaly detection and risk assessment module calculates the behavioral deviation from the normal baseline distribution based on the hierarchical feature representation, and generates a risk score set, an abnormal behavior list, and a behavior classification result based on the deviation. The model adaptation and continuous learning module monitors the new API call stream and the current model parameters, and outputs the updated model and drift detection report through adaptive model updates. The interpretability analysis and visualization module performs interpretability analysis based on the risk score, modal weights, and behavioral semantic graph, and outputs visualization analysis results to identify key risk features and behavioral associations. The feedback control and closed-loop optimization module, based on the visualization analysis results, outputs an updated model version and generates an evolution trend curve and performance convergence graph through closed-loop optimization.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the API behavior hierarchical perception modeling method based on multimodal feature fusion as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the API behavior hierarchical perception modeling method based on multimodal feature fusion as described in any one of claims 1 to 7.

Images