Interface request processing method, device, readable storage medium and computer equipment

Abstract

An interface request processing method, device, readable storage medium and computer equipment, the method comprising: when obtaining request information of a business process sent by an interface, determining whether the interface is a preset interface; if so, obtaining annotation attribute information corresponding to the interface, the annotation attribute information including an analysis type; extracting parameter information in the request information, and when the business process is completed, analyzing the parameter information and the result information of the business process by an analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal. The present invention processes the request information sent by the interface by means of log annotation, with a high degree of automation, improving the information processing efficiency and reducing labor costs.

Description

Technical Field

[0001] The present invention relates to the field of electronic technology, and in particular to an interface request processing method, device, readable storage medium and computer equipment. Background Art

[0002] Both enterprises and government departments require that all requests of their systems be logged to facilitate the investigation of system security. Since the current situational awareness platform is deployed on the Internet, although the system has been tested for security, the possibility of being attacked by strange access requests is very high, and many illegal requests appear.

[0003] Therefore, it is necessary to analyze the interface request to identify the legitimacy of the request. Since different interface requests have different analysis contents and methods, it is necessary to make appropriate configurations for each interface based on the user-defined content, that is, to do customized development for each interface request. There is a lot of repetitive work in this process, and the labor cost and R&D cost are high. Therefore, how to improve the analysis efficiency of interface requests and reduce costs has become a problem that needs to be solved urgently. Summary of the invention

[0004] In view of the above situation, it is necessary to provide an interface request processing method, apparatus, readable storage medium and computer equipment to improve the analysis efficiency of interface requests and reduce costs.

[0005] An interface request processing method, comprising:

[0006] When obtaining the request information of the business processing sent by the interface, determining whether the interface is a preset interface;

[0007] If yes, obtain annotation attribute information corresponding to the interface, the annotation attribute information including analysis type;

[0008] Parameter information in the request information is extracted, and when the business processing is completed, the parameter information and result information of the business processing are analyzed by the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal.

[0009] Further, in the above-mentioned interface request processing method, wherein the annotation attribute information includes log generation annotation and log storage type, when the business processing is completed, the interface request processing method further includes:

[0010] Generate an interface log using the parameter information and the result information according to the log description information in the log generation annotation;

[0011] A corresponding storage service and storage medium are selected according to the log storage type to store the interface log.

[0012] Furthermore, in the above-mentioned interface request processing method, before the step of generating an interface log by using the parameter information and the result information according to the log description information in the log generation annotation, the method further includes:

[0013] Asynchronously forwarding the parameter information and the result information of the business processing to a message queue;

[0014] The step of extracting information from the parameter information and the result information according to the log generation annotation comprises:

[0015] The parameter information and the result information in the message queue are used to generate an interface log according to the log description information in the log generation annotation.

[0016] Furthermore, in the above-mentioned method for processing interface requests, the step of selecting a corresponding storage service and storage medium according to the log storage type and storing the interface log further comprises:

[0017] Dividing the interface logs stored in the storage medium according to a plurality of preset dimensions, and sending the divided data to a third-party model corresponding to the dimensions for analysis;

[0018] When the analysis result of the third-party model is abnormal, the abnormal information and the abnormal level are determined according to the analysis result, and the abnormal information and the abnormal level are sent to the log alarm, so that the log alarm selects a corresponding alarm mode according to the abnormal level.

[0019] Furthermore, the above interface request processing method, wherein:

[0020] When the analysis type is an attack analysis type, the step of analyzing the parameter information and the result information of the business processing by using the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal includes:

[0021] Inputting the parameter information and the result information of the business processing into the analysis model corresponding to the analysis type, so that the analysis model extracts the attack features in the parameter information and the result information of the business processing, and when the attack features meet the preset conditions corresponding to the attack analysis type, determining that the request currently received by the interface is abnormal;

[0022] When the analysis type is a traffic analysis type, the step of analyzing the parameter information and the result information of the business processing by using an analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal includes:

[0023] The parameter information and the result information of the business processing are input into the analysis model corresponding to the analysis type, so that the analysis model extracts the network data packets in the parameter information and the result information of the business processing, and parses the network data packets to obtain network traffic data, and when the network traffic data meets the preset conditions corresponding to the attack analysis type, it is determined that the request currently received by the interface is abnormal.

[0024] Furthermore, in the above-mentioned interface request processing method, wherein the annotation attribute information also includes an alarm type, the step of analyzing the parameter information and the result information of the business processing by the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal further includes:

[0025] When it is determined that the current request of the interface is abnormal, an alarm is issued in a manner corresponding to the alarm type.

[0026] The present invention also provides an interface request processing system, comprising:

[0027] A log interceptor is used to determine whether the interface is a preset interface when the request information of the business process sent by the interface is obtained, and when the interface is the preset interface, obtain the annotation attribute information corresponding to the interface, and extract the parameter information in the request information, and when the business process is completed, obtain the result information of the business process, and the annotation attribute information includes the analysis type;

[0028] The request analyzer is used to analyze the parameter information and the result information of the business processing through the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal.

[0029] Further, in the above-mentioned interface request processing system, wherein the annotation attribute information includes log generation annotation and log storage type, the interface request processing system further includes:

[0030] A log processor is used to generate an interface log according to the parameter information and the result information in accordance with the log description information in the log generation annotation, and select a corresponding storage service and storage medium according to the log storage type to store the interface log.

[0031] Furthermore, the above interface request processing system further includes:

[0032] A log forwarder, used for asynchronously forwarding the parameter information and the result information of the business processing to a message queue;

[0033] The log processor is used to generate an interface log based on the parameter information and the result information in the message queue according to the log description information in the log generation annotation.

[0034] Furthermore, the above interface request processing system further includes:

[0035] A log analyzer, for extracting the interface log stored in the log storage, dividing the extracted interface log into installation dimensions, and sending the divided data to a third-party model corresponding to the dimension for analysis, and when the analysis result of the third-party model is abnormal, determining abnormal information and abnormal level according to the analysis result, and sending the abnormal information and the abnormal level to the log early warning device;

[0036] The log alarm is used to select a corresponding alarm mode according to the abnormality level.

[0037] The present invention also provides a readable storage medium on which a program is stored, and when the program is executed by a processor, any of the above-mentioned methods is implemented.

[0038] The present invention also provides a computer device, comprising a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor implements any one of the above-described methods when executing the program.

[0039] In the present invention, when the request information of the business processing sent by the interface is obtained, it is determined whether the interface is a preset interface. If so, it is analyzed according to the analysis model corresponding to the analysis type in the log annotation to realize the rapid processing of the interface request. The present invention processes the request information sent by the interface by means of log annotation, with a high degree of automation, thereby improving the information processing efficiency and reducing labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flowchart of the interface request processing method in the first embodiment of the present invention;

[0041] Figure 2 A flowchart of an interface request processing method in a second embodiment of the present invention;

[0042] Figure 3 It is a structural diagram of an interface request processing system in a second embodiment of the present invention;

[0043] Figure 4 4 is a structural block diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0045] These and other aspects of the embodiments of the present invention will become clear with reference to the following description and drawings. In these descriptions and drawings, some specific implementations of the embodiments of the present invention are specifically disclosed to represent some ways of implementing the principles of the embodiments of the present invention, but it should be understood that the scope of the embodiments of the present invention is not limited thereto. On the contrary, the embodiments of the present invention include all changes, modifications and equivalents that fall within the spirit and connotation of the appended claims.

[0046] See also Figure 1 , is an interface request processing method in the first embodiment of the present invention, comprising steps S11 to S13.

[0047] Step S11, when obtaining the request information of the business processing sent by the interface, determining whether the interface is a preset interface.

[0048] In this embodiment, log annotations are pre-configured for the interfaces that need to be monitored. Annotations are also called metadata. Annotations are at the same level as classes, interfaces, and enumerations, and can be applied to declarations of packages, types, constructors, methods, member variables, parameters, and local variables to explain and annotate these elements. In this embodiment, the main annotation attribute information of the log annotation includes but is not limited to:

[0049] Function name, that is, the name of the interface;

[0050] Log description, that is, explaining the functions and business logic implemented by the interface;

[0051] Log storage type, storage media and services used for log storage;

[0052] Analysis type, including attack analysis, traffic analysis, etc.;

[0053] Alarm types include DingTalk alarm, WeChat alarm, email alarm, SMS alarm, phone alarm, announcement alarm, etc.

[0054] Specifically, whether the interface is a preset interface can be determined by whether the interface has a log annotation identifier. If so, the interface is determined to be a preset interface.

[0055] Step S12: when the interface is a preset interface, obtaining annotation attribute information corresponding to the interface, wherein the annotation attribute information includes an analysis type.

[0056] Step S13, extracting parameter information from the request information, and when the business processing is completed, analyzing the parameter information and the result information of the business processing by using the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal.

[0057] The extracted parameters and processed result information include:

[0058] Request body (HttpServletRequest request);

[0059] Request return body (HttpServletResponse response);

[0060] Request general parameters (general);

[0061] request heads;

[0062] query parameters;

[0063] Request return header (response head);

[0064] Request return value (response value);

[0065] User information (userInfo): You can get the user authentication information token according to the Authorization in the request heads, and then query redis for token authentication according to the authentication information token. If the authentication is successful, the request user information will be obtained. The user information includes user ID, user name, etc. If the authentication is unsuccessful, the request will be directly returned as unauthenticated;

[0066] User access exit IP: IP information can be obtained through the request body HttpServletRequest.getRemoteAddr().

[0067] Request system time: Get it directly from the server.

[0068] The analysis type of the request information is determined according to the interface annotation attribute information, and the parameter information and the result information of the business processing are analyzed by the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal. The analysis types in this embodiment are mainly divided into attack analysis type and traffic analysis type, and the analysis type of the interface can be at least one of the attack analysis type and the traffic analysis type.

[0069] In a specific implementation, when the analysis type is an attack analysis type, the step of analyzing the parameter information and the result information of the business processing by using the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal includes:

[0070] Inputting the parameter information and the result information of the business processing into the analysis model corresponding to the analysis type, so that the analysis model extracts the attack features in the parameter information and the result information of the business processing, and when the attack features meet the preset conditions corresponding to the attack analysis type, determining that the request currently received by the interface is abnormal;

[0071] When the analysis type is a traffic analysis type, the step of analyzing the parameter information and the result information of the business processing by using an analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal includes:

[0072] The parameter information and the result information of the business processing are input into the analysis model corresponding to the analysis type, so that the analysis model extracts the network data packets in the parameter information and the result information of the business processing, and parses the network data packets to obtain network traffic data, and when the network traffic data meets the preset conditions corresponding to the attack analysis type, it is determined that the request currently received by the interface is abnormal.

[0073] Attack analysis can be performed based on parameter information and business processing result information, which includes request parameters, request headers, request paths, etc. Attack features are extracted based on these data. Generally speaking, the attacks on the system are mainly address spoofing attacks, WinNuke attacks, and Script / ActiveX attacks. Extract attack features and compare them with preset conditions to determine whether the offensive features meet the requirements. If so, determine that the request currently received by the interface is abnormal. Usually, the preset conditions for each attack setting are different. For example, the preset condition corresponding to IP address spoofing can be: the IP address in the request information is a third-party IP address; the preset condition corresponding to WinNuke attack is: the request information message is different from the normal data message, and its pointer field does not match the actual location of the data; the preset condition corresponding to Script / ActiveX attack is: the request information carries malicious Script (executable script) or ActiveX (control object).

[0074] Take IP address spoofing attack as an example. Generally, when forwarding a message, the router only checks the routing table according to the destination address of the message, regardless of the source address of the message. Therefore, this may lead to a danger: if an attacker sends a message to a target computer and fills in the source address of the message as a third-party IP address, after the message reaches the target computer, the target computer may respond to the unaware third-party computer, which is an IP address spoofing attack. Therefore, it is possible to determine whether the request of the interface is abnormal by judging whether the source address of the message is the IP address of a third party.

[0075] Network traffic runs through every link of business flow, so network traffic has great application value. However, the original network traffic is presented in binary form and cannot be directly read and applied. Therefore, it is necessary to use relevant tools and technologies to turn network traffic into easier-to-read data information, so as to better apply it in business scenarios and maximize its value. In this process, network traffic must be collected, decoded and analyzed. It is mainly achieved through the following steps:

[0076] Step 1: Collect network traffic. Collecting network traffic requires the help of relevant tools. If you need to capture network traffic temporarily, you can use some open source tools, such as Wireshark, Tcpdump, etc. If you need to capture and analyze network traffic for a long time, you can generally use professional probe equipment;

[0077] Step 2: Network packet decoding. After completing the collection of network traffic, the data packet needs to be parsed. The process of packet parsing is the process of extracting and parsing the fields at each position in the binary bit stream. In different analysis tools and application scenarios, the required level of analysis is different.

[0078] Depending on the usage scenario, the level that needs to be parsed is also different. For example, for network performance monitoring scenarios, you only need to parse the network-related levels to obtain network traffic data such as message length, traffic size, number of connections, source IP, destination IP, source port, destination port, TCP connection establishment, TCP disconnection, and TCP time consumption. Compare the network traffic data with the corresponding preset conditions to determine whether there are any abnormalities, such as determining whether the network time consumption is too long, the TCP three-way handshake success rate is low, packet loss, low transmission efficiency, etc. If so, it means that the request is abnormal.

[0079] In this embodiment, when the request information of the business processing sent by the interface is obtained, it is determined whether the interface is a preset interface. If so, it is analyzed according to the analysis model corresponding to the analysis type in the log annotation to realize the rapid processing of the interface request. This embodiment processes the request information sent by the interface by means of log annotation, with a high degree of automation, thereby improving the information processing efficiency and reducing labor costs.

[0080] See also Figure 2 , which is an interface request processing method in the second embodiment of the present invention, includes steps S21 to S29.

[0081] Step S21, when obtaining the request information of the business processing sent by the interface, determining whether the interface is a preset interface.

[0082] Step S22, when the interface is a preset interface, obtaining annotation attribute information corresponding to the interface, the annotation attribute information includes analysis type, log generation annotation, log storage type and alarm type.

[0083] Step S23, extracting parameter information from the request information, and obtaining result information of the business processing when the business processing is completed.

[0084] Step S24: analyzing the parameter information and the result information by using the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal.

[0085] For each request of the interface, there is its own log analysis type analysisType value. The system will match the name of the analysis model in the model management according to the real value of this analysisType, and will find the corresponding model for analysis. The specific analysis process can refer to the relevant content in the first embodiment, which will not be repeated here.

[0086] Step S25: When it is determined that the current request of the interface is abnormal, an alarm is issued in a manner corresponding to the alarm type.

[0087] It can be understood that the alarm type of the interface can be annotated according to the log annotation. During specific implementation, the alarm type can select at least one of DingTalk alarm, WeChat alarm, email alarm, SMS alarm, telephone alarm and announcement alarm.

[0088] Step S26: asynchronously forward the parameter information and the result information of the business processing to a message queue, and generate an interface log with the parameter information and the result information in the message queue according to the log description information in the log generation annotation.

[0089] When the message queue receives parameter information and business processing result information, it has two functions:

[0090] When the log processor goes down, the log message is stored and consumed when the log processor returns to normal.

[0091] When the log processor is operating normally, the message queue acts as a buffer to avoid system freezes.

[0092] Step S27: Select a corresponding storage service and storage medium according to the log storage type to store the interface log.

[0093] In this embodiment, log storage types are divided into multiple types according to the purpose of the data. For example, data that needs to be displayed on a large screen needs to be stored in MySQL for easy query and demonstration. Data that requires big data analysis is generally stored in elasticsearch. When the log needs to be displayed and analyzed, multiple storage media can be selected for easy management without affecting the display.

[0094] Step S28, dividing the interface log stored in the storage medium according to a plurality of preset dimensions, and sending the divided data to a third-party model corresponding to the dimensions for analysis.

[0095] Step S29, when the analysis result of the third-party model is abnormal, determine the abnormal information and the abnormal level according to the analysis result, and send the abnormal information and the abnormal level to the log alarm, so that the log alarm selects the corresponding alarm mode according to the abnormal level.

[0096] Since a single request may lead to inaccurate log analysis, it is necessary to conduct overall line analysis through a large amount of historical data. In specific implementation, the interface logs stored in the storage medium are divided according to multiple preset dimensions, such as user identification dimension, IP dimension, request interface dimension, and regional dimension. The regional dimension can obtain regional information based on the IP.

[0097] The data of each dimension is sent to the third-party model of the corresponding dimension for analysis to obtain the analysis results. If the analysis results are abnormal, the abnormal information and abnormal level are sent to the log alarm. The log alarm selects the corresponding alarm mode according to the abnormal level. For example, the abnormal level can be divided into three levels from high to low. The alarm mode corresponding to the highest level can be a telephone alarm, the alarm mode corresponding to the second level can be an email alarm, and the alarm mode corresponding to the lowest level can be a DingTalk alarm.

[0098] This embodiment realizes log collection, storage, and real-time analysis based on annotations, and performs overall analysis of time period log data through an offline mechanism, and issues alarms when risks are discovered.

[0099] See also Figure 3, is an interface request processing system in a third embodiment of the present invention, comprising:

[0100] The log interceptor 31 is used to determine whether the interface is a preset interface when obtaining the request information of the business process sent by the interface, and when the interface is the preset interface, extract the parameter information in the request information, and when the business process is completed, obtain the result information of the business process;

[0101] The request analyzer 32 is used to analyze the parameter information and the result information of the business processing through the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal.

[0102] The log interceptor is the key to the effectiveness of log annotations. Log interception is usually implemented using the @Aspect annotation in the spring framework, which is mainly implemented in several steps:

[0103] 1. Set the cut point to use the @LogEvent annotation to take effect and associate it with the corresponding interface class and method that needs log processing;

[0104] 2. Process business logic and log it before and after processing it. Before processing the business, record business parameters, request type, request header and common parameters. Usually use @Around annotation to implement business logic binding, parameter passing and return value passing;

[0105] 3. After processing the business logic, record the request return value and request return header.

[0106] When the request analyzer 32 receives the parameter information and the result information of the business processing, it performs an abnormal analysis according to the analysis model corresponding to the analysis type in the log annotation, and the analysis model mainly includes attack analysis and traffic analysis, etc. In addition, when the request is analyzed to be abnormal, the abnormal result can also be distributed to the log alarm.

[0107] Further, in the above-mentioned interface request processing system, wherein the annotation attribute information includes log generation annotation and log storage type, the interface request processing system further includes:

[0108] The log processor 33 is used to generate an interface log according to the parameter information and the result information according to the log description information in the log generation annotation, and select a corresponding storage service and storage medium according to the log storage type to store the interface log.

[0109] The log processor 33 is mainly used to store parameter information and result information in the corresponding storage according to the storage type, and forward the message to the request analyzer for processing. The log processor selects the corresponding storage service and storage medium storage according to the log storage type (logType). When logType=mysql, mysql data is used for storage. When logType=elasticsearch, elasticsearch search engine service storage is selected.

[0110] Furthermore, the above interface request processing system further includes:

[0111] A log forwarder 34, used for asynchronously forwarding the parameter information and the result information of the business processing to a message queue 35;

[0112] The log processor 33 is used to generate an interface log based on the parameter information and the result information in the message queue according to the log description information in the log generation annotation.

[0113] The main function of the log forwarder 34 is to improve the efficiency and performance of business requests, without blocking the normal return of business interface data. It can asynchronously forward the request parameters, request return results and abnormal situations to the message queue for processing. Here the message queue acts as a buffer and ensures that the request log is not lost.

[0114] Furthermore, the above interface request processing system further includes:

[0115] The log analyzer 36 is used to extract the interface log stored in the log storage, divide the extracted interface log into installation dimensions, and send the divided data to the third-party model corresponding to the dimension for analysis, and when the analysis result of the third-party model is abnormal, determine the abnormal information and the abnormal level according to the analysis result, and send the abnormal information and the abnormal level to the log alarm;

[0116] The log alarm device 37 is used to select a corresponding alarm mode according to the abnormality level.

[0117] The log analyzer 36 mainly integrates third-party platforms to conduct overall analysis of large amounts of historical data and improve the accuracy of log analysis.

[0118] The interface request processing system provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0119] Another aspect of the present invention provides a computer device, see Figure 4, shown is a computer device in the fourth embodiment of the present invention, including a processor 10, a memory 20, and a computer program 30 stored in the memory and executable on the processor, and when the processor 10 executes the computer program 30, the interface request processing method as described above is implemented.

[0120] The computer device may be, but is not limited to, a computer, a server, etc. In some embodiments, the processor 10 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip, for running program codes stored in the memory 20 or processing data.

[0121] The memory 20 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. The memory 20 may be an internal storage unit of a computer device in some embodiments, such as a hard disk of the computer device. The memory 20 may also be an external storage device of a computer device in other embodiments, such as a plug-in hard disk equipped on the computer device, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Further, the memory 20 may also include both an internal storage unit of a computer device and an external storage device. The memory 20 may be used not only to store application software and various types of data installed in the computer device, but also to temporarily store data that has been output or is to be output.

[0122] Optionally, the computer device may also include a user interface, a network interface, a communication bus, etc. The user interface may include a display (Display), an input unit such as a keyboard (Keyboard), and the optional user interface may also include a standard wired interface and a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the computer device and to display a visual user interface. The network interface may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface), which is generally used to establish a communication connection between the device and other electronic devices. The communication bus is used to realize the connection communication between these components.

[0123] It should be pointed out that Figure 4The structure shown does not constitute a limitation on the computer device. In other embodiments, the computer device may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0124] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the interface request processing method as described above is implemented.

[0125] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0126] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0127] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0128] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0129] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. An interface request processing method, characterized in that: include: When obtaining the request information of the business processing sent by the interface, determining whether the interface is a preset interface; If yes, obtain annotation attribute information corresponding to the interface, the annotation attribute information includes analysis type; the analysis type includes attack analysis type or traffic analysis type; Extract the parameter information in the request information, and when the business processing is completed, match the corresponding analysis model through the analysisType value of the attack analysis type or the traffic analysis type, and analyze the parameter information and the result information of the business processing through the analysis model to determine whether the current request of the interface is abnormal.

2. The interface request processing method according to claim 1, characterized in that: The annotation attribute information includes log generation annotation and log storage type. When the business processing is completed, the interface request processing method further includes: Generate an interface log using the parameter information and the result information according to the log description information in the log generation annotation; A corresponding storage service and storage medium are selected according to the log storage type to store the interface log.

3. The interface request processing method according to claim 2, characterized in that: Before the step of generating an interface log using the parameter information and the result information according to the log description information in the log generation annotation, the step further includes: Asynchronously forwarding the parameter information and the result information of the business processing to a message queue; The step of extracting information from the parameter information and the result information according to the log generation annotation comprises: The parameter information and the result information in the message queue are used to generate an interface log according to the log description information in the log generation annotation.

4. The interface request processing method according to claim 2, characterized in that: After the step of selecting a corresponding storage service and storage medium according to the log storage type and storing the interface log, the following steps are further included: Dividing the interface logs stored in the storage medium according to a plurality of preset dimensions, and sending the divided data to a third-party model corresponding to the dimensions for analysis; When the analysis result of the third-party model is abnormal, the abnormal information and the abnormal level are determined according to the analysis result, and the abnormal information and the abnormal level are sent to the log alarm device, so that the log alarm device selects a corresponding alarm mode according to the abnormal level.

5. The interface request processing method according to claim 1, characterized in that: When the analysis type is an attack analysis type, the step of analyzing the parameter information and the result information of the business processing by using the analysis model to determine whether the current request of the interface is abnormal includes: Inputting the parameter information and the result information of the business processing into the analysis model corresponding to the analysis type, so that the analysis model extracts the attack features in the parameter information and the result information of the business processing, and when the attack features meet the preset conditions corresponding to the attack analysis type, determining that the request currently received by the interface is abnormal; When the analysis type is a traffic analysis type, the step of analyzing the parameter information and the result information of the business processing by the analysis model to determine whether the current request of the interface is abnormal includes: The parameter information and the result information of the business processing are input into the analysis model corresponding to the analysis type, so that the analysis model extracts the network data packets in the parameter information and the result information of the business processing, and parses the network data packets to obtain network traffic data, and when the network traffic data meets the preset conditions corresponding to the attack analysis type, it is determined that the request currently received by the interface is abnormal.

6. The interface request processing method according to claim 1, characterized in that: The annotation attribute information also includes an alarm type, and the step of analyzing the parameter information and the result information of the business processing by using the analysis model corresponding to the analysis type to determine whether the current request of the interface is abnormal also includes: When it is determined that the current request of the interface is abnormal, an alarm is issued in a manner corresponding to the alarm type.

7. An interface request processing system, characterized in that: include: A log interceptor is used to determine whether the interface is a preset interface when request information of the business process sent by the interface is obtained, and when the interface is the preset interface, obtain annotation attribute information corresponding to the interface, and extract parameter information in the request information, and when the business process is completed, obtain result information of the business process, wherein the annotation attribute information includes an analysis type; the analysis type includes an attack analysis type or a traffic analysis type; A request analyzer is used to match the corresponding analysis model through the analysisType value of the attack analysis type or the traffic analysis type, and analyze the parameter information and the result information of the business processing through the analysis model to determine whether the current request of the interface is abnormal.

8. The interface request processing system according to claim 7, characterized in that: The annotation attribute information includes log generation annotation and log storage type, and the interface request processing system further includes: A log processor is used to generate an interface log according to the parameter information and the result information in accordance with the log description information in the log generation annotation, and select a corresponding storage service and storage medium according to the log storage type to store the interface log.

9. A readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer device comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

Images