API interface security management method, device, equipment and medium

Abstract

The present invention provides an API interface security management method, device, equipment and medium, the method comprising: clustering the basic API interface data corresponding to each API interface in a pre-stored application programming interface API basic information library; obtaining the original reference point corresponding to each classification based on the basic API interface data contained in each classification after clustering; collecting the real-time API interface data corresponding to each of the API interfaces, and judging whether there is an abnormal API interface based on the real-time API interface data and the original reference point corresponding to each of the API interfaces; if there is an abnormal API interface, taking security management measures for the abnormal API interface. The present invention classifies each API interface of the MEC platform, obtains multiple original reference points through classification, monitors the API interface for each original reference point, improves the accuracy of judging abnormal API interfaces, enhances the protection capability of the MEC platform, and builds a solid security baseline.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an API interface security management method, an API interface security management device, a computer device, and a computer-readable storage medium. Background Art

[0002] Mobile Edge Computing (MEC) is a key technology in 5G networks. By deploying multiple applications on the MEC platform, it meets the diverse needs of tenants. As the number of applications deployed on the MEC platform continues to increase, the platform's convenience continues to expand, and with the increasing number of open interfaces, the risks it faces are also increasing. Currently, research on the security of MEC platforms focuses on the platform itself, data security, and infrastructure.

[0003] Challenges related to Application Programming Interface (API) risks. With the rapid development of 5G networks and the deepening digital transformation of industries, these risks are becoming a major challenge in edge computing. MEC platforms, in particular, have numerous open APIs and inadequate protections, leading to frequent attacks on APIs and attempts to infiltrate application systems and steal data through them. However, research on API risks is limited. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art and provide an API interface security management method, device, equipment and medium to solve the problem in the prior art that there are too many API interfaces open to the MEC platform and abnormal API interfaces cannot be discovered and processed in a timely manner, causing the platform to face risks.

[0005] In a first aspect, the present invention provides an API interface security management method, which is applied to an edge computing MEC platform, and the method includes:

[0006] Clustering the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library;

[0007] Obtain the original reference points corresponding to each category based on the basic API interface data contained in each category after clustering;

[0008] Collecting real-time API interface data corresponding to each of the API interfaces, and determining whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces;

[0009] If there is an abnormal API interface, security management measures will be taken for the abnormal API interface.

[0010] Preferably, the basic API interface data and the real-time API interface data both include the digitized application type, application ownership, usage cycle, application provider, and call frequency;

[0011] Before clustering the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library, the method further includes:

[0012] Collect the application type, application ownership, usage cycle, application provider and call frequency corresponding to each of the API interfaces;

[0013] Numerical processing of the collected application type, application ownership, usage cycle, application provider, and call frequency;

[0014] The vector composed of the numerically processed application type, application ownership, usage cycle, application provider and calling frequency is saved in the API basic information library as the basic API interface data.

[0015] Preferably, before collecting the application type, application ownership, usage cycle, application provider, and call frequency corresponding to each of the API interfaces, the method further includes:

[0016] Predefine vectors representing the basic API interface data and the real-time API interface data for each API interface, each vector including numerically processed application type, application ownership, usage cycle, application provider, and call frequency;

[0017] The application type after numerical processing takes different values ​​according to whether the application type is a business application, a management application, or an operation and maintenance application;

[0018] The numerically processed application attribution takes different values ​​depending on whether the application is the platform's own application or a third-party application;

[0019] The digitized usage cycle is obtained by measuring the duration of the usage cycle of each API interface;

[0020] The numerically processed application provider takes different values ​​according to different application providers;

[0021] The numerically processed call frequency is obtained by measuring the number of calls to each API interface within a specified time period.

[0022] Preferably, clustering the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library specifically includes:

[0023] The K-Means algorithm is used to cluster the basic API interface data corresponding to each of the API interfaces in the API basic information library.

[0024] Preferably, obtaining the original reference point corresponding to each category according to the basic API interface data contained in each category after clustering specifically includes:

[0025] For the basic API interface data contained in each category after clustering, the average values ​​of the numerically processed application type, application affiliation, usage cycle, application provider and call frequency are calculated respectively, and the vector composed of each of the average values ​​is used as the original reference point corresponding to each category.

[0026] Preferably, before determining whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces, the method further includes:

[0027] Calculate the distance between the basic API interface data contained in each category and the original reference point, and use the maximum value of the distance values ​​as the safety threshold;

[0028] The determining whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces specifically includes:

[0029] It is determined whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold; if so, the API interface corresponding to the real-time API interface data is determined to be an abnormal API interface.

[0030] Preferably, the determining whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold specifically includes:

[0031] A safety range is defined with the original reference point as the center and the safety threshold as the radius;

[0032] According to whether the real-time API interface data exceeds the safety range, it is determined whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold.

[0033] Preferably, after determining whether the real-time API interface data exceeds the safety range and whether the distance from the original reference point exceeds the safety threshold, the method further comprises:

[0034] Classify the real-time API interface data according to the degree to which the real-time API interface data exceeds the safety range;

[0035] The real-time API interface data is identified by using different colors according to the level.

[0036] Preferably, the taking of security management measures for the abnormal API interface specifically includes:

[0037] Corresponding security management measures are taken according to the level of the real-time API interface data corresponding to the abnormal API interface, and the security management measures include at least one of the following: prompting an early warning, limiting the frequency of calling the abnormal API interface, and closing the abnormal API interface.

[0038] Preferably, if there is an abnormal API interface, the method further includes:

[0039] Acquire real-time API interface data corresponding to the abnormal API interface, and generate an API situation awareness map based on the real-time API interface data corresponding to the abnormal API interface.

[0040] In a second aspect, the present invention provides an API interface security management device, which is provided on an edge computing MEC platform, and the device includes:

[0041] The clustering module is used to cluster the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library;

[0042] A benchmark module, connected to the clustering module, is used to obtain the original benchmark points corresponding to each category based on the basic API interface data contained in each category after clustering;

[0043] A monitoring module, connected to the reference module, for collecting real-time API interface data corresponding to each of the API interfaces, and determining whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces;

[0044] The management module is connected to the monitoring module and is used to take security management measures for the abnormal API interface after determining that there is an abnormal API interface.

[0045] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein a computer program is stored in the memory, and when the processor runs the computer program stored in the memory, the processor executes the API interface security management method as described above.

[0046] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the API interface security management method as described above.

[0047] The present invention provides an API interface security management method, device, equipment and medium. First, through the edge computing MEC platform, the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library is clustered, and the basic API interface data of each API interface is stored using the API basic information library to classify each API interface of the MEC platform; then, the original reference point corresponding to each classification is obtained according to the basic API interface data contained in each clustered classification, and multiple original reference points are obtained through classification, and each original reference point corresponds to an API interface with similarity; then, the real-time API interface data corresponding to each of the API interfaces is collected, and it is judged whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces, and the API interface is monitored for each original reference point to improve the accuracy of the judgment of the abnormal API interface; finally, if there is an abnormal API interface, security management measures are taken for the abnormal API interface to achieve comprehensive and targeted security protection, improve the protection capability of the MEC platform, and build a solid security baseline. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flowchart of an API interface security management method according to embodiment 1 of the present invention;

[0049] Figure 2 This is an example diagram of the results of the real-time API interface data display of Example 1 of the present invention;

[0050] Figure 3 This is a schematic diagram of the structure of an API interface security management device according to embodiment 2 of the present invention;

[0051] Figure 4 An architectural diagram of a computer device according to embodiment 3 of the present invention. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the technical solutions of the present invention, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0053] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0054] It is understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments may be combined with each other.

[0055] It can be understood that, for the convenience of description, the drawings of the present invention only show parts related to the present invention, while parts unrelated to the present invention are not shown in the drawings.

[0056] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0057] It will be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0058] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented using a hardware-based system that implements the specified functions, or may be implemented using a combination of hardware and computer instructions.

[0059] It is understandable that the units and modules involved in the embodiments of the present invention may be implemented by software or hardware. For example, the units and modules may be located in a processor.

[0060] Example 1:

[0061] like Figure 1 As shown, embodiment 1 of the present invention provides an API interface security management method, which is applied to an edge computing MEC platform. The method includes:

[0062] S1. Clustering basic API interface data corresponding to each API interface in a pre-stored application programming interface (API) basic information library.

[0063] In this embodiment, each basic API interface data is collected and obtained from each API interface of the corresponding MEC platform. The API basic information library S is obtained by combining and storing all the basic API interface data. In order to obtain the pre-stored API basic information library S, the following steps are performed before step S1:

[0064] The basic API interface data includes the numerically processed application type, application ownership, usage cycle, application provider, and call frequency.

[0065] Specifically, the MEC platform predefines vectors representing the basic API interface data and the real-time API interface data of each API interface. Each vector includes the digitized application type, application ownership, usage cycle, application provider, and call frequency.

[0066] In this embodiment, the application type after digitization processing takes different values ​​depending on whether the application type is a business application, a management application, or an operation and maintenance application; the application attribution after digitization processing takes different values ​​depending on whether the application is a platform application itself or a third-party application; the usage cycle after digitization processing is determined by measuring the duration of the usage cycle of each API interface; the application provider after digitization processing takes different values ​​depending on the application provider; the call frequency after digitization processing is determined by measuring the number of calls of each API interface within a specified time period.

[0067] As an example, for the many API interfaces opened by the MEC platform, each API interface corresponds to an application deployed on the MEC platform (the applications mentioned here include applications deployed by the MEC platform itself and third-party applications). According to the characteristics of the applications connected to the API interface, each basic API interface data includes the following information: <application type, application ownership, usage cycle, application provider, call frequency>. Usually for MEC platform applications, their application types usually include business applications, management applications, operation and maintenance applications, etc., and numerical identifiers can be assigned according to the application type, such as business applications with identifier 1, management applications with identifier 2, operation and maintenance applications with identifier 3, etc.; the application ownership of the MEC platform usually includes the platform's own applications and the third-party applications. Third-party applications can distinguish between platform-specific applications and third-party applications, and can monitor the security status of API interfaces globally. Numerical identifiers can be assigned based on application affiliation, such as 0 for platform-specific applications and 1 for third-party applications. Manufacturer-unified standards are provided for applications corresponding to each API interface, such as 11 for Huawei, 21 for ZTE, and 32 for H3C. For quantitative API interface information, for example, the usage cycle and call frequency of the API interface are selected to form basic API interface data. The usage cycle can be directly determined by measuring the duration of the API interface usage cycle, such as 20 hours, and the call frequency can be determined by measuring the number of API interface calls within a specified period of time when the API interface is in use, such as 10 times / hour.

[0068] Collect the application type, application ownership, usage cycle, application provider and call frequency corresponding to each of the API interfaces;

[0069] Numerical processing of the collected application type, application ownership, usage cycle, application provider, and call frequency;

[0070] The vector composed of the numerically processed application type, application ownership, usage cycle, application provider and calling frequency is saved in the API basic information library as the basic API interface data.

[0071] As an example, for a specific MEC platform, N API interfaces are opened on it. The established API basic information library S should contain the basic API interface data of each API interface, for example, API1, API2, API3...API N Represents N basic API interface data. Each basic API interface data includes five dimension values, namely the corresponding values ​​of <application type, application ownership, usage cycle, application provider, and call frequency>. For each of the N API interfaces on the MEC platform, the corresponding five information are collected, converted into five values ​​after numerical processing, and assigned to API1, API2, API3...API N , API1, API2, API3...API N Combined to form the API basic information library S, S{API1, API2, API3...API N}.

[0072] For example, a MEC platform opens three API interfaces and defines three basic API interface data: API1, API2, and API3. The following basic information is collected for each of the three API interfaces:

[0073]

[0074] Therefore, three basic API interface data are obtained: API1<1,0,21,21,5>, API2<2,1,10,11,10>, API3<1,1,12,21,10>; the above three basic API interface data are combined to form the API basic information library S, S{API1, API2, API3}.

[0075] In this embodiment, clustering the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library specifically includes: clustering the basic API interface data corresponding to each API interface in the API basic information library using the K-Means algorithm.

[0076] As an example, for the N API interfaces of the MEC platform, the K-Means clustering algorithm is used to cluster all basic API interface data in the API basic information library S. By inputting the K (K < N) value and K initial clustering centers, calculations are performed until convergence, and the N basic API interface data are divided into K clusters. The result of the division is that the basic API interface data with similarity are divided into the same cluster, achieving the effect of maximum similarity within the class and minimum similarity between classes, which facilitates further analysis of API interfaces with similar characteristics.

[0077] S2. Obtain the original reference point corresponding to each category based on the basic API interface data contained in each category after clustering.

[0078] In this embodiment, step S2 specifically includes: for the basic API interface data contained in each category after clustering, respectively calculating the average values ​​of the numerically processed application type, application affiliation, usage cycle, application provider, and call frequency, and using the vector formed by each of the average values ​​as the original reference point corresponding to each category.

[0079] In a specific example, if the number of API interfaces of the MEC platform is small (such as N=3), it can be considered that all basic API interface data have similarity, and the original reference point is calculated directly based on all basic API interface data. For example, taking the aforementioned three basic API interface data as an example: S{API1, API2, API3}, API1<1,0,21,21,5>, API2<2,1,10,11,10>, API3<1,1,12,21,10>, the average value of each dimension is obtained, and the average value of each dimension is sequentially composed into a new vector containing 5 elements <1.33,0.67,14.3,17.7,8.3> as the original reference point; the above process is just a simple example and is easy to understand. When the number of API interfaces of the MEC platform is large (when the N value is large), the clustering classification result is first obtained through step S1, and then the above average value of each dimension is obtained for each category to form the original reference point.

[0080] S3. Collect real-time API interface data corresponding to each of the API interfaces, and determine whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces.

[0081] In this embodiment, in order to facilitate the monitoring of changes in real-time API interface data relative to the original reference point corresponding to its own API interface, the real-time API interface data and the basic API interface data have the same data format, that is, they also include the digitized application type, application ownership, usage cycle, application provider and call frequency.

[0082] In a specific example, the API basic information library S is classified using the K-Means clustering algorithm as mentioned above. After obtaining K clusters, the changes in the real-time API interface data relative to the original reference points corresponding to its own API interface are monitored, that is, monitoring is performed separately according to the classification results, and the API interface corresponding to the basic API interface data contained in each cluster is obtained for the K clusters. Each real-time API interface data obtained is divided into the corresponding cluster for analysis to obtain accurate analysis results.

[0083] In this embodiment, before determining whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces, the method also includes: calculating the distance between the basic API interface data contained in each category and the original reference points, and using the maximum value of the distance values ​​as a safety threshold; determining whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces specifically includes: determining whether the distance between the real-time API interface data and the original reference points exceeds the safety threshold, and if so, determining that the API interface corresponding to the real-time API interface data is an abnormal API interface.

[0084] In a specific example, when the API interface on the MEC platform is working in its corresponding application, real-time API interface data can be collected for the API interface. The real-time API interface data reflects the behavior of the corresponding application, such as changes in API cycle adjustment, call frequency, etc. The distance between the real-time API interface data and the original reference point can be calculated to determine whether the API interface corresponding to the real-time API interface data is an abnormal API interface, and then determine whether the application corresponding to the API interface has abnormal behavior. The judgment standard can be achieved by setting a safety threshold, and the distance can be calculated using the Euclidean distance method.

[0085] In this embodiment, the determination of whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold specifically includes: defining a safety range with the original reference point as the center and the safety threshold as the radius; and determining whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold based on whether the real-time API interface data exceeds the safety range.

[0086] In a specific example, in order to more clearly display the monitoring results, the original benchmark points and real-time API interface data can be plotted in the same graph according to the data values ​​of each dimension corresponding to them, such as Figure 2As shown in the figure, with the original reference point as the center, the real-time API interface data is distributed around the center, and a circle with a radius of d (d is equal to the safety threshold) is defined as the reference of the safety range. If the distance d1 between the real-time API interface data and the original reference point in the figure is less than d, that is, it is distributed within the circle, the API interface is determined to be normal; otherwise, if it exceeds the circle, it is abnormal.

[0087] In this embodiment, after determining whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold according to whether the real-time API interface data exceeds the safety range, the method further includes: dividing the levels of the real-time API interface data according to the degree to which the real-time API interface data exceeds the safety range; and using different colors to identify the real-time API interface data according to the levels.

[0088] In a specific example, as Figure 2 shown in the figure, the levels are divided according to the degree of exceeding the safety range. The safe real-time API interface data (within the safety range or exceeding the safety range by less than 5%) is marked in white, the real-time API interface data exceeding the safety range by 5%-10% is marked in light gray, the real-time API interface data exceeding the safety range by 10%-30% is marked in dark gray, and the real-time API interface data exceeding the safety range by >30% is marked in black, so that the risk levels are clear at a glance.

[0089] S4. If there are abnormal API interfaces, security management measures are taken for the abnormal API interfaces.

[0090] In this embodiment, taking security management measures for the abnormal API interfaces specifically includes: taking corresponding security management measures according to the levels of the real-time API interface data corresponding to the abnormal API interfaces, and the security management measures include at least one of the following: prompt warning, restricting the frequency of calling the abnormal API interfaces, and closing the abnormal API interfaces.

[0091] In a specific example, based on Figure 2The grading results shown in the figure take different security measures for abnormal API interfaces at different levels: if it exceeds the safety range by 5%-10%, an early warning will be prompted; if it exceeds the safety range by 10%-30%, it will prompt that measures need to be taken to find the abnormal API interface, and then take processing measures such as limiting the frequency of API calls; in other cases (exceeding the safety range by >30%), it will prompt that measures need to be taken immediately, such as closing the abnormal API interface, closing the application, and tracing the source (since the API interface data includes information such as application ownership and application provider, it is easy to trace). If it is determined that the application corresponding to the API interface has abnormal behavior, restrictive measures will be taken on the API interface to reduce the security risks brought to the platform by the abnormal behavior of the application, so that abnormal events can be handled in a timely manner and security risks can be reduced.

[0092] In this embodiment, if there is an abnormal API interface, the method further includes: obtaining real-time API interface data corresponding to the abnormal API interface, and generating an API situation awareness map based on the real-time API interface data corresponding to the abnormal API interface.

[0093] In a specific example, the risk level of real-time API interface data is displayed through the API situation awareness layer, and different colors are used for different levels of abnormal situations. By combining the clusters divided by the aforementioned clustering, K API situation awareness maps can be obtained. From the API situation awareness map, it can be seen which manufacturers, which types of applications, which APIs, etc. are prone to abnormalities, and corresponding disposal measures can be formulated according to actual conditions. For abnormal APIs in critical applications, reasonable measures can be taken to improve business continuity and data security protection capabilities, which has important reference value for manufacturer product optimization, operator procurement, intelligent operation and maintenance, and edge platform security.

[0094] Embodiment 1 of the present invention focuses on the risks of API interfaces. In view of the characteristics of MEC platform API interfaces, such as large number, multiple types, complex interfaces, and difficulty for operators to fully cover the functions of each interface, a method for improving the security of the MEC platform by security management of API interfaces is proposed. By clustering, similar API interfaces are placed in the same cluster. The API interface information set in the same cluster is quantified, and the average value of the values ​​of each dimension is used as the original reference point. Based on the original reference point, the constantly changing real-time API interface data is dynamically monitored to timely discover and handle abnormal API interfaces, thereby improving the current situation where the security protection measures of the MEC platform are relatively single.

[0095] Embodiment 1 of the present invention also selects appropriate interface information from API interface data, including dimensions such as application type, application ownership, usage cycle, application provider, and call frequency. When an abnormal API interface is discovered, the abnormal API interface and data are reported to form an API situation awareness map based on edge computing, and the security of the abnormal API interface is re-evaluated, including key indicators such as function, performance, and security. This method has important value and significance for improving MEC platform security, API security, and network security itself, guiding operator equipment procurement, and equipment manufacturer product upgrades.

[0096] Example 2:

[0097] like Figure 3 As shown, embodiment 2 of the present invention provides an API interface security management device, which is set on an edge computing MEC platform, and the device includes:

[0098] Clustering module 1, used for clustering basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library;

[0099] The benchmark module 2 is connected to the clustering module 1 and is used to obtain the original benchmark points corresponding to each category based on the basic API interface data contained in each category after clustering;

[0100] The monitoring module 3 is connected to the reference module 2 and is used to collect real-time API interface data corresponding to each of the API interfaces, and determine whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces;

[0101] The management module 4 is connected to the monitoring module 3 and is used to take security management measures for the abnormal API interface after determining that there is an abnormal API interface.

[0102] Optionally, the device further comprises:

[0103] The API basic information library module is used to collect the application type, application affiliation, usage cycle, application provider and call frequency corresponding to each API interface; then, the collected application type, application affiliation, usage cycle, application provider and call frequency are digitized; finally, the vector composed of the digitized application type, application affiliation, usage cycle, application provider and call frequency is saved as the basic API interface data in the API basic information library.

[0104] Optionally, the device further comprises:

[0105] A vectorization module is used to predefine vectors representing the basic API interface data and the real-time API interface data of each API interface, each vector including the digitized application type, application affiliation, usage cycle, application provider, and call frequency; the digitized application type takes different values ​​depending on whether the application type is a business application, a management application, or an operation and maintenance application; the digitized application affiliation takes different values ​​depending on whether the application affiliation is the platform's own application or a third-party application; the digitized usage cycle is determined by measuring the duration of the usage cycle of each API interface; the digitized application provider takes different values ​​depending on the application provider; the digitized call frequency is determined by measuring the number of calls of each API interface within a specified time period.

[0106] Optionally, the clustering module 1 specifically uses a K-Means algorithm to cluster the basic API interface data corresponding to each of the API interfaces in the API basic information library.

[0107] Optionally, the benchmark module 2 is specifically used to calculate the average values ​​of the numerically processed application type, application affiliation, usage cycle, application provider and call frequency for the basic API interface data contained in each category after clustering, and use the vector composed of each of the average values ​​as the original benchmark point corresponding to each category.

[0108] Optionally, the monitoring module 3 specifically includes:

[0109] A safety threshold unit, configured to calculate the distance between the basic API interface data included in each category and the original reference point, and use the maximum value of the distance values ​​as the safety threshold;

[0110] A collection unit, used to collect real-time API interface data corresponding to each of the API interfaces;

[0111] The judging unit is configured to judge whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold; if so, to judge that the API interface corresponding to the real-time API interface data is an abnormal API interface.

[0112] Optionally, the monitoring module 3 further includes:

[0113] The illustrated unit defines a safety range with the original reference point as the center and the safety threshold as the radius; based on whether the real-time API interface data exceeds the safety range, it is determined whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold; based on the degree to which the real-time API interface data exceeds the safety range, the real-time API interface data is divided into levels; and the real-time API interface data is identified with different colors according to the levels.

[0114] Optionally, the management module 4 is specifically used to take corresponding security management measures according to the level of the real-time API interface data corresponding to the abnormal API interface, and the security management measures include at least one of the following: prompting an early warning, limiting the frequency of calling the abnormal API interface, and closing the abnormal API interface.

[0115] Optionally, the device further comprises:

[0116] The API situational awareness module is configured to obtain real-time API interface data corresponding to the abnormal API interface and generate an API situational awareness map based on the real-time API interface data corresponding to the abnormal API interface. Embodiment 2 of the present invention is a device invention corresponding to Embodiment 1 of the present invention, and has the same beneficial effects as Embodiment 1, and will not be further described herein.

[0117] Example 3:

[0118] like Figure 4 As shown, embodiment 3 of the present invention provides a computer device, which includes a memory 10 and a processor 20, wherein a computer program is stored in the memory 10. When the processor 20 runs the computer program stored in the memory 10, the processor 20 executes the API interface security management method as described in embodiment 1.

[0119] The memory 10 is connected to the processor 20. The memory 10 may be a flash memory, a read-only memory, or other memory. The processor 20 may be a central processing unit or a single-chip microcomputer.

[0120] Example 4:

[0121] In addition, embodiment 4 of the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the API interface security management method as described in embodiment 1 is implemented.

[0122] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0123] It will be understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present invention, and the present invention is not limited thereto. Those skilled in the art will appreciate that various modifications and improvements can be made without departing from the spirit and substance of the present invention, and such modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for API interface security management, characterized in that: Applied to the edge computing MEC platform, the method includes: Clustering the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library; Based on the basic API interface data contained in each clustered category, the original benchmark points corresponding to each category are obtained, including: The vector consisting of the average value of each dimension of the basic API interface data contained in each clustered category is used as the original reference point corresponding to each category; Collecting real-time API interface data corresponding to each of the API interfaces, and determining whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces, specifically including: Calculate the distance between the basic API interface data contained in each category and the original reference point, and use the maximum value of the distance values ​​as the safety threshold. Determine whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold; if so, determine that the API interface corresponding to the real-time API interface data is an abnormal API interface; Classify the risk level of the real-time API interface data according to the extent to which the real-time API interface data exceeds the security threshold, and identify the real-time API interface data according to the risk level; The basic API interface data and the real-time API interface data both include the digitized application type, application ownership, usage cycle, application provider, and call frequency; If there is an abnormal API interface, security management measures will be taken for the abnormal API interface, and an API situation awareness map will be generated for each category based on the real-time API interface data corresponding to the abnormal API interface. The manufacturer, application and API where the abnormality occurred will be obtained from the API situation awareness map to guide operator equipment procurement, equipment manufacturer product upgrades and network security operation and maintenance.

2. The API interface security management method according to claim 1 is characterized in that Before clustering the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library, the method further includes: Collect the application type, application ownership, usage cycle, application provider and call frequency corresponding to each of the API interfaces; Numerical processing of the collected application type, application ownership, usage cycle, application provider, and call frequency; The vector composed of the numerically processed application type, application ownership, usage cycle, application provider and calling frequency is saved in the API basic information library as the basic API interface data.

3. The API interface security management method according to claim 2, characterized in that: Before collecting the application type, application ownership, usage cycle, application provider, and call frequency corresponding to each of the API interfaces, the method further includes: Predefine vectors representing the basic API interface data and the real-time API interface data for each API interface, each vector including numerically processed application type, application ownership, usage cycle, application provider, and call frequency; The application type after numerical processing takes different values ​​according to whether the application type is a business application, a management application, or an operation and maintenance application; The numerically processed application attribution takes different values ​​depending on whether the application is the platform's own application or a third-party application; The digitized usage cycle is obtained by measuring the duration of the usage cycle of each API interface; The numerically processed application provider takes different values ​​according to different application providers; The numerically processed call frequency is obtained by measuring the number of calls to each API interface within a specified time period.

4. The API interface security management method according to claim 1, characterized in that: The clustering of basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library specifically includes: The K-Means algorithm is used to cluster the basic API interface data corresponding to each of the API interfaces in the API basic information library.

5. The API interface security management method according to claim 2, characterized in that: The vector formed by the average value of each dimension of the basic API interface data contained in each clustered category is used as the original reference point corresponding to each category, specifically including: For the basic API interface data contained in each category after clustering, the average values ​​of the numerically processed application type, application affiliation, usage cycle, application provider and call frequency are calculated respectively, and the vector composed of each of the average values ​​is used as the original reference point corresponding to each category.

6. The API interface security management method according to any one of claims 1 to 5, characterized in that: The determining whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold specifically includes: A safety range is defined with the original reference point as the center and the safety threshold as the radius; According to whether the real-time API interface data exceeds the safety range, it is determined whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold.

7. The API interface security management method according to claim 1, characterized in that: The security management measures taken for the abnormal API interface specifically include: Corresponding security management measures are taken according to the risk level of the real-time API interface data corresponding to the abnormal API interface, and the security management measures include at least one of the following: prompting an early warning, limiting the frequency of calling the abnormal API interface, and closing the abnormal API interface.

8. An API interface security management device, characterized in that: Set up on the edge computing MEC platform, the device includes: The clustering module is used to cluster the basic API interface data corresponding to each API interface in the pre-stored application programming interface API basic information library; The benchmark module is connected to the clustering module and is used to obtain the original benchmark points corresponding to each category based on the basic API interface data contained in each category after clustering. Specifically, it is used to: The vector consisting of the average value of each dimension of the basic API interface data contained in each clustered category is used as the original reference point corresponding to each category; The monitoring module is connected to the reference module and is used to collect real-time API interface data corresponding to each of the API interfaces, and determine whether there is an abnormal API interface based on the real-time API interface data and the original reference points corresponding to each of the API interfaces, specifically including: The safety threshold unit is used to calculate the distance between the basic API interface data contained in each category and the original reference point, and use the maximum value of the distance values ​​as the safety threshold. a judging unit, configured to judge whether the distance between the real-time API interface data and the original reference point exceeds the safety threshold; if so, to judge that the API interface corresponding to the real-time API interface data is an abnormal API interface; a graphic representation unit, configured to classify the risk level of the real-time API interface data according to the extent to which the real-time API interface data exceeds the security threshold, and identify the real-time API interface data according to the risk level; The basic API interface data and the real-time API interface data both include the digitized application type, application ownership, usage cycle, application provider, and call frequency; The management module is connected to the monitoring module and is used to take security management measures for the abnormal API interface after determining that there is an abnormal API interface. The API situation awareness module is used to generate an API situation awareness map for each category based on the real-time API interface data corresponding to the abnormal API interface, and obtain the manufacturer, application and API where the abnormality occurs from the API situation awareness map to guide operator equipment procurement, equipment manufacturer product upgrades and network security operation and maintenance.

9. A computer device, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the API interface security management method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the API interface security management method according to any one of claims 1 to 7 is implemented.

Images