Abnormal interface application detection method and device, electronic device and storage medium

Abstract

The present invention discloses a method for detecting abnormal interface applications, a device thereof, an electronic device, and a storage medium, relating to the field of big data technology. The method comprises obtaining application data related to interface applications in historical processes, extracting an association rule set from the application data, and determining an abnormal application determination strategy based on the association rule set, wherein the abnormal application determination strategy is used to detect abnormal interface applications. The present invention solves the technical problem in related technologies of being unable to automatically detect abnormal interface applications, resulting in low detection efficiency and accuracy.

Description

Technical Field

[0001] The present invention relates to the field of data mining technology, and in particular to a method for detecting abnormal interface applications, a device thereof, an electronic device and a storage medium. Background Art

[0002] At present, many application apps involve functions such as transactions, transfers, payments, and information queries. To support the development of such application apps, many financial institutions have opened some API (application programming interface) calling interfaces to the outside world. Application apps can apply to financial institutions for the use of specific APIs to implement their corresponding functions.

[0003] However, in related technologies, API applications are primarily manually approved by financial institutions' internal audit departments, which cannot automatically detect abnormal interface applications. This approval method is not only inefficient but also easily overlooks illegal applications from some apps. For example, some apps may illegally apply for APIs unrelated to their primary functions, resulting in information leaks.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present invention provide a method for detecting abnormal interface applications, an apparatus thereof, an electronic device, and a storage medium, so as to at least solve the technical problem in the related art that abnormal interface applications cannot be automatically detected, resulting in low detection efficiency and accuracy.

[0006] According to one aspect of an embodiment of the present invention, a method for detecting abnormal interface applications is provided, comprising: obtaining application data involving interface applications in a historical process, wherein the interface application refers to a request behavior of an application program of an external device to call an application program interface API of a local financial institution; extracting an association rule set from the application data; and determining an abnormal application determination strategy based on the association rule set, wherein the abnormal application determination strategy is used to detect abnormal interface applications.

[0007] Optionally, after obtaining application data involving interface applications in the historical process, the detection method further includes: analyzing the application data, extracting interface applications in the application data that meet cleaning conditions; and deleting all interface applications that meet the cleaning conditions.

[0008] Optionally, after deleting all interface applications that meet the cleaning conditions, the detection method also includes: receiving a data format conversion task; obtaining the data format of each interface application in the application data, wherein the data format includes at least: an interface name; mapping the interface name of the interface application to a positive integer to complete the data format conversion task of the interface application.

[0009] Optionally, extracting an association rule set from the application data includes: obtaining the API contained in each interface application in the application data; extracting APIs whose interface support is greater than or equal to the minimum support to obtain a set of commonly used items; and generating the association rule set based on the set of commonly used items.

[0010] Optionally, based on the commonly used item set, the association rule set is generated, including: for each of the commonly used item sets, generating all non-empty subsets of the commonly used item set; calculating the support ratio between the support of each of the non-empty subsets and the support of the commonly used item set; and when the support ratio is greater than or equal to a minimum confidence threshold, determining the association rule between each of the non-empty subsets and the commonly used item set to obtain the association rule set.

[0011] Optionally, after determining the abnormal application judgment strategy based on the association rule set, the detection method also includes: using the first type of abnormal application judgment strategy to determine the conditions for satisfying the negative correlation pattern; combining every two of the commonly used item sets to obtain a common item union; detecting whether the common item union corresponding to every two of the commonly used item sets is a negative correlation pattern; and when the common item union is a negative correlation pattern, determining that the interface application containing the common item union is an abnormal interface application.

[0012] Optionally, after determining the abnormal application judgment strategy based on the association rule set, the detection method also includes: using the second type of abnormal application judgment strategy to determine the support threshold, wherein the support threshold is greater than the minimum support; analyzing the APIs in the current interface application whose support is less than the support threshold to obtain the first type of interface; detecting whether there is a rule in the association rule set that supports the current interface application of the first type of interface; if there is no rule in the association rule set that supports the current interface application of the first type of interface, determining that the current interface application is an abnormal interface application.

[0013] Optionally, after determining the abnormal application judgment strategy based on the association rule set, the detection method further includes: splitting the cleaned application data to obtain a data training set and a data test set; using the abnormal application judgment strategy and the data training set to construct an abnormal application analysis model, wherein the abnormal application analysis model is used to analyze whether the interface application to be detected is an abnormal interface application; running the data test set to determine the model generalization parameters of the abnormal application analysis model, wherein the model generalization parameters are used to evaluate the accuracy of the abnormal application analysis model in detecting abnormal interface applications.

[0014] According to another aspect of an embodiment of the present invention, a device for detecting abnormal interface applications is also provided, including: an acquisition unit for acquiring application data involving interface applications in a historical process, wherein the interface application refers to a request behavior of an application program of an external device to call an application program interface API of a local financial institution; an extraction unit for extracting an association rule set from the application data; and a determination unit for determining an abnormal application judgment strategy based on the association rule set, wherein the abnormal application judgment strategy is used to detect abnormal interface applications.

[0015] Optionally, the detection device also includes: a first analysis module, which is used to analyze the application data related to interface applications in the historical process after obtaining the application data, and extract the interface applications in the application data that meet the cleaning conditions; and a first deletion module, which is used to delete all interface applications that meet the cleaning conditions.

[0016] Optionally, the detection device also includes: a first receiving module, used to receive a data format conversion task after deleting all interface applications that meet the cleaning conditions; a first acquisition module, used to obtain the data format of each interface application in the application data, wherein the data format includes at least: an interface name; a first mapping module, used to map the interface name of the interface application to a positive integer to complete the data format conversion task of the interface application.

[0017] Optionally, the extraction unit includes: a second acquisition module, used to obtain the API contained in each interface application in the application data; a first extraction module, used to extract APIs whose interface support is greater than or equal to the minimum support to obtain a set of commonly used items; and a first generation module, used to generate the association rule set based on the set of commonly used items.

[0018] Optionally, the first generation module includes: a first generation submodule, used to generate all non-empty subsets of the commonly used item set for each of the commonly used item sets; a first calculation submodule, used to calculate the support ratio between the support of each of the non-empty subsets and the support of the commonly used item set; and a first determination submodule, used to determine the association rules between each of the non-empty subsets and the commonly used item set when the support ratio is greater than or equal to a minimum confidence threshold, so as to obtain an association rule set.

[0019] Optionally, the detection device also includes: a first adoption module, which is used to adopt a first type of abnormal application judgment strategy to determine the conditions for satisfying the negative correlation pattern after determining the abnormal application judgment strategy based on the association rule set; a first combination module, which is used to combine every two of the commonly used item sets to obtain a common item union; a first detection module, which is used to detect whether the common item union corresponding to every two of the commonly used item sets is a negative correlation pattern; and a first determination module, which is used to determine that the interface application containing the common item union is an abnormal interface application when the common item union is a negative correlation pattern.

[0020] Optionally, the detection device also includes: a second adoption module, which is used to determine the support threshold by adopting the second type of abnormal application determination strategy after determining the abnormal application determination strategy based on the association rule set, wherein the support threshold is greater than the minimum support; a second analysis module, which is used to analyze the API in the current interface application whose support is less than the support threshold to obtain the first type of interface; a second detection module, which is used to detect whether there is a rule in the association rule set that supports the current interface application of the first type of interface; and a second determination module, which is used to determine that the current interface application is an abnormal interface application when there is no rule in the association rule set that supports the current interface application of the first type of interface.

[0021] Optionally, the detection device also includes: a first splitting module, used to split the cleaned application data to obtain a data training set and a data test set after determining the abnormal application judgment strategy based on the association rule set; a third adoption module, used to adopt the abnormal application judgment strategy and the data training set to construct an abnormal application analysis model, wherein the abnormal application analysis model is used to analyze whether the interface application to be detected is an abnormal interface application; a first running module, used to run the data test set to determine the model generalization parameters of the abnormal application analysis model, wherein the model generalization parameters are used to evaluate the accuracy of the abnormal application analysis model in detecting abnormal interface applications.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for detecting abnormal interface applications.

[0023] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned methods for detecting abnormal interface applications.

[0024] In the present disclosure, application data involving interface applications in a historical process is obtained, an association rule set is extracted from the application data, and an abnormal application determination strategy is determined based on the association rule set, wherein the abnormal application determination strategy is used to detect abnormal interface applications. In the present application, by analyzing the application data of the interface application, association rules can be obtained, thereby determining the abnormal application determination strategy (for screening out abnormal interface applications), realizing the automation of the detection process, effectively improving the efficiency and accuracy of the detection, and thus solving the technical problem in the related art that abnormal interface applications cannot be automatically detected, resulting in low detection efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a flow chart of an optional method for detecting abnormal interface application according to an embodiment of the present invention;

[0027] Figure 2 is a schematic diagram of a detection process of an optional system for detecting abnormal API applications according to an embodiment of the present invention;

[0028] Figure 3 is a schematic diagram of an optional algorithm calling process according to an embodiment of the present invention;

[0029] Figure 4 is a schematic diagram of an optional abnormal interface application detection device according to an embodiment of the present invention;

[0030] Figure 5 The present invention is a hardware structure block diagram of an electronic device (or mobile device) for implementing a method for detecting abnormal interface applications according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] To facilitate those skilled in the art to understand the present invention, some of the terms or nouns involved in the embodiments of the present invention are explained below:

[0034] Application Programming Interface (API): It is a set of predefined interfaces (such as functions, HTTP interfaces), or refers to the agreement for connecting different components of a software system.

[0035] Association analysis: also known as association mining, is the process of finding frequent patterns, associations, correlations, or causal structures between sets of items or objects in transaction data, relational data, or other information carriers.

[0036] It should be noted that the method for detecting abnormal interface applications and the device thereof disclosed in the present invention can be used in the field of big data when detecting abnormal interface applications, and can also be used in any field other than the field of big data when detecting abnormal interface applications. The application field of the method for detecting abnormal interface applications and the device thereof disclosed in the present invention is not limited.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0038] The following embodiments of the present invention can be applied to various systems / applications / devices for detecting abnormal interface applications. The interface application refers to the request behavior of an external device's application to call the application program interface API of a local financial institution. The application can be various application APPs with functions such as transactions, transfers, and payments. Financial institutions include but are not limited to: fund institutions, bond institutions, etc.

[0039] This method first scans a database of API application records, using efficient algorithms to mine frequent itemsets and derive associations and correlation rules. It then uses the resulting association rule sets, combined with data features, to develop a strategy for identifying abnormal behavior and filter out anomalous API applications. This method fully leverages the computing resources of a big data platform to quantitatively calculate correlations between APIs, effectively shortening the approval and verification process and reducing the workload for auditors. It also enhances the interpretability of the results, facilitating their application to other fields.

[0040] Example 1

[0041] According to an embodiment of the present invention, an embodiment of a method for detecting abnormal interface applications is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] Figure 1 FIG. 1 is a flow chart of an optional method for detecting abnormal interface application according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0043] Step S101 : obtaining application data related to interface application in a historical process, wherein the interface application refers to a request behavior of an application program of an external device to call an application program interface (API) of a local financial institution.

[0044] Step S102: extracting an association rule set from the application data.

[0045] Step S103: determining an abnormal application determination strategy based on the association rule set, wherein the abnormal application determination strategy is used to detect abnormal interface applications.

[0046] Through the above steps, it is possible to obtain application data involving interface applications in the historical process, extract an association rule set from the application data, and determine an abnormal application determination strategy based on the association rule set, wherein the abnormal application determination strategy is used to detect abnormal interface applications. In an embodiment of the present invention, by analyzing the application data of the interface application, association rules can be obtained, thereby determining an abnormal application determination strategy (used to screen out abnormal interface applications), realizing the automation of the detection process, effectively improving the efficiency and accuracy of the detection, and thus solving the technical problem in the related art that abnormal interface applications cannot be automatically detected, resulting in low detection efficiency and accuracy.

[0047] The embodiment of the present invention is described in detail below in conjunction with the above steps.

[0048] Step S101 : obtaining application data related to interface application in a historical process, wherein the interface application refers to a request behavior of an application program of an external device to call an application program interface (API) of a local financial institution.

[0049] In an embodiment of the present invention, the external device can be various terminal devices, such as: mobile phones, PCs, tablets, etc. The external device can apply to call the application program interface API of a local financial institution (for example, a bank, etc.) through the application on it to interact with the financial institution system.

[0050] Optionally, after obtaining application data involving interface applications in the historical process, the detection method further includes: analyzing the application data, extracting interface applications from the application data that meet the cleaning conditions; and deleting all interface applications that meet the cleaning conditions.

[0051] In an embodiment of the present invention, after obtaining application data related to interface applications in the historical process, the application data can be cleaned to simplify the analysis task and prevent the algorithm from failing to run due to poor data quality or data imbalance. The cleaning conditions in this embodiment must meet at least any of the following aspects:

[0052] (1) All APIs applied for by an APP are only applied for by that APP;

[0053] (2) Among the APIs applied for by an APP, there is at least one API that has only been applied for by the APP;

[0054] (3) An application only applied for one API;

[0055] If there is an interface application that meets the cleaning condition in the application data, the interface application is deleted. For example, an SQL statement can be used to perform data cleaning to delete the interface application that meets the cleaning condition.

[0056] Optionally, after deleting all interface applications that meet the cleaning conditions, the detection method also includes: receiving a data format conversion task; obtaining the data format of each interface application in the application data, wherein the data format includes at least: an interface name; mapping the interface name of the interface application to a positive integer to complete the data format conversion task of the interface application.

[0057] In an embodiment of the present invention, the data format is converted to make the data format of each interface application consistent with the algorithm interface adopted, which means mapping the API name (that is, the interface name of the interface application) to a positive integer. For example, if get_name (the interface name) is 0, get_date is 1, and get_info is 2, then {get_name, get_info} is mapped to {0, 2}.

[0058] Step S102: extracting an association rule set from the application data.

[0059] Optionally, extracting an association rule set from the application data includes: obtaining the APIs contained in each interface application in the application data; extracting APIs whose interface support is greater than or equal to the minimum support to obtain a common item set; and generating an association rule set based on the common item set.

[0060] In an embodiment of the present invention, after the application data is cleaned and the data format conversion is completed, all APIs in the application data can be extracted. When the interface support of the API is greater than or equal to the minimum support (which can be set according to the specific situation), a set of common items (i.e., a frequent item set, which is used to mine association rules and can be generated by the FP-Growth algorithm or the Apriori algorithm) is obtained. Afterwards, an association rule set can be generated based on the set of common items.

[0061] Optionally, based on the common item set, an association rule set is generated, including: for each common item set, generating all non-empty subsets of the common item set; calculating the support ratio between the support of each non-empty subset and the support of the common item set; when the support ratio is greater than or equal to a minimum confidence threshold, determining the association rule between each non-empty subset and the common item set to obtain the association rule set.

[0062] In an embodiment of the present invention, for each frequently used item set, all non-empty subsets of the frequently used item set can be generated, and the support ratio between the support of each non-empty subset and the support of the frequently used item set is calculated. When the support ratio is greater than or equal to a minimum confidence threshold (the size of the threshold can be determined by data features, where the data features include mean, variance, median, mode, etc., which can be directly obtained using SQL statements), the association rules between each non-empty subset and the frequently used item set are determined to obtain an association rule set (for example, the association_rules function in the Python third-party library mlxtend can be called to calculate the association rule set). For example, for each frequent item set L, all non-empty subsets of L are generated. For each non-empty subset S of L, if support_count(L) / support_count(S)>=min_conf, an association rule S=>(LS) is generated, where min_conf is the minimum confidence threshold.

[0063] Step S103: determining an abnormal application determination strategy based on the association rule set, wherein the abnormal application determination strategy is used to detect abnormal interface applications.

[0064] Optionally, after determining the abnormal application determination strategy based on the association rule set, the detection method further includes: determining the satisfaction conditions of the negative correlation pattern by using the first type of abnormal application determination strategy; combining every two frequent item sets to obtain the union of frequent items; detecting whether the union of frequent items corresponding to every two frequent item sets is a negative correlation pattern; and determining the interface application including the union of frequent items as an abnormal interface application when the union of frequent items is a negative correlation pattern.

[0065] In an embodiment of the present invention, the first type of abnormal application determination strategy is to mine the "negative correlation pattern", and the definition of the negative correlation pattern is as follows:

[0066] Assume that both item sets X and Y are frequent (that is, both item sets X and Y are frequent item sets), that is, sup(X) >= min_support, sup(Y) >= min_support. If (P(X|Y) + P(Y|X)) / 2 < eps, where min_support is the minimum support degree and eps is the negative pattern threshold (which can be set according to specific situations), then X U Y is a negative correlation pattern.

[0067] Moreover, P(X|Y) and P(Y|X) can be calculated by the FP - Growth algorithm, which can determine whether the union of any two frequent item sets is a negative correlation pattern (that is, combining every two frequent item sets to obtain the union of frequent items, and detecting whether the union of frequent items corresponding to every two frequent item sets is a negative correlation pattern). To detect whether a certain API application (that is, an interface application) is abnormal, it can be checked whether it contains a negative correlation pattern. If there is a negative correlation pattern, it can be determined that the request is abnormal and output to the final result (that is, determining the interface application including the union of frequent items as an abnormal interface application when the union of frequent items is a negative correlation pattern).

[0068] Optionally, after determining the abnormal application determination strategy based on the association rule set, the detection method further includes: determining the support degree threshold by using the second type of abnormal application determination strategy, where the support degree threshold is greater than the minimum support degree; analyzing the APIs in the current interface application with support degrees less than the support degree threshold to obtain the first type of interfaces; detecting whether there is a rule in the association rule set that supports the current interface application of the first type of interfaces; and determining the current interface application as an abnormal interface application when there is no rule in the association rule set that supports the current interface application of the first type of interfaces.

[0069] In an embodiment of the present invention, the second-category abnormal application judgment strategy is to set a threshold alpha (i.e., support threshold) and satisfy alpha>min_support (i.e., minimum support), and filter out all APIs in the commonly used item set with support less than alpha. These APIs are defined as "low-frequency APIs" (represented by first-category interfaces in this embodiment). For each application request containing a low-frequency API, it is detected whether there is a rule in the association rule set that can support the rationality of the low-frequency API application (i.e., it is detected whether there is a rule in the association rule set that supports the current interface application of the first-category interface). If it cannot be found, the request can be determined to be abnormal and output to the final result (i.e., when there is no rule in the association rule set that supports the current interface application of the first-category interface, the current interface application is determined to be an abnormal interface application).

[0070] Optionally, after determining the abnormal application judgment strategy based on the association rule set, the detection method also includes: splitting the cleaned application data to obtain a data training set and a data test set; using the abnormal application judgment strategy and the data training set to construct an abnormal application analysis model, wherein the abnormal application analysis model is used to analyze whether the interface application to be detected is an abnormal interface application; running the data test set to determine the model generalization parameters of the abnormal application analysis model, wherein the model generalization parameters are used to evaluate the accuracy of the abnormal application analysis model in detecting abnormal interface applications.

[0071] In an embodiment of the present invention, the cleaned application data can be split into a training set (the training set can be set to account for approximately 80% of the entire data set) and a test set (the test set can be set to account for approximately 20% of the entire data set) so that it can cover the original data. After that, the abnormal application judgment strategy (i.e., the first type of abnormal application judgment strategy and the second type of abnormal application judgment strategy) and the data training set can be used to construct an abnormal application analysis model for analyzing whether the interface application to be detected is an abnormal interface application. After the construction is completed, the data test set can be run to test the generalization ability of the model (i.e., run the data test set to determine the model generalization parameters of the abnormal application analysis model), and the model generalization parameters are used to evaluate the accuracy of the abnormal application analysis model in detecting abnormal interface applications.

[0072] The embodiment of the present invention scans the API application record database, uses an efficient algorithm to mine frequent item sets, and derives associations and related rules from them. In combination with data features, a strategy for determining abnormal behavior is formulated to screen out abnormal API applications, thereby automating the detection process. This can effectively shorten the approval and verification process, reduce the workload of auditors, and at the same time enhance the interpretability of the results, which is conducive to their application to other fields.

[0073] Example 2

[0074] Figure 2 FIG. 1 is a schematic diagram of an optional detection process of a system for detecting abnormal API applications according to an embodiment of the present invention. Figure 2 As shown, it includes: data cleaning, data splitting, feature extraction, algorithm calling, and model evaluation, among which:

[0075] Data cleaning: This is used to simplify analysis tasks and prevent algorithms from failing due to poor data quality or imbalanced data. In this example, the following three types of data need to be cleaned in advance:

[0076] (1) All APIs applied for by an APP are only applied for by that APP;

[0077] (2) Among the APIs applied for by an APP, there is at least one API that has only been applied for by the APP;

[0078] (3) An application APP only applied for one API.

[0079] This system can use SQL statements to clean data.

[0080] Data splitting: Split the data into a training set (the training set can be set to about 80% of the entire data set) and a test set (the test set can be set to about 20% of the entire data set) to cover the original data.

[0081] Feature extraction: used to convert data format to make it consistent with the algorithm interface.

[0082] Figure 3 FIG. 1 is a schematic diagram of an optional algorithm calling process according to an embodiment of the present invention. The algorithm calling process is specifically as follows:

[0083] This system can use the FP-Growth algorithm provided by the Turing platform to mine frequent patterns, and call the association_rules function in the Python third-party library mlxtend to export the association rule set. In the process of exporting the association rule set, it is necessary to set the minimum support threshold min_support and the minimum confidence threshold confidence. The above thresholds can be set by relevant users.

[0084] After obtaining the association rule set, the following strategy can be used to model abnormal application behavior and obtain an abnormal application analysis model:

[0085] The first strategy is to set a threshold alpha (i.e., the low-frequency API threshold alpha), and satisfy alpha > min_support, then filter out all APIs with support less than alpha, and these APIs are defined as "low-frequency APIs". For each application request containing low-frequency APIs, detect whether there is a rule in the association rule set that can support the rationality of the low-frequency API application (i.e., judge the rationality of the low-frequency API request). If no such rule can be found, it can be determined that the request is abnormal and output to the final result.

[0086] The second strategy is to mine "negatively correlated patterns", which are defined as follows:

[0087] Suppose item sets X and Y are both frequent, sup(X) >= min_support, sup(Y) >= min_support. If (P(X|Y) + P(Y|X)) / 2 < eps, where min_support is the minimum support and eps is the negative pattern threshold (which can be set according to specific circumstances), then X U Y is a negatively correlated pattern.

[0088] Moreover, P(X|Y) and P(Y|X) can be calculated by the FP-Growth algorithm, which can determine whether the union of any two frequent item sets is a negatively correlated pattern. To examine whether an API application is abnormal, it can be checked whether it contains a negatively correlated pattern (i.e., determine whether the request contains a negatively correlated pattern). If there is a negatively correlated pattern, it can be determined that the request is abnormal and output to the final result.

[0089] Model evaluation: Run the test data set to test the generalization ability of the model, and the generalization ability of the model is used to evaluate the accuracy of the abnormal application analysis model when detecting abnormal interface applications.

[0090] In the embodiments of the present invention, by making full use of the computing resources provided by the Turing platform, scanning the API application record database, using an efficient algorithm to mine frequent item sets, and deriving association and correlation rules therefrom, and combining data characteristics, formulating a decision-making strategy for abnormal behaviors, filtering out abnormal API applications, the automation of the detection process is achieved. The detection abnormal API application system constructed in the embodiments of the present invention can effectively simplify the API application approval process, reduce the judgment pressure on auditors. In addition, the system can accurately measure the correlation between APIs and enhance the interpretability of the final result.

[0091] Embodiment 3

[0092] A detection device for abnormal interface applications provided in this embodiment includes multiple implementation units, and each implementation unit corresponds to each implementation step in Embodiment 1 above.

[0093] Figure 4FIG. 1 is a schematic diagram of an optional abnormal interface application detection device according to an embodiment of the present invention. Figure 4 As shown, the detection device may include: an acquisition unit 40, an extraction unit 41, and a determination unit 42, wherein:

[0094] An acquisition unit 40 is configured to acquire application data related to interface applications in a historical process, wherein an interface application refers to a request behavior of an application program of an external device to call an application program interface (API) of a local financial institution;

[0095] An extraction unit 41 is used to extract an association rule set from the application data;

[0096] The determination unit 42 is configured to determine an abnormal application determination strategy based on the association rule set, wherein the abnormal application determination strategy is used to detect abnormal interface applications.

[0097] The above-mentioned detection device can obtain application data involving interface applications in the historical process through the acquisition unit 40, extract the association rule set from the application data through the extraction unit 41, and determine the abnormal application judgment strategy based on the association rule set through the determination unit 42, wherein the abnormal application judgment strategy is used to detect abnormal interface applications. In an embodiment of the present invention, by analyzing the application data of the interface application, the association rules can be obtained, thereby determining the abnormal application judgment strategy to screen out abnormal interface applications, thereby realizing the automation of the detection process, effectively improving the efficiency and accuracy of the detection, and thus solving the technical problem in the related art that abnormal interface applications cannot be automatically detected, resulting in low detection efficiency and accuracy.

[0098] Optionally, the detection device also includes: a first analysis module, which is used to analyze the application data after obtaining the application data involving interface applications in the historical process, and extract the interface applications from the application data that meet the cleaning conditions; and a first deletion module, which is used to delete all interface applications that meet the cleaning conditions.

[0099] Optionally, the detection device also includes: a first receiving module, used to receive a data format conversion task after deleting all interface applications that meet the cleaning conditions; a first acquisition module, used to obtain the data format of each interface application in the application data, wherein the data format includes at least: an interface name; a first mapping module, used to map the interface name of the interface application to a positive integer to complete the data format conversion task of the interface application.

[0100] Optionally, the extraction unit includes: a second acquisition module, used to obtain the API contained in each interface application in the application data; a first extraction module, used to extract APIs whose interface support is greater than or equal to the minimum support to obtain a set of commonly used items; and a first generation module, used to generate an association rule set based on the set of commonly used items.

[0101] Optionally, the first generation module includes: a first generation submodule, used to generate all non-empty subsets of the common item set for each common item set; a first calculation submodule, used to calculate the support ratio between the support of each non-empty subset and the support of the common item set; a first determination submodule, used to determine the association rules between each non-empty subset and the common item set when the support ratio is greater than or equal to a minimum confidence threshold, and obtain an association rule set.

[0102] Optionally, the detection device also includes: a first adoption module, which is used to adopt a first type of abnormal application judgment strategy to determine the conditions for satisfying the negative correlation pattern after determining the abnormal application judgment strategy based on the association rule set; a first combination module, which is used to combine every two commonly used item sets to obtain a common item union; a first detection module, which is used to detect whether the common item union corresponding to every two common item sets is a negative correlation pattern; and a first determination module, which is used to determine that the interface application containing the common item union is an abnormal interface application when the common item union is a negative correlation pattern.

[0103] Optionally, the detection device also includes: a second adoption module, which is used to determine the support threshold by adopting the second type of abnormal application determination strategy after determining the abnormal application determination strategy based on the association rule set, wherein the support threshold is greater than the minimum support; a second analysis module, which is used to analyze the API in the current interface application whose support is less than the support threshold to obtain the first type of interface; a second detection module, which is used to detect whether there is a rule in the association rule set that supports the current interface application of the first type of interface; and a second determination module, which is used to determine that the current interface application is an abnormal interface application when there is no rule in the association rule set that supports the current interface application of the first type of interface.

[0104] Optionally, the detection device also includes: a first splitting module, used to split the cleaned application data to obtain a data training set and a data test set after determining the abnormal application judgment strategy based on the association rule set; a third adoption module, used to adopt the abnormal application judgment strategy and the data training set to construct an abnormal application analysis model, wherein the abnormal application analysis model is used to analyze whether the interface application to be detected is an abnormal interface application; a first running module, used to run the data test set to determine the model generalization parameters of the abnormal application analysis model, wherein the model generalization parameters are used to evaluate the accuracy of the abnormal application analysis model in detecting abnormal interface applications.

[0105] The above-mentioned detection device may also include a processor and a memory. The above-mentioned acquisition unit 40, extraction unit 41, determination unit 42, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0106] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the exception application judgment strategy is determined by adjusting kernel parameters.

[0107] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0108] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: obtaining application data involving interface applications in a historical process, extracting an association rule set from the application data, and determining an abnormal application judgment strategy based on the association rule set, wherein the abnormal application judgment strategy is used to detect abnormal interface applications.

[0109] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any of the above-mentioned methods for detecting abnormal interface applications.

[0110] Figure 5 FIG. 1 is a hardware structure diagram of an electronic device (or mobile device) for implementing a method for detecting abnormal interface applications according to an embodiment of the present invention. Figure 5 As shown, the electronic device may include one or more (illustrated as 102a, 102b, ..., 102n in the figure) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 5 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 5 More or fewer components than shown, or with Figure 5 Different configurations shown.

[0111] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any of the above-mentioned abnormal interface application detection methods.

[0112] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0113] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0115] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0116] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0117] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0118] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal interface application, characterized in that: Applied in systems for detecting abnormal interface applications, including: Obtain application data related to interface applications in the historical process, wherein the interface application refers to the request behavior of an application program of an external device to call the application program interface API of a local financial institution; Extracting an association rule set from the application data, including: obtaining an API contained in each interface application in the application data; extracting APIs whose interface support is greater than or equal to a minimum support to obtain a common item set; generating the association rule set based on the common item set; generating the association rule set based on the common item set, including: for each common item set, generating all non-empty subsets of the common item set; calculating a support ratio between the support of each non-empty subset and the support of the common item set; and when the support ratio is greater than or equal to a minimum confidence threshold, determining an association rule between each non-empty subset and the common item set to obtain an association rule set; Based on the association rule set, an abnormal application determination strategy is adopted to detect abnormal interface applications, including: Adopting a first-class abnormal application determination strategy to detect abnormal interface applications, including: adopting the first-class abnormal application determination strategy to determine a condition satisfying a negative correlation pattern; combining every two of the common item sets to obtain a common item union; detecting whether each common item union is a negative correlation pattern; and when the common item union is a negative correlation pattern, determining that the interface application containing the common item union is an abnormal interface application; And / or, a second-class abnormal application determination strategy is used to detect abnormal interface applications, including: using the second-class abnormal application determination strategy to determine a support threshold, the support threshold being greater than the minimum support; analyzing the APIs in the current interface application whose support is less than the support threshold to obtain a first-class interface; detecting whether there is a rule in the association rule set that supports the current interface application of the first-class interface; when there is no rule in the association rule set that supports the current interface application of the first-class interface, determining that the current interface application is an abnormal interface application.

2. The detection method according to claim 1, characterized in that After obtaining the application data related to the interface application in the historical process, the detection method further includes: Analyzing the application data and extracting interface applications in the application data that meet the cleaning conditions; Delete all interface applications that meet the cleaning conditions.

3. The detection method according to claim 2, characterized in that After deleting all interface applications that meet the cleaning conditions, the detection method further includes: Receive data format conversion tasks; Acquire the data format of each interface application in the application data, wherein the data format at least includes: an interface name; The interface name of the interface application is mapped to a positive integer to complete the data format conversion task of the interface application.

4. The detection method according to claim 1, wherein After detecting abnormal interface applications using the first type abnormal application determination strategy or the second type abnormal application determination strategy based on the association rule set, the detection method further includes: Split the cleaned application data into a training set and a test set; An abnormal application analysis model is constructed using the abnormal application determination strategy and the data training set, wherein the abnormal application analysis model is used to analyze whether the interface application to be detected is an abnormal interface application; The data test set is run to determine a model generalization parameter of the abnormal application analysis model, wherein the model generalization parameter is used to evaluate the accuracy of the abnormal application analysis model in detecting abnormal interface applications.

5. A device for detecting abnormal interface application, characterized in that: Applied in systems for detecting abnormal interface applications, including: An acquisition unit, configured to acquire application data related to interface applications in a historical process, wherein the interface application refers to a request behavior of an application program of an external device to call an application program interface (API) of a local financial institution; an extraction unit, configured to extract an association rule set from the application data; A determination unit, configured to detect abnormal interface applications using an abnormal application determination strategy based on the association rule set; a first adopting module for determining the conditions for satisfying a negative correlation pattern using a first type of abnormal application determination strategy; a first combining module for combining each two sets of commonly used items to obtain a commonly used item union; a first detecting module for detecting whether each commonly used item union is a negative correlation pattern; and a first determining module for determining, when the commonly used item union is a negative correlation pattern, that an interface application containing the commonly used item union is an abnormal interface application; The second adoption module is used to adopt the second type of abnormal application judgment strategy to determine the support threshold, and the support threshold is greater than the minimum support; the second analysis module is used to analyze the API whose support is less than the support threshold in the current interface application to obtain the first type of interface; the second detection module is used to detect whether there is a rule in the association rule set that supports the current interface application of the first type of interface; the second determination module is used to determine that the current interface application is an abnormal interface application when there is no rule in the association rule set that supports the current interface application of the first type of interface; The extraction unit includes: a second acquisition module, used to obtain the API contained in each interface application in the application data; a first extraction module, used to extract the API whose interface support is greater than or equal to the minimum support, and obtain a common item set; a first generation module, used to generate the association rule set based on the common item set; the first generation module includes: a first generation sub-module, used to generate all non-empty subsets of the common item set for each common item set; a first calculation sub-module, used to calculate the support ratio between the support of each non-empty subset and the support of the common item set; a first determination sub-module, used to determine the association rule between each non-empty subset and the common item set when the support ratio is greater than or equal to the minimum confidence threshold, and obtain the association rule set.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method for detecting abnormal interface applications according to any one of claims 1 to 4.

7. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for detecting abnormal interface applications as described in any one of claims 1 to 4.

Images