API risk determination method, device, equipment and medium

Abstract

The embodiment of the present invention provides a method, device, equipment and medium for determining the risk of an API, which is used to improve the accuracy of the risk assessment of each API. In the embodiment of the present invention, when determining the target risk value of a certain API, the first risk value determined for the alarm information received within a preset time length is not determined only for a certain alarm information, so the first risk value of the API being attacked by each alarm category can be accurately determined. In the embodiment of the present invention, the accuracy of the risk assessment of the API can be improved according to the first risk value, the importance level of the API and the threat level of each alarm category.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a risk determination method, device, equipment and medium for an application programming interface (API). Background Art

[0002] As enterprises continue to move to the Internet, more and more businesses are being migrated to the cloud. This requires enterprises to use a large number of APIs for business interaction and external services, such as using Representational state transfer-ful (Restful) APIs for business interaction and external services. In order to obtain data, attackers usually exploit and penetrate through APIs to gain greater benefits.

[0003] In the prior art, when detecting whether each API is at risk due to being attacked, each detection device and preset detection rules are used to perform single-point detection on the API. However, single-point detection is only a one-time detection, and the detection of whether the API is attacked is not necessarily accurate. In addition, different attack methods have different harmfulness and cause different losses to the API. Different APIs have the same importance, and the risks caused by attacks on different APIs are also different. Summary of the invention

[0004] The embodiments of the present invention provide a method, device, equipment and medium for determining the risk of an API, so as to improve the accuracy of the risk assessment of each API.

[0005] In a first aspect, an embodiment of the present invention provides a method for determining risk of an API, the method comprising:

[0006] If the risk determination condition is currently met, then, according to the saved time when each alarm message is received, each alarm message received within a preset time length before the current time is obtained; and the detected API carried in each alarm message is obtained;

[0007] For each detected API, obtain each target alarm information carrying the API; obtain the alarm category carried in each target alarm information; for each alarm category, count the target number of target alarm information carrying the alarm category, and use a first preset function to determine the target probability value of the API being attacked by the alarm category based on a preset value and the target number; use a second preset function to determine the loss value of the API being attacked by the alarm category based on a preset importance level of the API and a threat level of the alarm category; use a third preset function to determine the first risk value of the API being attacked by the alarm category based on the target probability value and the loss value; determine the target risk value of the API based on the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category.

[0008] Furthermore, the risk determination condition currently met includes:

[0009] If a risk determination request is received, determining that the risk determination condition is currently met; or

[0010] If the time interval between the current time and the time when the risk determination was last performed reaches the set time threshold, it is determined that the risk determination condition is currently met.

[0011] Further, the adopting of the first preset function to determine the target probability value of the API being attacked by the alarm category according to the preset value and the target quantity includes:

[0012] Determine, according to a first product of a first preset value and the target quantity, a probability value that the API has not been attacked by the alarm category;

[0013] A target probability value of the API being attacked by the alarm category is determined according to the difference between the second preset value and the probability value.

[0014] Further, the determining, based on the first product of the first preset value and the target quantity, the probability value that the API has not been attacked by the alarm category includes:

[0015] Determine a first product of a first preset value and the target number, determine a third preset value as a base, and the first product is a value of an exponent, which is a probability value that the API has not been attacked by the alarm category.

[0016] Furthermore, the use of the second preset function to determine the loss value of the API being attacked by the alarm category according to the preset importance level of the API and the threat level of the alarm category includes:

[0017] The loss value of the API being attacked by the alarm category is determined according to a second product of the preset importance level of the API and the preset threat level of the alarm category.

[0018] Further, the determining of the loss value of the API being attacked by the alarm category according to the second product of the preset importance level of the API and the preset threat level of the alarm category includes:

[0019] A second product of a preset importance level of the API and a preset threat level of the alarm category is determined, and the second product is determined to be a loss value of the API being attacked by the alarm category.

[0020] Further, the adopting of the third preset function to determine the first risk value of the API being attacked by the alarm category according to the target probability value and the loss value includes:

[0021] A first risk value of the API being attacked by the alarm category is determined according to a third product of the target probability value and the loss value.

[0022] Further, determining the first risk value of the API being attacked by the alarm category according to the third product of the target probability value and the loss value includes:

[0023] A third product of the target probability value and the loss value is determined, and the third product is determined to be a first risk value of the API being attacked by the alarm category.

[0024] Further, determining the target risk value of the API according to the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category includes:

[0025] Determine a second risk value of the API being attacked according to a first sum of the first risk values ​​of the API being attacked by each alarm category;

[0026] Determine a target loss value of the API being attacked according to the second sum of the loss values ​​of the API being attacked by each alarm category;

[0027] The target risk value of the API is determined according to the ratio of the second risk value to the target loss value.

[0028] Further, determining the target risk value of the API according to the ratio of the second risk value to the target loss value includes:

[0029] Determine a ratio of the second risk value to the target loss value, and determine the ratio as the target risk value of the API.

[0030] In a second aspect, an embodiment of the present invention further provides a risk determination device for an API, the device comprising:

[0031] An acquisition module, used to acquire each alarm message received within a preset time length before the current time according to the saved time of receiving each alarm message if the risk determination condition is currently met; and acquire the detected API carried in each alarm message;

[0032] A processing module is used to obtain, for each detected API, each target alarm information carrying the API; obtain the alarm category carried in the target alarm information; for each alarm category, count the target number of target alarm information carrying the alarm category, and use a first preset function to determine the target probability value of the API being attacked by the alarm category according to a preset value and the target number; use a second preset function to determine the loss value of the API being attacked by the alarm category according to a preset importance level of the API and a threat level of the alarm category; use a third preset function to determine the first risk value of the API being attacked by the alarm category according to the target probability value and the loss value; determine the target risk value of the API according to the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category.

[0033] Furthermore, the acquisition module is specifically used to determine whether the risk determination condition is currently met if a risk determination request is received; or to determine whether the risk determination condition is currently met if the time interval between the current time and the time of the last risk determination reaches a set time threshold.

[0034] Furthermore, the processing module is specifically used to determine the probability value that the API has not been attacked by the alarm category based on the first product of the first preset value and the target number; and determine the target probability value that the API has been attacked by the alarm category based on the difference between the second preset value and the probability value.

[0035] Furthermore, the processing module is specifically used to determine a first product of a first preset value and the target number, determine a third preset value as a base, and the first product is a value of an exponent, which is a probability value that the API has not been attacked by the alarm category.

[0036] Furthermore, the processing module is specifically used to determine the loss value of the API being attacked by the alarm category according to a second product of a preset importance level of the API and a preset threat level of the alarm category.

[0037] Furthermore, the processing module is specifically used to determine a second product of a preset importance level of the API and a preset threat level of the alarm category, and determine the second product as a loss value of the API being attacked by the alarm category.

[0038] Furthermore, the processing module is specifically configured to determine a first risk value of the API being attacked by the alarm category according to a third product of the target probability value and the loss value.

[0039] Furthermore, the processing module is specifically used to determine a third product of the target probability value and the loss value, and determine the third product as a first risk value of the API being attacked by the alarm category.

[0040] Furthermore, the processing module is specifically used to determine a second risk value of the API being attacked based on a first sum of the first risk values ​​of the API being attacked by each alarm category; determine a target loss value of the API being attacked based on a second sum of the loss values ​​of the API being attacked by each alarm category; and determine the target risk value of the API based on a ratio of the second risk value to the target loss value.

[0041] Furthermore, the processing module is specifically used to determine the ratio of the second risk value to the target loss value, and determine the ratio as the target risk value of the API.

[0042] In a third aspect, an embodiment of the present invention further provides an electronic device, which includes at least a processor and a memory, and the processor is used to execute the steps of any of the above-mentioned API risk determination methods when executing a computer program stored in the memory.

[0043] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of any of the above-mentioned API risk determination methods.

[0044] In an embodiment of the present invention, when the risk determination condition is currently met, the electronic device obtains each alarm information received within a preset time length before the current time, and obtains the detected API carried in each alarm information. For each detected API, obtain each target alarm information carrying the API; obtain the alarm category carried in each target alarm information, and for each alarm category, count the number of targets carrying the target alarm information of the alarm category, and determine the first risk value of the API being attacked by the alarm category according to the number of targets, the threat level of the alarm category, and the importance level of the API, and determine the target risk value of the API according to the first risk value of the API being attacked by each alarm category, the importance level of the API, and the threat level corresponding to each alarm category. Since in an embodiment of the present invention, when determining the target risk value of a certain API, the first risk value determined for the alarm information received within the preset time length is not only determined for a certain alarm information, so the first risk value of the API being attacked by each alarm category can be accurately determined. In the embodiment of the present invention, the accuracy of the risk assessment of the API can be improved according to the first risk value, the importance level of the API and the threat level of each alarm category. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 A schematic diagram of a risk determination process of an API provided in an embodiment of the present invention;

[0047] Figure 2 A schematic diagram of a risk determination process of an API provided in an embodiment of the present invention;

[0048] Figure 3 A schematic diagram of the structure of an API risk determination device provided by an embodiment of the present invention;

[0049] Figure 4 The present invention provides a schematic diagram of the structure of an electronic device. DETAILED DESCRIPTION

[0050] The present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] In order to improve the accuracy of each API risk assessment, an embodiment of the present invention provides an API risk determination method, device, equipment and medium.

[0052] Embodiment 1:

[0053] Figure 1 A schematic diagram of a risk determination process of an API provided in an embodiment of the present invention, the process includes the following steps:

[0054] S101: If the risk determination condition is currently met, then, based on the saved time when each alarm message is received, obtain each alarm message received within a preset time length before the current time; and obtain the detected API carried in each alarm message.

[0055] The API risk determination method provided in the embodiment of the present invention is applied to an electronic device, which may be a smart device such as a PC or a server.

[0056] In the embodiment of the present invention, when there is a need to determine the risk of an API, because each alarm message carries the detected API, each alarm message can be obtained based on the detected API carried in each alarm message.

[0057] Specifically, when the risk determination condition is currently met, the electronic device determines that there is a need to determine the risk of the API. The risk determination condition may be that a certain type of warning information is received, and then it is determined that the risk determination condition is currently met.

[0058] Since the risk of an API cannot be accurately determined based on a single alarm result, in an embodiment of the present invention, when the risk determination condition is currently met, the electronic device obtains each alarm message received within a preset time length before the current time. Specifically, the electronic device can store the time when each alarm message is received, and based on the time when the alarm message is received, the current time, and the preset time length, each alarm message received within the preset time length before the current time can be determined. The preset time length ΔT can be any length, such as 2 hours (hours, h), and the value of the preset time length can be flexibly configured as needed.

[0059] In order to determine whether each API poses a risk, the electronic device obtains each API carried in each alarm message after obtaining each alarm message received within a preset time length before the current time, and then can determine whether the API poses a risk for each detected API.

[0060] S102: For each detected API, obtain each target alarm information carrying the API; obtain the alarm category carried in each target alarm information; for each alarm category, count the target number of target alarm information carrying the alarm category, and use a first preset function to determine the target probability value of the API being attacked by the alarm category according to a preset value and the target number; use a second preset function to determine the loss value of the API being attacked by the alarm category according to a preset importance level of the API and a threat level of the alarm category; use a third preset function to determine the first risk value of the API being attacked by the alarm category according to the target probability value and the loss value; determine the target risk value of the API according to the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category.

[0061] In an embodiment of the present invention, the electronic device can determine the target risk value of each API being detected, and the size of the target risk value can indicate the size of the risk of the API, wherein the larger the target risk value, the greater the possibility that the API is at risk, and conversely, the smaller the target risk value, the smaller the possibility that the API is at risk. When determining the target risk value of the API, the electronic device can determine the first risk value of the API being attacked by each alarm category, and determine the target risk value of the API based on the first risk value of the API being attacked by each alarm category. Among them, the alarm categories include Structured Query Language (SQL) injection, command injection, abnormal behavior, vulnerability authentication, etc.

[0062] Each API may be subject to different types of attacks, and the corresponding alarm information has different alarm categories. In order to determine whether each API is at risk, in an embodiment of the present invention, for each detected API, the first risk value of the API being attacked by each alarm category can be counted. Since the greater the probability that an API is attacked by a certain alarm category, the greater the first risk value of the API being attacked by the alarm category, and the greater the loss of the API by the alarm category. Therefore, the electronic device can first determine the first risk value of each API being attacked by the alarm category for each alarm category.

[0063] Specifically, when determining the first risk value, the first risk value is related to the target probability value and loss value of the API being attacked by the alarm category. Therefore, it is necessary to first determine the target probability value and loss value of the API being attacked by the alarm category.

[0064] For each alarm category, the more target alarm information carrying the alarm category in the alarm information, the greater the target probability value of the API being attacked by the alarm category. In addition, since each alarm information carries the corresponding alarm category, the electronic device can first obtain the target number of each target alarm information carrying the alarm category, and after obtaining the target number, use the first preset function to determine the target probability value of the API being attacked by the alarm category according to the preset value and the target number.

[0065] The target probability value may be determined by determining the reciprocal of the target number, determining the difference between the preset value and the reciprocal, and determining the difference as the target probability value of the API being attacked by the alarm category.

[0066] The higher the importance level of a certain API, the greater the loss value of the API being attacked; the higher the threat level of a certain alarm category, the greater the loss value of the API being attacked by the alarm category. The importance level of each API and the threat level of each alarm category are preset in the electronic device, wherein the importance level of each API and the threat level of each alarm category are preset by the staff. When the electronic device determines the loss value of each detected API when the API is attacked by a certain alarm category, it can use a second preset function to determine the loss value of the API when it is attacked by the alarm category based on the preset importance level of the API and the threat level of the alarm category.

[0067] For each detected API, when determining the first risk value of the API being attacked by a certain alarm category, the electronic device can use a third preset function to determine the first risk value of the API being attacked by the alarm category based on the target probability value and the loss value of the API being attacked by the alarm category for each detected API.

[0068] Since the higher the first risk value of the API being attacked by each alarm category, the higher the target risk value of the API, and the target risk value of the API is related to the loss value of the API being attacked by each alarm category, in an embodiment of the present invention, for each detected API, the electronic device can determine the target risk value of the API based on the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category.

[0069] In addition, in the embodiment of the present invention, the alarm information can be sent by the detection device to the electronic device. Specifically, the detection device can detect different alarm categories according to different preset rules. Among them, the rule can be used to sort out API-related detection scenarios for managers, such as SQL injection, abnormal time period access, authentication vulnerability exploitation, etc., and form a rule list SceL=[ruleid i ], i is the identifier of the alarm category, ruleid i The rule list is a rule corresponding to the rule adopted when the detection device detects the i-th alarm category. In the embodiment of the present invention, the rule list can be stored in an alarm rule library.

[0070] Since in the embodiment of the present invention, when determining the target risk value of a certain API, the first risk value determined for the alarm information received within a preset time length is not determined only for a certain alarm information, the first risk value of the API being attacked by each alarm category can be accurately determined. In the embodiment of the present invention, the accuracy of the risk assessment of the API can be improved according to the first risk value, the importance level of the API and the threat level of each alarm category.

[0071] Embodiment 2:

[0072] In order to determine whether the risk determination condition is currently met, based on the above embodiment, in an embodiment of the present invention, the risk determination condition is currently met including:

[0073] If a risk determination request is received, determining that the risk determination condition is currently met; or

[0074] If the time interval between the current time and the time when the risk determination was last performed reaches the set time threshold, it is determined that the risk determination condition is currently met.

[0075] In the embodiment of the present invention, the electronic device may receive a risk determination request and then determine that the risk determination condition is currently satisfied. For example, the manager may send a risk determination request to the electronic device through a preset device.

[0076] In addition, in the embodiment of the present invention, the time when the risk determination was last performed can be stored in the electronic device, and the time interval between the current time and the time when the risk determination was last performed can be determined in real time, and it can be determined whether the time interval reaches a set time threshold. If the set time threshold is reached, it is determined that the risk determination condition is currently met. The set time threshold can be any time length, for example, 2 hours.

[0077] Specifically, during the operation of the electronic device, the alarm information reported by the detection device is received in real time, and the received alarm information is saved. For example, the alarm information can be saved in a database. And for each API detected, the target risk value of the API is periodically determined. For example, when the time threshold Δstep is set to 1h, it means that the target risk value of the API is determined once every 1h. Among them, the set time threshold Δstep can be flexibly configured as needed, but it should not be too large. Among them, in order to avoid obtaining certain alarm information multiple times when determining the target risk value twice in a row, in an embodiment of the present invention, the set time threshold is greater than the preset time length described above, that is, the set time threshold Δstep>ΔT.

[0078] In an embodiment of the present invention, for each API being detected, the electronic device can periodically determine the target risk value of the API by setting the time threshold, so that a corresponding curve can be drawn according to each target risk value of the API and the corresponding determined time, and the curve can be displayed, so that the management personnel can monitor the current target risk value of the API, as well as the risk change curve.

[0079] In order to determine the target probability value of an API being attacked by a certain alarm category, based on the above embodiments, in an embodiment of the present invention, the first preset function is used to determine the target probability value of the API being attacked by the alarm category according to the preset value and the target number, including:

[0080] Determine, according to a first product of a first preset value and the target quantity, a probability value that the API has not been attacked by the alarm category;

[0081] A target probability value of the API being attacked by the alarm category is determined according to the difference between the second preset value and the probability value.

[0082] For each detected API, when determining the target probability value of the API being attacked by a certain alarm category, the more target alarm information carrying the alarm category, the greater the target probability value of the API being attacked by the alarm category. Therefore, the electronic device can determine the target probability value of the API being attacked by the alarm category based on the number of targets carrying the alarm information of the alarm category.

[0083] For each detected API, when determining the target probability value that the API has been attacked by a certain alarm category, the electronic device can first determine a first preset value and a first product of the number of targets carrying target alarm information of the alarm category, wherein the first preset value is an arbitrary negative number, so that the larger the number of targets, the smaller the first product. After determining the first product, the probability value that the API has not been attacked by the alarm category can be determined based on the first product, so that the larger the first product, the larger the probability value. That is to say, the larger the number of targets, the smaller the first product, and the smaller the probability value that the API has not been attacked by the alarm category, so that the probability value that the API has not been attacked by the alarm category can be accurately determined.

[0084] After determining the probability value that the API has not been attacked by the warning category, the electronic device can determine the difference between the second preset value and the probability value, and the difference is the probability value that the API has been attacked by the warning category. Since the probability value is a value greater than 0 and less than 1, the second preset value is a value greater than 0 and not greater than 1.

[0085] In order to determine the probability value that the API has not been attacked by a certain alarm category, based on the above embodiments, in an embodiment of the present invention, according to the first product of the first preset value and the target number, determining the probability value that the API has not been attacked by the alarm category includes:

[0086] Determine a first product of a first preset value and the target number, determine a third preset value as a base, and the first product is a value of an exponent, which is a probability value that the API has not been attacked by the alarm category.

[0087] In the embodiment of the present invention, after determining the first product of the first preset value and the target number, the third preset value can be determined as the base, and the value obtained when the first product is an exponent is the probability value that the API has not been attacked by the alarm category. Among them, the third preset value is an arbitrary value greater than 1, for example, e. In this way, the probability value can be less than 1, which is more in line with the actual application scenario. In addition, the larger the first product, the larger the probability value, that is, the larger the target number, the smaller the first product, and the smaller the probability value that the API has not been attacked by the alarm category, so that the probability value that the API has not been attacked by the alarm category can be accurately determined.

[0088] In this embodiment of the present invention, if the third preset value is e, then for each detected API, the target probability value of the API being attacked by a certain alarm category can be determined in the following manner:

[0089] ae r*cnti

[0090] Among them, "a" is the second preset value, "r" is the first preset value, and cnti is the target number.

[0091] In the embodiment of the present invention, the relationship between the number of targets and the probability of being attacked can be adjusted by adjusting the first preset value. For example, when r=-0.3, a=1, and cnti=10, 1-e r*cnti If it is close to 1, it means that when the target alarm information carrying this alarm category appears 10 times, the target probability value of the API being attacked by this alarm category is almost 1.

[0092] Embodiment 3:

[0093] In order to determine the loss value of an API being attacked by a certain alarm category, based on the above embodiments, in an embodiment of the present invention, the second preset function is used to determine the loss value of an API being attacked by the alarm category according to the preset importance level of the API and the threat level of the alarm category, including:

[0094] The loss value of the API being attacked by the alarm category is determined according to a second product of the preset importance level of the API and the preset threat level of the alarm category.

[0095] Since the higher the importance level of a certain API, the greater the loss value of the API being attacked, and the higher the threat level of a certain alarm category, the greater the loss value of the API being attacked by the alarm category. Therefore, for each detected API, when determining the loss value of the API being attacked by a certain alarm category, the electronic device can obtain the preset second product of the importance level of the API and the threat level of the alarm category. The higher the importance level of the API, the greater the second product, the higher the threat level of the alarm category, and the greater the second product, the greater the loss value of the API being attacked by the alarm category. Therefore, the electronic device can determine the loss value of the API being attacked by the alarm category based on the second product. The loss value represents the loss caused to the API by the risk of the alarm category, and the loss value comprehensively considers the threat level of the alarm category and the importance level of the API. Specifically, the electronic device can determine the product of the second product and any positive integer as the loss value of the API being attacked by the alarm category, and can also determine the sum of the second product and any value as the loss value of the API being attacked by the alarm category.

[0096] In the embodiment of the present invention, the asset scanner can be used to proactively identify which APIs are included, or the design / code review can be used to sort out which APIs are included. The management personnel formulate the importance level of each API based on the user's business characteristics, and output the API importance level knowledge base AssetL = [ <APIa ,assetlevel a >], where a is the API identifier, and assetlevel a For API a The importance level of the API can be divided into three levels. For example, the administrator can pre-determine the importance level of the API with a higher degree of importance as 3, the importance level of the API with a lower degree of importance as 2, and the importance level of the API with a lower degree of importance as 1. In an embodiment of the present invention, the electronic device can obtain the importance level of the API from the importance level knowledge base.

[0097] In order to determine the loss value of an API being attacked by a certain alarm category, based on the above embodiments, in an embodiment of the present invention, the determination of the loss value of an API being attacked by the alarm category according to the second product of the preset importance level of the API and the preset threat level of the alarm category includes:

[0098] A second product of a preset importance level of the API and a preset threat level of the alarm category is determined, and the second product is determined to be a loss value of the API being attacked by the alarm category.

[0099] In the embodiment of the present invention, for each detected API, when determining the loss value of the API being attacked by a certain alarm category, the electronic device can determine the second product of the preset importance level of the API and the preset threat level of the alarm category, and can determine the second product as the loss value of the API being attacked by the alarm category. Therefore, the higher the importance level of the API, the greater the loss value of the API being attacked, and the higher the threat level of the alarm category, the greater the loss value of the API being attacked by the alarm category, so that the loss value of the API being attacked by the alarm category can be accurately determined.

[0100] When the electronic device determines the loss value of each detected API when the API is attacked by a certain alarm category, if the corresponding second product is determined to be the loss value of the API when the API is attacked by the alarm category, the electronic device can determine the loss value of the API when the API is attacked by the alarm category according to the following formula:

[0101] alarmlevel*assetlevel i

[0102] i is the identifier of the alarm category, alarmlevel is the importance level of the API, assetlevel i is the threat level of the i-th alarm category.

[0103] In order to determine the first risk value of an API being attacked by a certain alarm category, based on the above embodiments, in an embodiment of the present invention, the third preset function is used to determine the first risk value of the API being attacked by the alarm category according to the target probability value and the loss value, including:

[0104] A first risk value of the API being attacked by the alarm category is determined according to a third product of the target probability value and the loss value.

[0105] For each detected API, when determining the first risk value of the API being attacked by a certain alarm category, the higher the target probability value of the API being attacked by the alarm category, the greater the first risk value of the API being attacked by the alarm category, and the greater the loss value of the API being attacked by the alarm category, the greater the first risk value of the API being attacked by the alarm category. Therefore, the electronic device can obtain the target probability value of the API being attacked by the alarm category and the loss value of the API being attacked by the alarm category, and determine the third product of the target probability value and the loss value. Since the larger the target probability value of the API being attacked by the alarm category, the larger the third product, and the larger the loss value of the API being attacked by the alarm category, the larger the third product, the electronic device can determine the first risk value of the API being attacked by the alarm category based on the third product. Specifically, the electronic device can determine that the product of the third product and any positive integer is the first risk value of the API being attacked by the alarm category, or can determine that the sum of the third product and any numerical value is the first risk value of the API being attacked by the alarm category.

[0106] In order to determine the first risk value of an API being attacked by a certain alarm category, based on the above embodiments, in an embodiment of the present invention, determining the first risk value of an API being attacked by the alarm category according to the third product of the target probability value and the loss value includes:

[0107] A third product of the target probability value and the loss value is determined, and the third product is determined to be a first risk value of the API being attacked by the alarm category.

[0108] For each detected API, when determining the first risk value of the API being attacked by a certain alarm category, the electronic device can obtain the target probability value of the API being attacked by the alarm category and the loss value of the API being attacked by the alarm category, and determine the third product of the target probability value and the loss value as the first risk value of the API being attacked by the alarm category. Thus, the larger the target probability value, the larger the first risk value of the API being attacked by the alarm category, and the larger the loss value, the larger the first risk value of the API being attacked by the alarm category, so that the first risk value of the API being attacked by the alarm category can be accurately determined.

[0109] In the embodiment of the present invention, for each detected API, when determining the first risk value of the API being attacked by a certain alarm category, the first risk value of the API being attacked by the alarm category can be determined by the following formula:

[0110] risk i =(1-e r*cnti )*(alarmlevel i *assetlevel i )

[0111] Among them, i is the identifier of the alarm category, risk i is the first risk value of the API being attacked by the alarm category, 1 is the first preset value, r is the second preset value, and cnti is the target number.

[0112] Embodiment 4:

[0113] In order to determine the target risk value of the API, based on the above embodiments, in the embodiment of the present invention, the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category are used to determine the target risk value of the API, including:

[0114] Determine a second risk value of the API being attacked according to a first sum of the first risk values ​​of the API being attacked by each alarm category;

[0115] Determine a target loss value of the API being attacked according to the second sum of the loss values ​​of the API being attacked by each alarm category;

[0116] The target risk value of the API is determined according to the ratio of the second risk value to the target loss value.

[0117] For each detected API, when determining the risk value of the API, the higher the first risk value of the API being attacked by each alarm category, the higher the second risk value of the API being attacked. Therefore, the electronic device can first determine the first sum of the first risk values ​​of the API being attacked by each alarm category, and determine the second risk value of the API being attacked based on the first sum. Specifically, the electronic device can determine the first sum as the second risk value of the API being attacked, and can also determine the product of the first sum and any positive number as the second risk value of the API being attacked.

[0118] Since there may be a small number of alarm messages detected for attacks on APIs with a higher importance level, and a large number of alarm messages detected for attacks on APIs with a lower importance level, it may not be accurate enough to determine the target risk value of the API based only on the risk value of the API being attacked. Therefore, in an embodiment of the present invention, for each detected API, the electronic device can obtain the second sum of the loss values ​​of the API being attacked by each alarm category, and after obtaining the second sum, determine the target risk value of the API based on the ratio of the first sum to the second sum. Specifically, the electronic device can determine the product of the ratio and the preset value as the target risk value of the API.

[0119] In order to determine the target risk value of the API, based on the above embodiments, in an embodiment of the present invention, determining the target risk value of the API according to the ratio of the second risk value to the target loss value includes:

[0120] Determine a ratio of the second risk value to the target loss value, and determine the ratio as the target risk value of the API.

[0121] For each API being tested, when determining the target risk value of the API, the electronic device can determine the second risk value of the API being attacked, and the target loss value of the API being attacked. After determining the second risk value and the target loss value, the ratio of the second risk value to the target loss value can be determined, which is the target risk value of the API.

[0122] Wherein, for each API being tested, when determining the target risk value of the API, if the electronic device determines that the ratio is the target risk value of the API, the electronic device may determine the target risk value of the API according to the following formula:

[0123] risk=∑ i risk i / ∑ i (alarmlevel i *assetlevel i )

[0124] Among them, risk is the target risk value of the API, i is the identifier of a certain alarm category, and risk i The first risk value of the API being attacked by the i-th alarm category, alarmlevel i The importance level of the API obtained when the API encounters the i-th type of alarm. The importance level of the API obtained when the API encounters each type of alarm is the same. i is the threat level of the i-th alarm category.

[0125] Figure 2 A schematic diagram of a risk determination process for an API provided in an embodiment of the present invention.

[0126] Depend on Figure 2 It can be seen that the management personnel pre-configure the importance level of the API and the detection rules corresponding to each alarm information, and save the importance level of the API in the API importance level knowledge base, and save the detection rules corresponding to each alarm information in the alarm rule base. The electronic equipment periodically determines the risk based on the received alarm information, and determines the target risk value of each API accordingly, thereby drawing the risk curve of each API.

[0127] Embodiment 5:

[0128] Figure 3 A schematic diagram of the structure of an API risk determination device provided in an embodiment of the present invention, the device comprising:

[0129] The acquisition module 301 is used to acquire each alarm message received within a preset time length before the current time according to the saved time when each alarm message is received if the risk determination condition is currently met; and acquire the detected API carried in each alarm message;

[0130] Processing module 302 is used to obtain, for each detected API, each target alarm information carrying the API; obtain the alarm category carried in the target alarm information; for each alarm category, count the target number of target alarm information carrying the alarm category, and use a first preset function to determine the target probability value of the API being attacked by the alarm category based on a preset value and the target number; use a second preset function to determine the loss value of the API being attacked by the alarm category based on a preset importance level of the API and a threat level of the alarm category; use a third preset function to determine the first risk value of the API being attacked by the alarm category based on the target probability value and the loss value; determine the target risk value of the API based on the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category.

[0131] In a possible implementation, the acquisition module 301 is specifically used to determine whether the risk determination condition is currently met if a risk determination request is received; or to determine whether the risk determination condition is currently met if the time interval between the current time and the time when the risk determination was last performed reaches a set time threshold.

[0132] In a possible implementation, the processing module 302 is specifically used to determine the probability value that the API has not been attacked by the alarm category based on a first product of a first preset value and the target number; and to determine the target probability value that the API has been attacked by the alarm category based on a difference between a second preset value and the probability value.

[0133] In a possible implementation, the processing module 302 is specifically used to determine a first product of a first preset value and the target number, determine a third preset value as a base, and the first product is a value of an exponent, which is a probability value that the API has not been attacked by the alarm category.

[0134] In a possible implementation manner, the processing module 302 is specifically configured to determine a loss value of the API being attacked by the alarm category according to a second product of a preset importance level of the API and a preset threat level of the alarm category.

[0135] In a possible implementation, the processing module 302 is specifically used to determine a second product of a preset importance level of the API and a preset threat level of the alarm category, and determine the second product as a loss value of the API being attacked by the alarm category.

[0136] In a possible implementation manner, the processing module 302 is specifically configured to determine a first risk value of the API being attacked by the alarm category according to a third product of the target probability value and the loss value.

[0137] In a possible implementation manner, the processing module 302 is specifically configured to determine a third product of the target probability value and the loss value, and determine the third product as a first risk value of the API being attacked by the alarm category.

[0138] In a possible implementation, the processing module 302 is specifically used to determine a second risk value of the API being attacked based on a first sum of the first risk values ​​of the API being attacked by each alarm category; determine a target loss value of the API being attacked based on a second sum of the loss values ​​of the API being attacked by each alarm category; and determine the target risk value of the API based on a ratio of the second risk value to the target loss value.

[0139] In a possible implementation, the processing module 302 is specifically configured to determine a ratio of the second risk value to the target loss value, and determine the ratio as a target risk value of the API.

[0140] Embodiment 6:

[0141] Figure 4 FIG. 1 is a schematic diagram of the structure of an electronic device provided by the present invention. Based on the above embodiments, the present invention further provides an electronic device, such as Figure 4 As shown, it includes: a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404;

[0142] The memory 403 stores a computer program. When the program is executed by the processor 401, the processor 401 performs the following steps:

[0143] If the risk determination condition is currently met, then, according to the saved time when each alarm message is received, each alarm message received within a preset time length before the current time is obtained; and the detected API carried in each alarm message is obtained;

[0144] For each detected API, obtain each target alarm information carrying the API; obtain the alarm category carried in each target alarm information; for each alarm category, count the target number of target alarm information carrying the alarm category, and use a first preset function to determine the target probability value of the API being attacked by the alarm category based on a preset value and the target number; use a second preset function to determine the loss value of the API being attacked by the alarm category based on a preset importance level of the API and a threat level of the alarm category; use a third preset function to determine the first risk value of the API being attacked by the alarm category based on the target probability value and the loss value; determine the target risk value of the API based on the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category.

[0145] In a possible implementation manner, the currently satisfied risk determination condition includes:

[0146] If a risk determination request is received, determining that the risk determination condition is currently met; or

[0147] If the time interval between the current time and the time when the risk determination was last performed reaches the set time threshold, it is determined that the risk determination condition is currently met.

[0148] In a possible implementation manner, the using of the first preset function to determine the target probability value of the API being attacked by the alarm category according to the preset value and the target quantity includes:

[0149] Determine, according to a first product of a first preset value and the target quantity, a probability value that the API has not been attacked by the alarm category;

[0150] A target probability value of the API being attacked by the alarm category is determined according to the difference between the second preset value and the probability value.

[0151] In a possible implementation manner, determining the probability value that the API has not been attacked by the alarm category according to the first product of the first preset value and the target quantity includes:

[0152] Determine a first product of a first preset value and the target number, determine a third preset value as a base, and the first product is a value of an exponent, which is a probability value that the API has not been attacked by the alarm category.

[0153] In a possible implementation manner, the using of the second preset function to determine the loss value of the API being attacked by the alarm category according to the preset importance level of the API and the threat level of the alarm category includes:

[0154] The loss value of the API being attacked by the alarm category is determined according to a second product of the preset importance level of the API and the preset threat level of the alarm category.

[0155] In a possible implementation manner, determining the loss value of the API being attacked by the alarm category according to the second product of the preset importance level of the API and the preset threat level of the alarm category includes:

[0156] A second product of a preset importance level of the API and a preset threat level of the alarm category is determined, and the second product is determined to be a loss value of the API being attacked by the alarm category.

[0157] In a possible implementation manner, the adopting of the third preset function to determine, according to the target probability value and the loss value, a first risk value of the API being attacked by the alarm category includes:

[0158] A first risk value of the API being attacked by the alarm category is determined according to a third product of the target probability value and the loss value.

[0159] In a possible implementation manner, determining, according to the third product of the target probability value and the loss value, a first risk value of the API being attacked by the alarm category includes:

[0160] A third product of the target probability value and the loss value is determined, and the third product is determined to be a first risk value of the API being attacked by the alarm category.

[0161] In a possible implementation manner, determining the target risk value of the API according to the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category includes:

[0162] Determine a second risk value of the API being attacked according to a first sum of the first risk values ​​of the API being attacked by each alarm category;

[0163] Determine a target loss value of the API being attacked according to the second sum of the loss values ​​of the API being attacked by each alarm category;

[0164] The target risk value of the API is determined according to the ratio of the second risk value to the target loss value.

[0165] In a possible implementation manner, determining the target risk value of the API according to the ratio of the second risk value to the target loss value includes:

[0166] Determine a ratio of the second risk value to the target loss value, and determine the ratio as the target risk value of the API.

[0167] The communication bus mentioned in the above server can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0168] The communication interface is used for communication between the above electronic device and other devices.

[0169] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0170] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0171] Embodiment 7:

[0172] On the basis of the above embodiments, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program executable by an electronic device, and when the program is run on the electronic device, the electronic device implements the following steps when executing:

[0173] The memory stores a computer program, and when the program is executed by the processor, the processor performs the following steps:

[0174] If the risk determination condition is currently met, then, according to the saved time when each alarm message is received, each alarm message received within a preset time length before the current time is obtained; and the detected API carried in each alarm message is obtained;

[0175] For each detected API, obtain each target alarm information carrying the API; obtain the alarm category carried in each target alarm information; for each alarm category, count the target number of target alarm information carrying the alarm category, and use a first preset function to determine the target probability value of the API being attacked by the alarm category based on a preset value and the target number; use a second preset function to determine the loss value of the API being attacked by the alarm category based on a preset importance level of the API and a threat level of the alarm category; use a third preset function to determine the first risk value of the API being attacked by the alarm category based on the target probability value and the loss value; determine the target risk value of the API based on the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category.

[0176] In a possible implementation manner, the currently satisfied risk determination condition includes:

[0177] If a risk determination request is received, determining that the risk determination condition is currently met; or

[0178] If the time interval between the current time and the time when the risk determination was last performed reaches the set time threshold, it is determined that the risk determination condition is currently met.

[0179] In a possible implementation manner, the using of the first preset function to determine the target probability value of the API being attacked by the alarm category according to the preset value and the target quantity includes:

[0180] Determine, according to a first product of a first preset value and the target quantity, a probability value that the API has not been attacked by the alarm category;

[0181] A target probability value of the API being attacked by the alarm category is determined according to the difference between the second preset value and the probability value.

[0182] In a possible implementation manner, determining the probability value that the API has not been attacked by the alarm category according to the first product of the first preset value and the target quantity includes:

[0183] Determine a first product of a first preset value and the target number, determine a third preset value as a base, and the first product is a value of an exponent, which is a probability value that the API has not been attacked by the alarm category.

[0184] In a possible implementation manner, the using of the second preset function to determine the loss value of the API being attacked by the alarm category according to the preset importance level of the API and the threat level of the alarm category includes:

[0185] The loss value of the API being attacked by the alarm category is determined according to a second product of the preset importance level of the API and the preset threat level of the alarm category.

[0186] In a possible implementation manner, determining the loss value of the API being attacked by the alarm category according to the second product of the preset importance level of the API and the preset threat level of the alarm category includes:

[0187] A second product of a preset importance level of the API and a preset threat level of the alarm category is determined, and the second product is determined to be a loss value of the API being attacked by the alarm category.

[0188] In a possible implementation manner, the adopting of the third preset function to determine, according to the target probability value and the loss value, a first risk value of the API being attacked by the alarm category includes:

[0189] A first risk value of the API being attacked by the alarm category is determined according to a third product of the target probability value and the loss value.

[0190] In a possible implementation manner, determining, according to the third product of the target probability value and the loss value, a first risk value of the API being attacked by the alarm category includes:

[0191] A third product of the target probability value and the loss value is determined, and the third product is determined to be a first risk value of the API being attacked by the alarm category.

[0192] In a possible implementation manner, determining the target risk value of the API according to the first risk value of the API being attacked by each alarm category and the loss value of the API being attacked by each alarm category includes:

[0193] Determine a second risk value of the API being attacked according to a first sum of the first risk values ​​of the API being attacked by each alarm category;

[0194] Determine a target loss value of the API being attacked according to the second sum of the loss values ​​of the API being attacked by each alarm category;

[0195] The target risk value of the API is determined according to the ratio of the second risk value to the target loss value.

[0196] In a possible implementation manner, determining the target risk value of the API according to the ratio of the second risk value to the target loss value includes:

[0197] Determine a ratio of the second risk value to the target loss value, and determine the ratio as the target risk value of the API.

[0198] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0199] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0200] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0201] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0202] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for determining risk of an application program interface (API), characterized in that: The method comprises: If the risk determination condition is currently met, then, according to the saved time when each alarm message is received, each alarm message received within a preset time length before the current time is obtained; and the detected API carried in each alarm message is obtained; For each detected API, obtain each target alarm information carrying the API; obtain the alarm category carried in each target alarm information; for each alarm category, count the target number of target alarm information carrying the alarm category, and use a first preset function to determine the target probability value of the API being attacked by the alarm category according to a preset value and the target number; use a second preset function to determine the loss value of the API being attacked by the alarm category according to the preset importance level of the API and the threat level of the alarm category; determine the third product of the target probability value and the loss value, and determine the third product as the first risk value of the API being attacked by the alarm category; determine the second risk value of the API being attacked according to the first sum of the first risk values ​​of the API being attacked by each alarm category; determine the target loss value of the API being attacked according to the second sum of the loss values ​​of the API being attacked by each alarm category; determine the ratio of the second risk value to the target loss value, and determine the ratio as the target risk value of the API.

2. The method according to claim 1, characterized in that The risk determination conditions currently met include: If a risk determination request is received, determining that the risk determination condition is currently met; or If the time interval between the current time and the time when the risk determination was last performed reaches the set time threshold, it is determined that the risk determination condition is currently met.

3. The method according to claim 1, characterized in that The method of using the first preset function to determine the target probability value of the API being attacked by the alarm category according to the preset value and the target quantity includes: Determine, according to a first product of a first preset value and the target quantity, a probability value that the API has not been attacked by the alarm category; A target probability value of the API being attacked by the alarm category is determined according to the difference between the second preset value and the probability value.

4. The method according to claim 3, characterized in that Determining the probability value that the API has not been attacked by the alarm category according to the first product of the first preset value and the target number includes: Determine a first product of a first preset value and the target number, determine a third preset value as a base, and the first product is a value of an exponent, which is a probability value that the API has not been attacked by the alarm category.

5. The method according to claim 1, characterized in that The second preset function is used to determine the loss value of the API being attacked by the alarm category according to the preset importance level of the API and the threat level of the alarm category, including: The loss value of the API being attacked by the alarm category is determined according to a second product of the preset importance level of the API and the preset threat level of the alarm category.

6. The method according to claim 5, characterized in that The determining of the loss value of the API being attacked by the alarm category according to the second product of the preset importance level of the API and the preset threat level of the alarm category includes: A second product of a preset importance level of the API and a preset threat level of the alarm category is determined, and the second product is determined to be a loss value of the API being attacked by the alarm category.

7. A risk determination device for an API, characterized in that: The device comprises: An acquisition module, used to acquire each alarm message received within a preset time length before the current time according to the saved time of receiving each alarm message if the risk determination condition is currently met; and acquire the detected API carried in each alarm message; A processing module is used to obtain, for each detected API, each target alarm information carrying the API; obtain the alarm category carried in the target alarm information; for each alarm category, count the target number of target alarm information carrying the alarm category, and use a first preset function to determine the target probability value of the API being attacked by the alarm category according to a preset value and the target number; use a second preset function to determine the loss value of the API being attacked by the alarm category according to the preset importance level of the API and the threat level of the alarm category; determine the third product of the target probability value and the loss value, and determine the third product as the first risk value of the API being attacked by the alarm category; determine the second risk value of the API being attacked according to the first sum of the first risk values ​​of the API being attacked by each alarm category; determine the target loss value of the API being attacked according to the second sum of the loss values ​​of the API being attacked by each alarm category; determine the ratio of the second risk value to the target loss value, and determine the ratio as the target risk value of the API.

8. An electronic device, characterized in that: The electronic device comprises at least a processor and a memory, and the processor is used to execute the steps of the API risk determination method described in any one of claims 1-6 when executing the computer program stored in the memory.

9. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, performs the steps of the API risk determination method described in any one of claims 1-6.

Images