Model training methods, API request filtering methods, devices and storage media

Abstract

This invention discloses a model training method, an API request filtering method, a computer device, and a storage medium. The model training method includes the following steps: collecting first API request data; standardizing the first API request data to obtain a training sample set; classifying the training sample set according to features to obtain a self-set; and using the self-set to train an immune detector. The immune detector trained by the model training method of this invention has high detection speed and accuracy in detecting API requests carrying dangerous injection information. When an API request carries dangerous injection information, it can identify the API request as an abnormal request; when an API request does not carry dangerous injection information, it can identify the API request as a normal request. It can detect abnormal or illegal API requests in real time and accurately, and can provide a unified, secure, and reliable protection service. This invention has wide applications in the field of computer network technology.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and in particular to a model training method, an API request filtering method, a computer device, and a storage medium. Background Technology

[0002] API abuse is a common attack vector for web application data leaks. Applications and database servers are vulnerable to attacks initiated via API requests, such as SQL injection, HTTP request injection, and HTTP request header parameter injection (including cookie injection and XSS injection), leading to data leaks or data tampering. For example, SQL injection is a common network attack method. Instead of exploiting operating system bugs, SQL injection targets programmer oversights by inserting SQL commands into web form submissions, domain names, or query strings in page requests. This tricks the server into executing malicious SQL commands, enabling unauthorized login or even database tampering. SQL injection attacks completely compromise the confidentiality, integrity, and availability of the target system, and the resulting damage varies depending on the importance of the information stored in the database. Based on relevant technical principles, SQL injection can be divided into platform-level injection and code-level injection. The former is caused by insecure database configurations or vulnerabilities in the database platform; the latter is mainly due to programmers failing to carefully filter input, resulting in the execution of illegal data queries. Based on this, the causes of SQL injection usually manifest in the following aspects: improper type handling, insecure database configuration, unreasonable query set handling, improper error handling, inappropriate handling of escape characters, and improper handling of multiple submissions.

[0003] Current computer network technology struggles to detect various attacks such as SQL injection, XSS attacks, and cookie injection in API requests in real time and accurately.

[0004] Terminology Explanation:

[0005] API is an abbreviation for Application Programming Interface.

[0006] WEB is an abbreviation for World Wide Web, which stands for Global Wide Area Network.

[0007] SQL is an abbreviation for Structured Query Language.

[0008] http is an abbreviation for Hyper Text Transfer Protocol. Summary of the Invention

[0009] To address the technical problem that current computer network technologies struggle to detect at least one type of attack in API requests, such as SQL injection, XSS attacks, and cookie injection, in real time and accurately, the present invention aims to provide a model training method, an API request filtering method, a computer device, and a storage medium.

[0010] On one hand, embodiments of the present invention include a model training method, comprising:

[0011] Collect data from multiple first API requests;

[0012] The data from each of the first API requests is processed to standardize the format to obtain a training sample set;

[0013] The training sample set is classified and constructed according to features to obtain the self set;

[0014] Obtain an immune detector;

[0015] The immune detector is trained using the self-set.

[0016] Furthermore, the collection of multiple first API request data includes:

[0017] Actively crawl injection cases using a web crawler;

[0018] Extract the first API request data from the injection case.

[0019] Further, the standardization of the first API request data to obtain the training sample set includes:

[0020] The first API request data is processed using special character separation and space separation methods to obtain the first feature information;

[0021] The first feature information is tokenized to obtain token information;

[0022] The token information is assembled into an attack statement syntax tree;

[0023] The training sample set is composed of the attack statement syntax tree.

[0024] Further, the step of classifying the training sample set according to features to obtain a self-set includes:

[0025] Perform Naive Bayes clustering analysis on the training sample set, and classify the contents of the training sample set into normal datasets or abnormal datasets based on the results of the Naive Bayes clustering analysis.

[0026] According to the feature attribute criteria required for multi-way trees, feature attributes are extracted from the normal dataset to obtain the first feature attribute;

[0027] The self-set is constructed by using the first feature attribute as the main attribute of each node in the multi-way tree storage structure.

[0028] Furthermore, the model training method also includes:

[0029] According to the feature attribute criteria required for multi-way trees, feature attributes are extracted from the abnormal dataset to obtain the second feature attribute;

[0030] Using the second feature attribute as the main attribute of each node in the multi-way tree storage structure, the non-self set is constructed.

[0031] The immune detector is trained using the self set and the non-self set.

[0032] Further, training the immune detector using the self set and the non-self set includes:

[0033] The parameters of the immune detector are used as antibodies, and the data from the autogenous set and the non-autogenous set are used as antigens;

[0034] The process involves multiple iterations until the total number of iterations reaches a threshold. In each iteration, the antibody and the antigen are matched to obtain an affinity. If the affinity exceeds the affinity threshold, the parameters of the immune detector are stored; otherwise, the parameters of the immune detector are changed.

[0035] On the other hand, embodiments of the present invention also include an API request filtering method, the API request filtering method comprising:

[0036] Retrieve data from the second API request;

[0037] The second API request data is detected using an immune detector; the immune detector is trained using the model training method described in the embodiments.

[0038] Obtain the detection results from the immune detector;

[0039] Based on the detection results of the immune detector, the second API request data is identified as a normal request or an abnormal request;

[0040] If the second API request data is identified as a normal request, respond to the second API request data; if the second API request data is identified as an abnormal request, reject or ignore the second API request data.

[0041] On the other hand, embodiments of the present invention also include an API request filtering method, the API request filtering method comprising:

[0042] Retrieve data from multiple second API requests;

[0043] Sort the data from each of the second API requests based on a probability queue;

[0044] The immune detector is used to detect each second API request data in sequence according to the sorted order of the second API request data; the immune detector is trained by the model training method in the embodiment.

[0045] Obtain the detection results from the immune detector;

[0046] Based on the detection results of the immune detector, each second API request data is identified as a normal request or an abnormal request;

[0047] The response is the second API request data that is identified as a normal request; the response is rejected or ignored.

[0048] On the other hand, embodiments of the present invention also include a computer device, including a memory and a processor, the memory being used to store at least one program, and the processor being used to load the at least one program to execute the model training method and / or API request filtering method of the embodiments.

[0049] On the other hand, embodiments of the present invention also include a storage medium storing a processor-executable program, which, when executed by a processor, is used to perform the model training method and / or API request filtering method in the embodiments.

[0050] The beneficial effects of this invention are as follows: The immune detector trained by the model training method in the embodiments has a high detection speed and accuracy in detecting API requests carrying dangerous injection information. When the input API request carries dangerous injection information, it can identify the input API request as an abnormal request. When the input API request does not carry dangerous injection information, it can identify the input API request as a normal request. Therefore, when executing the API request filtering method in the embodiments, the immune detector can detect various abnormal or illegal API requests such as SQL injection, XSS attacks, and Cookie injection in real time and accurately, and can provide a unified, secure and reliable protection service. Attached Figure Description

[0051] Figure 1 This is a flowchart of the model training method in the embodiment;

[0052] Figure 2 This is a schematic diagram illustrating the model training method in the embodiment.

[0053] Figure 3 This is a flowchart of the first implementation of the API request filtering method in the embodiment;

[0054] Figure 4 This is a flowchart illustrating a second implementation of the API request filtering method in this embodiment;

[0055] Figure 5 This is a flowchart illustrating the overall execution of the model training method and the API request filtering method in the embodiment.

[0056] Figure 6 This is a structural diagram of the system used to execute the API request filtering method in the embodiment;

[0057] Figure 7 This is a structural diagram of the gateway server in the embodiment. Detailed Implementation

[0058] In this embodiment, refer to Figure 1 The model training method includes the following steps:

[0059] P1. Collect data from multiple first API requests;

[0060] P2. Standardize the data from each first API request to obtain a training sample set;

[0061] P3. Classify the training sample set according to features to obtain the self-set;

[0062] P4. Obtain the immunoassay detector;

[0063] P5. Use self-sets to train the immune detector.

[0064] The principle of steps P1-P5 is as follows: Figure 2 As shown. In step P1, a gateway device is configured between the application and the database server. By using the gateway device to capture and parse the access traffic packets, multiple first API request data can be collected through the gateway's request data. Some of these first API request data are normal requests entered by users, while others are different types of illegal injection requests entered by malicious actors, such as HTTP requests, HTTP request header parameter injection (cookie injection and XSS injection), base64 injection, etc. At the same time, the format information of the attack statements can be obtained by parsing the data packet format.

[0065] In step P1, a web crawler can also be run to actively crawl injection cases and extract the first API request data from them. By running a web crawler to obtain the first API request data, the first API request data can be kept up-to-date.

[0066] When performing step P2, which involves standardizing the data from each of the first API requests to obtain the training sample set, the following steps can be performed:

[0067] P201. Use special character separation method and space separation method to process the first API request data to obtain the first feature information;

[0068] P202. Tokenize the first feature information to obtain token information;

[0069] P203. Construct an attack statement syntax tree from the token information;

[0070] P204. The training sample set is composed of the syntax tree of the attack statement.

[0071] In step P201, the special character separation method and the space separation method used can extract feature information from the first API request data, and the extracted feature information is the first feature information.

[0072] In step P202, the first feature information extracted in step P201 is tokenized. Tokenization is an atomic process that allows even the smallest character unit in the first feature information to possess a token with specific meaning (also called token information). These tokens are then combined into feature vectors in a specific order. Feature vectors shorter than the noise threshold are filtered out. The feature vectors are then processed for deduplication, string splitting, and merging. In step P203, an attack statement syntax tree is formed based on the feature vectors created from these tokens. This attack statement syntax tree forms the training sample set in step P204. Figure 2 The formatted data shown.

[0073] When performing step P3, which involves classifying the training sample set according to features to obtain the self-set, the following steps can be performed:

[0074] P301. Perform Naive Bayes clustering analysis on the training sample set, and classify the contents of the training sample set into the normal dataset or the abnormal dataset based on the results of the Naive Bayes clustering analysis.

[0075] P302. Based on the feature attribute criteria required for multi-way trees, extract the feature attributes from the normal dataset to obtain the first feature attribute;

[0076] P303. Construct a self-set by using the first characteristic attribute as the main attribute of each node in the multi-way tree storage structure.

[0077] Reference Figure 2 In step P301, the training sample set (i.e. Figure 2 Naive Bayes clustering analysis is performed on the formatted data in the training sample set to classify the content into normal or abnormal datasets.

[0078] In step P302, a multi-branch tree classification mapping technique is used. This technique utilizes the storage structure of a multi-branch tree to perform secondary feature attribute extraction on the data after Naive Bayes clustering analysis, according to the feature attribute standards required for multi-branch trees, transforming it into the feature attributes needed to construct the multi-branch tree. Specifically, feature attributes are extracted from the normal dataset according to the feature attribute standards required for multi-branch trees to obtain the first feature attribute; additionally, feature attributes can also be extracted from the abnormal dataset according to the feature attribute standards required for multi-branch trees to obtain the second feature attribute.

[0079] In step P303, the first characteristic attribute obtained in step P302 is used as the main attribute of each node in the multi-way tree storage structure to construct a self set, and the second characteristic attribute obtained in step P302 is used as the main attribute of each node in the multi-way tree storage structure to construct a non-self set.

[0080] In this embodiment, immune theory is introduced, and the immune detector is trained using self-sets and / or non-self-sets. The meanings of relevant concepts in immune theory are as follows:

[0081] (1) Self set / Non-self set. The immune detector to be trained in this embodiment can be used to detect illegal service requests. The non-self set obtained by executing steps P301-P303 contains service attack request data information, and the self set contains normal service request information. Let the problem domain be X∈{0,1} (0 represents normal, 1 represents abnormal), which contains two subsets: the self set O and the non-self set F. These two sets have OF=S and O∩F=Θ, where S represents the morphological space and Θ represents the empty set.

[0082] (2) Antibodies and antigens. The immune detector to be trained in this embodiment can be used to detect illegal service requests. The service request information contains multiple attribute features. These attribute features are mapped to a certain range of real numbers, and each service request data is associated with a d-dimensional vector. Each component of the d-dimensional vector represents a measure of its corresponding service request data. At the same time, each component can also be regarded as a gene.

[0083] (3) Affinity. The immune recognition mechanism is achieved through the degree of binding between antigen epitopes and antibody epitopes, which is represented by the concept of affinity in artificial immunization methods. Affinity is a data quantity that measures the degree of closeness between antigen and antibody.

[0084] Here is the formula for calculating affinity, where F(t) i ,t j ) represents affinity, d(t) i ,t j ) indicates antibody t i With antigen t j The distance between them. As the formula shows, the closer the antibody is to the antigen, the higher the affinity, and vice versa.

[0085] In step P4, the immune detector is established by reading the initial parameters of the immune detector.

[0086] In step P5, the immune detector is trained using the self-set. Since the principle of training the immune detector using the non-self-set is similar to that of training the immune detector using the self-set, step P5 can be explained only for the process of training the immune detector using both the self-set and the non-self-set simultaneously.

[0087] When performing step P5, which involves training the immune detector using the self set and non-self sets, the following steps can be performed:

[0088] P501. Use the parameters of the immune detector as antibodies and the data from the auto-set and non-auto-set as antigens;

[0089] P502. Perform multiple iterations until the total number of iterations reaches the threshold. In each iteration, match the antibody and antigen to obtain affinity. When the affinity exceeds the affinity threshold, store the parameters of the immunodetector; otherwise, change the parameters of the immunodetector.

[0090] When a computer program is used to execute steps P501-P502, the process executed by the computer program is as follows:

[0091] (1) Initialize plugin package types and load them iteratively.

[0092] (2) Initially complete the loading of SQL, XSS, and Cookie plugin packages, and complete the secondary feature attribute extraction of request data.

[0093] (3) Load the plugin package to complete the secondary attribute extraction of other request data.

[0094] (4) Read the feature code and compare it

[0095] (5) Match the immune detector, calculate the affinity, and determine the number of immune evolution generations. When the preset threshold is reached, it is stored as an empirical threshold.

[0096] (6) Repeat steps 1-5 to learn and improve the matching library.

[0097] Based on the above process, the specific model algorithm for the computer program used to execute steps P501-P502 can be determined as follows:

[0098] (1) Input:

[0099] ① Initial set of detectors: ImDetectors[]

[0100] ② The original data attribute value vector group: OriginMetricValues[]

[0101] ③ The vector group of feature attribute values ​​of the secondary data after classification: MetricValues[]

[0102] ④ Affinity Threshold

[0103] ⑤ Iteration

[0104] ⑥ Regular learning cycle: T

[0105] (2) Algorithm:

[0106] ①Init Iteration=100 / / Initial setting of evolution generations is 100

[0107] ②Init AffinityThreshold=100 / / Initial setting of affinity threshold to 100

[0108] ③MetricValues[] = initWithPluginPackage(OriginMetricValues) / / Complete data classification and secondary feature attribute extraction based on the plugin package, which is the process of steps P301-P303.

[0109] ④While true do

[0110] ⑤For(MetricValue val:MetricValues){

[0111] ⑥ affinityresult = checkByPluginDetector(ImDetectors[val.type], val) / / Match the classified data with the corresponding detector to obtain the affinity result.

[0112] ⑦If(iter>=Iteration&&affinityresult>=AffinityThreshold){ / / If the iteration number is reached and the affinity result exceeds the preset threshold...}

[0113] ⑧ updateDetector(affinityresult, ImDetectors[val.type]) / / Stores and updates the corresponding detectors

[0114] ⑨}

[0115] ⑩ iter++ / / Increasing generation number

[0116] 11}

[0117] 12Wait(T)

[0118] 13 End while

[0119] Based on the above model, after multiple rounds of learning iterations, an immune detector was simulated and trained for different types of first API request data. Since the training process in steps P501-P502 employed a secondary feature matching model based on a Naive Bayes classification model and an immune detector from machine learning, the immune detector trained in steps P501-P502 exhibits higher detection speed and accuracy for detecting malicious injection information in API requests compared to other detection models. When an input API request carries malicious injection information, it can identify the input API request as an abnormal request; when an input API request does not carry malicious injection information, it can identify the input API request as a normal request. Therefore, the immune detector trained in steps P1-P5 can detect various abnormal or illegal API requests such as SQL injection, XSS attacks, and Cookie injection in real time and accurately, providing a unified, secure, and reliable protection service.

[0120] It can actively generate API requests that conform to SQL injection, XSS attack, cookie attack, and other syntax including HTTP requests and HTTP headers. The actively generated API requests are then input into the immune detector trained by steps P1-P5 to test the system robustness of the immune detector.

[0121] The API request filtering method can be performed using the immune detector trained through steps P1-P5.

[0122] Reference Figure 3 An API request filtering method that can be performed using an immune detector trained through steps P1-P5 includes the following steps:

[0123] S1A. Obtain the second API request data;

[0124] S2A. Use an immune detector to detect the second API request data;

[0125] S3A. Obtain the detection results from the immunoassay detector;

[0126] S4A. Based on the detection results of the immune detector, identify whether the second API request data is a normal request or an abnormal request;

[0127] S5A. When the second API request data is identified as a normal request, respond to the second API request data; when the second API request data is identified as an abnormal request, reject or ignore the second API request data.

[0128] Steps S1A-S5A can be used to process single API request data. In step S1A, a gateway device is configured between the application and the database server. By capturing and parsing the access traffic packets using the gateway device, a second API request data can be collected through the gateway's request data. The second API request data may be a normal request entered by the user, or it may be an illegal injection request entered by malicious actors, such as HTTP requests, HTTP request header parameter injection (cookie injection and XSS injection), base64 injection, or other types of illegal injection requests. An immune detector can be used to detect and judge the second API request data.

[0129] In steps S2A-S4A, the second API request data is input into the immune detector, which detects the second API request data. The detection result indicates that the second API request data is a normal request or an abnormal request.

[0130] In step S5A, if the gateway device identifies the second API request data as a normal request, then the gateway device can respond to the second API request data. Specifically, the gateway device can allow the second API request data to reach the next node, or the gateway device can respond to the request of the second API request data and perform the corresponding access operation. If the gateway device identifies the second API request data as an abnormal request, the gateway device can reject or ignore the second API request data. Specifically, the gateway device can prevent the second API request data from reaching the next node, and the second API request data cannot trigger the gateway device and related nodes to perform corresponding operations, thereby achieving the filtering effect of illegal API requests.

[0131] Reference Figure 4Another API request filtering method that can be performed using the immune detector trained through steps P1-P5 includes the following steps:

[0132] S1B. Retrieves data from multiple second API requests;

[0133] S2B. Sort the data of each second API request based on a probability queue;

[0134] S3B. Following the sorted order of the second API request data, use an immune detector to sequentially detect each second API request data;

[0135] S4B. Obtain the detection results from the immunoassay detector;

[0136] S5B. Based on the detection results of the immune detector, identify whether each second API request data is a normal request or an abnormal request;

[0137] S6B. Respond to the second API request data that is identified as a normal request, or reject or ignore the second API request data that is identified as a normal request.

[0138] Steps S1B-S6B can be used to process multiple API request data obtained simultaneously.

[0139] Step S1B is based on the same principle as step S1A, the difference being that step S1A obtains one second API request data, while step S1B obtains multiple second API request data.

[0140] In step S2B, the second API request data is sorted based on a probability queue, so that each second API request data has its corresponding order. In step S3B, according to the sorted order of the second API request data, an immune detector is used to detect each second API request data sequentially. The principle of the immune detector detecting each second API request data is the same as in step S2A.

[0141] In step S4B, since multiple second API request data are input into the immune detector for detection, the immune detector will output multiple detection results, indicating whether the corresponding second API request data belongs to a normal request or an abnormal request. The principle of step S6B is the same as step S5A. For second API request data identified as normal requests, the gateway device can allow these second API request data to reach the next node, or the gateway device can respond to these second API request data requests and perform corresponding access operations. For second API request data identified as abnormal requests, the gateway device can reject or ignore these second API request data. Specifically, the gateway device can prevent these second API request data from reaching the next node, and these second API request data cannot trigger the gateway device and related nodes to perform corresponding operations, thereby achieving the filtering effect of illegal API requests.

[0142] By sorting each second API request data based on a probability queue in steps S2B and S3B, and then using an immune detector to detect each second API request data in the order of the sorted data, the probability of each second API request data being matched is not the same. This approach can improve the matching speed when multiple second API request data are processed concurrently on a large scale and multiple second API request data need to be detected, thereby improving the detection and filtering efficiency of illegal API requests.

[0143] When steps P1-P5 and S1A-S5A are executed as a whole, or steps P1-P5 and S1B-S6B are executed as a whole, the overall process is as follows: Figure 5 As shown. Figure 5 Based on newly discovered security vulnerabilities, a new and more effective algorithm library is introduced as a plugin package, which is dynamically deployed to the context of the gateway call chain via Groovy scripts and loaded and takes effect in real time.

[0144] It can be used Figure 6 The system shown executes the API request filtering method in this embodiment. The core of the system is the gateway server, which is an API gateway that acts as an anti-attack filter by running the API request filtering method in this embodiment. The gateway server is trained using a machine learning model to build an immune detector with an interception library. API request information from applications or clients may or may not contain sensitive words. The gateway server detects API request information from applications or clients, filtering out illegal API request information, such as API request information containing sensitive words, and only sending legitimate API request information to the business server.

[0145] Figure 6 The structure of the gateway server in the middle can be as follows: Figure 7 As shown. (Refer to...) Figure 7 The gateway server includes capabilities such as network traffic control, API request filtering, and secure access control. The API request filter uses Groovy plugin packages to build SQL, XSS, and cookie detectors, and implements filtering policy configuration for API requests and responses through hot deployment. It also supports the assembly of filter chains based on plugin packages.

[0146] The service gateway supports protection against SQL injection, cross-site scripting (XSS) attacks, and cookie injection through dynamic and static policy configurations. Operations personnel can configure keywords or expressions for dangerous SQL (to prevent SQL injection) or dangerous scripts (to prevent XSS attacks) globally or at interfaces through the operations view. By adding filters, they can identify whether packets carry dangerous keywords and block dangerous requests.

[0147] Reference Figure 7 It also configures peripheral functions such as a capability integration management console for the gateway server. The management console is designed as a web interface and has a developer view (providing developers with a unified service entry point, offering functions such as user management, application management, capability catalog, statistical query, and help center), an operator view (operators can use this view to manage applications, capabilities, APIs, and system configuration, monitoring, resources, and security, ensuring the normal operation of the API capability open platform), and an operator view (providing a unified entry point for capability open platform operation and management personnel, offering management functions such as developer management, application management, capability management, statistical query, system security management, task approval management, announcement management, service management, system management, log management, and monitoring management, and providing a one-stop, streamlined operation and maintenance management service entry view).

[0148] By running Figure 7 The gateway server shown can enable... Figure 6 When the system shown works, it executes the API request filtering method in this embodiment, thereby achieving the technical effect of the API request filtering method in this embodiment.

[0149] The same technical effects as those of the model training method and API request filtering method in this embodiment can be achieved by writing a computer program to execute the model training method and API request filtering method in this embodiment when the computer program is read and run.

[0150] It should be noted that, unless otherwise specified, when a feature is referred to as "fixed" or "connected" to another feature, it can be directly fixed or connected to the other feature, or indirectly fixed or connected to the other feature. Furthermore, the descriptions of "upper," "lower," "left," and "right" used in this disclosure are only relative to the relative positional relationships of the various components of this disclosure in the accompanying drawings. The singular forms "a," "described," and "the" used in this disclosure are also intended to include the plural forms, unless the context clearly indicates otherwise. Moreover, unless otherwise defined, all technical and scientific terms used in this embodiment have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this embodiment specification is only for describing particular embodiments and is not intended to limit the invention. The term "and / or" as used in this embodiment includes any combination of one or more of the associated listed items.

[0151] It should be understood that although the terms first, second, third, etc., may be used to describe various elements in this disclosure, these elements should not be limited to these terms. These terms are only used to distinguish elements of the same type from each other. For example, a first element may also be referred to as a second element without departing from the scope of this disclosure, and similarly, a second element may also be referred to as a first element. The use of any and all instances or exemplary language (“e.g.,” “such as,” etc.) provided in this embodiment is intended only to better illustrate embodiments of the invention and, unless otherwise required, does not impose a limitation on the scope of the invention.

[0152] It should be recognized that embodiments of the present invention can be implemented or carried out by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable storage medium. The method can be implemented using standard programming techniques—including a non-transitory computer-readable storage medium configured with a computer program, wherein such a storage medium causes the computer to operate in a specific and predefined manner—according to the methods and drawings described in the specific embodiments. Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with the computer system. However, if desired, the program can be implemented in assembly or machine language. In any case, the language can be a compiled or interpreted language. Furthermore, for this purpose, the program can run on a programmed application-specific integrated circuit (ASIC).

[0153] Furthermore, the procedures described in this embodiment can be performed in any suitable order unless otherwise indicated by this embodiment or clearly contradicted by the context. The procedures (or variations and / or combinations thereof) described in this embodiment can be executed under the control of one or more computer systems configured with executable instructions, and can be implemented by hardware or a combination thereof as code (e.g., executable instructions, one or more computer programs, or one or more applications) that commonly executes on one or more processors. The computer program includes a plurality of instructions executable by one or more processors.

[0154] Furthermore, the method can be implemented in any suitable type of computing platform, including but not limited to personal computers, minicomputers, mainframes, workstations, networked or distributed computing environments, standalone or integrated computer platforms, or in communication with charged particle tools or other imaging devices. Aspects of the invention can be implemented as machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated into a computing platform, such as a hard disk, optical read and / or write storage medium, RAM, ROM, etc., such that it is readable by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the processes described herein. Furthermore, the machine-readable code, or portions thereof, can be transmitted via wired or wireless networks. The invention described in this embodiment includes these and other different types of non-transitory computer-readable storage media when such media comprises instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor. When programmed according to the methods and techniques described in the invention, the invention also includes the computer itself.

[0155] A computer program can be applied to input data to perform the functions described in this embodiment, thereby transforming the input data to generate output data stored in non-volatile memory. The output information can also be applied to one or more output devices, such as a display. In a preferred embodiment of the invention, the transformed data represents physical and tangible objects, including specific visual depictions of physical and tangible objects generated on the display.

[0156] The above description is merely a preferred embodiment of the present invention. The present invention is not limited to the above-described embodiments. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention, as long as they achieve the technical effects of the present invention by the same means, should be included within the scope of protection of the present invention. Within the scope of protection of the present invention, the technical solutions and / or implementation methods can have various modifications and variations.

Claims

1. A model training method, characterized in that, The model training method includes: Collect data from multiple first API requests; The data from each first API request is standardized to obtain a training sample set, including: The first API request data is processed using special character separation and space separation methods to obtain the first feature information; The first feature information is tokenized to obtain token information; the token information is combined into a feature vector in a specific order; feature vectors with a length less than the noise threshold are filtered out; and the feature vectors are deduplicated, split, and merged. The training sample set is classified and constructed according to features to obtain the self set, which includes: Perform Naive Bayes clustering analysis on the training sample set, and classify the contents of the training sample set into normal datasets or abnormal datasets based on the results of the Naive Bayes clustering analysis. Based on the feature attribute criteria required for multi-way trees, feature attributes are extracted from the normal dataset to obtain the first feature attribute; Using the first characteristic attribute as the main attribute of each node in the multi-way tree storage structure, construct the self set; Based on the feature attribute criteria required by the multi-way tree, feature attributes are extracted from the abnormal dataset to obtain the second feature attribute; Using the second characteristic attribute as the main attribute of each node in the multi-way tree storage structure, a non-self set is constructed. Training the immune detector using self-sets and non-self-sets includes: The parameters of the immune detector are used as antibodies, and the data from the self set and the non-self set are used as antigens; The process involves multiple iterations until the total number of iterations reaches a threshold. In each iteration, antibodies and antigens are matched to obtain affinity. If the affinity exceeds the affinity threshold, the parameters of the immunodetector are stored; otherwise, the parameters of the immunodetector are changed. The formulas used for affinity include: Wherein F(t) i ,t j ) represents affinity, d(t) i ,t j ) indicates antibody t i With antigen t j The distance between them; Obtain an immune detector; The immune detector was trained using a self-set.

2. The model training method according to claim 1, characterized in that, The collection of multiple first API request data includes: Actively crawl injection cases using a web crawler; Extract the first API request data from the injection case.

3. The model training method according to claim 1, characterized in that, The step of standardizing the first API request data to obtain a training sample set further includes: The token information is assembled into an attack statement syntax tree; The training sample set is composed of the attack statement syntax tree.

4. An API request filtering method, characterized in that, The API request filtering method includes: Retrieve data from the second API request; The second API request data is detected using an immune detector; the immune detector is trained using the model training method described in any one of claims 1-3. Obtain the detection results from the immune detector; Based on the detection results of the immune detector, the second API request data is identified as a normal request or an abnormal request; If the second API request data is identified as a normal request, respond to the second API request data; if the second API request data is identified as an abnormal request, reject or ignore the second API request data.

5. An API request filtering method, characterized in that, The API request filtering method includes: Retrieve data from multiple second API requests; Sort the data from each of the second API requests based on a probability queue; The immune detector is used to detect each of the second API request data in the order of sorting; the immune detector is trained by the model training method according to any one of claims 1-3. Obtain the detection results from the immune detector; Based on the detection results of the immune detector, each second API request data is identified as a normal request or an abnormal request; The response is the second API request data that is identified as a normal request; the response is rejected or ignored.

6. A computer device, characterized in that, The device includes a memory and a processor, the memory being used to store at least one program, and the processor being used to load the at least one program to perform the model training method according to any one of claims 1-3 and / or the API request filtering method according to any one of claims 4-5.

7. A storage medium storing a processor-executable program, characterized in that, The processor-executable program, when executed by the processor, is used to perform the model training method according to any one of claims 1-3 and / or the API request filtering method according to any one of claims 4-5.

Images