Application Programming Interface (API) Identification Method and Device

Abstract

An embodiment of the present invention provides a method and apparatus for identifying an application programming interface (API), wherein the method comprises: obtaining network traffic; parsing preset field features in the network traffic; the preset field features are used to characterize API features; and identifying whether the network traffic includes a public API based on the preset field features and API features included in an API rule base; the API rule base stores API features corresponding to each public API. The method and apparatus for identifying an application programming interface (API) provided by an embodiment of the present invention enable the identification of APIs in network traffic.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for identifying an application programming interface (API). Background Art

[0002] Network traffic is the total number of data packets passing through a network link per unit time. It is a basic indicator for measuring network load and forwarding performance. Hypertext Transfer Protocol (HTTP) traffic is one type of network traffic. HTTP traffic can be traffic generated by calling an Application Programming Interface (API) or HTTP background traffic. To better manage APIs, it is necessary to identify the APIs used from HTTP traffic. Summary of the Invention

[0003] In order to solve the problems in the prior art, an embodiment of the present invention provides a method and device for identifying an application programming interface (API).

[0004] Specifically, the embodiments of the present invention provide the following technical solutions:

[0005] In a first aspect, an embodiment of the present invention provides a method for identifying an application programming interface (API), comprising:

[0006] Get network traffic;

[0007] Parsing preset field features in the network traffic; the preset field features are used to characterize API features;

[0008] Based on the preset field features and the API features included in the API rule base, it is identified whether the network traffic includes a public API; the API rule base stores the API features corresponding to each public API.

[0009] Furthermore, the preset field feature and the API feature each include at least one of the following: a request method field feature, a path field feature, and a request header field feature.

[0010] Furthermore, the identifying whether the network traffic includes a public API based on the preset field feature and the API feature included in the API rule library includes:

[0011] Matching the preset field features with the API features included in the API rule base;

[0012] When the match is successful, determining that the network traffic includes the public API;

[0013] When the matching fails, it is determined that the network traffic does not include the public API.

[0014] Furthermore, the method further comprises:

[0015] When it is determined that the network traffic includes the public API, outputting the public API in the network traffic;

[0016] When it is determined that the network traffic does not include the public API, the network traffic is marked.

[0017] Furthermore, before identifying whether the network traffic includes a public API based on the preset field features and the API features included in the API rule base, the method further includes:

[0018] Get the API characteristics of each public API;

[0019] The API features of each of the public APIs are recorded in the API rule base.

[0020] Furthermore, the method further comprises:

[0021] Get new public API features based on preset update time;

[0022] The API features of the new public API are recorded in the API rule base.

[0023] In a second aspect, an embodiment of the present invention further provides an application program interface (API) identification device, comprising:

[0024] A first acquiring unit, configured to acquire network traffic;

[0025] A parsing unit, configured to parse preset field features in the network traffic; the preset field features are used to represent API features;

[0026] The identification unit is configured to identify whether the network traffic includes a public API based on the preset field feature and the API features included in the API rule base; the API feature corresponding to each public API is stored in the API rule base.

[0027] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for identifying the application program interface (API) as described in the first aspect is implemented.

[0028] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for identifying the application program interface API as described in the first aspect.

[0029] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the method for identifying the application program interface API described in the first aspect.

[0030] The application program interface (API) identification method and device provided in the embodiments of the present invention parse the preset field features in network traffic for characterizing API features, and identify whether the network traffic includes a public API based on the preset field features and the API features included in the API rule library, thereby realizing the identification of APIs in network traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 This is one of the flow charts of the method for identifying the application program interface API provided by the present invention;

[0033] Figure 2 This is the second flow chart of the method for identifying the application program interface API provided by the present invention;

[0034] Figure 3 This is the third flow chart of the method for identifying the application program interface API provided by the present invention;

[0035] Figure 4 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0037] Figure 1This is one of the flow charts of the identification method of the application program interface API provided by the present invention, such as Figure 1 As shown, the identification method of the application program interface API includes the following steps:

[0038] Step 101: Obtain network traffic.

[0039] For example, the electronic device can obtain network traffic from other devices, from its own storage device, or from a server; when obtaining the network traffic, HTTP traffic is filtered out from the network traffic, and the HTTP traffic is the network traffic that needs to be analyzed in the present invention.

[0040] Step 102: Analyze the preset field features in the network traffic.

[0041] The preset field characteristics are used to characterize API characteristics; the preset field characteristics include a preset field name and a field value corresponding to the preset field name.

[0042] For example, when HTTP traffic is acquired, the electronic device parses all field names and corresponding field values ​​in the HTTP traffic, and then searches for a preset field name and a field value corresponding to the preset field name among all the field names and corresponding field values.

[0043] Step 103: Identify whether the network traffic includes a public API based on the preset field characteristics and the API characteristics included in the API rule library.

[0044] The API rule library stores API features corresponding to each public API.

[0045] Among them, API is some predefined interfaces (such as functions or HTTP interfaces), or refers to the conventions for connecting different components of a software system; API features include API fields and field values ​​corresponding to API fields. Each API field and the field value corresponding to the API field form a regular expression stored in the API rule library.

[0046] For example, when the preset field name and the field value corresponding to the preset field name are parsed from the HTTP traffic, the preset field name and the field value corresponding to the preset field name are matched with each API field and the field value corresponding to the API field included in the API rule library, and whether the network traffic includes a public API is determined based on the matching result.

[0047] The method for identifying the application program interface (API) provided by the present invention parses the preset field features in network traffic for characterizing API features, and identifies whether the network traffic includes a public API based on the preset field features and the API features included in the API rule library, thereby realizing the identification of APIs in network traffic.

[0048] Optionally, the preset field feature and API feature both include at least one of the following: a request method field feature, a path field feature, and a request header field feature.

[0049] Among them, the request method field characteristics include the request method field name and the field value corresponding to the request method field name; the path field characteristics include the path field name and the field value corresponding to the path field name; the request header field characteristics include the host field and the field value corresponding to the host field.

[0050] For example, the request method field name can be represented by HTTP method, and the field value corresponding to HTTP method can be GET, etc.; the path field is part of the Uniform Resource Locator (URL), for example, the field value corresponding to the path field name can be represented by / a / b / {param}, where / a / b represents a fixed path and param represents a variable path parameter; the field value corresponding to the host field can be taobao or baidu, etc.

[0051] Optionally, step 103 may be implemented in the following manner:

[0052] The preset field features are matched with the API features included in the API rule library; when the match is successful, it is determined that the network traffic includes the public API; when the match fails, it is determined that the network traffic does not include the public API.

[0053] For example, assuming that the preset field characteristics include request method field characteristics and path field characteristics, the request method field characteristics and path field characteristics parsed from the HTTP traffic are matched with the regular expression composed of the request method field characteristics and path field characteristics included in the API rule library. If the match is successful, it means that the API rule library includes the request method field characteristics and path field characteristics parsed from the HTTP traffic. At this time, it can be determined that the HTTP traffic includes public APIs; if the match fails, it means that the API rule library does not include the request method field characteristics and path field characteristics parsed from the HTTP traffic. At this time, it is determined that the HTTP traffic does not include public APIs. The HTTP traffic may be HTTP background traffic, or it may be an omitted API that has not been added to the API rule library.

[0054] The application program interface (API) identification method provided by the present invention matches the preset field features parsed from HTTP traffic with the API features included in the API rule library. When the match is successful, it is determined that the HTTP traffic includes a public API; when the match fails, it is determined that the HTTP traffic does not include a public API, thereby realizing the identification of the API in the HTTP traffic.

[0055] Optionally, Figure 2 This is a second flow chart of the method for identifying the application program interface API provided by the present invention, such as Figure 2 As shown, after executing step 103, the method further includes the following steps:

[0056] Step 104: When it is determined that the network traffic includes the public API, output the public API in the network traffic.

[0057] For example, when it is determined that the HTTP traffic includes a public API, the public API in the HTTP traffic is output. The public API includes a path field feature parsed from the HTTP traffic. For example, the API in the HTTP traffic is / a / b / {param}.

[0058] It should be noted that the request method field characteristics and host field characteristics parsed from the HTTP traffic may also be output, and the present invention does not limit this.

[0059] Step 105: When it is determined that the network traffic does not include the public API, mark the network traffic.

[0060] For example, when it is determined that HTTP traffic does not include a public API, the HTTP traffic may be HTTP background traffic or an omitted API that has not been added to the API rule library. At this time, the network traffic can be marked, and the mark is used to indicate that the HTTP traffic does not include a public API.

[0061] The application program interface (API) identification method provided by the present invention outputs the public API in the HTTP traffic when it is determined that the HTTP traffic includes a public API, thereby facilitating the management of the public API in the HTTP traffic; and adds a mark to the HTTP traffic when it is determined that the HTTP traffic does not include a public API, thereby facilitating the user to further process the HTTP traffic based on the mark.

[0062] Optionally, Figure 3 This is the third flow chart of the identification method of the application program interface API provided by the present invention, such as Figure 3 As shown, before step 103, the method further includes the following steps:

[0063] Step 106: Obtain API characteristics of each public API.

[0064] Step 107: Record the API features of each of the public APIs in the API rule base.

[0065] For example, the public APIs corresponding to open source tools, application products, and product components are investigated, and at least one of the request method field characteristics, path field characteristics, and request header field characteristics of each public API is composed into a regular expression and recorded in the API rule library.

[0066] The application program interface (API) identification method provided by the present invention records the API features of each public API in an API rule base, making it easy to identify APIs in HTTP traffic based on the API rule base.

[0067] Furthermore, after step 107, the method further includes the following steps:

[0068] Acquire API features of a new public API based on a preset update time; and record the API features of the new public API in the API rule library.

[0069] The preset update time can be set based on actual needs, for example, the preset update time is 1 day.

[0070] For example, it is also possible to obtain new public APIs corresponding to open source tools, new public APIs corresponding to application products, and new public APIs corresponding to product components based on the preset update time, and then record the API features of each new public API into a regular expression in the API rule library to achieve automatic updating of the API rule library. Based on the updated API rule library, the API in HTTP traffic can be more accurately identified; in addition, invalid API features in the API rule library can be deleted regularly to achieve maintenance of the API rule library and reduce memory usage.

[0071] The API recognition device includes a first acquisition unit, a parsing unit, and a recognition unit; wherein:

[0072] A first acquiring unit, configured to acquire network traffic;

[0073] A parsing unit, configured to parse preset field features in the network traffic; the preset field features are used to represent API features;

[0074] The identification unit is configured to identify whether the network traffic includes a public API based on the preset field feature and the API features included in the API rule base; the API feature corresponding to each public API is stored in the API rule base.

[0075] The application program interface (API) identification device provided by an embodiment of the present invention parses preset field features in network traffic for characterizing API features, and identifies whether the network traffic includes a public API based on the preset field features and the API features included in the API rule library, thereby realizing the identification of APIs in network traffic.

[0076] Based on any of the above embodiments, the preset field characteristics and the API characteristics both include at least one of the following: a request method field characteristic, a path field characteristic, and a request header field characteristic.

[0077] Based on any of the above embodiments, the identification unit is specifically configured to:

[0078] Matching the preset field features with the API features included in the API rule base;

[0079] When the match is successful, determining that the network traffic includes the public API;

[0080] When the matching fails, it is determined that the network traffic does not include the public API.

[0081] Based on any of the above embodiments, the device further includes:

[0082] an output unit, configured to output the public API in the network traffic when it is determined that the network traffic includes the public API;

[0083] The marking unit is configured to add an alarm mark to the network traffic when it is determined that the network traffic does not include the public API.

[0084] Based on any of the above embodiments, the device further includes:

[0085] A second acquisition unit is used to acquire API features of each public API;

[0086] The first recording unit is configured to record the API features of each of the public APIs in the API rule base.

[0087] Based on any of the above embodiments, the device further includes:

[0088] A third acquisition unit is used to acquire API features of the new public API based on a preset update time;

[0089] The second recording unit is configured to record the API features of the new public API in the API rule base.

[0090] Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other via the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the following method: obtaining network traffic;

[0091] Parsing preset field features in the network traffic; the preset field features are used to characterize API features;

[0092] Whether the network traffic includes a public API is identified based on the preset field feature and the API features included in the API rule base; the API rule base stores the API features corresponding to each public API.

[0093] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0094] On the other hand, the present invention further provides a computer program product, the computer program product including a computer program, the computer program being storable on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can perform the application program interface API identification method provided by the above methods, the method including: obtaining network traffic;

[0095] Parsing preset field features in the network traffic; the preset field features are used to characterize API features;

[0096] Based on the preset field features and the API features included in the API rule base, it is identified whether the network traffic includes a public API; the API rule base stores the API features corresponding to each public API.

[0097] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for identifying the application program interface API provided by the above methods is implemented, the method comprising: obtaining network traffic;

[0098] Parsing preset field features in the network traffic; the preset field features are used to characterize API features;

[0099] Whether the network traffic includes a public API is identified based on the preset field feature and the API features included in the API rule base; the API rule base stores the API features corresponding to each public API.

[0100] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0101] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for identifying an application programming interface (API), characterized in that: include: Get network traffic; Parsing preset field features in the network traffic; the preset field features are used to characterize API features; Identifying whether the network traffic includes a public API based on the preset field characteristics and the API characteristics included in the API rule library; the API rule library stores the API characteristics corresponding to each public API; The preset field features and the API features both include: a request method field feature, a path field feature, and a request header field feature. The request method field feature includes a request method field name and a field value corresponding to the request method field name. The path field feature includes a path field name and a field value corresponding to the path field name. The request header field feature includes a host field and a field value corresponding to the host field. The identifying whether the network traffic includes a public API based on the preset field feature and the API feature included in the API rule library includes: Matching the request method field characteristics, path field characteristics, and request header field characteristics included in the preset field characteristics with the request method field characteristics, path field characteristics, and request header field characteristics included in the API characteristics, respectively; When the match is successful, determining that the network traffic includes the public API; When the matching fails, it is determined that the network traffic does not include the public API.

2. The method for identifying an application programming interface (API) according to claim 1, wherein: The method further comprises: When it is determined that the network traffic includes the public API, outputting the public API in the network traffic; When it is determined that the network traffic does not include the public API, the network traffic is marked.

3. The method for identifying an application programming interface (API) according to claim 1, wherein: Before identifying whether the network traffic includes a public API based on the preset field features and the API features included in the API rule base, the method further includes: Get the API characteristics of each public API; The API features of each of the public APIs are recorded in the API rule base.

4. The method for identifying an application programming interface (API) according to claim 3, wherein: The method further comprises: Get new public API features based on preset update time; The API features of the new public API are recorded in the API rule base.

5. An application program interface (API) recognition device, characterized in that: include: A first acquiring unit, configured to acquire network traffic; A parsing unit, configured to parse preset field features in the network traffic; the preset field features are used to represent API features; an identification unit, configured to identify whether the network traffic includes a public API based on the preset field characteristics and the API characteristics included in the API rule base; the API rule base stores API characteristics corresponding to each public API; the preset field characteristics and the API characteristics both include: a request method field characteristic, a path field characteristic, and a request header field characteristic; The request method field characteristics include the request method field name and the field value corresponding to the request method field name, the path field characteristics include the path field name and the field value corresponding to the path field name, and the request header field characteristics include the host field and the field value corresponding to the host field; The identification unit is specifically used to: Matching the request method field characteristics, path field characteristics, and request header field characteristics included in the preset field characteristics with the request method field characteristics, path field characteristics, and request header field characteristics included in the API characteristics, respectively; When the match is successful, determining that the network traffic includes the public API; When the matching fails, it is determined that the network traffic does not include the public API.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for identifying the application program interface (API) according to any one of claims 1 to 4 is implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying the application program interface API according to any one of claims 1 to 4 is implemented.

8. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the method for identifying the application program interface API as claimed in any one of claims 1 to 4.

Images