Method and device for identifying application programming interface (API) of network traffic

Abstract

An embodiment of the present invention provides a method and apparatus for identifying an application programming interface (API) in network traffic. The method comprises: obtaining uniform resource locator (URL) information from network traffic data; segmenting the URL information to obtain multiple URL domains; determining a target hierarchy based on each URL domain and its hierarchy within the URL information; and identifying the API in the network traffic based on the URL information and the target hierarchy. The method of the embodiment of the present invention enables identification of APIs in network traffic.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for identifying an application programming interface (API) of network traffic. Background Art

[0002] With the continuous development of Internet technology, there are a large number of Application Programming Interfaces (APIs) in network traffic. Since APIs can have a serious impact on network management and network security, how to effectively identify APIs in network traffic has become a concern for technicians in this field.

[0003] In the existing technology, relevant technical personnel can only identify known APIs in network traffic, and cannot effectively identify and manage newly added or unknown APIs in network traffic, which can easily cause network security risks. Summary of the Invention

[0004] In response to the problems in the prior art, embodiments of the present invention provide a method and device for identifying an application programming interface (API) of network traffic.

[0005] Specifically, the embodiments of the present invention provide the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a method for identifying an application programming interface (API) of network traffic, comprising:

[0007] Obtaining uniform resource locator URL information from network traffic data;

[0008] Segmenting the URL information to obtain multiple URL domains;

[0009] Determining a target level according to each of the URL domains and the level of each of the URL domains in the URL information;

[0010] An API in the network traffic is identified based on the URL information and the target level.

[0011] Furthermore, determining the target level according to each of the URL domains and the level of each of the URL domains in the URL information includes:

[0012] determining at least one candidate URL domain from the URL domains based on character quantity information in the multiple URL domains;

[0013] The target level is determined according to at least one candidate URL domain and the level of the candidate URL domain in the URL information.

[0014] Furthermore, determining at least one candidate URL domain from the URL domains based on the character count information in the multiple URL domains includes:

[0015] For any of the URL domains, if the number of digits in the URL domain is greater than a first threshold, and the number of characters in the URL domain is greater than a second threshold, then the URL domain is used as the candidate URL domain; or,

[0016] If the URL domain only includes numbers, the URL domain is used as the candidate URL domain;

[0017] Determining the target level according to at least one candidate URL domain and the level of the candidate URL domain in the URL information includes:

[0018] For any candidate URL domain, if the level of the candidate URL domain in the URL information is greater than a third threshold, the candidate URL domain is used as the target URL domain, and the level of the target URL domain in the URL information is determined as the target level.

[0019] Furthermore, identifying the API in the network traffic based on the URL information and the target level includes:

[0020] The URL domains from the first level to the target level in the URL information are identified as APIs in the network traffic; the first level is the level corresponding to the first URL domain arranged in the first direction in the URL information.

[0021] Furthermore, the URL information includes at least two pieces of URL information, and determining the target level according to each URL domain and the level of each URL domain in the URL information includes:

[0022] Constructing a URL information tree based on each of the URL domains in the network traffic and the hierarchy of each of the URL domains in the URL information; each of the URL domains is a child node of the URL information tree; and the hierarchy of each of the URL domains in the URL information is the hierarchy of the child node in the URL information tree;

[0023] The target level is determined according to the number of child nodes in each level in the URL information tree and the threshold value corresponding to each level.

[0024] Furthermore, determining the target level in the URL information tree according to the number of child nodes in each level in the URL information tree includes:

[0025] For any of the levels, when the number of child nodes in the level in the URL information tree is greater than a threshold corresponding to the level, the level is determined as the target level.

[0026] Furthermore, identifying the API in the network traffic based on the URL information and the target level includes:

[0027] The URL domains from the first level to the target level in the URL information tree are identified as the API in the network traffic; the URL domain of the target level in the API includes the URL domains corresponding to all child nodes.

[0028] Furthermore, identifying the API in the network traffic based on the URL information and the target level includes:

[0029] Determine a candidate child node from all child nodes corresponding to the target level;

[0030] The URL domains from the first level to the target level in the URL information tree are identified as APIs in the network traffic; the URL domains of the target level in the API only include URL domains corresponding to the candidate child nodes.

[0031] Furthermore, determining a candidate child node from all child nodes corresponding to the target level includes:

[0032] For any of the child nodes in the target level, if the number of digits in the URL field corresponding to the child node is greater than a first threshold, and the number of characters in the URL field corresponding to the child node is greater than a second threshold, then the child node is used as the candidate child node; or,

[0033] If the URL field corresponding to the child node only includes numbers, the child node is used as the candidate child node.

[0034] Furthermore, the URL information is segmented to obtain multiple URL domains, including:

[0035] The URL information is segmented according to the separator in the URL information to obtain multiple URL domains.

[0036] In a second aspect, an embodiment of the present invention further provides a device for identifying an application programming interface (API) of network traffic, comprising:

[0037] An acquisition module is used to obtain uniform resource locator URL information in network traffic data;

[0038] A segmentation module, configured to segment the URL information to obtain multiple URL domains;

[0039] a determination module, configured to determine a target level according to each of the URL domains and the level of each of the URL domains in the URL information;

[0040] An identification module is used to identify the API in the network traffic according to the URL information and the target level.

[0041] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the application programming interface (API) identification method for network traffic as described in the first aspect is implemented.

[0042] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the application programming interface API identification method for network traffic as described in the first aspect.

[0043] In a fifth aspect, an embodiment of the present invention further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method for identifying the application programming interface (API) of network traffic as described in the first aspect.

[0044] The method and device for identifying the application programming interface (API) of network traffic provided by the embodiments of the present invention obtain URL information in the network traffic and divide the URL information into smaller units of URL domains, thereby facilitating the analysis of the URL information in the network traffic and the identification of the API; further, the target hierarchy can be determined based on each URL domain and the hierarchy of each URL domain in the URL information, and finally, the target hierarchy information corresponding to the determined API in the URL information can be used to achieve the purpose of identifying the API in the network traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 1 is a flow chart of a method for identifying an application programming interface (API) of network traffic provided by an embodiment of the present invention;

[0047] Figure 2 This is another flowchart of the method for identifying the application programming interface (API) of network traffic provided by an embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of the structure of an application programming interface (API) identification device for network traffic provided by an embodiment of the present invention;

[0049] Figure 4 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0051] The method of the embodiment of the present invention can be applied in scenarios in the field of computer technology to implement API identification of network traffic.

[0052] In related technologies, technicians can only identify known APIs in network traffic, and are unable to effectively identify and manage newly added or unknown APIs in network traffic, which can easily cause network security risks.

[0053] The method for identifying an application programming interface (API) in network traffic according to an embodiment of the present invention obtains uniform resource locator (URL) information in network traffic and divides the URL information into smaller units of URL domains, thereby facilitating analysis of the URL information in network traffic and identification of the API; further, the target hierarchy can be determined based on each URL domain and the hierarchy of each URL domain in the URL information, and finally, based on the URL information and the target hierarchy information corresponding to the determined API in the URL information, the purpose of identifying the API in the network traffic can be achieved.

[0054] The following combination Figure 1-Figure 4 The technical solution of the present invention is described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0055] Figure 1 This is a flow chart of an embodiment of a method for identifying network traffic using an application programming interface (API) according to an embodiment of the present invention. Figure 1 As shown, the method provided in this embodiment includes:

[0056] Step 101: Obtaining uniform resource locator (URL) information from network traffic data;

[0057] Specifically, in order to identify the API in the network traffic data, the uniform resource locator (URL) information in the network traffic data may be obtained, and the URL information may be further analyzed to identify the API in the network traffic.

[0058] Step 102: Segment the URL information to obtain multiple URL domains;

[0059] Specifically, to more conveniently identify APIs in network traffic, the URL information in the network traffic can be segmented, that is, the URL information can be divided into smaller URL domains, so as to facilitate analysis of the URL information in the network traffic and identification of APIs. Optionally, the URL information can be segmented based on the separator " / " in the URL information to obtain multiple URL domains.

[0060] Step 103: Determine the target level based on each URL domain and its level in the URL information.

[0061] Specifically, after the URL information in the network traffic is divided into multiple URL domains, the target level in the URL information can be determined based on the URL domains obtained after the division and the levels of each URL domain in the URL information, that is, the target level corresponding to the API in the URL information can be determined.

[0062] Step 104: Identify the API in the network traffic based on the URL information and the target level.

[0063] Specifically, after determining the target level in the URL information, that is, determining the level information corresponding to the API in the URL information, the API in the network traffic can be identified based on the URL information and the level information corresponding to the API in the URL information.

[0064] For example, the URL information: / a / b / aaaabb123 / aabb is identified from the network traffic. After the URL information is split according to the separator " / ", four URL domains are obtained, namely a at the first level, b at the second level, aaaabb123 at the third level, and aabb at the fourth level. If the target level is determined to be the third level based on the above four domains and the levels of the four domains in the URL information, then / a / b / aaaabb123 from the first level to the target level in the network traffic is identified as an API based on the URL information and the third level corresponding to the target level.

[0065] The method of the above embodiment obtains URL information in network traffic and divides the URL information into smaller units of URL domains, thereby facilitating the analysis of URL information in network traffic and the identification of APIs; further, the target hierarchy can be determined based on each URL domain and the hierarchy of each URL domain in the URL information, and finally, the target hierarchy information corresponding to the determined API in the URL information can be used to achieve the purpose of identifying APIs in network traffic.

[0066] In one embodiment, determining the target level based on each URL domain and its level in the URL information includes:

[0067] determining at least one candidate URL domain from the URL domains based on character count information in the plurality of URL domains;

[0068] A target level is determined according to at least one candidate URL domain and a level of the candidate URL domain in the URL information.

[0069] Specifically, the composition of APIs in network traffic usually has certain rules and characteristics, and the URL domains obtained after the corresponding URL information is segmented also meet the corresponding rules and characteristics. Therefore, by identifying the rules and characteristics corresponding to the URL domain, the candidate URL domain corresponding to the API can be determined, and the hierarchical information corresponding to the API in the URL information can be determined through the hierarchy of the candidate URL domain in the URL information.

[0070] In one embodiment, determining at least one candidate URL domain from the URL domains based on the character count information in the multiple URL domains includes:

[0071] For any URL domain, if the number of digits in the URL domain is greater than a first threshold, and the number of characters in the URL domain is greater than a second threshold, the URL domain is considered as a candidate URL domain; or,

[0072] If the URL domain only includes numbers, the URL domain is considered as a candidate URL domain;

[0073] For any candidate URL domain, if the level of the candidate URL domain in the URL information is greater than the third threshold, the candidate URL domain is used as the target URL domain, and the level of the target URL domain in the URL information is determined as the target level.

[0074] Specifically, the composition of APIs in network traffic usually has certain rules and characteristics, and the URL domains obtained after the corresponding URL information is segmented also meet their corresponding rules and characteristics. When the number of digits in the URL domain is greater than a first threshold, and the number of characters in the URL domain is greater than a second threshold, the URL domain is considered a candidate URL domain, or if the URL domain only includes digits, the URL domain is considered a candidate URL domain. That is, under normal circumstances, the number of digits and characters in the URL domain corresponding to the URL information in network traffic should be within a certain range. If the number of digits and characters in the URL domain exceeds the preset range, then the URL domain can be considered as a candidate URL domain corresponding to the API. Furthermore, if the level of the candidate URL domain in the URL information is greater than a third threshold, the candidate domain is determined as the target URL domain, and the level of the target URL in the URL information is determined as the target level.

[0075] For example, the two URL information obtained from the network are as follows:

[0076] / a / b / 1; / a / b / a / aaaabb123;

[0077] The URL information in the network traffic is split using " / " as a delimiter. Each split field is a URL domain, where the URL domain hierarchy increases from left to right, with the starting URL domain hierarchy being 1. For the first URL information, if the URL domain in the third level contains only numbers, this domain can be considered a candidate URL domain. For the second URL information, if the number of numbers "123" in the URL domain in the fourth level exceeds a first threshold of 2, and the number of characters "aaaabb123" contained in this domain exceeds a second threshold of 7, this domain can be considered a candidate URL domain.

[0078] Optionally, if the URL domains corresponding to the first three levels in the URL information generally do not have an API, the third threshold value may be set to 3. If the level of the candidate URL domain in the URL information is greater than the third threshold value 3, the candidate domain is determined as the target URL domain, and the level of the target URL in the URL information is determined as the target level. For example, if the level corresponding to the candidate domain in the first URL information is 3, and the level corresponding to the candidate domain in the second URL information is 4, the candidate domain in the second URL information may be determined as the target URL domain, and the fourth level of the target URL domain in the URL information may be determined as the target level.

[0079] The method of the above embodiment determines at least one candidate URL domain from the URL domains based on the character count information in multiple URL domains, and determines the target level based on the at least one candidate URL domain and the level of the candidate URL domain in the URL information; that is, by analyzing the characteristics and rules of the URL domain in the URL information, the URL domain corresponding to the API is determined, and the level information of the URL domain corresponding to the API is used as the target level. Further, based on the determined target URL domain and the target level corresponding to the target URL domain, the corresponding API can be effectively identified.

[0080] In one embodiment, identifying APIs in network traffic based on URL information and target hierarchy includes:

[0081] The URL domains from the first level to the target level in the URL information are identified as APIs in the network traffic; the first level is the level corresponding to the first URL domain arranged in the first direction in the URL information.

[0082] Specifically, after the URL information is segmented to obtain multiple URL domains, the hierarchy corresponding to the segmented URL domains can be determined according to the first direction. Optionally, the URL information in the network traffic can be segmented using " / " as a separator, and each segmented field is a URL domain, wherein the hierarchy of the URL domain increases from left to right, and the starting URL domain hierarchy is set to 1. For example, after the URL information / a / b / a / aaaabb123 is segmented using " / " as a separator, the "aaaabb123" corresponding to the fourth hierarchy is determined as the target domain through analysis, and the hierarchy corresponding to the target domain is the fourth hierarchy. Then, the URL domains from the first hierarchy to the fourth hierarchy in the URL information can be identified as APIs in the network traffic, that is, / a / b / a / aaaabb123 can be identified as an API. That is, by applying the corresponding rules of the API, that is, utilizing the number of symbols in the URL domain corresponding to the API, unknown APIs in the network traffic can be identified, which has the characteristics of fast processing speed and parallel processing.

[0083] The method of the above embodiment, after dividing the URL information into URL domains, can determine the level corresponding to each URL domain according to the first direction; further, after determining the target URL domain, the target level corresponding to the target URL domain is also determined according to the first direction, and the URL domains from the first level to the target level in the URL information can be identified as APIs in network traffic, thus achieving the effect of identifying APIs from network traffic.

[0084] In one embodiment, the URL information includes at least two pieces of URL information, and determining the target level according to each URL domain and the level of each URL domain in the URL information includes:

[0085] A URL information tree is constructed based on each URL domain in the network traffic and the hierarchy of each URL domain in the URL information; each URL domain is a child node of the URL information tree; the hierarchy of each URL domain in the URL information is the hierarchy of the child node in the URL information tree;

[0086] The target level is determined according to the number of child nodes in each level in the URL information tree and the threshold corresponding to each level.

[0087] Specifically, after obtaining at least two pieces of URL information, the two pieces of URL information can be constructed into a URL information tree based on the hostnames of the URL information. Each URL domain is a child node of the URL information tree, and the level of each URL domain in the URL information corresponds to the level of the child node in the URL information tree. Accordingly, after constructing the URL information tree from the at least two pieces of URL information, the target level can be determined based on the number of child nodes in each level of the URL information tree and the thresholds corresponding to each level.

[0088] For example, the three URL information obtained in the network traffic are as follows: / a / b / a, / a / b / c, / a / b / aaaabb123; if the host names of the three URL information are the same, the host names of the URL information can be used as the main node of the URL information tree, and each URL domain can be used as a child node of the URL information tree, that is, each domain "a", "b", "a", "a", "b", "c", "a", "b", "aaaabb123" can be used as a child node of the URL information tree. Optionally, if the content of a domain in the two URL information is the same, and the hierarchy of the domain in the two URL information is also the same, the domain can be merged in the ULR information tree; accordingly, the hierarchy of each URL domain in the URL information is the hierarchy of the child node in the URL information tree, and the URL information tree is constructed in this order.

[0089] In one embodiment, determining a target level in the URL information tree based on the number of child nodes in each level in the URL information tree includes:

[0090] For any level, if the number of child nodes in the level in the URL information tree is greater than a threshold corresponding to the level, the level is determined as a target level.

[0091] Specifically, after constructing at least two URL information into a URL information tree, for any level, whether the level is the target level can be determined based on the number of child nodes in the level and the threshold corresponding to the level. For example, after constructing multiple URL information into a URL information tree, the number of child nodes in the third level of the URL information tree is normally less than 10. In this case, the threshold corresponding to the third level of the URL tree can be set to 10. Then, when the number of child nodes corresponding to the third level of the URL tree after the multiple URL information is formed is 15, that is, when the number of child nodes in the third level of the URL information tree is greater than the threshold of 10 corresponding to the third level of the URL tree, the third level of the URL tree is determined to be the target level.

[0092] The method of the above embodiment constructs a URL information tree by using the obtained multiple URL information, wherein each URL domain in the URL information serves as a child node of the URL information tree, and the level of each URL domain in the URL information serves as the level of the child node in the URL information tree; then, based on the relationship between the number of child nodes in each level in the URL information tree and the size of the threshold corresponding to each level, the target level corresponding to the API in the URL information tree is determined.

[0093] In one embodiment, identifying APIs in network traffic based on URL information and target hierarchy includes:

[0094] The URL domains from the first level to the target level in the URL information tree are identified as APIs in network traffic; the URL domains of the target level in the API include the URL domains corresponding to all child nodes.

[0095] Specifically, when multiple pieces of URL information are obtained, and the multiple pieces of URL information are constructed into a URL information tree based on the host name of the URL information and the target layer corresponding to the URL tree is determined, the URL domains from the first level to the target level in the URL information tree can be identified as APIs in network traffic, wherein the URL domains of the target level in the API include the URL domains corresponding to all child nodes.

[0096] For example, the fourth level in the URL information tree is determined as the target level, and the fourth level includes 8 child nodes, that is, the fourth level in the URL information tree corresponds to 8 URL domains, then the URL domains from the first level to the target level in the URL information tree are identified as APIs in network traffic, that is, all 8 URL paths corresponding to the 8 URL domains in the first level to the fourth level are identified as APIs in network traffic.

[0097] The method of the above embodiment, after forming a URL information tree with multiple URL information domains and determining the target level of the URL information tree, can identify the URL paths corresponding to each URL domain from the first level to the target level in the URL information tree as APIs in network traffic, thereby achieving the purpose of identifying APIs from network traffic.

[0098] In one embodiment, identifying APIs in network traffic based on URL information and target hierarchy includes:

[0099] Determine candidate child nodes from all child nodes corresponding to the target level;

[0100] The URL domains from the first level to the target level in the URL information tree are identified as APIs in network traffic; the URL domains of the target level in the API only include URL domains corresponding to candidate child nodes.

[0101] Specifically, when multiple pieces of URL information are obtained, and the multiple pieces of URL information are constructed into a URL information tree based on the host name of the URL information and the target layer corresponding to the URL tree is determined, the URL domains from the first level to the target level in the URL information tree can be identified as APIs in network traffic, wherein the URL domains of the target level in the API only include the URL domains corresponding to the candidate child nodes.

[0102] For example, the fourth level in the URL information tree is determined as the target level, and the fourth level includes 8 child nodes, of which only 2 are candidate child nodes. That is, the target level in the API includes URL domains corresponding to 2 candidate child nodes. Then, the 2 URL paths corresponding to the 2 candidate URL domains from the first level to the target level in the URL information tree can be identified as APIs in network traffic.

[0103] The method of the above embodiment, after forming a URL information tree with multiple URL information domains and determining the target level of the URL information tree, can identify the URL path corresponding to the candidate URL domains from the first level to the target level in the URL information tree as the API in the network traffic, thereby achieving the purpose of identifying the API from the network traffic.

[0104] In one embodiment, determining a candidate child node from all child nodes corresponding to the target level includes:

[0105] For any child node in the target level, if the number of digits in the URL field corresponding to the child node is greater than a first threshold, and the number of characters in the URL field corresponding to the child node is greater than a second threshold, then the child node is considered as a candidate child node; or,

[0106] If the URL field corresponding to the child node only includes numbers, the child node is regarded as a candidate child node.

[0107] Specifically, based on the URL path corresponding to the candidate child nodes from the first level to the target level in the URL information tree, the API in the network traffic can be identified; wherein, the candidate URL child nodes can be determined by the number of symbols in each URL domain. If the number of digits in the URL domain corresponding to the child node is greater than a first threshold, and the number of characters in the URL domain corresponding to the child node is greater than a second threshold, the child node is regarded as a candidate child node; or, if the URL domain corresponding to the child node only includes digits, the child node is regarded as a candidate child node.

[0108] For example, if the target level in the URL information tree is the third level, and the content in the URL domain corresponding to a subnode in the third level is "aaaabb123", if the first threshold is 2 and the second threshold is 7, that is, the number of digits in the URL domain corresponding to the subnode is greater than the first threshold of 2, and the number of characters in the URL domain corresponding to the subnode is greater than the second threshold of 7, then the subnode is regarded as a candidate subnode. In the case where the number of symbols in the URL domain corresponding to the API cannot be used to identify unknown APIs in network traffic, by constructing a URL information tree and determining the target level, all URL paths from the first level to the target level or paths containing only candidate URL domains are identified as unknown APIs in network traffic. This can further identify unknown APIs in network traffic compared to the first API identification method based on the number of URL symbols.

[0109] The method of the above embodiment forms a URL information tree from multiple URL information domains and determines the target level of the URL information tree. If the number of digits in the URL domain in the target level is greater than a first threshold, and the number of characters in the URL domain is greater than a second threshold, the URL domain is considered a candidate URL domain. Alternatively, if the URL domain only contains digits, the URL domain is considered a candidate URL domain in the target level. In other words, the number of digits and characters in the URL domain corresponding to the URL information in network traffic should generally be within a certain range. If the number of digits and characters in the URL domain exceeds the preset range, the URL domain can be considered a candidate URL domain in the target level corresponding to the API. Furthermore, based on the candidate URL domains in the determined target level, the purpose of identifying APIs from network traffic can be achieved.

[0110] In one embodiment, the URL information is segmented to obtain multiple URL domains, including:

[0111] The URL information is split according to the separator in the URL information to obtain multiple URL domains.

[0112] Specifically, to more conveniently identify APIs in network traffic, the URL information in the network traffic can be segmented, that is, the URL information can be divided into smaller URL domains to facilitate analysis of the URL information in the network traffic and identification of APIs. Optionally, the URL information can be segmented based on the separator " / " in the URL information to obtain multiple URL domains, thereby further facilitating analysis of the URL information to identify APIs in the network traffic.

[0113] For example, Figure 2 The flowchart of the method for identifying the application programming interface (API) of network traffic provided by an embodiment of the present invention is shown. After obtaining multiple URL information, the hostname that is the same in the multiple URLs can be used as the main node, and the level corresponding to the URL information tree can be determined. Then, the URL domains in each URL information can be used as child nodes of the URL information tree to construct a URL information tree. The construction of the URL information tree follows the following rules: (1) Only URL information with the same hostname can constitute a URL information tree; (2) When the number of child nodes of a certain level exceeds the threshold of the level to which it corresponds, the level is determined as the target level; (3) The thresholds corresponding to each level can be different and can be adjusted according to the actual traffic characteristics; usually, the threshold corresponding to the first level is much higher than the thresholds of other levels (the probability that the first level is the target level is relatively small compared to other levels); (4) For the candidate URL domains in the target level, optionally, only the URL paths corresponding to the candidate URL domains from the first level to the target level can be identified as the API in the network traffic, or the URL paths corresponding to all URL domains from the first level to the target level can be identified as the API in the network traffic.

[0114] The following describes the network traffic application programming interface API identification device provided by the present invention. The network traffic application programming interface API identification device described below and the network traffic application programming interface API identification method described above can be referenced to each other.

[0115] Figure 3 Schematic diagram of the structure of the network traffic application programming interface API identification device provided by the present invention. The network traffic application programming interface API identification device provided in this embodiment includes:

[0116] The acquisition module 710 is used to obtain the uniform resource locator URL information in the network traffic data;

[0117] A segmentation module 720 is used to segment the URL information to obtain multiple URL domains;

[0118] a determination module 730 for determining a target level based on each URL domain and the level of each URL domain in the URL information;

[0119] The identification module 740 is used to identify the API in the network traffic based on the URL information and the target level.

[0120] Optionally, the determining module 730 is specifically configured to: determine at least one candidate URL domain from the URL domains based on information about the number of characters in the multiple URL domains;

[0121] A target level is determined according to at least one candidate URL domain and a level of the candidate URL domain in the URL information.

[0122] Optionally, the determining module 730 is specifically configured to: for any URL domain, if the number of digits in the URL domain is greater than a first threshold and the number of characters in the URL domain is greater than a second threshold, then consider the URL domain as a candidate URL domain; or

[0123] If the URL domain only includes numbers, the URL domain is considered as a candidate URL domain;

[0124] For any candidate URL domain, if the level of the candidate URL domain in the URL information is greater than the third threshold, the candidate URL domain is used as the target URL domain, and the level of the target URL domain in the URL information is determined as the target level.

[0125] Optionally, the identification module 740 is specifically used to: identify the URL domains from the first level to the target level in the URL information as APIs in the network traffic; the first level is the level corresponding to the first URL domain arranged in the first direction in the URL information.

[0126] Optionally, the determining module 730 is specifically configured to: construct a URL information tree based on each URL domain in the network traffic and the hierarchy of each URL domain in the URL information; each URL domain is a child node of the URL information tree; the hierarchy of each URL domain in the URL information is the hierarchy of the child node in the URL information tree;

[0127] The target level is determined according to the number of child nodes in each level in the URL information tree and the threshold corresponding to each level.

[0128] Optionally, the determination module 730 is specifically configured to: for any level, if the number of child nodes in the level in the URL information tree is greater than a threshold corresponding to the level, determine the level as the target level.

[0129] Optionally, the identification module 740 is specifically configured to: identify URL domains from the first level to the target level in the URL information tree as APIs in network traffic; the URL domains of the target level in the API include URL domains corresponding to all child nodes.

[0130] Optionally, the identification module 740 is specifically configured to: determine a candidate child node from all child nodes corresponding to the target level;

[0131] The URL domains from the first level to the target level in the URL information tree are identified as APIs in network traffic; the URL domains of the target level in the API only include URL domains corresponding to candidate child nodes.

[0132] Optionally, the determination module 730 is specifically configured to: for any child node in the target level, if the number of digits in the URL field corresponding to the child node is greater than a first threshold, and the number of characters in the URL field corresponding to the child node is greater than a second threshold, then select the child node as a candidate child node; or

[0133] If the URL field corresponding to the child node only includes numbers, the child node is regarded as a candidate child node.

[0134] Optionally, the segmentation module 720 is specifically configured to segment the URL information according to separators in the URL information to obtain multiple URL domains.

[0135] The device of the embodiment of the present invention is used to execute the method in any of the aforementioned method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0136] Figure 4 The present invention provides a schematic diagram of the physical structure of an electronic device, which may include: a processor 810, a communications interface 820, a memory 830, and a communications bus 840. The processor 810, the communications interface 820, and the memory 830 communicate with each other via the communications bus 840. The processor 810 may invoke logic instructions in the memory 830 to execute a method for identifying an application programming interface (API) in network traffic. The method includes: obtaining uniform resource locator (URL) information from network traffic data; segmenting the URL information to obtain multiple URL domains; determining a target hierarchy based on each URL domain and its hierarchy in the URL information; and identifying the API in the network traffic based on the URL information and the target hierarchy.

[0137] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0138] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the network traffic application programming interface API identification method provided by the above methods, and the method includes: obtaining uniform resource locator URL information in network traffic data; segmenting the URL information to obtain multiple URL domains; determining a target level based on each URL domain and the level of each URL domain in the URL information; and identifying the API in the network traffic based on the URL information and the target level.

[0139] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the above-mentioned network traffic application programming interface API identification method, the method comprising: obtaining uniform resource locator URL information in network traffic data; segmenting the URL information to obtain multiple URL domains; determining a target level based on each URL domain and the level of each URL domain in the URL information; and identifying the API in the network traffic based on the URL information and the target level.

[0140] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0141] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for identifying an application programming interface (API) of network traffic, characterized in that: include: Obtaining uniform resource locator URL information from network traffic data; Segmenting the URL information to obtain multiple URL domains; Determining a target level according to each of the URL domains and the level of each of the URL domains in the URL information; identifying an API in the network traffic based on the URL information and the target level; The determining of the target level according to each of the URL domains and the level of each of the URL domains in the URL information includes: determining at least one candidate URL domain from the URL domains based on character quantity information in the multiple URL domains; determining the target level according to at least one candidate URL domain and a level of the candidate URL domain in the URL information; The step of determining at least one candidate URL domain from the URL domains based on the character count information in the multiple URL domains includes: For any of the URL domains, if the number of digits in the URL domain is greater than a first threshold, and the number of characters in the URL domain is greater than a second threshold, then the URL domain is used as the candidate URL domain; or, If the URL domain only includes numbers, the URL domain is used as the candidate URL domain; The determining the target level according to at least one candidate URL domain and the level of the candidate URL domain in the URL information includes: For any candidate URL domain, if the level of the candidate URL domain in the URL information is greater than a third threshold, the candidate URL domain is used as the target URL domain, and the level of the target URL domain in the URL information is determined as the target level; or The URL information includes at least two pieces of URL information, and determining the target level according to each URL domain and the level of each URL domain in the URL information includes: Constructing a URL information tree based on each of the URL domains in the network traffic and the hierarchy of each of the URL domains in the URL information; each of the URL domains is a child node of the URL information tree; and the hierarchy of each of the URL domains in the URL information is the hierarchy of the child node in the URL information tree; Determining the target level according to the number of child nodes in each level in the URL information tree and the threshold value corresponding to each level; The determining the target level in the URL information tree according to the number of child nodes in each level in the URL information tree includes: For any of the levels, when the number of child nodes in the level in the URL information tree is greater than a threshold corresponding to the level, the level is determined as the target level.

2. The method for identifying the application programming interface (API) of network traffic according to claim 1, characterized in that: The identifying the API in the network traffic according to the URL information and the target level includes: The URL domains from the first level to the target level in the URL information are identified as APIs in the network traffic; the first level is the level corresponding to the first URL domain arranged in the first direction in the URL information.

3. The method for identifying the application programming interface (API) of network traffic according to claim 1, characterized in that: The identifying the API in the network traffic according to the URL information and the target level includes: The URL domains from the first level to the target level in the URL information tree are identified as the API in the network traffic; the URL domain of the target level in the API includes the URL domains corresponding to all child nodes.

4. The method for identifying the application programming interface (API) of network traffic according to claim 1, characterized in that: The identifying the API in the network traffic according to the URL information and the target level includes: Determine a candidate child node from all child nodes corresponding to the target level; The URL domains from the first level to the target level in the URL information tree are identified as APIs in the network traffic; the URL domains of the target level in the API only include URL domains corresponding to the candidate child nodes.

5. The method for identifying the application programming interface (API) of network traffic according to claim 4, characterized in that: Determine candidate child nodes from all child nodes corresponding to the target level, including: For any of the child nodes in the target level, if the number of digits in the URL field corresponding to the child node is greater than a first threshold, and the number of characters in the URL field corresponding to the child node is greater than a second threshold, then the child node is used as the candidate child node; or, If the URL field corresponding to the child node only includes numbers, the child node is used as the candidate child node.

6. The method for identifying the application programming interface (API) of network traffic according to claim 1, characterized in that: The URL information is segmented to obtain multiple URL domains, including: The URL information is segmented according to the separator in the URL information to obtain multiple URL domains.

7. A device for identifying an application programming interface (API) of network traffic, characterized in that: include: An acquisition module is used to obtain uniform resource locator URL information in network traffic data; A segmentation module, configured to segment the URL information to obtain multiple URL domains; a determination module, configured to determine a target level according to each of the URL domains and the level of each of the URL domains in the URL information; The determining of the target level according to each of the URL domains and the level of each of the URL domains in the URL information includes: determining at least one candidate URL domain from the URL domains based on character quantity information in the multiple URL domains; determining the target level according to at least one candidate URL domain and a level of the candidate URL domain in the URL information; The step of determining at least one candidate URL domain from the URL domains based on the character count information in the multiple URL domains includes: For any of the URL domains, if the number of digits in the URL domain is greater than a first threshold, and the number of characters in the URL domain is greater than a second threshold, then the URL domain is used as the candidate URL domain; or, If the URL domain only includes numbers, the URL domain is used as the candidate URL domain; The determining the target level according to at least one candidate URL domain and the level of the candidate URL domain in the URL information includes: For any candidate URL domain, if the level of the candidate URL domain in the URL information is greater than a third threshold, the candidate URL domain is used as the target URL domain, and the level of the target URL domain in the URL information is determined as the target level; or The URL information includes at least two pieces of URL information, and determining the target level according to each URL domain and the level of each URL domain in the URL information includes: Constructing a URL information tree based on each of the URL domains in the network traffic and the hierarchy of each of the URL domains in the URL information; each of the URL domains is a child node of the URL information tree; and the hierarchy of each of the URL domains in the URL information is the hierarchy of the child node in the URL information tree; Determining the target level according to the number of child nodes in each level in the URL information tree and the threshold value corresponding to each level; The determining the target level in the URL information tree according to the number of child nodes in each level in the URL information tree includes: For any of the levels, if the number of child nodes in the level in the URL information tree is greater than a threshold corresponding to the level, the level is determined as the target level; An identification module is used to identify the API in the network traffic according to the URL information and the target level.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for identifying the application programming interface (API) of network traffic according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying the application programming interface (API) of network traffic according to any one of claims 1 to 6 is implemented.

10. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the method for identifying the application programming interface (API) of network traffic according to any one of claims 1 to 6.

Images