Application Programming Interface (API) Identification Method and Device

Abstract

The present invention provides a method and device for identifying an application program interface (API), wherein the method comprises: parsing network traffic data to obtain a field value of at least one field in the network traffic data; matching the field value of the at least one field with an API field value in an API rule base to obtain a first matching result; when the first matching result is a matching failure, determining whether the network traffic data includes an unknown API based on the field value of the at least one field. The method and device for identifying an application program interface (API) provided by the present invention, when a field value in the network traffic data fails to match an API field value in an API rule base, determines whether the network traffic data includes an unknown API based on the field value of each field in the network traffic data, thereby realizing the identification of unknown APIs in the network traffic data.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method and device for identifying an application programming interface (API). Background Art

[0002] In risk assessment, the important factor of risk is asset-centric. Threats, vulnerabilities, and risks all exist objectively for assets. Threats exploit the vulnerabilities of assets themselves, making security incidents possible, thus forming security risks. With the evolution of security situation and the development of security concepts, more and more people realize that in the enterprise security operation system, asset security is the foundation of all security. Therefore, asset identification is particularly important. Usually, electronic devices use application programming interfaces (APIs) to implement data call transmission, and API asset identification devices are mainly API gateways, which uniformly connect all API calls to the API gateway layer, which is responsible for API access and output. The API gateway provides specific APIs for each type of client, reducing the number of interactions between the client and the server application (software system), which means that API calls are related to the security of the network, and the core of API calls is API identification.

[0003] In the prior art, API identification is to first obtain and analyze network traffic data, and then match it with a legal and public API library stored on the server. When the match is successful, the API corresponding to the network traffic data can be identified.

[0004] However, the above-mentioned prior art can only identify the API that successfully matches the API library, and does not consider the case where the match with the API library fails, so that it is impossible to identify the unknown API in the network traffic data. Summary of the invention

[0005] The present invention provides an API recognition method and device, which are used to solve the defect that the prior art can only recognize the API in the traffic data that successfully matches the API library, but does not consider the situation where the matching with the API library fails.

[0006] The present invention provides a method for identifying an application program interface (API), comprising:

[0007] Parsing the network traffic data to obtain a field value of at least one field in the network traffic data;

[0008] Matching the field value of the at least one field with the API field value in the API rule library to obtain a first matching result;

[0009] When the first matching result is a matching failure, it is determined whether the network traffic data includes an unknown API based on the field value of the at least one field.

[0010] According to an API identification method provided by the present invention, the API rule base includes a public API rule base; the public API rule base stores a public API field value corresponding to at least one first preset field;

[0011] The step of matching the field value of the at least one field with the API field value in the API rule base to obtain a first matching result includes:

[0012] Matching a field value of a target field with a public API field value corresponding to a first preset field in the public API rule base; the target field is a field in the at least one field;

[0013] When it is determined that the field value of the target field matches the public API field value of the first preset field in the public API rule library, the first matching result is determined to be a successful match.

[0014] According to an API identification method provided by the present invention, the API rule base also includes a custom API rule base; the custom API rule base stores a first custom API field value corresponding to at least one second preset field; the method also includes:

[0015] When it is determined that the field value of the target field does not match the public API field value of the first preset field in the public API rule base, matching the field value of the at least one field with the first custom API field value corresponding to the second preset field in the custom API rule base;

[0016] When it is determined that the field value of the at least one field matches the first custom API field value corresponding to the second preset field in the custom API rule base, determining that the first matching result is a successful match;

[0017] When it is determined that the field value of the at least one field does not match the second custom API field value corresponding to the second preset field in the custom API rule base, the first matching result is determined to be a matching failure.

[0018] According to a method for identifying an application program interface (API) provided by the present invention, determining whether the network traffic data includes an unknown API based on the field value of the at least one field comprises:

[0019] Matching the field value of the at least one field with the traffic filtering rule base to obtain a second matching result;

[0020] It is determined whether the network traffic data includes the unknown API based on the second matching result.

[0021] According to an application program interface API identification method provided by the present invention, the traffic filtering rule base includes a whitelist filtering rule base and a blacklist filtering rule base;

[0022] The whitelist filtering rule library stores a second custom API field value corresponding to at least one second preset field; the second custom API field value is different from the first custom API field value;

[0023] The blacklist filtering rule library stores other field values ​​corresponding to at least one second preset field; the other field values ​​are field values ​​other than the second custom API field value and the first custom API field value.

[0024] According to an API recognition method provided by the present invention, matching the field value of the at least one field with a traffic filtering rule library to obtain a second matching result includes:

[0025] Matching the field value of the at least one field with the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and other field values ​​corresponding to the second preset field in the blacklist filtering rule library;

[0026] When it is determined that the field value of the at least one field matches both the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and the other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is obtained based on the priority of the whitelist filtering rule library and the blacklist filtering rule library;

[0027] When it is determined that the field value of the at least one field does not match the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and other field values ​​corresponding to the second preset field in the blacklist filtering rule library, determining that the second matching result is a match to the blacklist filtering rule library;

[0028] When it is determined that the field value of the at least one field matches the second custom API field value corresponding to the second preset field in the whitelist filtering rule library, determining that the second matching result is the whitelist filtering rule library;

[0029] When it is determined that the field value of the at least one field matches other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is determined to match the blacklist filtering rule library.

[0030] According to an API identification method provided by the present invention, obtaining the second matching result based on the priority of the whitelist filtering rule library and the blacklist filtering rule library includes:

[0031] When the priority of the whitelist filtering rule library is the same as the priority of the blacklist filtering rule library, determining that the second matching result is a match with the blacklist filtering rule library;

[0032] When the priority of the whitelist filtering rule library is greater than the priority of the blacklist filtering rule library, determining that the second matching result is a match to the whitelist filtering rule library;

[0033] When the priority of the whitelist filtering rule library is lower than the priority of the blacklist filtering rule library, it is determined that the second matching result matches the blacklist filtering rule library.

[0034] According to a method for identifying an application program interface (API) provided by the present invention, the step of determining whether the network traffic data includes the unknown API based on the second matching result includes:

[0035] When the second matching result is a match to a whitelist filtering rule library, determining that the network traffic data includes the unknown API;

[0036] When the second matching result is a match to a blacklist filtering rule library, it is determined that the network traffic data does not include an unknown API.

[0037] According to a method for identifying an application program interface (API) provided by the present invention, before determining that the network traffic data includes the unknown API, the method further includes:

[0038] Acquire a field value corresponding to a uniform resource identifier path field in the network traffic data; the field value corresponding to the uniform resource identifier path field includes a path parameter;

[0039] The determining that the network traffic data includes the unknown API comprises:

[0040] When it is determined that the path parameter satisfies any one of the following, it is determined that the network traffic data includes the unknown API:

[0041] The path parameter includes only numeric information, the path parameter includes numeric information and letter information, and the path parameter complies with a universal unique identifier (UUID) format.

[0042] According to a method for identifying an application program interface (API) provided by the present invention, the step of determining that the network traffic data includes the unknown API comprises:

[0043] Counting the path parameters corresponding to each of the network traffic data;

[0044] When it is determined that the number of occurrences of the same type of path parameter is greater than a preset number, it is determined that the network traffic data includes the unknown API.

[0045] According to a method for identifying an application program interface (API) provided by the present invention, the method further includes:

[0046] When it is determined that the network traffic data does not include an unknown API, the network traffic data is marked invalid.

[0047] According to a method for identifying an application program interface (API) provided by the present invention, the method further includes:

[0048] When it is determined that the network traffic data includes the unknown API, identification information corresponding to the unknown API is generated and stored.

[0049] According to a method for identifying an application program interface (API) provided by the present invention, the method further includes:

[0050] Determine the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data;

[0051] The application type corresponding to the API, the behavior type corresponding to the API, and the identification information of the API are stored correspondingly.

[0052] According to an application program interface API identification method provided by the present invention, the public API rule base also stores the application type and behavior type corresponding to each public API field value; the custom API rule base also stores the application type and behavior type corresponding to each first custom API field value;

[0053] The determining the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data includes:

[0054] When it is determined that the field value of the at least one field matches the public API field value of the first preset field in the public API rule base, searching the public API rule base for an application type and a behavior type corresponding to the API in the network traffic data;

[0055] When it is determined that the field value of the at least one field matches the first custom API field value corresponding to the second preset field in the custom API rule base, the application type and behavior type corresponding to the API in the network traffic data are searched in the custom API rule base.

[0056] According to a method for identifying an application program interface (API) provided by the present invention, matching the field value of the at least one field with the API field value in the API rule base to obtain a first matching result includes:

[0057] Determining a target application type corresponding to the network traffic data;

[0058] The field value of the at least one field is matched with the API field value in the API rule library corresponding to the target application type to obtain a first matching result.

[0059] The present invention also provides an application program interface API identification device, comprising:

[0060] A parsing unit, which parses the network flow data to obtain a field value of at least one field in the network flow data;

[0061] A matching unit, matching the field value of the at least one field with the API field value in the API rule base to obtain a first matching result;

[0062] A determination unit is configured to determine, when the first matching result is a matching failure, whether the network traffic data includes an unknown API based on a field value of the at least one field.

[0063] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for identifying an application program interface API as described in any one of the above items is implemented.

[0064] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for identifying an application program interface API as described in any one of the above items is implemented.

[0065] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method for identifying the application program interface API as described in any one of the above items is implemented.

[0066] The method and device for identifying the application program interface (API) provided by the present invention determine whether the network traffic data includes an unknown API based on the field values ​​of each field in the network traffic data when the field value in the network traffic data fails to match the API field value in the API rule library, thereby realizing the identification of the unknown API in the network traffic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0068] Figure 1 This is one of the flow charts of the identification method of the application program interface API provided by the present invention;

[0069] Figure 2 This is the second flow chart of the method for identifying the application program interface API provided by the present invention;

[0070] Figure 3 This is the third flow chart of the method for identifying the application program interface API provided by the present invention;

[0071] Figure 4 This is a fourth flow chart of the method for identifying the application program interface API provided by the present invention;

[0072] Figure 5 This is a fifth flow chart of the method for identifying the application program interface API provided by the present invention;

[0073] Figure 6 This is the sixth flow chart of the method for identifying the application program interface API provided by the present invention;

[0074] Figure 7 This is the seventh flow chart of the method for identifying the application program interface API provided by the present invention;

[0075] Figure 8 It is a structural schematic diagram of an identification device for an application program interface API provided by the present invention;

[0076] Fig. 9 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0078] Combine the following Figure 1-Figure 7 The identification method of the application program interface API of the present invention is described.

[0079] Figure 1 This is one of the flow charts of the identification method of the application program interface API provided by the present invention, such as Figure 1 As shown, the identification method of the application program interface API includes the following steps:

[0080] Step 101: parse network traffic data to obtain a field value of at least one field in the network traffic data.

[0081] Among them, network traffic data can be obtained through electronic devices or other devices, or from its own storage device, or from a server; when the network traffic is obtained, HTTP traffic data is filtered out from the network traffic, and the HTTP traffic data is the network traffic that needs to be analyzed in the present invention.

[0082] For example, the network traffic data obtained from the device is parsed according to fields to obtain the field value of each field in the network traffic data. Different types of network traffic data have different numbers of fields and field types after parsing. For example, if the network traffic data is an http request, the fields after parsing include host (domain name), uri_path (uniform resource identifier path), uri_query (uniform resource identifier parameter), req_header (request header) and req_body (request body); if the network traffic data is an http response, the fields after parsing include rsp_status_code (response status code) status code, rsp_content_type (response type) and rsp_body (response body).

[0083] It should be noted that the analysis of network traffic data is to extract key information from the network traffic data and provide data support for API threat discovery.

[0084] Step 102: Match the field value of the at least one field with the API field value in the API rule library to obtain a first matching result.

[0085] Among them, the API field value is an API field value with API characteristics. Generally, the API field value in the API rule library can include one or more different API field values ​​of the same field, or can include multiple different fields, each field including one or more different API field values.

[0086] For example, the field value of the field in the network traffic data is matched with the API field value of the API field in the API rule library to determine whether the API field value of the API field in the API rule library includes the field value of the field in the network traffic data. If the API field value of the API field in the API rule library includes the field value of the field in the network traffic data, it means that the network traffic data includes the public API stored in the API rule library, and the first matching result is determined to be a successful match. If the API field value of the API field in the API rule library does not include the field value of the field in the network traffic data, it means that the network traffic data does not include the public API stored in the API rule library, and the first matching result is determined to be a failed match.

[0087] It should be noted that when matching multiple fields, the field values ​​of multiple fields in the network traffic data must all be matched successfully.

[0088] Step 103: When the first matching result is a matching failure, determine whether the network traffic data includes an unknown API based on the field value of the at least one field.

[0089] For example, when the first matching result is a matching failure, an unknown API is further determined based on the characteristics of the field values ​​of each field in the network traffic data to determine whether the network traffic data includes an unknown API.

[0090] The application program interface API identification method provided by the present invention determines whether the network traffic data includes an unknown API based on the field values ​​of each field in the network traffic data when the field value in the network traffic data fails to match the API field value in the API rule library, thereby realizing the identification of the unknown API in the network traffic data and achieving the purpose of preventing the unknown API from being maliciously called.

[0091] Optionally, the API rule base includes a public API rule base; the public API rule base stores a public API field value corresponding to at least one first preset field; Figure 2 FIG. 2 is a flow chart of the method for identifying the application program interface API provided by the present invention. Figure 2 As shown, step 102 can be specifically implemented by the following steps:

[0092] Step 1021: Match the field value of the target field with the public API field value corresponding to the first preset field in the public API rule library; the target field is a field in the at least one field.

[0093] Among them, the public API rule base includes public API data, and the public API data refers to data with a specific field having a specific field value. The specific field having a specific field value can represent a known API (or a public API). The specific field is represented by a first preset field, and the specific field value is represented by a public API field value. Then the public API rule base stores the public API field value corresponding to the first preset field, and the first preset field can be one or more. The API data in the public API rule base can be the current mainstream API standard configuration file, or it can be EXCEL data provided by the user. The EXCEL data includes multiple information data, and each information data includes the public API field value of each first preset field. Then the field for matching the network traffic data with the public API rule base should be the same field as the first preset field. Therefore, the target field is the same field as the first preset field.

[0094] Optionally, the first preset field of the public API rule base includes host and uri_path, and the public API rule base includes multiple data information, each of which includes the field value of host and the field value of uri_path, and the target field in the network traffic data should also be the host and uri_path fields. When the network traffic data is matched with the public API rule base, the field value of host and the field value of uri_path in the network traffic data should be matched with the field value of host and the field value of uri_path of each piece of information data in the public API rule base.

[0095] Step 1022: When it is determined that the field value of the target field matches the public API field value of the first preset field in the public API rule library, determine that the first matching result is a successful match.

[0096] For example, when it is determined that the field value of the target field in the network traffic data matches the public API field value of the first preset field in the public API rule library, it indicates that there is a field in the network traffic data that matches the public API field value in the API rule library, and the first matching result is a successful match, that is, the public API rule library is matched in the network traffic data. The successful match here means that the field value of each target field is successfully matched. For example, when the first preset field of the public API rule library includes host and uri_path, only when the field value of host and the field value of uri_path in the network traffic data are successfully matched, it indicates that the first matching result is a successful match.

[0097] The method for identifying the application programming interface (API) provided by the present invention matches the field value of the target field in the network traffic data with the public API field value corresponding to the first preset field in the public API rule library. Based on the public API rule library, it can facilitate the query of the public API, thereby realizing accurate identification of the public API.

[0098] Optionally, the API rule base further includes a custom API rule base; the custom API rule base stores a first custom API field value corresponding to at least one second preset field; Figure 3 FIG. 3 is a flow chart of the method for identifying the application program interface API provided by the present invention. Figure 3 As shown, in the execution Figure 2 After step 1021, the following steps are also included:

[0099] Step 1023: When it is determined that the field value of the target field does not match the public API field value of the first preset field in the public API rule library, match the field value of the at least one field with the first custom API field value corresponding to the second preset field in the custom API rule library.

[0100] Among them, the custom API rule base is an API field value with API characteristics determined by the user based on the rule engine. The API field value does not conform to the public API rule base, but obviously has API characteristics; the API field value is represented by the first custom API field value, and the field for matching the network traffic data with the custom API rule base is the same field as the second preset field.

[0101] For example, when the field value of the target field in the network traffic data does not match the public API field value of the first preset field in the public API rule library, it means that the network traffic data does not match the public API rule library, and the network traffic data is then matched with the custom API rule library. Specifically, the field value of the field that is the same as the second preset field in the network traffic data is matched with the first custom API field value corresponding to each second preset field stored in the custom API rule library. For example, rule 1 in the custom API rule library is uri_path: " / api / v1.0 / getUser", rsp_status_code: "200", then the second preset field includes uri_path and rsp_status_code, the first custom API field value corresponding to uri_path is / api / v1.0 / getUser, and the first custom API field value corresponding to rsp_status_code is 200. When the network traffic data is matched with the custom API rule library, the field value of uri_path and the field value of rsp_status_code in the network traffic data should be matched with the field value of the field of rule 1 in the public API rule library.

[0102] It should be noted that each public API field value of the public API rule base and each first custom API field value of the custom API rule base has a unique API_ID. The network traffic data is first matched with the public API rule base. If the public API rule base is matched, the first match result is a successful match; if the public API rule base is not matched, it is then matched with the custom API rule base. If the custom API rule base is matched, the first match result is a successful match; if the custom API rule base is not matched, the first match result is a failed match.

[0103] Step 1024: When it is determined that the field value of the at least one field matches the first custom API field value corresponding to the second preset field in the custom API rule library, determine that the first matching result is a successful match.

[0104] For example, when it is determined that the field value of the field that is the same as the second preset field in the network traffic data successfully matches the first custom API field value corresponding to the second preset field in the custom API rule library, it means that the network traffic data matches the public API rule library, and the first matching result is determined to be a successful match.

[0105] Step 1025: When it is determined that the field value of the at least one field does not match the second custom API field value corresponding to the second preset field in the custom API rule base, determine that the first matching result is a matching failure.

[0106] For example, when it is determined that the field value of the field that is the same as the second preset field in the network traffic data fails to match the first custom API field value corresponding to the second preset field in the custom API rule library, it indicates that the network traffic data does not match the public API rule library, and the first matching result is determined to be a successful match.

[0107] The application program interface API identification method provided by the present invention further identifies the network traffic data through a custom API rule library when the network traffic data fails to match the public API rule library, thereby further improving the accurate identification of known APIs, and the custom API rule library provides users with a flexible and convenient API entry function.

[0108] Optionally, Figure 4 FIG. 4 is a flow chart of the method for identifying the application program interface API provided by the present invention. Figure 4 As shown, step 103 can be specifically implemented by the following steps:

[0109] Step 1031: Match the field value of the at least one field with the traffic filtering rule library to obtain a second matching result.

[0110] For example, when the network traffic data does not match the public API rule base and the custom API rule base, the field value of the field in the network traffic data is matched with the traffic filtering rule base to obtain a second matching result.

[0111] It should be noted that the traffic filtering rule base may be a rule-based engine that provides filtering rules.

[0112] Step 1032: Determine whether the network traffic data includes the unknown API based on the second matching result.

[0113] For example, whether the network traffic data includes the unknown API is determined based on a second matching result of a field value of a field in the network traffic data and a traffic filtering rule base.

[0114] The application program interface API identification method provided by the present invention matches the network traffic data with the traffic filtering rule library when the network traffic data fails to match the public API rule library and the custom API rule library. Through the rich filtering rule engine, the complex screening function of the network traffic data is realized, and the unknown API in the network traffic data can be identified.

[0115] Optionally, the traffic filtering rule library includes a whitelist filtering rule library and a blacklist filtering rule library; the whitelist filtering rule library stores a second custom API field value corresponding to at least one second preset field; the second custom API field value is different from the first custom API field value; the blacklist filtering rule library stores other field values ​​corresponding to at least one second preset field; the other field values ​​are field values ​​other than the second custom API field value and the first custom API field value.

[0116] Among them, the whitelist filtering rule base is also determined based on the rule engine, but the difference from the custom API rule base is mainly reflected in the following two points: First, the custom API rule base is provided by the user, while the whitelist filtering rule base is determined by the product party based on experience summary; Second, the requirements for the first custom API field value in the custom API rule base are more specific, while the requirements for the second custom API field value in the whitelist filtering rule base are more general. For example, a rule data in the custom API rule base is uri_path:" / api / v1.0 / getUser", and a rule data in the whitelist filtering rule base is uri_path:" / api / | / openapi / ", the custom API rule base can only match the network traffic data whose field value of the uri_path field is / api / v1.0 / getUser, while the whitelist filtering rule base can match the network traffic data whose field value of the uri_path field includes api or openapi, that is, the whitelist filtering rule base can match the network traffic data whose field value of the uri_path field is / api / v1.0 / getUser, / api / v1.0 / addUser, / openapi / v1.0 / getUser, / openapi / v1.0 / addUser, etc. Therefore, when the first preset field and the second preset field are the same field, the second custom API field value is different from the first custom API field value.

[0117] Among them, the blacklist filtering rule library stores other field values ​​corresponding to at least one second preset field, and the other field values ​​are field values ​​other than the second custom API field value and the first custom API field value. For example, a rule data in the blacklist filtering rule library is: uri_path:"\.js|\.ejs|\.htm|\.html|\.shtml|\.jhtml|\.gif|\.ico|\.jpg|\.jpeg|\.png|\.css|\.ico|\.svg|\.woff|\.woff2|\.otf|\.ttf".

[0118] The present invention provides an application program interface (API) identification method, wherein the traffic filtering rule library includes a whitelist filtering rule library and a blacklist filtering rule library. The whitelist filtering rule library can be used to identify unknown APIs in network traffic data, thereby achieving the purpose of flexible configuration of APIs within a company or enterprise, and improving the accuracy of identifying unknown APIs.

[0119] Optionally, when the traffic filtering rule base includes a whitelist filtering rule base and a blacklist filtering rule base; the whitelist filtering rule base stores a second custom API field value corresponding to at least one second preset field; and the second custom API field value is different from the first custom API field value, step 1031 can be specifically implemented in the following manner:

[0120] The field value of the at least one field is matched respectively with the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and other field values ​​corresponding to the second preset field in the blacklist filtering rule library.

[0121] When determining that the field value of at least one field matches both the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and the other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is obtained based on the priority of the whitelist filtering rule library and the blacklist filtering rule library.

[0122] When it is determined that the field value of at least one field does not match the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is determined to match the blacklist filtering rule library.

[0123] When it is determined that the field value of the at least one field matches the second custom API field value corresponding to the second preset field in the whitelist filtering rule library, the second matching result is determined to be the whitelist filtering rule library.

[0124] When it is determined that the field value of the at least one field matches other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is determined to match the blacklist filtering rule library.

[0125] Among them, when the field value of at least one field matches the second custom API field value corresponding to the second preset field in the whitelist filtering rule library, the field value of at least one field here should be the field value corresponding to the field in the network traffic data that is the same as the second preset field in the whitelist filtering rule library.

[0126] Furthermore, when the field value of at least one field matches other field values ​​corresponding to the second preset field in the blacklist filtering rule library, at least one field feature here should be the field value corresponding to the field in the network traffic data that is the same as the second preset field in the blacklist filtering rule library.

[0127] It should be noted that when the field value of a field in the network traffic data does not match the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and the other field values ​​corresponding to the second preset field in the blacklist filtering rule library, it indicates that the field value in the network traffic data does not belong to the custom API field value or other custom field values, and it is considered that the network traffic data matches the blacklist filtering rule library, that is, the second matching result is a match with the blacklist filtering rule library.

[0128] It should be noted that the network traffic data of the matching whitelist filtering rule base is the filtered traffic, and the network traffic data of the matching blacklist filtering rule base is the non-filtered traffic.

[0129] Optionally, obtaining the second matching result based on the priorities of the whitelist filtering rule library and the blacklist filtering rule library in step 1031 specifically includes:

[0130] When the priority of the whitelist filtering rule library is the same as the priority of the blacklist filtering rule library, determining that the second matching result is a match with the blacklist filtering rule library;

[0131] When the priority of the whitelist filtering rule library is greater than the priority of the blacklist filtering rule library, determining that the second matching result is a match to the whitelist filtering rule library;

[0132] When the priority of the whitelist filtering rule library is lower than the priority of the blacklist filtering rule library, it is determined that the second matching result matches the blacklist filtering rule library.

[0133] For example, the priorities of the whitelist filtering rule base and the blacklist filtering rule base are preset. When the network traffic data matches the whitelist filtering rule base and the blacklist filtering rule base at the same time, there are the following three matching situations:

[0134] Matching situation 1: If the whitelist filtering rule base and the blacklist filtering rule base are at the same priority, it is considered that the blacklist filtering rule base is matched.

[0135] Matching situation 2: If the priority of the whitelist filtering rule base is greater than the priority of the blacklist filtering rule base, it is considered that the whitelist filtering rule base is matched.

[0136] Matching situation three: If the priority of the blacklist filtering rule base is greater than the priority of the whitelist filtering rule base, it is considered that the blacklist filtering rule base is matched.

[0137] Optionally, step 1032 may be implemented by the following steps:

[0138] When the second matching result is a match to a whitelist filtering rule library, determining that the network traffic data includes the unknown API;

[0139] When the second matching result is a match to a blacklist filtering rule library, it is determined that the network traffic data does not include an unknown API.

[0140] For example, when the second matching result is matching the whitelist filtering rule library, it indicates that the network traffic data match includes an API field value that matches the whitelist filtering rule library, and the API field value represents the API, then the network traffic data includes an unknown API; when the second matching result is matching the blacklist filtering rule library, it indicates that the network traffic data match includes a field value that matches the blacklist filtering rule library, and the field value is a field value that obviously does not have API characteristics, such as .js|\.ejs|\.htm|\.html|\.shtml|\.jhtml|\.gif|\.ico|\.jpg|\.jpeg|\.png|\.css|\.ico|\.svg|\.woff|\.woff2|\.otf|\.ttf.

[0141] Optionally, before executing step 1032, the method further includes the following steps:

[0142] A field value corresponding to a uniform resource identifier path field (uri_path field) in the network traffic data is obtained; the field value corresponding to the uniform resource identifier path field includes a path parameter.

[0143] In step 1032, determining that the network traffic data includes the unknown API may be specifically implemented in the following manner:

[0144] When it is determined that the path parameter satisfies any one of the following, it is determined that the network traffic data includes the unknown API:

[0145] The path parameter includes only numeric information, the path parameter includes numeric information and letter information, and the path parameter complies with a Universally Unique Identifier (UUID) format.

[0146] The specific rules for determining the path parameters include:

[0147] Rule 1: Path parameters only include numeric information, such as / a / b / 1, / a / b / 2..... / a / b / 10, where the numbers 1, 2, and 10 are path parameters.

[0148] Rule 2: The path parameter includes digital information and letter information, and the number of digital information is greater than or equal to a first preset value, and the total length is greater than or equal to a second preset value. For example, the first preset value is 3 and the second preset value is 8.

[0149] Rule 3: The path parameter conforms to the Universally Unique Identifier (UUID) format.

[0150] For example, the field value corresponding to the uniform resource identifier path field (uri_path field) in the network traffic data is obtained. When the path parameter of the uniform resource identifier path field in the network traffic data satisfies any of the above-mentioned rule aggregation rules, that is, the path parameter of the uniform resource identifier path field in the network traffic data is digital information, digital information and letter information, or the universal unique identifier UUID format, it indicates that the network traffic data includes an unknown API, and the field value of the unknown API is the field value corresponding to the uniform resource identifier path field.

[0151] The method for identifying the application program interface (API) provided by the present invention can realize the identification of unknown APIs in network traffic data through the rule aggregation law of path parameters, prevent the malicious calling of unknown APIs within the company or enterprise, and improve security.

[0152] Optionally, determining in step 1032 that the network traffic data includes the unknown API may be implemented in the following manner:

[0153] Counting the path parameters corresponding to each of the network traffic data;

[0154] When it is determined that the number of occurrences of the same type of path parameter is greater than a preset number, it is determined that the network traffic data includes the unknown API.

[0155] It should be noted that the algorithm aggregation is a big data analysis process through various APIs. It is found that in the API, if a resource in the API is a parameter, the parameter is dispersed. When the number of times the parameter appears is greater than the preset number, the parameter can be aggregated. The preset number here can be 300 or other empirical values.

[0156] For example, the path parameters corresponding to each network flow data are counted. When it is determined that the number of occurrences of the same type of path parameters is greater than the preset number, the network flow data corresponding to the path parameter can be aggregated, indicating that the network flow data of the path parameter includes an unknown API, and the field value of the unknown API is the field value corresponding to the uniform resource identifier path field. Assuming there are 500 network flow data, if the path parameters in 300 network flow data are all of the same type, it means that the 300 network flows all contain unknown APIs.

[0157] The application program interface API recognition method provided by the present invention realizes the recognition of unknown APIs in network traffic data based on algorithm aggregation of path parameters, prevents unknown APIs within companies from being maliciously called, and improves security.

[0158] Optionally, Figure 5 FIG. 5 is a flowchart of a method for identifying an application program interface API provided by the present invention. Figure 5 As shown, in the execution Figure 1 After step 103 in the method, the following steps are also included:

[0159] Step 104: When it is determined that the network traffic data does not include an unknown API, mark the network traffic data as invalid.

[0160] For example, when it is determined that the network traffic data does not include an unknown API, it indicates that the network traffic data is invalid data. Therefore, the network traffic data is marked as invalid, and the traffic can be input into the HTTP access log assembly module.

[0161] The method for identifying the application program interface API provided by the present invention marks the network flow data determined not to include the API as invalid, thereby facilitating the management of the network flow data not including the API.

[0162] Optionally, Figure 6 FIG. 6 is a flow chart of the identification method of the application program interface API provided by the present invention. Figure 6 As shown, in the execution Figure 1 After step 103 in the method, the following steps are also included:

[0163] Step 105: When it is determined that the network traffic data includes the unknown API, identification information corresponding to the unknown API is generated and stored.

[0164] For example, when it is determined based on rule aggregation law or algorithm aggregation that the network traffic data includes an unknown API, an API_ID is generated, the API_ID represents identification information corresponding to the unknown API, and the identification information corresponding to the unknown API is stored in the shared memory.

[0165] The method for identifying the application program interface (API) provided by the present invention generates identification information corresponding to the unknown API when determining that the network traffic data includes an unknown API, and achieves the purpose of marking the API by labeling the identified API, thereby facilitating the accurate identification of the network traffic data containing the unknown API.

[0166] Optionally, Figure 7 FIG. 7 is a flow chart of the identification method of the application program interface API provided by the present invention. Figure 7 As shown, after step 105, the following steps are also included:

[0167] Step 106: Determine the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data; store the application type corresponding to the API, the behavior type corresponding to the API, and the identification information of the API in correspondence.

[0168] The application type may be an office automation software application or a database application, etc.; the behavior type may be a file upload, a file download, an identity authentication, etc.

[0169] For example, determine the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data, add a corresponding application tag according to the application type of each network traffic data, and add a corresponding behavior tag according to the behavior type, and store the application type corresponding to the API, the behavior type corresponding to the API, and the identification information of the API accordingly.

[0170] It should be noted that when the network traffic data does not identify the behavior tag corresponding to the API, there is no need to add the behavior tag and store the information.

[0171] The application program interface API identification method provided by the present invention obtains the application type, behavior type and identification information of network traffic data, can accurately identify the applications and behavior modes in the network traffic data, and realizes the management of the application type and behavior type of the API in the network traffic data.

[0172] Optionally, the public API rule base further stores an application type and a behavior type corresponding to each public API field value; the custom API rule base further stores an application type and a behavior type corresponding to each first custom API field value; and the determination of the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data in step 106 is implemented in the following manner:

[0173] When it is determined that the field value of the at least one field matches the public API field value of the first preset field in the public API rule base, searching the public API rule base for an application type and a behavior type corresponding to the API in the network traffic data;

[0174] When it is determined that the field value of the at least one field matches the first custom API field value corresponding to the second preset field in the custom API rule base, the application type and behavior type corresponding to the API in the network traffic data are searched in the custom API rule base.

[0175] For example, when the network traffic data is matched with a public API rule base or a custom API rule base, the application type and behavior type corresponding to the API in the network traffic data can be found.

[0176] Optionally, step 102 is specifically implemented in the following manner:

[0177] Determining a target application type corresponding to the network traffic data;

[0178] The field value of the at least one field is matched with the API field value in the API rule library corresponding to the target application type to obtain a first matching result.

[0179] For example, before matching the network traffic data with the API rule library, the target application type corresponding to the network traffic data is identified. When matching, the field value of the network traffic data only needs to be matched with the API field value in the API rule library corresponding to the identified target application type to obtain a first matching result.

[0180] The application program interface API recognition method provided by the present invention first identifies the target application type corresponding to the network traffic data. When matching with the API rule library, it only needs to match with the API field value in the API rule library corresponding to the target application type, which can reduce the matching operation amount and further improve the API recognition efficiency.

[0181] Further, in the case of determining the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data; and storing the application type corresponding to the API, the behavior type corresponding to the API, and the identification information of the API in correspondence, the method further includes:

[0182] Each network traffic data is labeled with a corresponding label according to its characteristics, and then sent to the HTTP access log assembly module.

[0183] The HTTP access log assembly module sets the API_ID and label for each piece of network traffic data and sends it to the log module.

[0184] The log module sets the SN detection system device number for each piece of network traffic data, sends it to the log processing module of the central platform for processing, and enters it into the database of the central platform; at the same time, it is entered into the database of the local detection system; where SN represents the product sequence.

[0185] At the same time, the data in the shared memory is monitored regularly, and if a newly generated API is found, it will be entered into the database of the local detection system.

[0186] The method for identifying the application program interface (API) provided by the present invention can be combined with the central platform by setting labels for network traffic data and sending the data to the central platform through a log module, thereby improving the ability to identify APIs and discover unknown APIs.

[0187] Figure 8 Schematic diagram of the structure of the recognition device of the application program interface API provided by the present invention, such as Figure 8 As shown, the recognition device of the application program interface API includes a parsing unit 801, a matching unit 802 and a determining unit 803; wherein:

[0188] The parsing unit 801 parses the network flow data to obtain a field value of at least one field in the network flow data;

[0189] A matching unit 802 matches the field value of the at least one field with the API field value in the API rule library to obtain a first matching result;

[0190] The determining unit 803 determines whether the network traffic data includes an unknown API based on the field value of the at least one field when the first matching result is a matching failure.

[0191] The application program interface API identification device provided by the present invention determines whether the network traffic data includes an unknown API based on the field values ​​of each field in the network traffic data when the field value in the network traffic data fails to match the API field value in the API rule library, thereby realizing the identification of the unknown API in the network traffic data.

[0192] Based on any of the above embodiments, the API rule base includes a public API rule base; the public API rule base stores a public API field value corresponding to at least one first preset field; the matching unit 802 is used to:

[0193] Matching a field value of a target field with a public API field value corresponding to a first preset field in the public API rule base; the target field is a field in the at least one field;

[0194] When it is determined that the field value of the target field matches the public API field value of the first preset field in the public API rule library, the first matching result is determined to be a successful match.

[0195] Based on any of the above embodiments, the API rule base further includes a custom API rule base; the custom API rule base stores a first custom API field value corresponding to at least one second preset field; the matching unit 802 is further used to:

[0196] When it is determined that the field value of the target field does not match the public API field value of the first preset field in the public API rule base, matching the field value of the at least one field with the first custom API field value corresponding to the second preset field in the custom API rule base;

[0197] When it is determined that the field value of the at least one field matches the first custom API field value corresponding to the second preset field in the custom API rule base, determining that the first matching result is a successful match;

[0198] When it is determined that the field value of the at least one field does not match the second custom API field value corresponding to the second preset field in the custom API rule base, the first matching result is determined to be a matching failure.

[0199] Based on any of the foregoing embodiments, the determining unit 803 is used to:

[0200] Matching the field value of the at least one field with the traffic filtering rule base to obtain a second matching result;

[0201] It is determined whether the network traffic data includes the unknown API based on the second matching result.

[0202] Based on any of the above embodiments, the traffic filtering rule base includes a whitelist filtering rule base and a blacklist filtering rule base;

[0203] The whitelist filtering rule library stores a second custom API field value corresponding to at least one second preset field; the second custom API field value is different from the first custom API field value;

[0204] The blacklist filtering rule library stores other field values ​​corresponding to at least one second preset field; the other field values ​​are field values ​​other than the second custom API field value and the first custom API field value.

[0205] Based on any of the foregoing embodiments, the determining unit 803 is further configured to:

[0206] Matching the field value of the at least one field with the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and other field values ​​corresponding to the second preset field in the blacklist filtering rule library;

[0207] When it is determined that the field value of the at least one field matches both the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and the other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is obtained based on the priority of the whitelist filtering rule library and the blacklist filtering rule library;

[0208] When it is determined that the field value of the at least one field does not match the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and other field values ​​corresponding to the second preset field in the blacklist filtering rule library, determining that the second matching result is a match to the blacklist filtering rule library;

[0209] When it is determined that the field value of the at least one field matches the second custom API field value corresponding to the second preset field in the whitelist filtering rule library, determining that the second matching result is the whitelist filtering rule library;

[0210] When it is determined that the field value of the at least one field matches other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is determined to match the blacklist filtering rule library.

[0211] Based on any of the foregoing embodiments, the determining unit 803 is further configured to:

[0212] When the priority of the whitelist filtering rule library is the same as the priority of the blacklist filtering rule library, determining that the second matching result is a match with the blacklist filtering rule library;

[0213] When the priority of the whitelist filtering rule library is greater than the priority of the blacklist filtering rule library, determining that the second matching result is a match to the whitelist filtering rule library;

[0214] When the priority of the whitelist filtering rule library is lower than the priority of the blacklist filtering rule library, it is determined that the second matching result matches the blacklist filtering rule library.

[0215] Based on any of the foregoing embodiments, the determining unit 803 is further configured to:

[0216] When the second matching result is a match to a whitelist filtering rule library, determining that the network traffic data includes the unknown API;

[0217] When the second matching result is a match to a blacklist filtering rule library, it is determined that the network traffic data does not include an unknown API.

[0218] Based on any of the foregoing embodiments, the determining unit 803 is further configured to:

[0219] Acquire a field value corresponding to a uniform resource identifier path field in the network traffic data; the field value corresponding to the uniform resource identifier path field includes a path parameter;

[0220] The determining that the network traffic data includes the unknown API comprises:

[0221] When it is determined that the path parameter satisfies any one of the following, it is determined that the network traffic data includes the unknown API:

[0222] The path parameter includes only numeric information, the path parameter includes numeric information and letter information, and the path parameter complies with a universal unique identifier (UUID) format.

[0223] Based on any of the foregoing embodiments, the determining unit 803 is further configured to:

[0224] Counting the path parameters corresponding to each of the network traffic data;

[0225] When it is determined that the number of occurrences of the same type of path parameter is greater than a preset number, it is determined that the network traffic data includes the unknown API.

[0226] Based on any of the above embodiments, the application program interface API recognition device further includes a marking unit;

[0227] The marking unit is used to mark the network traffic data as invalid when it is determined that the network traffic data does not include an unknown API.

[0228] Based on any of the above embodiments, the application program interface API recognition device further includes a generation and storage unit;

[0229] The storage unit is used to generate and store identification information corresponding to the unknown API when it is determined that the network traffic data includes the unknown API.

[0230] Based on any of the above embodiments, the application program interface API identification device further includes a storage unit;

[0231] The storage unit is used to determine the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data;

[0232] The application type corresponding to the API, the behavior type corresponding to the API, and the identification information of the API are stored correspondingly.

[0233] Based on any of the above embodiments, the public API rule base further stores the application type and behavior type corresponding to each public API field value; the custom API rule base further stores the application type and behavior type corresponding to each first custom API field value; the storage unit is also used to:

[0234] When it is determined that the field value of the at least one field matches the public API field value of the first preset field in the public API rule base, searching the public API rule base for an application type and a behavior type corresponding to the API in the network traffic data;

[0235] When it is determined that the field value of the at least one field matches the first custom API field value corresponding to the second preset field in the custom API rule base, the application type and behavior type corresponding to the API in the network traffic data are searched in the custom API rule base.

[0236] Based on any of the foregoing embodiments, the matching unit 802 is further configured to:

[0237] Determining a target application type corresponding to the network traffic data;

[0238] The field value of the at least one field is matched with the API field value in the API rule library corresponding to the target application type to obtain a first matching result.

[0239] Fig. 9 An example of a physical structure diagram of an electronic device is shown in FIG. Fig. 9 As shown, the electronic device may include: a processor 910, a communication interface 920, a memory 930 and a communication bus 940, wherein the processor 910, the communication interface 920 and the memory 930 communicate with each other through the communication bus 940. The processor 910 may call the logic instructions in the memory 930 to execute the identification method of the application program interface API, the method comprising: parsing the network traffic data to obtain the field value of at least one field in the network traffic data;

[0240] Matching the field value of the at least one field with the API field value in the API rule library to obtain a first matching result;

[0241] When the first matching result is a matching failure, it is determined whether the network traffic data includes an unknown API based on the field value of the at least one field.

[0242] In addition, the logic instructions in the above-mentioned memory 930 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0243] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the application program interface API identification method provided by the above methods, the method includes: parsing network traffic data to obtain a field value of at least one field in the network traffic data;

[0244] Matching the field value of the at least one field with the API field value in the API rule library to obtain a first matching result;

[0245] When the first matching result is a matching failure, it is determined whether the network traffic data includes an unknown API based on the field value of the at least one field.

[0246] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, the computer program being implemented when executed by a processor to perform the identification method of the application program interface API provided by the above methods, the method comprising: parsing network traffic data to obtain a field value of at least one field in the network traffic data;

[0247] Matching the field value of the at least one field with the API field value in the API rule library to obtain a first matching result;

[0248] When the first matching result is a matching failure, it is determined whether the network traffic data includes an unknown API based on the field value of the at least one field.

[0249] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0250] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0251] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying an application program interface (API), characterized in that: include: Parsing the network traffic data to obtain a field value of at least one field in the network traffic data; Matching the field value of the at least one field with the API field value in the API rule library to obtain a first matching result; When the first matching result is a matching failure, determining whether the network traffic data includes an unknown API based on the field value of the at least one field; Before determining that the network traffic data includes the unknown API, the method further includes: obtaining a field value corresponding to a uniform resource identifier path field in the network traffic data; the field value corresponding to the uniform resource identifier path field includes a path parameter; The determining that the network traffic data includes the unknown API includes: determining that the network traffic data includes the unknown API when it is determined that the path parameter satisfies any one of the following: the path parameter includes only numeric information, the path parameter includes numeric information and letter information, and the path parameter conforms to a universal unique identifier UUID format; The determining that the network traffic data includes the unknown API includes: counting the path parameters corresponding to each of the network traffic data; when it is determined that the number of occurrences of the same type of path parameters is greater than a preset number, determining that the network traffic data includes the unknown API.

2. The method for identifying an application program interface API according to claim 1, characterized in that: The API rule base includes a public API rule base; the public API rule base stores a public API field value corresponding to at least one first preset field; The step of matching the field value of the at least one field with the API field value in the API rule base to obtain a first matching result includes: Matching the field value of the target field with the public API field value corresponding to the first preset field in the public API rule base; The target field is a field in the at least one field; When it is determined that the field value of the target field matches the public API field value of the first preset field in the public API rule library, the first matching result is determined to be a successful match.

3. The method for identifying an application program interface API according to claim 2, characterized in that: The API rule base also includes a custom API rule base; the custom API rule base stores a first custom API field value corresponding to at least one second preset field; the method also includes: When it is determined that the field value of the target field does not match the public API field value of the first preset field in the public API rule base, matching the field value of the at least one field with the first custom API field value corresponding to the second preset field in the custom API rule base; When it is determined that the field value of the at least one field matches the first custom API field value corresponding to the second preset field in the custom API rule base, determining that the first matching result is a successful match; When it is determined that the field value of the at least one field does not match the second custom API field value corresponding to the second preset field in the custom API rule base, the first matching result is determined to be a matching failure.

4. The method for identifying an application program interface API according to claim 3, characterized in that: The determining, based on the field value of the at least one field, whether the network traffic data includes an unknown API comprises: Matching the field value of the at least one field with the traffic filtering rule base to obtain a second matching result; It is determined whether the network traffic data includes the unknown API based on the second matching result.

5. The method for identifying an application program interface API according to claim 4, characterized in that: The traffic filtering rule base includes a whitelist filtering rule base and a blacklist filtering rule base; The whitelist filtering rule library stores a second custom API field value corresponding to at least one second preset field; the second custom API field value is different from the first custom API field value; The blacklist filtering rule library stores other field values ​​corresponding to at least one second preset field; The other field values ​​are field values ​​other than the second custom API field value and the first custom API field value.

6. The method for identifying an application program interface API according to claim 5, characterized in that: The step of matching the field value of the at least one field with a traffic filtering rule base to obtain a second matching result includes: Matching the field value of the at least one field with the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and other field values ​​corresponding to the second preset field in the blacklist filtering rule library; When it is determined that the field value of the at least one field matches both the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and the other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is obtained based on the priority of the whitelist filtering rule library and the blacklist filtering rule library; When it is determined that the field value of the at least one field does not match the second custom API field value corresponding to the second preset field in the whitelist filtering rule library and other field values ​​corresponding to the second preset field in the blacklist filtering rule library, determining that the second matching result is a match to the blacklist filtering rule library; When it is determined that the field value of the at least one field matches the second custom API field value corresponding to the second preset field in the whitelist filtering rule library, determining that the second matching result is the whitelist filtering rule library; When it is determined that the field value of the at least one field matches other field values ​​corresponding to the second preset field in the blacklist filtering rule library, the second matching result is determined to match the blacklist filtering rule library.

7. The method for identifying an application program interface (API) according to claim 6, characterized in that: The obtaining the second matching result based on the priority of the whitelist filtering rule library and the blacklist filtering rule library includes: When the priority of the whitelist filtering rule library is the same as the priority of the blacklist filtering rule library, determining that the second matching result is a match with the blacklist filtering rule library; When the priority of the whitelist filtering rule library is greater than the priority of the blacklist filtering rule library, determining that the second matching result is a match to the whitelist filtering rule library; When the priority of the whitelist filtering rule library is lower than the priority of the blacklist filtering rule library, it is determined that the second matching result matches the blacklist filtering rule library.

8. The method for identifying an application program interface (API) according to claim 6, characterized in that: The determining, based on the second matching result, whether the network traffic data includes the unknown API comprises: When the second matching result is a match to a whitelist filtering rule library, determining that the network traffic data includes the unknown API; When the second matching result is a match to a blacklist filtering rule library, it is determined that the network traffic data does not include an unknown API.

9. The method for identifying an application program interface API according to claim 8, characterized in that: The method further comprises: When it is determined that the network traffic data does not include an unknown API, the network traffic data is marked invalid.

10. The method for identifying an application program interface API according to any one of claims 1 to 9, characterized in that: The method further comprises: When it is determined that the network traffic data includes the unknown API, identification information corresponding to the unknown API is generated and stored.

11. The method for identifying an application program interface (API) according to claim 4, characterized in that: The method further comprises: Determine the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data; The application type corresponding to the API, the behavior type corresponding to the API, and the identification information of the API are stored correspondingly.

12. The method for identifying an application program interface (API) according to claim 11, characterized in that: The public API rule library also stores the application type and behavior type corresponding to each public API field value; The custom API rule library also stores the application type and behavior type corresponding to each first custom API field value; The determining the application type corresponding to the API and the behavior type corresponding to the API in the network traffic data includes: When it is determined that the field value of the at least one field matches the public API field value of the first preset field in the public API rule base, searching the public API rule base for an application type and a behavior type corresponding to the API in the network traffic data; When it is determined that the field value of the at least one field matches the first custom API field value corresponding to the second preset field in the custom API rule base, the application type and behavior type corresponding to the API in the network traffic data are searched in the custom API rule base.

13. The method for identifying an application program interface (API) according to any one of claims 1 to 9, characterized in that: The step of matching the field value of the at least one field with the API field value in the API rule base to obtain a first matching result includes: Determining a target application type corresponding to the network traffic data; The field value of the at least one field is matched with the API field value in the API rule library corresponding to the target application type to obtain a first matching result.

14. An application program interface (API) recognition device, characterized in that: include: A parsing unit, which parses the network flow data to obtain a field value of at least one field in the network flow data; A matching unit, matching the field value of the at least one field with the API field value in the API rule base to obtain a first matching result; a determining unit, which determines, when the first matching result is a matching failure, whether the network traffic data includes an unknown API based on a field value of the at least one field; The determining unit is further configured to: Acquire a field value corresponding to a uniform resource identifier path field in the network traffic data; the field value corresponding to the uniform resource identifier path field includes a path parameter; When it is determined that the path parameter satisfies any one of the following, it is determined that the network traffic data includes the unknown API: the path parameter includes only numeric information, the path parameter includes numeric information and letter information, and the path parameter conforms to a universal unique identifier UUID format; Counting the path parameters corresponding to each of the network traffic data; when it is determined that the number of occurrences of the same type of path parameters is greater than a preset number, determining that the network traffic data includes the unknown API.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for identifying the application program interface API according to any one of claims 1 to 13 is implemented.

16. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying the application program interface API according to any one of claims 1 to 13 is implemented.

Images