API safety monitoring model training method, monitoring method, device and equipment

Abstract

The present invention discloses an API security monitoring model training method, monitoring method, device and equipment, which belongs to the field of computer network space security technology, wherein the API security monitoring model training method includes: inputting training data into the API security monitoring neural network model to be trained, the training data is data related to API calls; the training data includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data; obtaining the first prediction result output by the API security monitoring neural network model to be trained based on the input training data; based on the first prediction result and the label corresponding to the training data, iteratively updating the parameters of the API security monitoring neural network model to be trained. The technical solution provided by the present invention can improve the accuracy of API call security monitoring in complex scenarios.

Description

Technical Field

[0001] The present invention relates to the field of computer network space security technology, and in particular to an API security monitoring model training method, monitoring method, device and equipment. Background Art

[0002] With the development of the Internet and cloud computing, a large number of third-party network applications and network services have emerged. As a channel for data calls between network services and applications, the Application Programming Interface (API) plays an extremely important role in modern application development. Although API makes applications more scalable and compatible, because the network environment is extremely complex and the data involved in API calls often contains sensitive data that is closely related to the interests of the enterprise, API has become an important target of attack by network hackers. Current monitoring methods cannot provide real-time warnings of security risks faced by APIs.

[0003] The traditional API security monitoring method is to collect normal call data of the interface, build a call baseline model based on a large amount of normal call data, and monitor abnormal calls through threshold comparison. However, since the APIs contained in an application may involve multiple types of terminals, different types of microservices, and different types of roles and users, a single call baseline model is difficult to universally and effectively monitor the security risks faced by the API. Therefore, the accuracy of this API security monitoring method is low. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides an API security monitoring model training method, monitoring method, device and equipment to solve the problem of low accuracy of traditional API security risk monitoring methods.

[0005] In a first aspect, an embodiment of the present invention provides an API security monitoring model training method, the method comprising:

[0006] Inputting training data into the API security monitoring neural network model to be trained, wherein the training data is data related to API calls; the training data includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data;

[0007] Obtaining a first prediction result output by the API security monitoring neural network model to be trained based on the input training data;

[0008] Based on the first prediction result and the label corresponding to the training data, the parameters of the API security monitoring neural network model to be trained are iteratively updated to obtain the trained API security monitoring neural network model.

[0009] Optionally, the basic attribute characteristic data records information of the terminal that calls the API and connection information when the call is initiated;

[0010] The calling behavior characteristic data describes the behavior characteristics when the terminal calls the API;

[0011] The parameter statistical characteristic data is data obtained by performing precise quantitative analysis on the data information during the API call process;

[0012] The parameter text feature data is data obtained by analyzing the text parameters when the API is called and the text content returned by the server.

[0013] Optionally, the basic attribute characteristic data includes characteristic data of at least one of the following basic attributes: IP address of the API calling terminal, original page address of the API calling terminal request, user agent of the program representing user behavior during API calling, media access control address of the API calling terminal, data stored on the user's local terminal when the terminal is connected to the API server during continuous API calling; and / or,

[0014] The calling behavior characteristic data includes at least one of the following: average calling interval, average calling duration; and / or,

[0015] The parameter statistical characteristic data includes at least one of the following: the size of data returned by the server in a single API call, the number of data types returned by the server in a single API call, the amount of data uploaded by the terminal per second in a single API call, and the amount of data downloaded by the terminal per second in a single API call; and / or,

[0016] The parameter text feature data includes at least one of the following: the similarity between the parameters of an API call and the parameters of the previous call, the length of the parameter text of a single API call, the amount of sensitive information in the text content returned by the server in a single API call, and the word frequency-inverse text frequency index of the parameters in a single API call.

[0017] Optionally, before inputting the training data into the API security monitoring neural network model to be trained, the method further includes:

[0018] Get the original training data;

[0019] Perform at least one of the following operations on the numerical data in the original training data, and use the obtained data as the training data: merge collected data, delete duplicate data, supplement missing values, discard abnormal or erroneous values, and convert to batch format.

[0020] Optionally, before inputting the training data into the API security monitoring neural network model to be trained, the method further includes:

[0021] Get the original training data;

[0022] Perform at least one of the following operations on the text data in the original training data, and use the obtained data as the training data:

[0023] Merge collected data, delete duplicate data, fill text with preset characters if the number of characters is less than the preset value, truncate text if the number of characters is greater than the preset value, use word embedding technology to vectorize the text, and convert it into batch format.

[0024] Optionally, before inputting the training data into the API security monitoring neural network model to be trained, the method further includes:

[0025] Construct the API security monitoring neural network model to be trained, wherein the API security monitoring neural network model is a CNN-LSTM model; the architecture of the CNN-LSTM model includes: an input layer, a convolutional layer, a maximum pooling layer, a long short-term memory layer and an output layer; wherein,

[0026] The convolution layer is used to improve the correlation between different feature data through local perception and / or weight parameter sharing;

[0027] The long short-term memory layer is used to express the temporal information and semantic information in the feature data. The long short-term memory layer includes a forget gate, an input gate, a candidate gate and an output gate.

[0028] In a second aspect, an embodiment of the present invention further provides an API security monitoring method, the method comprising:

[0029] Inputting the data to be detected into the API security monitoring neural network model, the data to be detected is data related to API calls; the data to be detected includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data;

[0030] Obtain a second prediction result output by the API security monitoring neural network model based on the input data to be detected;

[0031] Based on the second prediction result, determine whether the API call corresponding to the data to be detected is an abnormal call.

[0032] In a third aspect, an embodiment of the present invention further provides an API security monitoring model training device, including:

[0033] A first input module is used to input training data into the API security monitoring neural network model to be trained, wherein the training data is data related to API calls; the training data includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data;

[0034] A first acquisition module is used to obtain a first prediction result output by the API security monitoring neural network model to be trained based on the input training data;

[0035] A parameter adjustment module is used to iteratively update the parameters of the API security monitoring neural network model to be trained based on the first prediction result and the label corresponding to the training data to obtain the trained API security monitoring neural network model.

[0036] In a fourth aspect, an embodiment of the present invention further provides an API security monitoring device, including:

[0037] The second input module is used to input the data to be detected into the API security monitoring neural network model, wherein the data to be detected is data related to API calls; the data to be detected includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data;

[0038] A second acquisition module is used to obtain a second prediction result output by the API security monitoring neural network model based on the input data to be detected;

[0039] A determination module is used to determine whether the API call corresponding to the data to be detected is an abnormal call based on the second prediction result.

[0040] In a fifth aspect, an embodiment of the present invention further provides an electronic device, including:

[0041] A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory is used to store a computer program, and when the computer program is executed by the processor, any one of the API security monitoring model training methods described in the first aspect above or the API security monitoring method described in the second aspect above is implemented.

[0042] In the sixth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed by a processor, it implements any one of the API security monitoring model training methods described in the first aspect or implements the API security monitoring method described in the second aspect.

[0043] In the embodiment of the present invention, the data input into the API security monitoring neural network model for learning or prediction includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data when the API is called. These feature data can provide a more comprehensive and comprehensive description of the API call situation in complex environments and multi-business scenarios. In addition, the API security monitoring neural network model based on deep learning can effectively learn and characterize the API call features implicitly expressed in these feature data, with higher accuracy and lower false alarm rate than traditional methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The features and advantages of the present invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the present invention in any way. In the accompanying drawings:

[0045] Figure 1 A flowchart of an API security monitoring model training method provided by an embodiment of the present invention;

[0046] Figure 2 is a schematic diagram of a feature data processing process in an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of a process for acquiring feature data input into an API security monitoring neural network model and a model architecture in an embodiment of the present invention;

[0048] Figure 4 A schematic diagram of a process flow of an API security monitoring method provided by an embodiment of the present invention;

[0049] Figure 5 A schematic diagram of the structure of an API security monitoring model training device provided by an embodiment of the present invention;

[0050] Figure 6 A schematic diagram of the structure of an API safety monitoring device provided in an embodiment of the present invention;

[0051] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0053] It should be noted that the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the statement "comprising one ..." do not exclude the presence of other identical elements in the process, method, commodity or device comprising the elements. In addition, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. In the description of the following embodiments, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0054] See also Figure 1 , an embodiment of the present invention provides an API security monitoring model training method, the method comprising:

[0055] S101: inputting training data into the API security monitoring neural network model to be trained, wherein the training data is data related to API calls; the training data includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data;

[0056] S102: Obtain a first prediction result output by the API security monitoring neural network model to be trained based on the input training data;

[0057] S103: Based on the first prediction result and the label corresponding to the training data, the parameters of the API security monitoring neural network model to be trained are iteratively updated to obtain the trained API security monitoring neural network model. Among them, the label corresponding to the training data is a judgment result obtained by comprehensively judging the training data in combination with expert knowledge and system conditions. The judgment result includes whether it is an abnormal call or not. Specifically, the feature data involved in each call is judged whether it is the feature data of an abnormal call or the feature data of an abnormal call. In this step, the parameters in the API security monitoring neural network model can be iteratively calculated and optimized using a gradient descent algorithm (such as the Adam (Adaptive Moment Estimation) algorithm) in a supervised manner. For the detailed process, please refer to the relevant technology.

[0058] In the embodiment of the present invention, by studying the characteristics of abnormal API calls, combining the characteristics of normal API calls in complex scenarios, and integrating the knowledge involved in API calls in the context of cloud services and microservice architectures, a multi-dimensional API security monitoring indicator system (also called a security feature indicator system) suitable for complex environments and multi-business scenarios is pre-constructed. The API security monitoring indicator system includes four major categories of features: basic attribute features, call behavior features, parameter statistical features, and parameter text features. Then, training data is obtained based on the API security monitoring indicator system.

[0059] In the embodiment of the present invention, the data input into the API security monitoring neural network model for learning includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data during API calls. These feature data can provide a more comprehensive and comprehensive description of API calls in complex environments and multi-business scenarios. In addition, the API security monitoring neural network model based on deep learning can effectively learn and characterize the API call features implicitly expressed in these feature data, with higher accuracy and lower false alarm rate than traditional methods.

[0060] In some specific implementations, the basic attribute characteristic data records information of the terminal that calls the API and connection information when the call is initiated;

[0061] The calling behavior characteristic data describes the behavior characteristics when the terminal calls the API;

[0062] The parameter statistical characteristic data is data obtained by performing accurate quantitative analysis on data information (especially key data information) during the API call process;

[0063] The parameter text feature data is data obtained by analyzing the text parameters when the API is called and the text content returned by the server.

[0064] In the embodiment of the present invention, the normal calling behavior of the terminal can be effectively modeled and analyzed by using the calling behavior characteristic data.

[0065] In some specific implementations, the basic attribute characteristic data includes characteristic data of at least one of the following basic attributes: the IP address of the API calling terminal, the original page address (Referer) from which the API calling terminal request was initiated, the user agent (User-Agent) of the program representing the user behavior during the API call, the Media Access Control Address (MAC) of the API calling terminal, and the data (Cookie) stored on the user's local terminal when the terminal is connected to the API server during the continuous API call process; and / or,

[0066] The calling behavior characteristic data includes at least one of the following: average calling interval, average calling duration; and / or,

[0067] The parameter statistical characteristic data includes at least one of the following: the size of data returned by the server in a single API call (hereinafter referred to as the returned data size), the number of data types returned by the server in a single API call (hereinafter referred to as the number of returned data types), the amount of data uploaded by the terminal per second in a single API call (hereinafter referred to as the uploaded data size per second), and the amount of data downloaded by the terminal per second in a single API call (hereinafter referred to as the downloaded data size per second); and / or,

[0068] The parameter text feature data includes at least one of the following: the degree of similarity between the parameters in one API call and the parameters in the last call (hereinafter referred to as: the degree of similarity with the parameters in the last call), the length of the parameter text of a single API call (hereinafter referred to as: the length of the parameter text), the amount of sensitive information in the text content returned by the server in a single API call (hereinafter referred to as: the amount of sensitive information in the returned text), the term frequency-inverse document frequency (tf-idf) index of the parameters in a single API call (hereinafter referred to as: the tf-idf of the call parameters).

[0069] Specifically, the IP address is an important identifier used to mark the network status of the terminal device initiating the API call. When the network environment of the terminal device remains unchanged, its IP address will not change. This feature data can be obtained by the server reading the request header of the network data packet sent by the terminal when the terminal initiates the API call request. Referer records the original jump page of the terminal when calling the API. This feature data can be obtained by the server reading the request header of the network data packet sent by the terminal when the terminal initiates the API call request. User-Agent records the characteristics of the program representing the user behavior when the API call request is initiated, such as the browser type, operating system, software developer and software version number. This feature data can be obtained by the server reading the request header of the network data packet sent by the terminal when the terminal initiates the API call request. MAC is a unique network identifier for each device in the network. It is written inside the hardware when the network equipment manufacturer produces it and cannot be changed under normal circumstances. This feature data can be obtained by the server reading the link layer data of the network data packet sent by the terminal when the terminal initiates the API call request. Cookie refers to data stored on the user's local terminal in order to identify the user. During the continuous API call process, the use of Cookies can reduce the time required for verification. The characteristic data can be obtained by the server reading the request header of the network data packet sent by the terminal when the terminal initiates an API call request.

[0070] The average call interval is the average interval between adjacent calls when a single terminal makes multiple API calls within a time period: the average call interval of a legitimate terminal that normally handles business to an API is regular, including the difference in call intervals during different time periods within a day, or the upper and lower bounds of the call interval. The characteristic data is calculated as follows: when the server receives an API call request from the terminal, it extracts the timestamp when the call is initiated from the network data packet sent by the terminal and caches it locally on the server. Subsequently, according to the granularity of modeling, characteristic statistics can be performed at time lengths such as minutes, hours, and days.

[0071] The average call duration is the time consumed when the API call is initiated, including the handshake and identity authentication between the client and the server, until the server returns the result: the normal call process will first go through the handshake and identity authentication between the client and the server, and the time consumed in these stages is not much different when the network is in good condition. Malicious terminals may have malicious behaviors such as second dialing IP or denial of service (DoS) attacks, resulting in premature interruption of the call and a significant reduction or increase in the call duration. The calculation method of this feature data is as follows: when the server receives the API call request from the terminal, it is defined as the first data packet sent to establish the connection and the last data packet to end the connection, and then the timestamps are obtained from the two data packets respectively, and cached in the form of a two-tuple {start time, end time}. Later, according to the granularity of modeling, feature statistics can be performed at the time length of minutes, hours, days, etc.

[0072] Return data size: The size of data returned by a legitimate API call is relatively fixed. If the data returned by the API at a certain moment is much higher or lower than the normal range, there is a possibility that the terminal implements attacks such as Structured Query Language (SQL) injection. When calling the API, the terminal constructs illegal parameters to obtain data in batches in a single call, or even modify the data. The calculation method of this feature data is: the server records the length information of all data packets involved in an API call process in units of connection streams, and performs summation or average calculation.

[0073] Number of returned data types: The functions that an API can implement are relatively small, and multiple types of data are often divided into different APIs for acquisition. If the data class returned by a call to an API includes multiple types, it may indicate malicious data acquisition behavior. The calculation method of this feature data is: when the server responds to the terminal's call request, the returned content is first cached locally, and then the various components of the content are obtained through text segmentation, and then the data type of each content is detected separately, and finally the number of data types is counted.

[0074] Upload or download data size per second: The upload data size per second reflects the relationship between the frequency of the terminal initiating a connection when initiating an API call and the size of the data uploaded in a single connection, and the download data size reflects the server's response to the terminal's request. The calculation method of this feature data is as follows: the server records the length information of all data packets in the outbound and inbound directions involved in an API call process in units of connection flow, and records the timestamp information of each data packet, and then uses the size information and time information of the data packet to calculate the feature.

[0075] Similarity with the parameters of the last call: The distribution of text parameters when a legitimate terminal calls an API should be sufficiently uniform and random. When the API parameters are illegally tampered with, the malicious terminal will make similar guesses based on a known legitimate parameter. For example, after obtaining the legitimate parameter 001, the malicious terminal may guess parameters 002, 003, etc. in turn to try to obtain more internal data. The calculation method of this feature data is as follows: the server caches the parameters in each call request received from the terminal, and performs character segmentation on the recorded parameters, and then calculates the similarity of multiple call parameters through cosine similarity.

[0076] Parameter text length: The legal parameter length of an API should be relatively fixed. For example, when using a fixed-length employee number to query information, a malicious terminal can pass carefully constructed input to the API to obtain additional information or unauthorized information. The length of such carefully constructed text parameters is not fixed. The characteristic data is calculated as follows: the server caches the parameters in each call request received from the terminal, performs character segmentation on the recorded parameters, and then counts the character length of the parameters.

[0077] The number of sensitive information in the returned text: Sensitive information is data that needs to be monitored. When a large amount of sensitive information appears in the text content returned during an API call, it may indicate that the current API is being maliciously exploited. The calculation method of this feature data is as follows: When the server responds to the terminal's call request, the returned content is first cached locally, and the pre-trained natural language processing model is used to detect whether the returned content contains sensitive information, such as ID number, mobile phone number, email address, etc. Then the number of sensitive information involved is counted.

[0078] tf-idf of call parameters: tf-idf is a common weighting technique used in information retrieval and text mining. It is used to evaluate the importance of a word to one of the documents in a corpus. The importance of a word increases in direct proportion to the number of times it appears in the document, but at the same time it decreases in inverse proportion to the frequency of its appearance in the corpus. By analyzing the tf-idf of text parameters, the abnormal part of the current call parameters relative to all legal parameters can be identified, and then the malicious parameters constructed by the terminal can be identified. The calculation method of this feature data is as follows: the server first caches all request parameters from the terminal for a certain API interface for a certain period of time to build a corpus. Then when a new call occurs, the server separates and caches the parameter part of the API call, and then calculates the tf-idf of the current parameter relative to the complete corpus based on the pre-built corpus.

[0079] In the embodiment of the present invention, the feature data actually input to the API security monitoring neural network model is the fine-grained feature data described above. The API security monitoring neural network model realizes the mapping of these fine-grained feature data from the feature space as input to the category probability space as output, and finally realizes the detection of abnormal API scheduling.

[0080] In some specific implementations, before inputting the training data into the API security monitoring neural network model to be trained, the method further includes:

[0081] Get the original training data;

[0082] Perform at least one of the following operations on the numerical data in the original training data, and use the obtained data as the training data: merge collected data, delete duplicate data, supplement missing values, discard abnormal or erroneous values, and convert to batch format.

[0083] In some specific implementations, before inputting the training data into the API security monitoring neural network model to be trained, the method further includes:

[0084] Get the original training data;

[0085] Perform at least one of the following operations on the text data in the original training data, and use the obtained data as the training data:

[0086] Merge the collected data, delete duplicate data, fill the text with preset characters if the number of characters is less than the preset value, truncate the text if the number of characters is greater than the preset value, use word embedding technology to vectorize the text, and convert it into batch format.

[0087] Specifically, the process of obtaining the original training data can be: when an API call occurs, the network data packets related to the current API call are captured and stored in the form of a session stream. According to the pre-constructed API security monitoring indicator system, the feature data of the API call process is collected from the network data packets (including calculation, statistics, extraction and other collection methods), that is, the feature data of the types in the pre-constructed API security monitoring indicator system are mainly collected, and the feature data of the feature data types that do not belong to the API security monitoring indicator system may not be collected.

[0088] Then, the collected feature data can be cleaned and transformed based on data mining technology. Figure 2 Specifically, the cleaning and conversion process includes at least one of the following:

[0089] 1. Merge and collect data. Since the feature data collection process is to collect feature data for a single API call (including calculation, statistics, extraction and other collection methods), the feature data is scattered. The purpose of merging and collecting data is to centrally store the scattered feature data so that the feature data can be processed uniformly later. This processing process does not distinguish between numerical feature data and text feature data. All feature data collected according to the API security monitoring indicator system are merged together.

[0090] 2. Delete duplicate data. Duplicate feature data increases the amount of computation for subsequent models, but is of little help to the model's learning. This operation will count all samples with exactly the same feature data and retain only one such sample. This processing does not distinguish between numerical feature data and text feature data. For any feature data collected according to the API security monitoring indicator system that contains duplicate API call feature data, only one will be retained. Among them, one sample is all the feature data related to an API call. Because unexpected factors such as the network may lead to duplicate storage of feature data related to an API call, there may be samples with all the feature data exactly the same.

[0091] 3. Supplement missing values. When a small amount of feature data of a sample is missing, using the average value to supplement the missing feature data can make the current sample usable without causing too much deviation to the model learning. When the missing feature data items account for less than 30%, supplement the feature data in the sample; when it is greater than 30%, discard the sample. This processing is for numerical feature data, and text feature data does not need to be processed.

[0092] 4. Discard abnormal or erroneous values. The abnormal values ​​here are different from the abnormal values ​​that need to be found in the detection. The values ​​that need to be discarded here are those caused by system errors and from which valid information cannot be obtained, such as values ​​that lose original information due to encoding errors. This processing process is for numerical feature data, and text feature data does not need to be processed.

[0093] 5. For texts with less than a preset number of characters, fill them with preset characters. In other words, fill short texts with preset characters (which can be special characters) to make all texts of the same length. This processing is for text-based feature data, and this processing is not required for numerical feature data.

[0094] 6. Truncate the text with more characters than the preset value. In other words, truncate the overlong text to make all the texts have the same length. This processing is for text feature data, and this processing is not necessary for numerical feature data.

[0095] 7. Use word embedding technology to vectorize text. Since the subsequent deep learning model cannot directly use discrete text information, it is necessary to use word embedding technology to process discrete text into continuous values ​​for the identification of sensitive information and to extract relevant features.

[0096] 8. Convert to batch format (or batch processing features): The input data of the subsequent API security monitoring neural network model (specifically, it can be a deep learning model) is in batch format, and the model needs to continuously adjust its own parameters through a large amount of batch data input. Here, it is necessary to pre-segment the existing feature data according to the batch format to obtain batch data to facilitate the use of subsequent models. This processing process does not distinguish between numerical feature data and text feature data. All feature data collected according to the API security monitoring indicator system will perform this processing operation.

[0097] In the embodiment of the present invention, the above processing can make the format of the training data input to the API security monitoring neural network model to be trained more suitable.

[0098] Finally, the processed feature data can be comprehensively judged based on expert knowledge and system conditions to determine whether it is an abnormal call, and the result of the judgment can be saved as a label together with the processed feature data in the storage unit. In other words, after the acquired raw feature data is cleaned and converted, the processed feature data can be labeled and stored in the storage unit for subsequent use as training data.

[0099] The embodiment of the present invention utilizes both the numerical feature data and the text feature data of the API call to predict abnormal API calls. Compared with using a single type of feature data to predict abnormal API calls, it can provide a more comprehensive perspective for analyzing the security risks faced by the API.

[0100] In some specific implementations, before inputting the training data into the API security monitoring neural network model to be trained, the method further includes:

[0101] Construct the API security monitoring neural network model to be trained, the API security monitoring neural network model is a CNN-LSTM model; please refer to Figure 3 The architecture of the CNN-LSTM model includes: an input layer (including multiple input units), a convolution layer (including multiple convolution units), a maximum pooling layer (including a maximum pooling unit), a long short-term memory layer (including multiple long short-term memory units) and an output layer; wherein,

[0102] The convolution layer is used to improve the correlation between different feature data through local perception and / or weight parameter sharing;

[0103] The long short-term memory layer is used to express the temporal information and semantic information in the feature data. The long short-term memory layer includes a forget gate, an input gate, a candidate gate and an output gate.

[0104] Among them, the combined function of the forget gate, input gate, candidate gate and output gate is to control the memory and forgetting degree of the feature data at the previous moment and the feature data at the current moment, thereby improving the classification performance of the model (in the embodiment of the present invention, the classification of whether the API call is abnormal).

[0105] Specifically, the input layer may be composed of n (a positive integer) neural units, where n is the number of feature data items.

[0106] The convolution layer can be composed of three different sizes of convolution kernels, whose window sizes can be 3, 4, and 5 respectively, and each convolution kernel can have 128. The function of the convolution layer is feature extraction. The feature data is generated through the convolution kernel to generate a feature map. The convolution kernel has the advantages of weight sharing and translation invariance. It only focuses on local features, and the degree of locality depends on the size of the convolution kernel. The convolution kernel setting here cannot be too large or too small. If the convolution kernel is too large, it will not be conducive to increasing the depth of the model, and the computing performance will also be reduced. If the convolution kernel is too small, the smaller the receptive field, the effective local features may not be extracted.

[0107] The size of the maximum pooling window used by the maximum pooling layer can be (2, 2). The maximum pooling layer can effectively reduce the amount of computation of the model while reducing the overfitting degree of the model and allowing the model to learn the relative position information of different features in space.

[0108] The long short-term memory layer is bidirectionally superimposed in structure, so that the model can simultaneously learn the previous information and the following information relative to a certain sample. The long short-term memory layer enables the model to learn the relationship between multiple calls in continuous API calls and capture the relationship between feature data in time sequence. The long short-term memory layer without bidirectional superposition contains states at multiple moments, which are serially connected from front to back, so that when processing sequence or vector features (assuming they are all called features), the subsequent features can take into account the influence of the features that appear before them when calculating, then relatively, the features that appear in front cannot take into account the influence of the features that appear later. The specific method of bidirectional superposition is: 1. First, there is an ordinary long short-term memory layer that is serially connected from front to back. 2. Then construct a long short-term memory layer that is serially connected from back to front. 3. When data is input, it is first calculated by the long short-term memory layer from front to back, and then the output result is input again into the long short-term memory layer from back to front. Therefore, the learning of the information of the previous context (from front to back) and the following context (from back to front) can be realized.

[0109] The output layer can be a fully connected layer connected to the softmax mapping function, that is, the API security monitoring neural network model provided in the embodiment of the present invention uses the softmax function to perform mapping conversion and outputs the final prediction result (that is, the first prediction result or the second prediction result).

[0110] In addition, the CNN-LSTM model can use the Relu function as an activation function.

[0111] In order to better prevent the overfitting of the model, the CNN-LSTM model adds the Dropout algorithm, which will stop the activation value of a neuron with a certain probability p, so that the model can be more generalized. Specifically, the Dropout algorithm can be added between the long short-term memory layer and the fully connected layer of the output layer.

[0112] See also Figure 4 , an embodiment of the present invention provides an API security monitoring method, the method comprising:

[0113] S401: Inputting the data to be detected into the API security monitoring neural network model, wherein the data to be detected is data related to API calls; the data to be detected includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data;

[0114] S402: Obtain a second prediction result output by the API security monitoring neural network model based on the input data to be detected;

[0115] S403: Determine whether the API call corresponding to the data to be detected is an abnormal call based on the second prediction result.

[0116] Among them, the API security monitoring neural network model is an API security monitoring neural network model trained by any of the above API security monitoring model training method embodiments. The data to be detected is also feature data collected based on the API security monitoring indicator system. Its specific content and acquisition method can also refer to the above API security monitoring model training method embodiment, which will not be repeated here.

[0117] For example, when a new API call occurs, the training data can be obtained in accordance with the method of obtaining training data in the embodiment of the API security monitoring model training method (there is no need to merge collected data, delete duplicate data, convert to batch format, etc., and missing values ​​can be supplemented, obviously abnormal or erroneous values ​​can be discarded, text with fewer characters than a preset value can be filled with preset characters, text with more characters than a preset value can be truncated, and text can be vectorized using Word embedding technology, etc.), to obtain the relevant feature data belonging to the API security monitoring indicator system in this API call as the data to be detected. If it is determined based on the second prediction result that the API call corresponding to the data to be detected is an abnormal call, it means that the API is being used maliciously and faces security risks. An early warning should be issued and the call behavior should be recorded; if it is determined to be a normal call, only the call behavior is recorded.

[0118] The embodiment of the present invention provides an API security monitoring method based on deep learning. The data input into the API security monitoring neural network model for prediction includes basic attribute feature data, call behavior feature data, parameter statistical feature data, and parameter text feature data during API calls. These feature data can provide a more comprehensive and high-coverage description of API calls in complex environments and multi-business scenarios. In addition, the API security monitoring neural network model based on deep learning can effectively learn and characterize the API call features implicitly expressed in these feature data, with higher accuracy and lower false alarm rate than traditional methods.

[0119] In summary, in the embodiment of the present invention, by studying the characteristics of abnormal API calls, combining the characteristics of normal API calls in complex scenarios, and integrating the knowledge involved in API calls in the context of cloud services and microservice architectures, a multi-dimensional API security monitoring indicator system suitable for complex environments and multi-business scenarios is pre-constructed. On this basis, further combining data mining and deep learning technology, a neural network model is constructed to learn the characteristic data of each data type in the multi-dimensional API security monitoring indicator system, and the implicit characteristics of normal and abnormal API calls, so as to achieve accurate characterization of API call behavior in complex scenarios, thereby effectively identifying API security risks.

[0120] Accordingly, please refer to Figure 5 The embodiment of the present invention provides an API security monitoring model training device, the device comprising:

[0121] The first input module 501 is used to input training data into the API security monitoring neural network model to be trained, wherein the training data is data related to API calls; the training data includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data;

[0122] A first acquisition module 502 is used to obtain a first prediction result output by the API safety monitoring neural network model to be trained based on the input training data;

[0123] The parameter adjustment module 503 is used to iteratively update the parameters of the API security monitoring neural network model to be trained based on the first prediction result and the label corresponding to the training data to obtain the trained API security monitoring neural network model.

[0124] In the embodiment of the present invention, the data input into the API security monitoring neural network model for learning includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data during API calls. These feature data can provide a more comprehensive and comprehensive description of API calls in complex environments and multi-business scenarios. In addition, the API security monitoring neural network model based on deep learning can effectively learn and characterize the API call features implicitly expressed in these feature data, with higher accuracy and lower false alarm rate than traditional methods.

[0125] In some specific implementations, the basic attribute characteristic data records information of the terminal that calls the API and connection information when the call is initiated;

[0126] The calling behavior characteristic data describes the behavior characteristics when the terminal calls the API;

[0127] The parameter statistical characteristic data is data obtained by performing precise quantitative analysis on the data information during the API call process;

[0128] The parameter text feature data is data obtained by analyzing the text parameters when the API is called and the text content returned by the server.

[0129] In some specific implementations, the basic attribute characteristic data includes characteristic data of at least one of the following basic attributes: IP address of the API calling terminal, original page address of the API calling terminal request, user agent of the program representing user behavior during API calling, media access control address of the API calling terminal, data stored on the user's local terminal when the terminal is connected to the API server during continuous API calling; and / or,

[0130] The calling behavior characteristic data includes at least one of the following: average calling interval, average calling duration; and / or,

[0131] The parameter statistical characteristic data includes at least one of the following: the size of data returned by the server in a single API call, the number of data types returned by the server in a single API call, the amount of data uploaded by the terminal per second in a single API call, and the amount of data downloaded by the terminal per second in a single API call; and / or,

[0132] The parameter text feature data includes at least one of the following: the similarity between the parameters of an API call and the parameters of the previous call, the length of the parameter text of a single API call, the amount of sensitive information in the text content returned by the server in a single API call, and the word frequency-inverse text frequency index of the parameters in a single API call.

[0133] In some specific implementations, the API security monitoring model training device further includes:

[0134] A first original training data acquisition module, used to acquire original training data;

[0135] The first data processing module is used to perform at least one of the following operations on the numerical data in the original training data and use the obtained data as the training data: merging collected data, deleting duplicate data, supplementing missing values, discarding abnormal or erroneous values, and converting to batch format.

[0136] In some specific implementations, the API security monitoring model training device further includes:

[0137] A second original training data acquisition module, used to acquire original training data;

[0138] The second data processing module is used to perform at least one of the following operations on the text data in the original training data, and use the obtained data as the training data:

[0139] Merge collected data, delete duplicate data, fill text with preset characters if the number of characters is less than the preset value, truncate text if the number of characters is greater than the preset value, use word embedding technology to vectorize the text, and convert it into batch format.

[0140] In some specific implementations, the API security monitoring model training device further includes:

[0141] A model building module is used to build the API security monitoring neural network model to be trained, wherein the API security monitoring neural network model is a CNN-LSTM model; the architecture of the CNN-LSTM model includes: an input layer, a convolutional layer, a maximum pooling layer, a long short-term memory layer and an output layer; wherein,

[0142] The convolution layer is used to improve the correlation between different feature data through local perception and / or weight parameter sharing;

[0143] The long short-term memory layer is used to express the temporal information and semantic information in the feature data. The long short-term memory layer includes a forget gate, an input gate, a candidate gate and an output gate.

[0144] The embodiment of the present invention is an apparatus embodiment based on the same inventive concept as the above-mentioned API security monitoring model training method embodiment. Therefore, for specific technical details and corresponding technical effects, please refer to the above-mentioned method embodiment, which will not be repeated here.

[0145] Accordingly, please refer to Figure 6 , an embodiment of the present invention provides an API safety monitoring device, the device comprising:

[0146] The second input module 601 is used to input the data to be detected into the API security monitoring neural network model, wherein the data to be detected is data related to API calls; the data to be detected includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data;

[0147] A second acquisition module 602 is used to obtain a second prediction result output by the API security monitoring neural network model based on the input data to be detected;

[0148] The determination module 603 is used to determine whether the API call corresponding to the data to be detected is an abnormal call based on the second prediction result.

[0149] In the embodiment of the present invention, the data input into the API security monitoring neural network model for prediction includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data during API calls. These feature data can provide a more comprehensive and comprehensive description of API calls in complex environments and multi-business scenarios. In addition, the API security monitoring neural network model based on deep learning can effectively learn and characterize the API call features implicitly expressed in these feature data, with higher accuracy and lower false alarm rate than traditional methods.

[0150] The embodiment of the present invention is an apparatus embodiment based on the same inventive concept as the above-mentioned API security monitoring method embodiment. Therefore, for specific technical details and corresponding technical effects, please refer to the above-mentioned method embodiment, which will not be repeated here.

[0151] The embodiment of the present invention further provides an electronic device, such as Figure 7 As shown, the electronic device may include a processor 71 and a memory 72, wherein the processor 71 and the memory 72 may be connected to each other through a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0152] The processor 71 may be a central processing unit (CPU). The processor 71 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0153] The memory 72 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the API security monitoring model training method in the embodiment of the present invention (for example, Figure 5 The first input module 501, the first acquisition module 502 and the parameter adjustment module 503 shown in the figure, and the program instructions / modules corresponding to the API security monitoring method in the embodiment of the present invention (for example, Figure 6 The processor 71 executes various functional applications and data processing of the processor by running the non-transient software programs, instructions and modules stored in the memory 72, that is, the API security monitoring model training method or API security monitoring method in the above method embodiment is implemented.

[0154] The memory 72 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created by the processor 71, etc. In addition, the memory 72 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 72 may optionally include a memory remotely arranged relative to the processor 71, and these remote memories may be connected to the processor 71 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0155] The one or more modules are stored in the memory 72, and when executed by the processor 71, the above method embodiments are executed.

[0156] For details of the above electronic equipment, please refer to Figures 1 to 4 The corresponding related descriptions and effects in the illustrated embodiments can be understood and will not be repeated here.

[0157] Correspondingly, an embodiment of the present invention also provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed by a processor, it implements the various processes of the above-mentioned API security monitoring model training method embodiment, or implements the various processes of the above-mentioned API security monitoring method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0158] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and computer-readable storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0159] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for training an API security monitoring model, characterized in that: The method comprises: Input the training data into the API security monitoring neural network model to be trained, wherein the training data is data related to API calls; the training data includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data; the basic attribute feature data records the information of the terminal that calls the API and the connection information when the call is initiated; the call behavior feature data describes the behavioral characteristics of the terminal when calling the API; the parameter statistical feature data is data obtained by quantitatively analyzing the data information during the API call process; the parameter text feature data is data obtained by analyzing the text parameters when the API is called and the text content returned by the server; Obtaining a first prediction result output by the API security monitoring neural network model to be trained based on the input training data; Based on the first prediction result and the label corresponding to the training data, the parameters of the API security monitoring neural network model to be trained are iteratively updated to obtain the trained API security monitoring neural network model.

2. The method according to claim 1, characterized in that The basic attribute characteristic data includes characteristic data of at least one of the following basic attributes: IP address of the API calling terminal, original page address of the API calling terminal request, user agent of the program representing user behavior during API calling, media access control address of the API calling terminal, data stored on the user's local terminal when the terminal is connected to the API server during the continuous API calling process; and / or, The calling behavior characteristic data includes at least one of the following: average calling interval, average calling duration; and / or, The parameter statistical characteristic data includes at least one of the following: the size of data returned by the server in a single API call, the number of data types returned by the server in a single API call, the amount of data uploaded by the terminal per second in a single API call, and the amount of data downloaded by the terminal per second in a single API call; and / or, The parameter text feature data includes at least one of the following: the similarity between the parameters of an API call and the parameters of the previous call, the length of the parameter text of a single API call, the amount of sensitive information in the text content returned by the server in a single API call, and the word frequency-inverse text frequency index of the parameters in a single API call.

3. The method according to claim 1, characterized in that: Before inputting the training data into the API security monitoring neural network model to be trained, the method further includes: Get the original training data; Perform at least one of the following operations on the numerical data in the original training data, and use the obtained data as the training data: merge collected data, delete duplicate data, supplement missing values, discard abnormal or erroneous values, and convert to batch format.

4. The method according to claim 1, characterized in that Before inputting the training data into the API security monitoring neural network model to be trained, the method further includes: Get the original training data; Perform at least one of the following operations on the text data in the original training data, and use the obtained data as the training data: Merge collected data, delete duplicate data, fill text with preset characters if the number of characters is less than the preset value, truncate text if the number of characters is greater than the preset value, use word embedding technology to vectorize the text, and convert it into batch format.

5. The method according to claim 1, characterized in that Before inputting the training data into the API security monitoring neural network model to be trained, the method further includes: Construct the API security monitoring neural network model to be trained, wherein the API security monitoring neural network model is a CNN-LSTM model; the architecture of the CNN-LSTM model includes: an input layer, a convolutional layer, a maximum pooling layer, a long short-term memory layer and an output layer; wherein, The convolution layer is used to improve the correlation between different feature data through local perception and / or weight parameter sharing; The long short-term memory layer is used to express the temporal information and semantic information in the feature data. The long short-term memory layer includes a forget gate, an input gate, a candidate gate and an output gate.

6. A method for API security monitoring, characterized in that: The method comprises: The data to be detected is input into the API security monitoring neural network model, wherein the data to be detected is data related to API calls; the data to be detected includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data; the basic attribute feature data records the information of the terminal that calls the API and the connection information when the call is initiated; the call behavior feature data describes the behavioral characteristics of the terminal when calling the API; the parameter statistical feature data is data obtained by quantitatively analyzing the data information during the API call process; the parameter text feature data is data obtained by analyzing the text parameters when the API is called and the text content returned by the server; Obtain a second prediction result output by the API security monitoring neural network model based on the input data to be detected; Based on the second prediction result, determine whether the API call corresponding to the data to be detected is an abnormal call.

7. An API safety monitoring model training device, characterized in that: include: The first input module is used to input training data into the API security monitoring neural network model to be trained, wherein the training data is data related to API calls; the training data includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data; the basic attribute feature data records the information of the terminal that calls the API and the connection information when the call is initiated; the call behavior feature data describes the behavioral characteristics of the terminal when calling the API; the parameter statistical feature data is data obtained by quantitatively analyzing the data information during the API call process; the parameter text feature data is data obtained by analyzing the text parameters when the API is called and the text content returned by the server; A first acquisition module is used to obtain a first prediction result output by the API security monitoring neural network model to be trained based on the input training data; A parameter adjustment module is used to iteratively update the parameters of the API security monitoring neural network model to be trained based on the first prediction result and the label corresponding to the training data to obtain the trained API security monitoring neural network model.

8. An API safety monitoring device, characterized in that: include: The second input module is used to input the data to be detected into the API security monitoring neural network model, wherein the data to be detected is data related to API calls; the data to be detected includes basic attribute feature data, call behavior feature data, parameter statistical feature data and parameter text feature data; the basic attribute feature data records the information of the terminal that calls the API and the connection information when the call is initiated; the call behavior feature data describes the behavioral characteristics of the terminal when calling the API; the parameter statistical feature data is data obtained by quantitatively analyzing the data information during the API call process; the parameter text feature data is data obtained by analyzing the text parameters when the API is called and the text content returned by the server; A second acquisition module is used to obtain a second prediction result output by the API security monitoring neural network model based on the input data to be detected; A determination module is used to determine whether the API call corresponding to the data to be detected is an abnormal call based on the second prediction result.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory is used to store a computer program, and when the computer program is executed by the processor, the API safety monitoring model training method described in any one of claims 1 to 5 is implemented or the API safety monitoring method described in claim 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program. When the computer program is executed by a processor, it implements the API safety monitoring model training method described in any one of claims 1 to 5 or the API safety monitoring method described in claim 6.

Images