A link tracking method and apparatus

Abstract

The application discloses a link tracking method and device, relates to the technical field of network security analysis, and mainly aims at improving the efficiency of link tracking. The main technical scheme comprises the following steps: obtaining log information corresponding to a target interface in an interface calling link, wherein the interface calling link is used for threat analysis, and the log information is used for recording calling data related to threat analysis generated when the corresponding target interface is called; and performing link tracking processing on a to-be-tracked interface in the target interface based on the calling data recorded in the obtained log information.

Description

Technical Field

[0001] This application relates to the field of network security analysis technology, and in particular to a link tracing method and apparatus. Background Technology

[0002] As cybersecurity becomes increasingly severe, threat analysis of leads has become a crucial task for security analysts. Currently, threat analysis is typically performed using API call chains. These chains involve interfaces between various services, and threat analysis is achieved through the mutual calls between these interfaces. During threat analysis, if security analysts obtain inaccurate data from the threat analysis chain, they need to perform chain tracing to pinpoint exactly where the problem occurred in the API call chain.

[0003] Traditional link tracing methods typically involve: first, security analysts need to locate the interface to be analyzed by examining the business code; then, they simulate requests to the interface and analyze the returned data for anomalies; if the analysis reveals anomalies, the interface is identified as the one causing inaccurate analysis; if the analysis shows normal results, the process is repeated upstream to trace back to the interface causing the inaccurate analysis until the anomaly is found. It is evident that this existing link tracing method requires security analysts to trace back upstream to the interface causing the inaccurate analysis, which is time-consuming, labor-intensive, and inefficient. Summary of the Invention

[0004] In view of this, this application proposes a link tracing method and apparatus, the main purpose of which is to improve the efficiency of link tracing.

[0005] To achieve the above objectives, this application mainly provides the following technical solutions:

[0006] Firstly, this application provides a link tracing method, which includes:

[0007] Obtain log information corresponding to the target interface in the interface call chain, wherein the interface call chain is used for threat analysis, and the log information is used to record call data related to threat analysis generated when the corresponding target interface is called;

[0008] Based on the call data recorded in the acquired log information, link tracing processing is performed on the interface to be traced in the target interface.

[0009] In some embodiments, before performing link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information, the method further includes: analyzing the call data recorded in the acquired log information; when it is found that there is abnormal call data in the acquired log information, determining the target interface corresponding to the log information recording the abnormal call data as the interface to be traced.

[0010] In some embodiments, the method further includes: when it is found that there is abnormal call data in the acquired log information, issuing an abnormal prompt for the interface to be traced based on the log information recording the abnormal call data.

[0011] In some embodiments, before performing link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information, the method further includes: detecting whether a keyword is received; if received, checking whether target call data corresponding to the keyword exists in the acquired log information; if found, determining the target interface corresponding to the log information recording the target call data as the interface to be traced.

[0012] In some embodiments, before performing link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information, the method further includes: detecting whether a link tracing instruction carrying an interface identifier is received; if received, determining the interface corresponding to the interface identifier as the interface to be traced.

[0013] In some embodiments, based on the call data recorded in the acquired log information, link tracing processing is performed on the interface to be traced in the target interface, including: determining a first interface based on the interface position in the interface call chain, wherein the first interface includes at least one of the following interfaces: a target interface located upstream of the interface to be traced, and a target interface located downstream of the interface to be traced; and displaying the call data recorded in the log information of the first interface and the interface to be traced based on the call relationship between the first interface and the interface to be traced.

[0014] In some embodiments, the method further includes: determining whether the interface to be traced has a logical identifier, wherein the logical identifier indicates that there is a second interface in the interface call chain, the second interface and the interface to be traced are both downstream nodes of the same interface, and the second interface and the interface to be traced are different logical branches corresponding to the same judgment logic; if so, while displaying the call data recorded in the log information of the first interface and the interface to be traced, the call data recorded in the log information of the interface to be traced and the second interface are also displayed in association.

[0015] In some embodiments, based on the call data recorded in the acquired log information, link tracing processing is performed on the interface to be traced in the target interface, including: displaying the call data recorded in the log information corresponding to the interface to be traced.

[0016] In some embodiments, before obtaining the log information corresponding to the target interface in the interface call chain, the method further includes: obtaining the instrumentation information corresponding to the target interface, wherein the instrumentation information is related to the service to which the target interface belongs and the threat analysis business type corresponding to the interface call chain; setting a corresponding instrumentation point at the target interface based on the instrumentation information, wherein the instrumentation point is used to generate corresponding log information when the target interface is called.

[0017] In some embodiments, before obtaining the tracking information corresponding to the target interface, the method further includes: determining an interface with multiple downstream interfaces in the interface call chain; and determining the determined interface and its downstream interfaces as the target interface.

[0018] In some embodiments, before obtaining the tracking information corresponding to the target interface, the method further includes: displaying the interface identifiers corresponding to the interfaces included in the interface call chain through an interactive interface; and determining the interface corresponding to the selected interface identifier as the target interface.

[0019] In some embodiments, the tracking information includes threat analysis tags of multiple dimensions, and the log information generated by the tracking includes call data corresponding to each threat analysis tag of each dimension.

[0020] In some embodiments, the method further includes: determining a target link, wherein the target link and the interface call link belong to interface call links of different threat analysis business types under the same threat analysis scenario; and forming a knowledge base for the threat analysis scenario based on the log information of the target interface and the interface call link's respective target interfaces.

[0021] In some embodiments, the method further includes: sending probe information to the interfaces constituting the interface call chain at a preset frequency; if no normal status information is received from the interface in response to the probe information, then determining that the interface that did not provide the normal status information is abnormal.

[0022] Secondly, this application provides a link tracing device, which includes:

[0023] The acquisition module is used to acquire log information corresponding to the target interface in the interface call chain, wherein the interface call chain is used for threat analysis, and the log information is used to record call data related to threat analysis generated when the corresponding target interface is called;

[0024] The processing module is used to perform link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information.

[0025] Thirdly, this application provides a computer-readable storage medium including a stored program, wherein the program, when running, controls the device where the storage medium is located to execute the link tracing method described in the first aspect.

[0026] Fourthly, this application provides an electronic device comprising: a memory for storing a program; and a processor coupled to the memory for running the program to perform the link tracing method described in the first aspect.

[0027] The link tracing method and apparatus provided in this application, when used for threat analysis of an interface call chain, acquires log information corresponding to the target interface. This log information records call data related to threat analysis generated when the target interface is called. Then, based on the call data recorded in the acquired log information, link tracing processing is performed on the interface to be traced within the target interface. As can be seen, the log information in the solution provided in this application records call data related to threat analysis generated when the target interface is called. Therefore, when there is an interface to be traced within the target interface, it is not necessary to re-simulate the interface request to obtain the interface call data for analysis, as in existing technologies. Since the call data related to the interface to be traced already exists in the acquired log information, link tracing processing can be directly performed on the interface to be traced based on the call data recorded in the acquired log information. This allows for rapid location of the interface to be traced and analysis of its call behavior. Therefore, the technical solution of this application, which directly uses log information to perform link tracing on interfaces, can improve the efficiency of link tracing.

[0028] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1A flowchart of a link tracing method provided in one embodiment of this application is shown;

[0031] Figure 2 This illustration shows a schematic diagram of the relationship between services involved in an interface call chain according to an embodiment of this application;

[0032] Figure 3 This paper shows a schematic diagram of the structure of a link tracing device according to an embodiment of the present application;

[0033] Figure 4 A schematic diagram of a link tracing device provided in another embodiment of this application is shown. Detailed Implementation

[0034] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0035] Currently, security analysts typically use API call chains for threat analysis to perform threat analysis on clues. These API call chains involve interfaces between various services, and threat analysis is achieved through the mutual calls between these interfaces. During threat analysis, if security analysts obtain inaccurate or abnormal data through the threat analysis chain, they need to perform chain tracing to accurately pinpoint where the problem occurred in the API call chain.

[0036] Traditional link tracing methods typically involve: first, security analysts need to locate the interface to be analyzed by tracing the business code; then, they simulate requests to the interface and analyze the returned data for anomalies; if the analysis shows anomalies, the interface is identified as the one causing inaccurate analysis; if the analysis shows normal results, the same method is used to trace upstream through the link, identifying the interface causing the inaccurate analysis, until the anomaly is found. It is evident that this existing link tracing method requires security analysts to trace upstream through the link one by one, which is time-consuming and labor-intensive, makes it difficult to quickly locate the anomaly in the link, and results in low efficiency.

[0037] To quickly locate abnormal interfaces in an API call chain and improve tracing efficiency, this application provides a tracing method and apparatus. The tracing method and apparatus provided in this application can obtain log information corresponding to the target interface in the API call chain. This log information records call data related to threat analysis generated when the corresponding target interface is called. When there is an interface to be traced among the target interfaces, tracing processing is performed directly on the interface to be traced based on the call data recorded in the obtained log information.

[0038] The link tracing method and apparatus provided in this application are applicable to interface call links of various threat analysis business types in various threat analysis scenarios. The link tracing method and apparatus provided in this application will be described in detail below.

[0039] like Figure 1 As shown in the figure, this application provides a link tracing method, which mainly includes the following steps:

[0040] 101. Obtain the log information corresponding to the target interface in the interface call chain. The interface call chain is used for threat analysis, and the log information is used to record the call data related to threat analysis generated when the corresponding target interface is called.

[0041] Interface call chains are used for threat analysis. They consist of interfaces involving different services, and threat analysis is achieved through the mutual calls between these interfaces. For example, an interface call chain can perform threat analysis on any IOC (Indicator of Compromise) indicator.

[0042] An anomaly at any interface in the API call chain can lead to inaccurate threat analysis. Therefore, it is necessary to perform link tracing on the interfaces in the call chain. This allows for the analysis and elimination of anomalies when they exist, ensuring the accuracy and efficiency of threat analysis. It should be noted that the anomalies referred to here include at least one of the following: inaccurate analysis data, abnormal interface stability, and business anomalies.

[0043] To quickly perform link tracing on interfaces in threat analysis, it is necessary to identify the target interface in the call chain before obtaining the log information of the target interface. The target interface is the interface for which link tracing based on log information is required. The methods for determining the target interface are described below, and include at least the following three methods:

[0044] The first approach is to identify all interfaces in the API call chain as the target interfaces.

[0045] Considering that any abnormality in any interface in the API call chain may lead to inaccurate threat analysis, all interfaces in the API call chain are identified as target interfaces.

[0046] The second approach involves identifying interfaces with multiple downstream interfaces in the API call chain, and then designating both the identified interface and its downstream interfaces as the target interface.

[0047] An API call chain typically consists of multiple APIs. Retrieving log information from all APIs in the chain would consume significant CPU and memory. Therefore, to reduce CPU and memory consumption, only a subset of the APIs in the call chain are identified as target APIs.

[0048] For an interface with multiple downstream interfaces in the API call chain, it is equivalent to having multiple asynchronous tasks downstream. Once there is an abnormal interface among its downstream interfaces, the difficulty of locating the abnormal interface will increase. Therefore, in order to reduce the difficulty of locating in this case, it is necessary to identify the interface with multiple downstream interfaces in the API call chain and identify the identified interface and its downstream interfaces as the target interface.

[0049] The third method involves displaying the interface identifiers corresponding to the interfaces included in the API call chain through an interactive interface; the interface corresponding to the selected interface identifier is then identified as the target interface.

[0050] To meet the needs of security analysts for tracing interfaces in the API call chain, the authority to determine the target interface is delegated to them. To provide security analysts with a more intuitive understanding of the interfaces included in the API call chain, an interactive interface displays the corresponding interface identifiers for selection. When an interface identifier is selected, it indicates that the security analyst has a need to trace the chain to the interface corresponding to that selected identifier; therefore, the interface corresponding to the selected identifier is designated as the target interface.

[0051] After identifying the target interface in the API call chain, the target interface can be configured in two ways to obtain its corresponding log information. The two configuration methods for the target interface are explained below:

[0052] The first method is to set up event tracking points for the target interface. These event tracking points are used to generate corresponding log information when the target interface is called.

[0053] After selecting the target interface, it is necessary to install event tracking points on it. These points will generate log information when the target interface is invoked, enabling tracing and link analysis. The log information records threat analysis-related call data generated when the target interface is called. This call data describes the call status of the target interface and serves as the basis for determining whether the target interface is abnormal. Furthermore, when the target interface is abnormal, the call data also provides security analysts with information to determine the cause of the anomaly.

[0054] The following describes the specific process of adding tracking points to the target interface, which includes steps one and two:

[0055] Step 1: Obtain the event tracking information corresponding to the target interface. The event tracking information is related to the service to which the target interface belongs and the threat analysis business type corresponding to the interface call chain.

[0056] An interface call chain consists of interfaces involving different services, each with different functionalities. Furthermore, the interfaces included in the interface call chain for different threat analysis business types also have different functionalities. Therefore, in order to collect log information from target interfaces in a targeted manner, the tracking information corresponding to each target interface needs to be related to the service to which the target interface belongs and the threat analysis business type corresponding to the interface call chain. This embodiment does not limit the services involved in the interfaces of the interface call chain or the corresponding threat analysis business types. For example, the services involved in the interfaces of the interface call chain may include at least one of the following: threat analysis business-side interface service, data fusion and enrichment service, and data layer gateway service. The data fusion and enrichment service is used to integrate multi-source data for data fusion processing, providing unified data processing and a logic layer. The data layer network management service provides unified data query services. The threat analysis business type corresponding to the interface call chain may be any one of the following: production chain, data aggregation chain, or data normalization chain. For example, if the interface call chain is a generated chain, and it is necessary to locate a user query parameter value = ciis-cn.netuser = xxx, then the calling order of the interfaces in the interface call chain is as follows: start by calling the interface belonging to the threat analysis business side interface service, then call the interface belonging to the data fusion and enrichment service, and finally call the interface belonging to the data layer gateway service.

[0057] For example, such as Figure 2 As shown, Figure 2This diagram illustrates the relationships between services involved in the interface call chain. The interfaces in this chain involve the following three services: Threat Analysis Business-Side Interface Service 21, Data Fusion and Enrichment Service 22, and Data Layer Gateway Service 23. The call relationship between the interfaces of these three services is as follows: the interface in Threat Analysis Business-Side Interface Service 21 calls the interface in Data Fusion and Enrichment Service 22, and the interface in Data Fusion and Enrichment Service 22 calls the interface in Data Layer Gateway Service 23. The threat analysis business type corresponding to this interface call chain is a production chain. The tracking information for the target interface of Data Fusion and Enrichment Service 22 in the API call chain includes the following: api_name: the name of the API requesting the data layer gateway service; remote_addr: the client IP address; user: the username; uid: the user ID; url: the complete URL of the request; headers: the request header information; timeout: the request timeout; data: the request body information; method: the request method; msg: the request error message; message: the returned message information; visit_time: the start time of API access; cost_time: the time taken to access the API; status_code: the API return status code; and IOC: the request IOC content. The tracking information for the target interface of Data Layer Gateway Service 23 in the API call chain includes the following: is_whitelist: whether it is on the whitelist; has_result: whether the API returned a result; targeted: whether it is a targeted attack; campaign: whether there is a group attack; count: the number of times the attack was performed; IOC_category: the type of IOC; and malicious: the final malicious value.

[0058] To ensure that the corresponding event tracking points generate log information containing multi-dimensional call data when the target interface is invoked, the event tracking information for the target interface includes threat analysis tags across multiple dimensions. Thus, when event tracking points are set for the target interface based on this information, the tracking points include threat analysis tags across multiple dimensions, and the log information generated by the corresponding event tracking points when the target interface is invoked includes call data corresponding to each threat analysis tag. Therefore, when performing link tracing on the target interface, the call behavior of the target interface can be analyzed using multi-dimensional call data. For example, the content included in the event tracking information for the target interface belonging to Data Fusion Enrichment Service 22 and the content included in the event tracking information for the target interface belonging to Data Layer Gateway Service 23 both consist of threat analysis tags.

[0059] Step 2: Set up corresponding event points at the target interface based on the event point information. The event points are used to generate corresponding log information when the target interface is called.

[0060] When setting corresponding event tracking points at the target interface based on event tracking information, the threat analysis tags of multiple dimensions included in the event tracking information are set at the target interface so that log information is generated based on the threat analysis tags when the event tracking point is triggered. The event tracking point is triggered when the corresponding target interface is called. The log information includes the call data corresponding to each threat analysis tag.

[0061] By embedding data points into the target interfaces in the API call chain, we are essentially coloring and marking the target interfaces. Based on the log information obtained from these coloring and marking, we can perform link tracing processes such as locating interfaces in the API call chain.

[0062] After setting up tracking points for the target interfaces in the API call chain, when the API call chain is used for link analysis, each time a target interface is called, its corresponding tracking point will generate log information. To ensure the timeliness of link analysis, once the tracking point corresponding to a target interface generates log information, the log information corresponding to the target interface is obtained.

[0063] The second method involves deploying a monitoring module, which, when the target interface is called, obtains the call data corresponding to the threat analysis tag set for the target interface, and forms log information corresponding to the target interface.

[0064] The monitoring module does not require the deployment of specific monitoring points in the interface call chain. As long as the monitoring module detects that the target interface is being called, it can obtain the call data corresponding to the threat analysis tag set for the target interface and form the log information corresponding to the target interface.

[0065] In order to enable the monitoring module to obtain log information including multi-dimensional call data when the target interface is called, the threat analysis tags set for the target interface are multi-dimensional threat analysis tags. In this way, the log information generated by the monitoring when the target interface is called includes the call data corresponding to each dimension of threat analysis tag.

[0066] After obtaining the log information of the target interface using the above method, the log information corresponding to the target interface in the same call chain will be uniformly summarized. It should be noted that, in order to distinguish the correspondence between the target interface and the log information, the log information contains the interface identifier corresponding to the target interface.

[0067] 102. Based on the call data recorded in the obtained log information, perform link tracing processing on the interfaces to be traced in the target interface.

[0068] Link tracing is performed on the interfaces to be traced within the target interface. Therefore, before performing link tracing on the interfaces to be traced within the target interface based on the call data recorded in the acquired log information, it is necessary to determine the interfaces to be traced. The methods for determining the interfaces to be traced are described below, including the following:

[0069] Method 1: Analyze the call data recorded in the obtained log information; when abnormal call data is found in the obtained log information, the target interface corresponding to the log information recording the abnormal call data is determined as the interface to be tracked.

[0070] To automatically trace abnormal API calls, after acquiring log information, the call data recorded in the logs is analyzed to determine if any abnormal call data exists. If abnormal call data is found, it indicates that the target API corresponding to the log information containing the abnormal call data experienced an error during the call process. To facilitate analysis, this target API is designated as the API to be traced. If no abnormal call data is found in the logs, it means that none of the currently called target APIs in the API call chain are experiencing errors, therefore, there is no need to designate an API to be traced.

[0071] The specific process of analyzing the call data recorded in the acquired log information can be as follows: For each call data: determine the threat analysis tag corresponding to the call data; determine whether the call data meets the data requirements corresponding to the threat analysis tag; if it meets the requirements, the call data is determined to be normal call data; if it does not meet the requirements, the call data is determined to be abnormal call data. It should be noted that this embodiment does not limit the specific content of the data requirements. For example, the data requirements can be numerical range requirements or data format requirements.

[0072] Furthermore, the link tracing method also includes the following steps: when abnormal call data is found in the obtained log information, an abnormal prompt is issued for the interface to be traced based on the log information recording the abnormal call data.

[0073] When an interface anomaly occurs, to ensure security analysts are promptly aware of the anomaly, an anomaly alert is issued for the interface to be traced based on the log information recording the abnormal call data, once the analysis reveals such data. This embodiment does not limit the specific method of the anomaly alert. The anomaly alert methods include the following two: First, displaying the call data recorded in the log information corresponding to the interface to be traced in the anomaly display area of ​​the interactive interface for analysis by security analysts; second, issuing an anomaly alert to security analysts via email or message, carrying the call data recorded in the log information corresponding to the interface to be traced for analysis by security analysts.

[0074] Method 2: Detect whether a keyword has been received; if so, check if there is target call data corresponding to the keyword in the obtained log information; if found, determine the target interface to be tracked by recording the log information of the target call data.

[0075] To enable security analysts to quickly locate the interfaces they need to query using custom search criteria, they can identify the interfaces to be tracked using keywords.

[0076] When security analysts need to perform link tracing on interfaces in an API call chain based on a specific keyword, they will input the keyword. The keyword can be at least one of the following: fields involved in threat analysis tags, fields involved in the call data.

[0077] When a keyword is detected, it indicates that security analysts need to perform link tracing on the interfaces involved in the keyword. Therefore, they check the acquired log information for target call data corresponding to the keyword. It should be noted that target call data includes two types: one where the target call data contains the keyword; and another where the threat analysis tag corresponding to the target call data contains the keyword. If target call data is found, it indicates that link tracing needs to be performed on the target interface corresponding to the log information recording the target call data. Therefore, the target interface corresponding to the log information recording the target call data is identified as the interface to be traced. If no target call data is found, it indicates that there is no interface in the interface call chain that meets the analysis needs of security analysts. Therefore, a message indicating that no target call data was found is issued.

[0078] Method 3: Detect whether a link tracing command carrying an interface identifier has been received; if so, identify the interface corresponding to the interface identifier as the interface to be traced.

[0079] To enable security analysts to flexibly select the interfaces that need to be traced based on their own needs, they can determine the interfaces to be traced by issuing a link tracing command carrying the interface identifier.

[0080] When a link tracing command carrying an interface identifier is detected, it indicates that security analysts have a need to perform link tracing on the interface corresponding to the interface identifier; therefore, the interface corresponding to the interface identifier is identified as the interface to be traced. When no link tracing command carrying an interface identifier is detected, it indicates that security analysts do not have a need to identify the interface to be traced through link tracing commands.

[0081] It should be noted that the above three methods for determining the interface to be tracked can be used in combination or individually, and this embodiment does not impose any specific limitations.

[0082] After identifying the interface to be traced, it is necessary to perform distributed tracing on the target interface based on the call data recorded in the acquired log information. The methods for performing distributed tracing on the interface to be traced include the following:

[0083] The first method involves performing link tracing on the target interface based on the call data recorded in the acquired log information. The specific process includes: determining the first interface based on the interface position in the interface call chain, wherein the first interface includes at least one of the following interfaces: the target interface located upstream of the interface to be traced, and the target interface located downstream of the interface to be traced; and displaying the call data recorded in the log information of the first interface and the interface to be traced based on the call relationship between the first interface and the interface to be traced.

[0084] For any interface in an API call chain, its own call behavior is affected by the calls of its upstream adjacent interfaces, and its own call behavior affects the calls of its downstream adjacent interfaces. Therefore, in order to analyze the interfaces in the API call chain in a contextual manner, facilitate contextual analysis, and improve the accuracy of the analysis, after determining the interface to be traced, it is necessary to determine the first interface related to the interface to be traced based on the position of each interface in the API call chain. The first interface is the interface adjacent to the interface to be traced and located upstream of the interface to be traced. Alternatively, the first interface is the interface adjacent to the interface to be traced and located downstream of the interface to be traced.

[0085] After identifying the first interface, based on the call relationship between the first interface and the interface to be traced, the call data recorded in the log information of the first interface and the interface to be traced is displayed on the interactive interface. This allows security analysts to intuitively view the call data of the interface to be traced and the first interface that has a call relationship with the interface to be traced, and to reconstruct the business logic call relationship between the interface to be traced and the first interface. This enables security analysts to perform contextual analysis on the displayed call data, making it easier for them to accurately find problems in the interface call chain during threat analysis.

[0086] It should be noted that even if the first interface is not called, this application can still restore the business logic call relationship between the interface to be traced and the first interface. It only shows the call data recorded in the log information of the interface to be traced, while the first interface that was not called can be shown as not having executed a call.

[0087] Furthermore, to more completely describe the threat analysis process, the link tracing method also includes the following steps: determining whether the interface to be traced has a logical identifier, wherein the logical identifier indicates that there is a second interface in the interface call chain, the second interface and the interface to be traced are both downstream nodes of the same interface, and the second interface and the interface to be traced are different logical branches corresponding to the same judgment logic; if so, while displaying the call data recorded in the log information of the first interface and the interface to be traced, the call data recorded in the log information of the interface to be traced and the second interface are also displayed in association.

[0088] API call chains often contain complex business logic, meaning a single API may have multiple downstream APIs, each representing a different branch of the same logic. For example, an API might have two downstream APIs: one with a "yes" logic branch and the other with a "no" logic branch.

[0089] The call data from interfaces in different logical branches may interfere with each other. Therefore, to more completely reconstruct the call logic, it is also necessary to determine whether the interface to be traced has a logical identifier to identify whether it is a logical branch of a decision-making logic. The logical identifier is used to indicate that the corresponding interface is a logical branch.

[0090] After determining that the interface to be traced has a logical identifier, it indicates that the interface to be traced is a logical branch of a judgment logic, and there is a second interface in the interface call chain. The second interface and the interface to be traced are both downstream nodes of the same interface. After identifying the second interface, in order to facilitate a complete reconstruction of the call situation of the interface to be traced, the call data recorded in the log information of the first interface and the interface to be traced are displayed together, along with the call data recorded in the log information of the interface to be traced and the second interface.

[0091] It should be noted that even if the second interface is not called, this application can still restore the business logic call relationship between the interface to be tracked and the second interface. It only shows the call data recorded in the log information of the interface to be tracked, while the second interface that was not called can be shown as not having executed a call.

[0092] The second method involves performing link tracing on the target interface based on the call data recorded in the acquired log information. This process includes displaying the call data recorded in the log information corresponding to the interface to be traced.

[0093] To quickly locate the interface to be traced and allow security analysts to clearly understand the call status of the interface to be traced, the call data recorded in the log information of the interface to be traced can be displayed in the display window.

[0094] By using the above-described method for link tracing of the interfaces to be tracked, and by displaying the call data of the interfaces in the threat analysis process, the health status of the interfaces is visualized. This makes it easier for security analysts to perform link tracing on the interfaces, thereby facilitating the analysis and investigation of call data and identifying abnormal interfaces.

[0095] The link tracing method provided in this application, when used for threat analysis of an interface call chain, obtains log information corresponding to the target interface. This log information records call data related to threat analysis generated when the target interface is called. Then, based on the call data recorded in the obtained log information, link tracing is performed on the interface to be traced within the target interface. As can be seen, in the solution provided in this application, the log information records call data related to threat analysis generated when the target interface is called. Therefore, when there is an interface to be traced within the target interface, it is not necessary to re-simulate the interface request to obtain the interface call data for analysis, as in existing technologies. Since the call data related to the interface to be traced already exists in the obtained log information, link tracing can be performed directly on the interface to be traced based on the call data recorded in the obtained log information. This allows for rapid location of the interface to be traced and analysis of its call behavior. Therefore, the technical solution of directly using log information to perform link tracing on interfaces in this application can improve the efficiency of link tracing.

[0096] In some embodiments of this application, the link tracing method further includes the following steps: determining the target link, wherein the target link and the interface call link belong to interface call links of different threat analysis business types under the same threat analysis scenario; and forming a knowledge base for the threat analysis scenario based on the log information of the target interface of the target link and the interface call link.

[0097] In a threat analysis scenario, there may be interface call chains for different threat analysis business types. These interface call chains under the same threat analysis scenario contain certain logic. Therefore, in order to better analyze the interface call chains under a threat analysis scenario, the log information corresponding to the target interfaces of each interface call chain under the same threat analysis scenario can be summarized.

[0098] In practical applications, each interface call chain, in addition to its own chain identifier, also has an identifier for its corresponding threat analysis scenario. For example, besides its own chain identifier "Data Normalization Chain," the interface call chain also has a corresponding threat analysis scenario identifier "AA Business Data Processing Scenario." Therefore, when determining the target chain, it can be based on the threat analysis scenario identifier corresponding to the chain.

[0099] Based on the log information of the target interfaces in the target call chain and the interface call chain, a knowledge base is formed for threat analysis scenarios. This knowledge base is organized by interface call chain, and displays the call data recorded in the log information of each interface based on the call relationship within the chain. Furthermore, the knowledge base sorts the interface call chains according to their execution order or importance in the scenario.

[0100] Since the knowledge base includes log information corresponding to the interfaces in each interface call chain within the same threat analysis scenario, the interface call situation in each interface call chain can be context-linked. By sorting out the predefined scenarios and production debugging definitions in different threat analysis scenarios, the faults that occur in the analysis interface can be clearly visualized, making it easier to quickly locate and resolve problems. This not only improves the efficiency of link tracing but also enhances the stability of threat analysis production operations.

[0101] In some embodiments of this application, the link tracing method further includes the following steps: sending probe information to the interfaces that make up the interface call link at a preset frequency; if no normal status information is received from the interface in response to the probe information, then determining that the interface that did not provide normal status information is abnormal.

[0102] To promptly detect anomalies in the API call chain, keep-alive monitoring of these interfaces is necessary. The specific execution logic of keep-alive monitoring is as follows: For each interface in the API call chain, probe information is sent to it at a preset frequency. If a normal status message is received from the interface in response to the probe message, it is determined that the interface can be called normally. If no normal status message is received from the interface in response to the probe message, it is determined that the interface is abnormal and at risk of being inaccessible. Therefore, an anomaly alert can be issued for this interface, allowing security analysts to troubleshoot the anomaly based on the alert.

[0103] The preset frequency and normal status information can be set based on business needs, and this embodiment does not impose specific limitations on them. For example, for an interface in the interface call chain, a probe message is sent to the interface every 5 minutes; if no status code 200 is received from the interface, it means that no normal status information for the probe message has been received from the interface; if a status code 200 is received from the interface, it means that normal status information for the probe message has been received from the interface.

[0104] In some embodiments of this application, the link tracing method provided in this embodiment can be applied to the following system, which includes: a client module, a proxy module, a collection module, a storage module, and a query module. The client module can add event tracking information to the target interface of the interface call chain via API. The proxy module is used to listen to the log information generated by the event tracking, and it can send the listened log information in batches to the collection module. The proxy module decouples the client module and the collection module, shielding the client module from the details of routing and discovering the collection module. The collection module receives the log information sent by the proxy module and transmits the log information to the storage module. The collection module can be designed as a stateless component so that any number of collection modules can run simultaneously. The storage module is used to store and process the log information passed from the collection module. The storage module can be designed as a pluggable component, supporting the writing of log information to databases such as Cassandra and Elasticsearch. The query module is used to extract log information related to the module to be traced and display it through the target interface. The query module can be designed as a stateless component so that any number of query modules can run simultaneously. Additionally, the query module may be deployed behind a load balancer such as Nginx for querying log information.

[0105] Furthermore, based on the above method embodiments, another embodiment of this application also provides a link tracing device, such as... Figure 3 As shown, the device includes:

[0106] The acquisition module 31 is used to acquire log information corresponding to the target interface in the interface call chain, wherein the interface call chain is used for threat analysis, and the log information is used to record call data related to threat analysis generated when the corresponding target interface is called;

[0107] The processing module 32 is used to perform link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information.

[0108] The link tracing device provided in this application embodiment obtains log information corresponding to the target interface when the interface call chain is used for threat analysis. This log information records call data related to threat analysis generated when the target interface is called. Then, based on the call data recorded in the obtained log information, link tracing processing is performed on the interface to be traced within the target interface. It can be seen that in the solution provided in this application embodiment, the log information is used to record call data related to threat analysis generated when the target interface is called. Therefore, when there is an interface to be traced within the target interface, it is not necessary to re-simulate the interface request to obtain the interface call data for analysis, as in existing technologies. Since the call data related to the interface to be traced already exists in the obtained log information, link tracing processing can be directly performed on the interface to be traced based on the call data recorded in the obtained log information. This allows for rapid location of the interface to be traced and analysis of its call status. Therefore, the technical solution of directly using log information to perform link tracing on the interface in this application embodiment can improve the efficiency of link tracing.

[0109] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0110] The first determining module 33 is used to analyze the call data recorded in the acquired log information before the processing module 32 performs link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information; when abnormal call data is found in the acquired log information, the target interface corresponding to the log information recording the abnormal call data is determined as the interface to be traced.

[0111] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0112] The prompt module 34 is used to issue an abnormal prompt for the interface to be traced based on the log information recording the abnormal call data when it is found that there is abnormal call data in the obtained log information.

[0113] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0114] The second determining module 35 is used to detect whether a keyword is received before the processing module 32 performs link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information; if a keyword is received, it searches whether there is target call data corresponding to the keyword in the acquired log information; if found, it determines the target interface corresponding to the log information recording the target call data as the interface to be traced.

[0115] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0116] The third determining module 36 is used to detect whether a link tracing instruction carrying an interface identifier is received before the processing module 32 performs link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information; if received, the interface corresponding to the interface identifier is determined as the interface to be traced.

[0117] Optional, such as Figure 4 As shown, the processing module 32 includes:

[0118] The first processing unit 321 is configured to determine a first interface based on the interface position in the interface call chain, wherein the first interface includes at least one of the following interfaces: a target interface located upstream of the interface to be traced and a target interface located downstream of the interface to be traced; and based on the call relationship between the first interface and the interface to be traced, to associate and display the call data recorded in the log information of the first interface and the interface to be traced.

[0119] Optional, such as Figure 4 As shown, the processing module 32 also includes:

[0120] The second processing unit 322 is used to determine whether the interface to be traced has a logical identifier, wherein the logical identifier indicates that there is a second interface in the interface call chain, the second interface and the interface to be traced are both downstream nodes of the same interface, and the second interface and the interface to be traced are different logical branches corresponding to the same judgment logic; if so, while displaying the call data recorded in the log information of the first interface and the interface to be traced, the call data recorded in the log information of the interface to be traced and the second interface are also displayed in association.

[0121] Optional, such as Figure 4 As shown, the processing module 32 includes:

[0122] Display unit 323 is used to display the call data recorded in the log information corresponding to the interface to be tracked.

[0123] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0124] The setting module 37 is used to obtain the instrumentation information corresponding to the target interface before the acquisition module 31 obtains the log information corresponding to the target interface in the interface call chain. The instrumentation information is related to the service to which the target interface belongs and the threat analysis business type corresponding to the interface call chain. Based on the instrumentation information, the corresponding instrumentation is set at the target interface. The instrumentation is used to generate corresponding log information when the target interface is called.

[0125] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0126] The fourth determining module 38 is used to determine the interface with multiple downstream interfaces in the interface call chain before the setting module 37 obtains the embedding information corresponding to the target interface; and to determine the determined interface and its downstream interfaces as the target interface.

[0127] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0128] The fifth determining module 39 is used to display the interface identifiers corresponding to the interfaces included in the interface call chain through an interactive interface before the setting module 37 obtains the embedding information corresponding to the target interface; and to determine the interface corresponding to the selected interface identifier as the target interface.

[0129] Optionally, the tracking points include threat analysis tags of multiple dimensions, and the log information generated by the tracking point information includes the call data corresponding to each threat analysis tag of each dimension.

[0130] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0131] The generation module 40 is used to determine the target link, wherein the target link and the interface call link belong to the interface call links of different threat analysis business types under the same threat analysis scenario; based on the log information of the target interface of the target link and the interface call link, a knowledge base for the threat analysis scenario is formed.

[0132] Optional, such as Figure 4 As shown, the link tracing device further includes:

[0133] The sixth determining module 41 is used to send probe information to the interfaces that make up the interface call chain at a preset frequency; if no normal status information is received from the interface in response to the probe information, it is determined that the interface that did not respond to the normal status information is abnormal.

[0134] The detailed explanation of the methods used in the operation of each functional module in the link tracing device provided in this application embodiment can be found in the corresponding method explanation of the above link tracing method embodiment, and will not be repeated here.

[0135] Furthermore, based on the above embodiments, another embodiment of this application also provides a computer-readable storage medium, the storage medium including a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the above-described link tracing method.

[0136] The beneficial effects of the computer-readable storage medium provided in this application embodiment are basically the same as those of the link tracing method described above, and will not be repeated here.

[0137] Furthermore, based on the above embodiments, another embodiment of this application also provides an electronic device, the electronic device comprising: a memory for storing a program; and a processor coupled to the memory for running the program to perform the above-described link tracing method.

[0138] The beneficial effects of the electronic device provided in this application embodiment are basically the same as those of the link tracing method described above, and will not be repeated here.

[0139] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0140] It is understood that the relevant features in the above methods and apparatus can be referenced interchangeably. Furthermore, the terms "first," "second," etc., in the above embodiments are used to distinguish between embodiments and do not represent the superiority or inferiority of any particular embodiment.

[0141] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0142] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this application is not directed to any particular programming language. It should be understood that the content of this application described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of this application.

[0143] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0144] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0145] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the link tracing method and apparatus according to the embodiments of this application. This application can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0146] It should be noted that the above embodiments are illustrative of this application and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

Claims

1. A link trace method characterized by, The method comprises: obtaining the target interface corresponding to the embedded point information, wherein the embedded point information is related to the threat analysis business type corresponding to the service and the interface call link to which the target interface belongs; based on the embedded point information, the corresponding embedded point is set at the target interface, wherein the embedded point is used to generate the corresponding log information when the target interface is called; the embedded point information comprises threat analysis labels of multiple dimensions, and the log information generated by the embedded point comprises the calling data corresponding to each dimension of the threat analysis label respectively; deploying a monitoring module, wherein the monitoring module is used to obtain the calling data corresponding to each dimension of the threat analysis label based on at least one dimension of the threat analysis label set for the target interface when the target interface is monitored, and form the log information corresponding to the target interface; the log information corresponding to the target interface in the same interface call link is summarized; obtaining the log information corresponding to the target interface in the interface call link, wherein the interface call link is used for threat analysis, and the log information is used to record the calling data related to threat analysis generated when the corresponding target interface is called; based on the calling data recorded in the obtained log information, the link tracking processing is performed on the to-be-traced interface in the target interface; based on the calling data recorded in the obtained log information, the link tracking processing is performed on the to-be-traced interface in the target interface, comprising: in the case that it is determined that the to-be-traced interface is provided with a logical identifier, the calling data recorded in the log information of the first interface and the to-be-traced interface is associated and displayed, and the calling data recorded in the log information of the to-be-traced interface and the second interface is associated and displayed; the first interface comprises at least one of the following: a target interface located upstream of the to-be-traced interface, a target interface located downstream of the to-be-traced interface; the logical identifier indicates that the second interface exists in the interface call link, the second interface and the to-be-traced interface are both downstream nodes of the same interface, and the second interface and the to-be-traced interface are different logical branches corresponding to the same judgment logic.

2. The method of claim 1, wherein, Before the link tracking processing is performed on the to-be-traced interface in the target interface based on the calling data recorded in the obtained log information, the method further comprises: analyzing the calling data recorded in the obtained log information; when it is analyzed that there is abnormal calling data in the obtained log information, the target interface corresponding to the log information recording the abnormal calling data is determined as the to-be-traced interface.

3. The method of claim 2, wherein, The method further comprises: when it is analyzed that there is abnormal calling data in the obtained log information, an exception prompt for the to-be-traced interface is issued based on the log information recording the abnormal calling data.

4. The method of claim 1, wherein, Before the link tracking processing is performed on the to-be-traced interface in the target interface based on the calling data recorded in the obtained log information, the method further comprises: detecting whether a keyword is received; if the keyword is received, it is found whether there is target calling data corresponding to the keyword in the obtained log information; If found, the target interface corresponding to the log information recording the target call data will be identified as the interface to be tracked.

5. The method of claim 1, wherein, Before performing link tracing processing on the interface to be traced in the target interface based on the call data recorded in the acquired log information, the method further includes: Detect whether a link tracing command carrying an interface identifier has been received; If received, the interface corresponding to the interface identifier is identified as the interface to be tracked.

6. The method of claim 1, wherein, Based on the call data recorded in the acquired log information, link tracing processing is performed on the interface to be traced in the target interface, including: Display the call data recorded in the log information corresponding to the interface to be tracked.

7. The method of claim 1, wherein, Before obtaining the tracking information corresponding to the target interface, the method further includes: Identify the interfaces in the interface call chain that have multiple downstream interfaces; The identified interface and its downstream interfaces are both designated as target interfaces.

8. The method of claim 1, wherein, Before obtaining the tracking information corresponding to the target interface, the method further includes: The interface identifiers corresponding to the interfaces included in the interface call chain are displayed through an interactive interface; The interface corresponding to the selected interface identifier is identified as the target interface.

9. The method according to any one of claims 1-6, characterized in that, The method further includes: Identify the target link, wherein the target link and the interface call link belong to interface call links of different threat analysis business types under the same threat analysis scenario; Based on the log information of the target links and their respective target interfaces, a knowledge base is formed for the threat analysis scenario.

10. The method according to any one of claims 1-6, characterized in that, The method further includes: Send probe information to the interfaces that make up the interface call link at a preset frequency; If no normal status information is received from the interface regarding the probe information, then the interface that did not provide the normal status information is determined to be abnormal.

11. A link tracking apparatus, characterized by comprising: The device includes: A configuration module is used to acquire the tracking information corresponding to the target interface, wherein the tracking information is related to the service to which the target interface belongs and the threat analysis business type corresponding to the interface call chain; based on the tracking information, corresponding tracking points are set at the target interface, wherein the tracking points are used to generate corresponding log information when the target interface is called; the tracking information includes threat analysis tags of multiple dimensions, and the log information generated by the tracking points includes call data corresponding to each dimension of threat analysis tags; a deployment monitoring module is used to acquire the call data corresponding to each dimension of threat analysis tags based on at least one dimension of threat analysis tags set for the target interface when the target interface is called, forming log information corresponding to the target interface; and to summarize the log information corresponding to the target interface in the same interface call chain; an acquisition module is used to acquire the log information corresponding to the target interface in the interface call chain, wherein the interface call chain is used for threat analysis, and the log information is used to record the threat analysis-related call data generated when the corresponding target interface is called; The processing module is configured to perform link tracking processing on the to-be-tracked interface in the target interface based on the call data recorded in the obtained log information; the link tracking processing on the to-be-tracked interface in the target interface based on the call data recorded in the obtained log information comprises: in a case where it is determined that the to-be-tracked interface is provided with a logical identifier, in association with the call data recorded in the log information of the first interface and the to-be-tracked interface, the call data recorded in the log information of the to-be-tracked interface and the second interface is also associated and displayed; the first interface comprises at least one of the following: a target interface located upstream of the to-be-tracked interface, and a target interface located downstream of the to-be-tracked interface; the logical identifier indicates that the second interface exists in the interface call link, the second interface and the to-be-tracked interface are both downstream nodes of the same interface, and the second interface and the to-be-tracked interface are different logical branches corresponding to the same judgment logic.

12. A computer-readable storage medium, characterized in that, The storage medium comprises a stored program, wherein the program controls a device in which the storage medium is located to perform the link tracking method of any one of claims 1 to 10 when the program is running.

13. An electronic device, comprising: The electronic device comprises: a memory configured to store a program; a processor coupled to the memory and configured to execute the program to perform the link tracking method of any one of claims 1 to 10. The electronic device comprises: a memory configured to store a program; a processor coupled to the memory and configured to execute the program to perform the link tracking method of any one of claims 1 to 10.

Images