A service system-based API asset management method and device

Abstract

The application discloses an API asset management method and device based on a business system, and the method comprises the following steps: registering domain names and host assets based on a business system; determining an access path of an API request and a mapping relationship between the API and an application and a host according to a source address and a destination address of the API request; performing convergence processing on a URL path of the API request, and determining API assets under a business system according to a business system to which the API corresponds; establishing an API access baseline of the business system based on API access amounts of customers, and performing alarm and interception on abnormal behaviors deviating from the API access baseline, wherein the API access baseline comprises a traffic control strategy and a whitelist strategy of the API. The method and device realize automatic management of API assets based on the business system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to an API asset management method and device based on a business system. BACKGROUND

[0002] With the development of API ecology with microservices and cloud native technology, more and more APIs will be exposed for third parties or other systems to call. However, API data leakage incidents occur frequently, and the root cause is the lack of effective API management mechanism. Old APIs are not recycled in time, and new APIs do not implement effective security policies. With the version iteration of each software system, API management becomes more chaotic. SUMMARY

[0003] In view of the above problems, the present application provides an API asset management method and device based on a business system. Through traffic analysis, the APIs under the domain name are aggregated according to the URL path, and are associated with the domain name and host of the business system for analysis, so as to determine the API assets under the business system, realize the management of the API assets based on the business system, and improve the operation and maintenance efficiency and security of the system.

[0004] To achieve the above purpose, the present application adopts the following technical scheme:

[0005] In an embodiment of the present application, an API asset management method based on a business system is provided, which comprises:

[0006] Registering the domain name and host assets based on the business system;

[0007] According to the source address and destination address of the API request, determining the access path of the API request and the mapping relationship between the API and the application and the host;

[0008] Converging the URL path of the API request, and determining the API assets under the business system according to the business system to which the API corresponds;

[0009] Establishing an API access baseline of the business system based on the API access volume of the customer, including the traffic control policy and the whitelist policy of the API, and alarming and intercepting the abnormal behavior deviating from the API access baseline.

[0010] Further, taking the domain name as the root, establishing a base tree of the URL path of the API request, and according to the URL step length, aggregating and splitting to determine the hierarchical relationship of the URL.

[0011] Further, the destination address of the API request under the domain name is analyzed, whether the destination address is the host address under the business system is detected, if yes, whether the host and the port outward of the host are the proxy is further judged, if yes, the proxy information is recorded, if not the proxy, the host is considered as the business server, and the mapping relationship between the domain name and the proxy or the mapping relationship between the domain name and the business server is recorded.

[0012] Further, the relationship between the source address and the destination address in the API request and the proxy and the business server is judged, the access path of the API request is established, and the client address of the API request is determined.

[0013] Further, according to the actual port of the API accessing the business server, the mapping relationship table between the domain name and the business server and the actual access port is established.

[0014] Further, the relationship between the aggregation path of the API request and the business server and the actual access port is analyzed, and the relationship table between the URL path of the API request and the business server and the actual access port is established.

[0015] Further, the identity of the client is determined according to the client address, the traffic control strategy and the white list strategy based on the access baseline of the client are established in combination with the actual access traffic of the client.

[0016] In an embodiment of the present application, an API asset management device based on a business system is also provided, the device comprises:

[0017] A domain name and host asset registration module is used for registering the domain name and host asset based on the business system;

[0018] A mapping relationship determination module is used for determining the access path of the API request and the mapping relationship between the API and the application and the host according to the source address and the destination address of the API request;

[0019] An API asset determination module is used for converging the URL path of the API request, and determining the API asset under the business system according to the business system to which the API corresponds;

[0020] An API access baseline establishment module is used for establishing the API access baseline of the business system based on the API access amount of the client, including the traffic control strategy and the white list strategy of the API, and alarming and intercepting the abnormal behavior deviating from the API access baseline.

[0021] Further, the radix tree of the URL path of the API request is established with the domain name as the root, and the URL step length is used for aggregation and splitting to determine the hierarchical relationship of the URL.

[0022] Further, the destination address of the API request under the domain name is analyzed, whether the destination address is the host address under the business system is detected, if yes, whether the host and the port outward of the host are the proxy is further judged, if yes, the proxy information is recorded, if not the proxy, the host is considered as the business server, and the mapping relationship between the domain name and the proxy or the mapping relationship between the domain name and the business server is recorded.

[0023] Further, the relationship between the source address and the destination address in the API request and the proxy and the business server is judged, the access path of the API request is established, and the client address of the API request is determined.

[0024] Further, according to the actual port of the API accessing the business server, the mapping relationship table between the domain name and the business server and the actual access port is established.

[0025] Further, the relationship between the aggregation path of the API request and the business server and the actual access port is analyzed, and the relationship table between the URL path of the API request and the business server and the actual access port is established.

[0026] Further, the identity of the client is determined according to the client address, the traffic control strategy and the white list strategy based on the access baseline of the client are established in combination with the actual access traffic of the client.

[0027] In an embodiment of the present application, a computer device is also provided, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to realize the API asset management based on the business system.

[0028] In an embodiment of the present application, a computer readable storage medium is also provided, and the computer readable storage medium stores the computer program for executing the API asset management based on the business system.

[0029] Beneficial effects:

[0030] The API assets under the business system are sorted in the present application, and the security of the API is improved. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 is a process schematic diagram of the API asset management based on the business system of the present application;

[0032] Figure 2 is a structure schematic diagram of the API asset management device based on the business system of the present application;

[0033] Figure 3 is a structure schematic diagram of the computer device of the present application. DETAILED DESCRIPTION

[0034] The principles and spirits of the present application will be described below with reference to several exemplary embodiments, and it should be understood that these embodiments are given only to enable those skilled in the art to better understand and implement the present application, and do not limit the scope of the present application in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0035] Those skilled in the art know that the embodiments of the present application can be implemented as an apparatus, a device, a node, a method or a computer program product. Therefore, the present disclosure can be embodied in the form of entire hardware, entire software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0036] The embodiments of the present application propose an API asset management method based on a business system. By traffic analysis, the API under the domain name is aggregated according to the URL path, and the domain name and host of the business system are analyzed to determine the API asset under the business system, thereby realizing the management of the API asset based on the business system, and improving the operation and maintenance efficiency and security of the system.

[0037] The principles and spirits of the present application will be described below with reference to several exemplary embodiments, and it should be understood that these embodiments are given only to enable those skilled in the art to better understand and implement the present application, and do not limit the scope of the present application in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0038] Figure 1 is a flowchart of the API asset management method based on the business system of the present application. As shown in Figure 1 , the method comprises:

[0039] S1, registering the domain name and host asset based on the business system;

[0040] The user registers the domain name and host asset under the business system. For the host asset, the existing SOC system can be synchronized to manage the host asset.

[0041] The host asset here includes the host name, the port of the host to the outside, the running software (application), and the network card information, etc.

[0042] The domain name here includes the domain name to the outside and the local domain name, i.e. the domain name inside the system.

[0043] S2, determining the access path of the API request and the mapping relationship between the API and the application and the host according to the source address and the destination address of the API request message;

[0044] The collected traffic and logs are parsed, mainly the information of network layer and the request header information of application layer. The information of network layer includes source address, destination address and destination port, etc. The request header information of application layer includes protocol type (HTTP and Websocket, etc.), request URL path, host HOST and user behavior UA, etc.

[0045] The destination address of API request is analyzed to detect whether it is the host address under the business system (the host asset registration of S1 includes the host address). If yes, it is further judged whether the host and the port exposed by the host (the host asset registration of S1 includes the host and the port exposed by the host) are proxies (when the host asset is registered, the application will be registered, and the application includes the port number, such as the nginx application, which exposes the 8080 port, etc.). If yes, the proxy information is recorded (the proxy information is determined according to the application, and the nginx and haproxy applications are proxies). If not, the host is considered as a business server, and the mapping relationship between the domain name and the proxy or the domain name and the business server is recorded.

[0046] The API asset here not only includes the API interface provided by the WEB application and the backend service, but also the API interface provided by the Redis and Flink middleware.

[0047] The application here includes WEB application, middleware and backend service, etc.

[0048] If the host HOST in the API request is a domain name, the mapping relationship between the domain name and the proxy is recorded.

[0049] If the host HOST in the API request is an IP address, the host asset is matched through the host address and the port exposed by the host to confirm that the API belongs to a certain middleware or a certain backend service. The mapping relationship between the middleware and the host is recorded, and the mapping relationship between the middleware and the API is recorded. At the same time, the mapping relationship between the backend service and the host is recorded, and the mapping relationship between the backend service and the API interface published by the backend service is recorded.

[0050] Determine the relationship between the source address and the destination address in the API request and the proxy and the business server, establish the access path of the API, i.e., the business path, and determine the client address of the API request (the proxy will convert the source address and the destination address of the API request, and for the same request (determined according to the domain name and the URL path), the destination address of the API request before conversion is the address of the proxy, and the source address of the API request after conversion is the address of the proxy; according to the relationship between the source address and the destination address and the proxy, the access path of the API is determined; the first address in the x_forwarded_for in the API request header information is the client address, and if the field is empty, the source address of the API request received by the first proxy is the client address). The access path identifies the actual forwarding path of the API request in the network.

[0051] According to the actual port of the API accessing the business server (the destination port in the API request sent by the last proxy is the actual port of the API accessing the business server), determine the mapping relationship between the API request and the host, query the host asset information according to the address and the port of the business server, determine the specific application, establish the mapping relationship between the API request and the application, and establish the mapping relationship table between the domain name and the business server and the actual access port according to the domain name to which the API request belongs, i.e., the relationship table between the domain name and the backend business.

[0052] S3, aggregate the URL path of the API request, and determine the API asset under the business system according to the business system to which the API corresponds;

[0053] If there is domain name information in the API request, take the domain name as the root to establish the base tree of the URL path of the API request, and aggregate and split according to the URL step length, and when the business server information of the nodes of the base tree is consistent, pruning is performed, i.e., the business server information is saved from the uppermost bifurcation node of the base tree.

[0054] If there is only IP information in the API request, take the middleware name or the backend service name to which the API belongs as the root to establish the base tree of the URL path of the API request, and the processing mode is the same as that of the domain name.

[0055] Analyze the relationship between the aggregated path of the API request and the backend service, and establish the relationship table between the API and the backend service.

[0056] According to the domain name and the business system to which the host belongs, determine the business system to which the API asset belongs.

[0057] The API assets under the business system are uniformly presented, and the API exposed by each application to the outside is respectively presented according to the application under the business system, and the type of the API is determined according to the identity of the client, whether the API is for external clients Public (public user) or internal private (private user) or third-party partner (partner); and the business server information providing the API is presented. The API assets that are not used for a long time are recycled, and the client identity of the illegal URL path can be identified, and a blacklist strategy can be performed.

[0058] S4, establishing an API access baseline of the business system based on the API access amount of the client, including the traffic control policy and the whitelist policy of the API, and alarming and intercepting the abnormal behavior deviating from the API access baseline, so as to realize the automatic management of the API assets based on the business system;

[0059] The network information to which the client address belongs is determined by analyzing the client address, whether it belongs to the external network or a certain business system, if it belongs to a certain business system, the access baseline of the client is established according to the identity attribute (the host address of the business system is included in the host asset registration of S1, that is, the identity attribute) of the business system and the actual access traffic, and different traffic control policies and whitelist policies are set for the corresponding application, that is, service.

[0060] When the access behavior of the client deviates from the access baseline, the abnormal behavior is alarmed and intercepted.

[0061] It should be noted that although the operations of the method of the present application are described in a specific order in the above embodiments and drawings, this does not require or imply that the operations must be performed in this specific order, or that all of the shown operations must be performed to achieve the desired result. Additionally or alternatively, certain steps can be omitted, a plurality of steps can be combined into one step, and / or one step can be divided into a plurality of steps.

[0062] In order to more clearly explain the above-mentioned API asset management method based on the business system, a specific embodiment will be described below, however, it should be noted that this embodiment is only used to better illustrate the present application, and does not constitute an improper limitation on the present application.

[0063] Embodiment:

[0064] S1, registering domain names and host assets based on business systems;

[0065] The user registers the domain name and host asset under the business system, and for the host asset, the existing SOC system can be synchronized with the host asset.

[0066] The host asset here includes host name, host external port, running software (application) and network card information, etc.

[0067] The domain name here includes external domain name and local domain name, i.e. the domain name inside the system.

[0068] In the embodiment, taking the IT operation and maintenance system and the IP management system as examples, the two business systems register the corresponding domain name and host asset to the IT asset registration center, which can be registered by the management personnel of each business actively or reported actively by the probe.

[0069] Specifically, the host asset first reports the host information (host name, host address, CPU, memory, host type and operating system information), and then reports the application information, for example, Mysql application (application name, application address and application port, etc.).

[0070] S2, determining the access path of the API request and the mapping relationship between the API and the application and the host according to the source address and the destination address of the API request message;

[0071] The collected traffic and logs are analyzed, mainly the information of the network layer and the request header information of the application layer. The information of the network layer includes source address, destination address and destination port, etc. The request header information of the application layer includes protocol type (HTTP and Websocket, etc.), request URL path, host HOST and user behavior UA, etc.

[0072] In the embodiment, taking the HTTP protocol as an example, the user accesses the host asset of the IT business system. In the embodiment, it is assumed that the user accesses the IT business system through the domain name, so the HOST in the request message can be determined as the API request to the IT business system.

[0073] If the business system has no external domain name, it is judged whether the destination address of the API request is the host address under the IT business system.

[0074] The destination address of the API request is analyzed to detect whether the destination address is the host address under the business system (the host address is included in the host asset registration of S1), if yes, it is further judged whether the host and the external port of the host (the host and the external port of the host are included in the host asset registration of S1) are proxies (the host asset registration registers applications, and the applications include port numbers, such as nginx application, which exposes 8080 port externally, etc.), if yes, the proxy information is recorded (the proxy information is determined according to the application, and the nginx and haproxy applications are proxies), if not, the host is considered as a business server, and the mapping relationship between the domain name and the proxy or the domain name and the business server is recorded.

[0075] In the present embodiment, the user accesses the IT business system through the NGINX proxy, determines the host under the IT business system according to the destination IP address of the API request, that is, the API is the API of the IT business system, and matches the application under the host asset according to the destination port of the API, so as to determine the relationship between the API and the application.

[0076] The API asset here not only includes the API interface provided by the WEB application and the backend service, but also includes the API interface provided by the Redis and Flink middleware.

[0077] The application here includes the WEB application, the middleware and the backend service.

[0078] If the host HOST in the API request is a domain name, record the mapping relationship between the domain name and the proxy;

[0079] If the host HOST in the API request is an IP address, match the host asset through the host address and the port of the host, confirm that the API belongs to a certain middleware or a certain backend service, record the mapping relationship between the middleware and the host, and record the mapping relationship between the middleware and the API; at the same time, record the mapping relationship between the backend service and the host, and the mapping relationship between the backend service and the API interface published by the backend service.

[0080] Determine the relationship between the source address and the destination address in the API request and the proxy and the business server, establish the access path of the API, that is, the business path, and determine the client address of the API request (the proxy will convert the source address and the destination address of the API request, for the same request (determined according to the domain name and the URL path), the destination address of the API request before conversion is the address of the proxy, and the source address of the API request after conversion is the address of the proxy, according to the relationship between the source address and the destination address and the proxy, the access path of the API is determined; the first address in the x_forwarded_for in the API request header information is the client address, if the field is empty, the source address of the API request received by the first proxy is the client address). The access path identifies the actual forwarding path of the API request in the network.

[0081] In the embodiment, the source address and the destination address of the API request are analyzed to determine the relationship of the NGINX proxy. If there is a proxy, it is determined that the request has passed the NGINX proxy. If the destination address is the address of the proxy, it is considered that the message is accessing the NGINX proxy. If the source address is the address of the NGINX, it is considered that the message is from the NGINX. In this way, the complete access path of the API request can be determined (only the proxy can change the address of the message, and other network devices are only transit, and the application focuses on the forwarding path of the message).

[0082] According to the actual port of the API access service server (the destination port obtained from the API request sent by the last proxy is the actual port of the API access service server), the mapping relationship between the API request and the host is determined. According to the address and port of the service server, the host asset information is queried to determine the specific application, and the mapping relationship between the API request and the application is established. According to the domain name to which the API request belongs, the mapping relationship table between the domain name and the service server and the actual access port is established, that is, the relationship table between the domain name and the backend service.

[0083] S3, the URL path of the API request is aggregated and processed, and the API asset under the business system is determined according to the business system to which the API belongs.

[0084] If the domain name information exists in the API request, the base tree of the URL path of the API request is established with the domain name as the root, and the URL step (proportion) is aggregated and split (starting from the root path, each step is recursively compared, and the same is aggregated, such as / api / fw / get / user and / api / fw / get / nat, / api / fw / get / can be aggregated into a node, and the following two leaves / user and / nat exist, if a new branch comes in, it needs to be split), when the node of the base tree belongs to the same service server information, pruning is performed (that is, / api / fw / get / is associated with the service server information, so as to reduce redundant information, and related information is combined as much as possible; if the service server information of all businesses under / api / fw is the same, the service server information of / api / fw is associated with the node), that is, the service server information is saved in the uppermost branch node of the base tree.

[0085] If only IP information exists in the API request, the base tree of the URL path of the API request is established with the middleware name or the backend service name as the root, and the processing mode is the same as that of the domain name.

[0086] Analyze the relationship between the aggregated path of API request and the backend service, and establish the relationship table between API and backend service.

[0087] According to the domain name and the business system to which the host belongs, determine the business system to which the API asset belongs.

[0088] By analyzing the source and destination address, port, host and application of API request, all API assets under the business system can be determined.

[0089] The API assets under the business system are uniformly presented, and the API exposed by each application to the outside is displayed according to the application under the business system. According to the identity of the client, the type of API is determined, whether it is public (public user) or private (private user) or partner (partner) of the third party; and the business server information providing these APIs is displayed. The API assets that have not been used for a long time are recycled, and the client identity of the illegal URL path can be identified, and the blacklist strategy can be executed.

[0090] Specifically, the API assets under the business system can be presented according to different dimensions, such as application dimension, domain name dimension and customer identity.

[0091] S4, based on the API access volume of the customer, establish the API access baseline of the business system, including the traffic control policy and the whitelist policy of the API, and alarm and intercept the abnormal behavior deviating from the API access baseline, so as to realize the automatic management of the API assets based on the business system.

[0092] By analyzing the client address, the network information to which the client address belongs is determined, whether it belongs to the external network or a certain business system. If it belongs to a certain business system, the access baseline of the customer is established according to the identity attribute (S1 includes the host address of the business system when the host asset is registered) of the business system and the actual access traffic, and different traffic control policy and whitelist policy are set for the corresponding application, i.e. service.

[0093] By analyzing the actual traffic of the client address, the normal access behavior of the user is obtained, and the access baseline is drawn. The baseline is used as the basis for matching, and the behavior of the user is analyzed in real time whether it deviates from the normal. When the identity of the user is not clear, the user is classified according to the group, and the group behavior baseline is established.

[0094] When the access behavior of the customer deviates from the access baseline, the abnormal behavior is alarmed and intercepted.

[0095] Based on the same inventive concept, the application further provides a service system based API asset management device. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be described herein. The term "module" used below can be a combination of software and / or hardware that realizes predetermined functions. Although the device described in the following embodiments is preferably realized in software, the implementation of hardware or a combination of software and hardware is also possible and is conceived.

[0096] Figure 2 is a structural diagram of the service system based API asset management device of the application. As shown in Figure 2 , the device comprises:

[0097] A domain name and host asset registration module 101 is configured to register domain names and host assets based on a service system.

[0098] A mapping relationship determination module 102 is configured to determine an access path of an API request and a mapping relationship between the API and an application and a host according to a source address and a destination address of the API request.

[0099] The destination address of the API request under the domain name is analyzed to detect whether the destination address is a host address under the service system. If yes, it is further judged whether the host and the port of the host to the outside are a proxy. If yes, the proxy information is recorded. If not, the host is considered as a service server, and a mapping relationship between the domain name and the proxy or a mapping relationship between the domain name and the service server is recorded.

[0100] The relationship between the source address and the destination address in the API request and the proxy and the service server is judged to establish an access path of the API request and determine a client address of the API request.

[0101] According to the actual port of the API accessing the service server, a mapping relationship between the API request and the host is determined. According to the address and the port of the service server, the host asset information is queried to determine a specific application, a mapping relationship between the API request and the application is established, and a mapping relationship table between the domain name and the service server and the actual access port, i.e., a relationship table between the domain name and the back-end service, is established according to the domain name to which the API request belongs.

[0102] An API asset determination module 103 is configured to aggregate the URL path of the API request, and determine the API asset under the service system according to the service system to which the API belongs.

[0103] A base tree of the URL path of the API request is established with the domain name as the root, and the URL step length is used for aggregation and splitting to determine the hierarchical relationship of the URL.

[0104] The API request aggregation path is analyzed to determine the relationship between the API request URL path and the business server and the actual access port thereof, and a table of the relationship between the API request URL path and the business server and the actual access port thereof is established, including the relationship between each level of the API request URL path and the business server.

[0105] The API access baseline establishment module 104 is configured to establish an API access baseline of the business system based on the API access volume of the client, including a traffic control strategy and a whitelist strategy of the API, and to perform alarm and interception on abnormal behaviors deviating from the API access baseline.

[0106] The identity of the client is determined according to the client address, and the traffic control strategy and the whitelist strategy based on the access baseline of the client are established in combination with the actual access traffic of the client.

[0107] It should be noted that although several modules of the business system-based API asset management apparatus are mentioned in the foregoing detailed description, such division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided into several modules.

[0108] Based on the foregoing inventive concept, as shown in Figure 3 The present application further proposes a computer device 200, which comprises a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220, and the processor 220 implements the foregoing business system-based API asset management method when executing the computer program 230.

[0109] Based on the foregoing inventive concept, the present application further proposes a computer-readable storage medium, which stores a computer program for executing the foregoing business system-based API asset management.

[0110] The business system-based API asset management method and apparatus proposed by the present application improves the security of the API by sorting the API assets under the business system.

[0111] Although the spirit and principles of the present application have been described with reference to several specific embodiments, it should be understood that the present application is not limited to the disclosed specific embodiments, and the division of aspects does not mean that the features in these aspects cannot be combined for the benefit, and such division is only for the convenience of expression. The present application is intended to cover various modifications and equivalent arrangements included in the spirit and scope of the appended claims.

[0112] The skilled in the art should understand that the modifications or changes made on the basis of the technical scheme of the present application without paying creative labor are still within the protection scope of the present application.

Claims

1. A method for managing API assets based on a business system, characterized in that, The method includes: Register domain names and hosting assets based on the business system; Based on the source and destination addresses of the API request, determine the access path of the API request and the mapping relationship between the API, the application, and the host. Analyze the destination address of the API request to check if it is a host address under the business system. If so, further determine if the host and its external port are proxies. If they are proxies, record the proxy information. If they are not proxies, consider the host to be a business server and record the mapping relationship between the domain name and the proxy or the domain name and the business server. If the host in the API request is a domain name, record the mapping relationship between the domain name and the proxy. If the host in the API request is an IP address, match the host assets by the host address and the host's external port to confirm that the API belongs to a certain middleware or a certain backend service. Record the mapping relationship between the middleware and the host, and the mapping relationship between the middleware and the API. At the same time, record the mapping relationship between the backend service and the host, and the mapping relationship between the backend service and its externally published API interface. Determine the relationship between the source and destination addresses in the API request and the proxy and the business server, establish the API access path (i.e., the business path), and determine the client address of the API request. The URL paths of API requests are aggregated. If the API request contains domain name information, a radix tree of the API request's URL paths is built with the domain name as the root, and aggregation and splitting are performed according to the URL step. When the business server information to which the nodes of the radix tree belong is consistent, pruning is performed, that is, the business server information is stored in the top-level branch node of the radix tree. If the API request only contains IP information, a radix tree of the API request's URL paths is built with the middleware name or backend service name to which the API belongs as the root, and the processing method is the same as that for domain names. Based on the business system to which the API belongs, the API assets under the business system are determined. Establish an API access baseline for the business system based on the customer's API access volume, including API traffic control policies and whitelist policies, and issue alerts and block abnormal behaviors that deviate from the API access baseline.

2. The API asset management method based on a business system according to claim 1, characterized in that, Using the domain name as the root, a radix tree of the URL paths for API requests is built, and aggregation and splitting are performed according to the URL step size to determine the hierarchical relationship of the URLs.

3. The API asset management method based on a business system according to claim 1, characterized in that, Based on the actual port of the business server accessed by the API, establish a mapping table between the domain name and the business server and its actual access port.

4. The API asset management method based on a business system according to claim 1, characterized in that, Analyze the relationship between the aggregated path of API requests and the business server and its actual access port, and establish a table showing the relationship between the URL path of API requests and the business server and its actual access port.

5. The API asset management method based on a business system according to claim 1, characterized in that, Based on the client address, determine the client's identity, and combine this with the client's actual access traffic to establish a traffic control policy and a whitelist policy based on the client's access baseline.

6. An API asset management device based on a business system, characterized in that, The device includes: The domain name and hosting asset registration module is used to register domain names and hosting assets based on the business system; The mapping relationship determination module is used to determine the access path of an API request and the mapping relationship between the API, the application, and the host based on the source and destination addresses of the API request. It analyzes the destination address of the API request to check if it is a host address under the business system. If so, it further determines whether the host and its external port are proxies. If a proxy is used, the proxy information is recorded; otherwise, the host is considered a business server, and the mapping relationship between the domain name and the proxy or the domain name and the business server is recorded. If the host in the API request is a domain name, the mapping relationship between the domain name and the proxy is recorded. If the host in the API request is an IP address, the host assets are matched using the host address and the host's external port to confirm that the API belongs to a certain middleware or backend service. The mapping relationship between the middleware and the host, and the mapping relationship between the middleware and the API are recorded. Simultaneously, the mapping relationship between the backend service and the host, and the mapping relationship between the backend service and its externally published API interface are recorded. The module determines the relationship between the source and destination addresses in the API request and the proxy and the business server, establishes the API access path (i.e., the business path), and determines the client address of the API request. The API asset determination module is used to aggregate the URL paths of API requests. If the API request contains domain name information, a radix tree of the API request's URL path is built with the domain name as the root, and aggregation and splitting are performed according to the URL step. When the business server information to which the nodes of the radix tree belong is consistent, pruning is performed, that is, the business server information is stored in the top-level branch node of the radix tree. If the API request only contains IP information, a radix tree of the API request's URL path is built with the middleware name or backend service name to which the API belongs as the root, and the processing method is the same as that for domain names. Based on the business system to which the business corresponding to the API belongs, the API assets under the business system are determined. The API access baseline establishment module is used to establish the API access baseline of the business system based on the customer's API access volume, including API traffic control policies and whitelist policies, and to alert and block abnormal behaviors that deviate from the API access baseline.

7. The API asset management device based on a business system according to claim 6, characterized in that, Using the domain name as the root, a radix tree of the URL paths for API requests is built, and aggregation and splitting are performed according to the URL step size to determine the hierarchical relationship of the URLs.

8. The API asset management device based on a business system according to claim 6, characterized in that, Based on the actual port of the business server accessed by the API, establish a mapping table between the domain name and the business server and its actual access port.

9. The API asset management device based on a business system according to claim 6, characterized in that, Analyze the relationship between the aggregated path of API requests and the business server and its actual access port, and establish a table showing the relationship between the URL path of API requests and the business server and its actual access port.

10. The API asset management device based on a business system according to claim 6, characterized in that, Based on the client address, determine the client's identity, and combine this with the client's actual access traffic to establish a traffic control policy and a whitelist policy based on the client's access baseline.

11. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1-5.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the method according to any one of claims 1-5.

Images