A method and device for implementing hierarchical classification of API assets

Abstract

The present invention discloses a method and device for implementing hierarchical classification of API assets, wherein the method comprises: parsing the acquired request message and response message of the API interface to obtain the basic information of the API interface and the metadata of the API interface; determining the business type to which the API interface belongs according to the basic information of the API interface, and determining the data type of the API interface in combination with the metadata of the API interface; determining the asset classification and grading of the API interface according to the business type to which the API interface belongs and the data type of the API interface. The method and device improve the asset management efficiency and accuracy of the API interface.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and device for implementing hierarchical classification of API assets. Background Art

[0002] As the diversification, complexity and service-oriented nature of Internet applications become a significant trend, application architectures in more and more scenarios are using application programming interfaces (APIs) as data transmission and control processes between applications; with the development of big data applications, the amount and sensitivity of data transmitted by API interfaces are also increasing.

[0003] API interfaces, as channels for data transmission, involve multiple processes in data lifecycle management. In recent years, many security incidents caused by non-standard API interfaces have occurred around the world. Therefore, the telecommunications and Internet industry data security standard system has formulated data classification standards. Summary of the invention

[0004] In view of the above situation, the present invention provides a method and device for implementing the hierarchical classification of API assets. By deeply analyzing the API request message and response message and combining them with business scenarios, multi-dimensional asset classification and grading of API assets are implemented, thereby improving the management efficiency and accuracy of API assets.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] In one embodiment of the present invention, a method for implementing hierarchical classification of API assets is proposed, and the method includes:

[0007] Parse the obtained API interface request message and response message to obtain the basic information and metadata of the API interface;

[0008] Determine the business type of the API interface based on the basic information of the API interface, and determine the data type of the API interface based on the metadata of the API interface;

[0009] Determine the asset classification and grading of the API interface based on the business type to which the API interface belongs and the data type of the API interface.

[0010] Furthermore, the relationship between the request path of the API interface and the corresponding domain name of the site to which it belongs is determined;

[0011] The request path of the API interface is processed in layers, and the URL request path is decomposed and merged according to the tree structure;

[0012] According to the hierarchical relationship of the domain names corresponding to the sites to which the API interfaces belong, the hierarchical relationship of the request paths of the associated API interfaces is determined to determine the overall hierarchical relationship of the API interface business.

[0013] Furthermore, the domain name corresponding to the site to which the API interface belongs and the request path of the API interface are parsed to determine the business type to which the API interface belongs.

[0014] Furthermore, labels are added to different levels of the request path of the API interface, and the labels can be associated with the business type to which the API belongs; each request path of the API interface can have multiple labels, and each label has a different dimension.

[0015] Furthermore, the data type of the API interface is determined based on the request parameters of the API interface in combination with the analysis of the metadata of the API interface.

[0016] Furthermore, based on the analysis results of the metadata of the API interface, the metadata of the API interface is labeled. The label can be associated with the data type of the API interface, and each label identifies a different data type of the API interface. The data information associated with the assets of the API interface is determined based on the data type of the API interface, and the hierarchical classification of the API is determined in combination with the business type to which the API belongs.

[0017] Furthermore, the business type to which the API interface belongs has multiple dimensions, and each type of business has multiple levels; the data type of the API interface has multiple levels; based on any dimension combined with the business type to which the API interface belongs and the data type of the API interface, the asset classification and grading of the API interface is determined.

[0018] Furthermore, the asset priority of the API interface is determined based on the priority corresponding to the business type to which the API interface belongs and the priority corresponding to the data type of the API interface; the asset classification of the API interface is determined based on the hierarchical relationship of the business type to which the API interface belongs and the category to which the data type of the API interface belongs. If the priorities are different, the higher priority shall prevail; an asset of an API interface can be divided according to multiple dimensions.

[0019] Furthermore, different protection strategies are implemented according to the asset classification of the API interface, and the asset protection strategy of the API interface is adjusted in real time according to the changes in the labels of the API interface.

[0020] In one embodiment of the present invention, a device for implementing hierarchical classification of API assets is also proposed, and the device includes:

[0021] The message parsing module is used to parse the request message and response message of the obtained API interface to obtain the basic information and metadata of the API interface;

[0022] The tag management module is used to manage tags, including tag name, type, security level, paranoia level, whether to enable, detection method, detection object, rule content, sample data and test results;

[0023] The business and data type determination module is used to determine the business type of the API interface based on the basic information of the API interface, and determine the data type of the API interface in combination with the metadata of the API interface;

[0024] The asset classification and grading determination module is used to determine the asset classification and grading of the API interface according to the business type to which the API interface belongs and the data type of the API interface.

[0025] Furthermore, the relationship between the request path of the API interface and the corresponding domain name of the site to which it belongs is determined;

[0026] The request path of the API interface is processed in layers, and the URL request path is decomposed and merged according to the tree structure;

[0027] According to the hierarchical relationship of the domain names corresponding to the sites to which the API interfaces belong, the hierarchical relationship of the request paths of the associated API interfaces is determined to determine the overall hierarchical relationship of the API interface business.

[0028] Furthermore, the domain name corresponding to the site to which the API interface belongs and the request path of the API interface are parsed to determine the business type to which the API interface belongs.

[0029] Furthermore, labels are added to different levels of the request path of the API interface, and the labels can be associated with the business type to which the API belongs; each request path of the API interface can have multiple labels, and each label has a different dimension.

[0030] Furthermore, the data type of the API interface is determined based on the request parameters of the API interface in combination with the analysis of the metadata of the API interface.

[0031] Furthermore, based on the analysis results of the metadata of the API interface, the metadata of the API interface is labeled. The label can be associated with the data type of the API interface, and each label identifies a different data type of the API interface. The data information associated with the assets of the API interface is determined based on the data type of the API interface, and the hierarchical classification of the API is determined in combination with the business type to which the API belongs.

[0032] Furthermore, the business type to which the API interface belongs has multiple dimensions, and each type of business has multiple levels; the data type of the API interface has multiple levels; based on any dimension combined with the business type to which the API interface belongs and the data type of the API interface, the asset classification and grading of the API interface is determined.

[0033] Furthermore, the asset priority of the API interface is determined based on the priority corresponding to the business type to which the API interface belongs and the priority corresponding to the data type of the API interface; the asset classification of the API interface is determined based on the hierarchical relationship of the business type to which the API interface belongs and the category to which the data type of the API interface belongs. If the priorities are different, the higher priority shall prevail; an asset of an API interface can be divided according to multiple dimensions.

[0034] Furthermore, different protection strategies are implemented according to the asset classification of the API interface, and the asset protection strategy of the API interface is adjusted in real time according to the changes in the labels of the API interface.

[0035] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the hierarchical classification of the aforementioned API assets when executing the computer program.

[0036] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for implementing the hierarchical classification of API assets.

[0037] Beneficial effects:

[0038] The present invention improves the management efficiency and accuracy of API assets through in-depth analysis of API request messages and response messages and through multiple data identification and data classification methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flowchart of a method for implementing hierarchical classification of API assets of the present invention;

[0040] Figure 2 is a schematic diagram of system interaction according to an embodiment of the present invention;

[0041] Figure 3 It is an overall hierarchical relationship diagram of the API interface corresponding to the business of one embodiment of the present invention;

[0042] Figure 4 It is a schematic diagram of the structure of the device for implementing the hierarchical classification of API assets of the present invention;

[0043] Figure 5 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0044] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0045] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a device, apparatus, equipment, method or computer program product. Therefore, the present disclosure may be implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0046] According to an embodiment of the present invention, a method and device for implementing hierarchical classification of API assets are proposed to improve the efficiency and accuracy of API asset management.

[0047] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0048] Figure 1 This is a flow chart of the method for implementing the hierarchical classification of API assets of the present invention. Figure 1 As shown, the method includes:

[0049] S1. Get API traffic

[0050] The traffic here refers to the request and response messages of the API interface.

[0051] Specifically, the traffic of the API interface is captured through mirroring or probes.

[0052] S2. Parse the API request and response messages;

[0053] The request message and response message of the API interface are parsed based on the network layered model and protocol type, and the metadata in the request message and response message are parsed to obtain the basic information of the API interface and the metadata of the API interface.

[0054] The network layered model here mainly refers to the OSI model, and the protocol types include: TCP / UDP / HTTP / HTTPS / WEBsocket / etc.

[0055] Specifically, according to the OSI model, the network layer, transport layer and application layer are analyzed in layers. Taking the HTTP protocol as an example, according to the HTTP protocol format, the HTTP request header, request entity, response header and response entity are analyzed, and the metadata in the request entity and response entity are analyzed, including the fields in XML / JSON.

[0056] The basic information here includes protocol type, protocol version, request path, request action, HOST, XFF, UA, cookie, source address, destination address, port number, etc. Metadata mainly refers to the fields and content of the body part of the request message and the response message, and also includes the fields and content after XML and JSON parsing.

[0057] S3. Determine the business type to which the API belongs and determine the data type of the API;

[0058] Determine the business type of the API interface based on the basic information of the API interface, and determine the data type of the API interface based on the metadata of the API interface.

[0059] The business type here includes the business name, business dimension, parent node and priority. The business type can be associated with a label. The parent node identifies the hierarchical relationship of the business type.

[0060] The data type here includes the data type name and priority.

[0061] First, determine the relationship between the API interface request path PATH and the site, then perform hierarchical processing on the API interface request path PATH, and decompose and merge the URL request path according to the tree structure.

[0062] According to the hierarchical relationship of the domain names corresponding to the sites to which the API interfaces belong, the hierarchical relationship of the request paths PATH of the API interfaces are associated to determine the overall hierarchical relationship of the API interface services.

[0063] The short text analysis method is used to parse the domain name corresponding to the site to which the API interface belongs and the request path PATH of the API interface to determine the business type to which the API interface belongs.

[0064] In specific implementation, the site information corresponding to the API asset can be determined according to the HOST information in the HTTP message, and the API asset information under the tenant can be determined according to the relationship between the tenant and the site;

[0065] In specific implementation, different levels of the request path PATH of the API interface can be labeled, and the labels are associated with business types. Each request path PATH of the API interface can have multiple labels, and each label has different dimensions.

[0066] Specifically, business types can have multiple dimensions and can be divided into personal information, banking business, and operational business according to content. They can also be classified according to organizational structures, business systems, or the regions to which the business belongs.

[0067] Each type of business can have multiple levels, such as banking business, which can be subdivided into loan business and storage business, etc.

[0068] Based on the request parameters in the request message of the API interface and the metadata in the request message and the response message, specifically, taking HTTP as an example, it can be an analysis of fields and data, including the HTTP header and entity content; by using regular expressions, dictionaries, short text analysis and clustering algorithms, determine the data type of the API interface;

[0069] In specific implementation, the metadata in the API interface can be labeled according to the analysis results of the metadata of the API interface. Each label identifies a different data type. The label is associated with the data type, and the data information associated with the assets of the API interface is determined according to the data type of the API interface.

[0070] In specific implementation, the business type to which the API interface belongs has multiple levels and multiple dimensions, and the data type of the API interface has multiple levels; based on any dimension combined with the business type to which the API interface belongs and the data type of the API interface, the asset classification and grading of the API interface is determined.

[0071] S4. Determine the classification and grading of API assets based on business type and data type.

[0072] Combined with the business type and data type of the API interface, determine the asset priority of the API interface according to the priority corresponding to the business type of the API interface and the priority corresponding to the data type of the API interface, and determine the asset classification of the API interface according to the hierarchical relationship of the business type to which the API interface belongs and the category to which the data type of the API interface belongs. If the priorities are different, the higher priority shall prevail. An asset of an API interface can be divided according to multiple dimensions.

[0073] In specific implementation, the metadata in the API interface can be labeled according to the analysis results of the metadata of the API interface. Each label identifies a different data type. The label is associated with the data type. The data information associated with the assets of the API interface is determined according to the data type of the API interface. The asset classification of the API interface is determined in combination with the business type to which the API interface belongs.

[0074] The request path PATH of the API interface is divided into levels, and its business type is determined based on the information of the request path PATH of the API interface. Furthermore, based on the request message and response message of the API interface, the API interface and the message are identified and scored in combination with regular expressions, dictionaries, short texts and clustering algorithms, and verified by security personnel.

[0075] The asset classification of API interfaces provides a basis for risk management and security protection of API interfaces. Different protection measures can be implemented according to the asset classification of API interfaces. For example, different protection strategies can be implemented for API registration, login, and red envelope grabbing interfaces.

[0076] During specific implementation, the label changes of the API interface can be compared to promptly discover asset changes of the API interface, and the asset protection strategy of the API interface can be adjusted in a timely manner based on the asset changes of the API interface.

[0077] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0078] In order to explain the implementation of the hierarchical classification of the above-mentioned API assets more clearly, a specific embodiment is used for illustration below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0079] Example:

[0080] S1. Get API traffic.

[0081] Specifically, the traffic of the API interface is captured through mirroring or probes and sent to the API analysis system.

[0082] The traffic here refers to the request and response messages of the API interface.

[0083] Figure 2 The node in can be an API gateway or NGINX (an open source software). Different technical architectures have different collection methods. Traffic collection can also be performed through eBPF (extended BPF, extended Berkeley packet filter) or agent (probe), or through multiple collection points.

[0084] The flow collection method does not affect the implementation of the present invention.

[0085] S2. Parse the API request and response messages;

[0086] The request message and response message of the API interface are parsed based on the network layered model and protocol type, and the metadata in the request message and response message are parsed to obtain the basic information and metadata of the API interface.

[0087] The network layered model here mainly refers to the OSI model, and the protocol types include: TCP / UDP / HTTP / HTTPS / WEBsocket / etc.

[0088] In this embodiment, the HTTP protocol is taken as an example, and the present invention is also applicable to other protocols, such as Websocket (a protocol at the application layer), etc.

[0089] Specifically, according to the OSI model, the network layer, transport layer and application layer are analyzed in layers. Taking the HTTP protocol as an example, according to the HTTP protocol format, the HTTP request header, request entity, response header and response entity are analyzed, and the metadata in the request entity and response entity are analyzed, including the fields in XML / JSON.

[0090] Specifically, if it is the HTTPS protocol, SSL offloading is performed first.

[0091] Taking the HTTP protocol as an example, the request path PATH, request parameters, protocol version, request action, user behavior UA, Cookie and HOST of the API interface are parsed and obtained.

[0092] S3. Determine the business type to which the API belongs and determine the data type of the API;

[0093] Determine the business type of the API interface based on the basic information of the API interface, and determine the data type of the API interface based on the metadata of the API interface.

[0094] The business type here includes the business name, business dimension, parent node and priority. The business type can be associated with a label. The parent node identifies the hierarchical relationship of the business type.

[0095] Step 1: Determine the business hierarchy of the API interface;

[0096] ① First, build the relationship between the API interface request path PATH and the domain name, and determine the site information corresponding to the API interface based on the HOST information in the HTTP message;

[0097] In this embodiment, the site and the domain name are equivalent.

[0098] In a multi-tenant scenario, you can determine the site information corresponding to the API interface based on the HOST information in the HTTP message, and determine the API interface information under the tenant based on the relationship between the tenant and the site. The request path PATH analysis of all API interfaces is based on a certain site.

[0099] If the domain name corresponding to HOST has a multi-level relationship, first build a hierarchical relationship diagram of the domain name.

[0100] For example, market.ctyun.com and product.ctyun.com (an example of a domain name) are both children of ctyun.com (an example of a root domain name).

[0101] ② Establish a hierarchical relationship of the request path PATH of the API interface, and decompose and merge the request path of the URL according to the tree structure;

[0102] Specifically, the PATH format is generally / api / product / ecs / ; / api / product / vms / (an example of the request path PATH of the API interface).

[0103] Specifically, taking the prefix tree as an example, the request path PATH of the API interface is inserted according to the prefix tree, and different forks are decomposed and processed, and the same level is merged. Taking the request path PATH of the API interface above as an example, vms and ecs belong to different forks; but / api / product belongs to the same branch and is the common parent node of vms and ecs.

[0104] ③ According to the hierarchical relationship of the domain names corresponding to the sites to which the API interfaces belong, the hierarchical relationship of the request paths PATH of the API interfaces is associated to determine the overall hierarchical relationship of the API interface business;

[0105] like Figure 3 As shown in the figure, / api / product / ecs / belongs to the ecs product in / api / product / under the site product.ctyun.com.

[0106] ④ Analyze the domain name and API interface request path PATH through short text analysis method to determine the business type of the API.

[0107] In specific implementation, the request path PATH of the corresponding API interface is split according to / , and each split character is analyzed and combined to determine the business type to which the API belongs, such as ecs for virtual machine business, loggin for login interface, etc.

[0108] In specific implementation, different levels of the request path PATH of the API interface are labeled according to the analysis results of the short text, and the labels are associated with the business type to which the API belongs. The request path PATH of each API interface can have multiple labels, and each label has different dimensions.

[0109] For example, the label of / api / product is product, the label of ecs is cloud host, and so on.

[0110] Specifically, the business type to which the API belongs can have multiple dimensions and can be divided into personal information, banking business, and operational business according to the content. It can also be classified according to organizational structure, business system, or the region to which the business belongs.

[0111] Each type of business can have multiple levels, such as banking business, which can be subdivided into loan business and storage business, etc.

[0112] A tag consists of a tag name, type, security level, paranoia level, whether it is enabled, detection method, detection object, rule content, sample data, and test results. The name of a tag is unique. The type includes business type and data type, and the hierarchical relationship between business type and data type is established in a tree structure. Paranoia level refers to the looseness of execution, and each site or tenant can choose a different paranoia level. Detection methods include regular expressions, dictionaries, and short texts. The detection object specifies the specific detection content, specifically the request header, request path, request parameters, HOST, UA, COOKIE, request body, and response body; the detection object can be a field in the message or the value corresponding to the field; a tag can specify one or more elements to match. The API analysis system assembles the parsed message and provides the detection object for the tag. The rule content specifies the rule content of the corresponding matching method, including the text content of regular expressions and dictionary matching, as well as logical calculations and calculation functions. The API analysis system analyzes and calculates the content of the API request and the content of the API response according to the specified rule content. The sample data is the sample of the detection data corresponding to the tag, and the test result is the test execution result of the sample.

[0113] During implementation, different tenants or sites can select different tags.

[0114] ⑤ Analyze the metadata of the API interface by using regular expressions, dictionaries, short text analysis and clustering algorithms to determine the data type of the API interface.

[0115] In specific implementation, the metadata of the API interface can be analyzed based on the parsing results of the metadata of the API interface by using regular expressions, dictionaries, short text analysis and clustering algorithms, and the metadata in the API interface can be labeled according to the tags associated with the analysis results. Each tag identifies a different data type of the API interface, and the tag is associated with the data type of the API interface. The data information associated with the API interface is determined based on the data type of the API interface.

[0116] Regular expressions and dictionaries are associated with tags. When the request and response content of the API interface matches the rules, the corresponding tags will be added. Short text analysis is similar. The analysis results are associated with tags. When the corresponding content of the API interface matches the analysis results, the API interface will be labeled accordingly.

[0117] Based on the request parameters of the API interface and the metadata in the request message and the response message, specifically, taking HTTP as an example, it can be an analysis of fields and data, including the HTTP header and entity content; by using regular expressions, dictionaries, short text analysis and clustering algorithms, determine the data type of the API interface;

[0118] In specific implementation, the business type to which the API interface belongs has multiple levels and multiple dimensions, and the data type of the API interface has multiple levels; based on any dimension combined with the business type to which the API interface belongs and the data type of the API interface, the asset classification and grading of the API interface is determined.

[0119] In specific implementation, the URL request parameters of the request message and the UA can be used to determine the user's device type; the composition of the cookie can be used to determine the user type.

[0120] S4. Determine the classification and grading of API assets based on business type and data type.

[0121] Combined with the business type and data type of the API interface, determine the asset priority of the API interface according to the priority corresponding to the business type and data type of the API interface. Determine the asset classification of the API interface according to the hierarchical relationship of the business type and the category of the data type. If the priorities are different, the higher priority shall prevail. An asset of an API interface can be divided according to multiple dimensions.

[0122] In specific implementation, the metadata in the API interface can be labeled according to the analysis results of the metadata of the API interface. Each label identifies a different data type of the API interface. The label is associated with the data type of the API interface. The data information associated with the assets of the API interface is determined according to the data type of the API interface. The asset classification of the API interface is determined in combination with the business type to which the API interface belongs.

[0123] The request path PATH of the API interface is divided into levels, and its business function is determined based on the information of the request path PATH of the API interface. Furthermore, based on the request message and response message of the API interface, the API interface and the message are identified and scored in combination with regular expressions, dictionaries, short texts and clustering algorithms, and verified by security personnel.

[0124] The asset classification of API interfaces provides a basis for risk management and security protection of API interfaces. Different protection measures can be implemented according to the asset classification of API interfaces. For example, different protection strategies can be implemented for API registration, login, and red envelope grabbing interfaces.

[0125] During specific implementation, the label changes of the API interface can be compared to promptly discover asset changes of the API interface, and the asset protection strategy of the API interface can be adjusted in a timely manner based on the asset changes of the API interface.

[0126] Based on the same inventive concept, the present invention also proposes a device for implementing the hierarchical classification of API assets. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0127] Figure 4 This is a schematic diagram of the structure of the device for implementing the hierarchical classification of API assets of the present invention. Figure 4 As shown, the device comprises:

[0128] The message parsing module 101 is used to parse the obtained request message and response message of the API interface to obtain basic information of the API interface and metadata of the API interface.

[0129] The tag management module 102 is used to manage tags. Tags are composed of tag name, type, security level, paranoia level, whether to enable, detection method, detection object, rule content, sample data and test results;

[0130] The service and data type determination module 103 is used to determine the service type to which the API interface belongs according to the basic information of the API interface, and determine the data type of the API interface in combination with the metadata of the API interface;

[0131] Determine the relationship between the request path of the API interface and the corresponding domain name of the site to which it belongs;

[0132] The request path of the API interface is processed in layers, and the URL request path is decomposed and merged according to the tree structure;

[0133] According to the hierarchical relationship of the domain names corresponding to the sites to which the API interfaces belong, the hierarchical relationship of the request paths of the associated API interfaces is determined to determine the overall hierarchical relationship of the API interface business.

[0134] Parse the domain name corresponding to the site to which the API interface belongs and the request path of the API interface to determine the business type to which the API interface belongs.

[0135] Label different levels of the API interface request path. Labels can be associated with the business type to which the API belongs. Each API interface request path can have multiple labels, and each label has different dimensions.

[0136] Determine the data type of the API interface based on the request parameters of the API interface and the analysis of the metadata of the API interface.

[0137] The asset classification and grading determination module 104 is used to determine the asset classification and grading of the API interface according to the business type to which the API interface belongs and the data type of the API interface;

[0138] The business type to which the API interface belongs has multiple dimensions, and each type of business has multiple levels; the data type of the API interface has multiple levels; based on any dimension combined with the business type to which the API interface belongs and the data type of the API interface, the asset classification and grading of the API interface is determined.

[0139] Determine the asset priority of the API interface based on the priority of the business type to which the API interface belongs and the priority of the data type of the API interface; determine the asset classification of the API interface based on the hierarchical relationship of the business type to which the API interface belongs and the category to which the data type of the API interface belongs. If the priorities are different, the higher priority shall prevail; an asset of an API interface can be divided according to multiple dimensions.

[0140] Implement different protection strategies based on the asset classification of the API interface, and adjust the asset protection strategy of the API interface in real time based on changes in the API interface labels.

[0141] It should be noted that although several modules of the implementation device for hierarchical classification of API assets are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0142] Based on the above invention concept, Figure 5 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220, and when the processor 220 executes the computer program 230, the hierarchical classification of the aforementioned API assets is implemented.

[0143] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for implementing the aforementioned hierarchical classification of API assets.

[0144] The method and device for implementing the hierarchical classification of API assets proposed in the present invention improve the asset management efficiency and accuracy of the API interface.

[0145] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0146] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for implementing hierarchical classification of API assets, characterized in that: The method includes: Parse the obtained API interface request message and response message to obtain the basic information and metadata of the API interface; Determine the business type of the API interface based on the basic information of the API interface, and determine the data type of the API interface in combination with the metadata of the API interface; determine the relationship between the request path of the API interface and the domain name corresponding to the site to which it belongs; perform hierarchical processing on the request path of the API interface, and decompose and merge the URL request path according to the tree structure; determine the overall hierarchical relationship of the API interface business based on the hierarchical relationship of the domain name corresponding to the site to which the API interface belongs, and associate the hierarchical relationship of the request path of the API interface; parse the domain name corresponding to the site to which the API interface belongs and the request path of the API interface to determine the business type of the API interface; Determine the asset classification and grading of the API interface based on the business type to which the API interface belongs and the data type of the API interface.

2. The method for implementing hierarchical classification of API assets according to claim 1, characterized in that: Label different levels of the API interface request path. Labels can be associated with the business type to which the API belongs. Each API interface request path can have multiple labels, and each label has different dimensions.

3. The method for implementing hierarchical classification of API assets according to claim 1, characterized in that: Determine the data type of the API interface based on the request parameters of the API interface and the analysis of the metadata of the API interface.

4. The method for implementing hierarchical classification of API assets according to claim 3, characterized in that: According to the analysis results of the metadata of the API interface, the metadata of the API interface is labeled. The label can be associated with the data type of the API interface, and each label identifies a different data type of the API interface; according to the data type of the API interface, the data information associated with the assets of the API interface is determined, and the API's hierarchical classification is determined in combination with the business type to which the API belongs.

5. The method for implementing hierarchical classification of API assets according to claim 1, characterized in that: The business type to which the API interface belongs has multiple dimensions, and each type of business has multiple levels; the data type of the API interface has multiple levels; based on any dimension combined with the business type to which the API interface belongs and the data type of the API interface, the asset classification and grading of the API interface is determined.

6. The method for implementing hierarchical classification of API assets according to claim 5, characterized in that: Determine the asset priority of the API interface based on the priority of the business type to which the API interface belongs and the priority of the data type of the API interface; Determine the asset classification of the API interface based on the hierarchical relationship of the business type to which the API interface belongs and the category to which the data type of the API interface belongs. If the priorities are different, the higher priority shall prevail. An asset of an API interface can be divided according to multiple dimensions.

7. The method for implementing hierarchical classification of API assets according to claim 1 or 6, characterized in that: Implement different protection strategies based on the asset classification of the API interface, and adjust the asset protection strategy of the API interface in real time based on changes in the API interface labels.

8. A device for implementing hierarchical classification of API assets, characterized in that: The device includes: The message parsing module is used to parse the request message and response message of the obtained API interface to obtain the basic information and metadata of the API interface; The tag management module is used to manage tags, including tag name, type, security level, paranoia level, whether to enable, detection method, detection object, rule content, sample data and test results; The business and data type determination module is used to determine the business type of the API interface based on the basic information of the API interface, and determine the data type of the API interface in combination with the metadata of the API interface; determine the relationship between the request path of the API interface and the domain name corresponding to the site to which it belongs; perform hierarchical processing on the request path of the API interface, and decompose and merge the URL request path according to the tree structure; associate the hierarchical relationship of the request path of the API interface with the hierarchical relationship of the domain name corresponding to the site to which the API interface belongs, and determine the overall hierarchical relationship of the business of the API interface; parse the domain name corresponding to the site to which the API interface belongs and the request path of the API interface to determine the business type to which the API interface belongs; label different levels of the request path of the API interface, and the label can be associated with the business type to which the API belongs; each request path of the API interface can have multiple labels, and each label has different dimensions; The asset classification and grading determination module is used to determine the asset classification and grading of the API interface according to the business type to which the API interface belongs and the data type of the API interface.

9. The device for implementing hierarchical classification of API assets according to claim 8, characterized in that: Determine the data type of the API interface based on the request parameters of the API interface and the analysis of the metadata of the API interface.

10. The device for implementing hierarchical classification of API assets according to claim 9, characterized in that: According to the analysis results of the metadata of the API interface, the metadata of the API interface is labeled. The label can be associated with the data type of the API interface, and each label identifies a different data type of the API interface; according to the data type of the API interface, the data information associated with the assets of the API interface is determined, and the API's hierarchical classification is determined in combination with the business type to which the API belongs.

11. The device for implementing hierarchical classification of API assets according to claim 8, characterized in that: The business type to which the API interface belongs has multiple dimensions, and each type of business has multiple levels; the data type of the API interface has multiple levels; based on any dimension combined with the business type to which the API interface belongs and the data type of the API interface, the asset classification and grading of the API interface is determined.

12. The device for implementing hierarchical classification of API assets according to claim 11, characterized in that: Determine the asset priority of the API interface based on the priority of the business type to which the API interface belongs and the priority of the data type of the API interface; Determine the asset classification of the API interface based on the hierarchical relationship of the business type to which the API interface belongs and the category to which the data type of the API interface belongs. If the priorities are different, the higher priority shall prevail. An asset of an API interface can be divided according to multiple dimensions.

13. The device for implementing hierarchical classification of API assets according to claim 8 or 12, characterized in that: Implement different protection strategies based on the asset classification of the API interface, and adjust the asset protection strategy of the API interface in real time based on changes in the API interface labels.

14. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 6.

Images