API asset identification method, device, equipment and storage medium

Abstract

The present invention discloses an API asset identification method, device, equipment and storage medium. The method comprises: obtaining network traffic data in a cloud environment; filtering the network traffic data to obtain interface information; identifying different types of application program interfaces API in the interface information, and classifying the API to obtain classified API assets. The method can obtain classified API assets by identifying APIs in the network traffic data of a cloud environment, thereby ensuring the clarity of API assets and thus ensuring data security.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network technology, and in particular to an API asset identification method, device, equipment and storage medium. Background Art

[0002] With the development of cloud computing, big data, and mobile Internet, more and more systems in enterprises are running in cloud environments, and the calls, accesses, and data sharing between systems are becoming more frequent. In this process, the Application Programming Interface (API) plays a vital role as an important channel for data transmission and circulation. The API interface provides functions, methods, and protocols, allowing data exchange and sharing between different systems, thereby achieving data interoperability.

[0003] However, while API interfaces bring convenient access, the data security issues related to them are becoming increasingly prominent. As an important channel for data circulation on the cloud, API has become the most frequently used carrier by cyber attackers, who exploit interface vulnerabilities to steal sensitive data and business information of enterprises. Due to the unclear API assets, there are a large number of outdated and abandoned zombie APIs, which increase the API security threat in the absence of security protection, resulting in excessive exposure of sensitive information in the API interface. Once the above security issues are exploited, it will lead to information leakage and even the takeover of databases and servers. In other words, the unclear API assets are the root cause of the above problems. Summary of the invention

[0004] The present invention provides an API asset identification method, device, equipment and storage medium to solve the problem of unclear API assets in the prior art.

[0005] According to one aspect of the present invention, there is provided an API asset identification method, the method comprising:

[0006] Obtain network traffic data in cloud environments;

[0007] Filtering the network traffic data to obtain interface information;

[0008] Different types of application program interfaces API in the interface information are identified, and the APIs are classified to obtain classified API assets.

[0009] According to another aspect of the present invention, there is provided an API asset identification device, the device comprising:

[0010] An acquisition module, used to acquire network traffic data in a cloud environment;

[0011] A filtering module, used for filtering the network traffic data to obtain interface information;

[0012] The identification module is used to identify different types of application program interfaces API in the interface information and classify the API to obtain classified API assets.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising: at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the API asset identification method described in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the API asset identification method described in any embodiment of the present invention when executed.

[0017] An API asset identification method, device, equipment and storage medium according to an embodiment of the present invention include: obtaining network traffic data in a cloud environment; filtering the network traffic data to obtain interface information; identifying different types of application program interfaces API in the interface information, and classifying the API to obtain classified API assets. The method can obtain classified API assets by identifying APIs in the network traffic data of the cloud environment, thereby ensuring the clarity of API assets and data security.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A flowchart of an API asset identification method provided in Embodiment 1 of the present invention;

[0021] Figure 2 A schematic diagram of obtaining network traffic data provided by an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of a process of API asset classification provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of a tree structure provided by an embodiment of the present invention;

[0024] Figure 5 A flowchart of an API asset identification method provided by an embodiment of the present invention;

[0025] Figure 6 A schematic diagram of the structure of an API asset identification device provided in Embodiment 2 of the present invention;

[0026] Figure 7 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only an embodiment of a part of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should belong to the scope of protection of the present invention. It should be understood that the various steps recorded in the method implementation of the present invention can be performed in different orders and / or in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0028] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0031] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0032] Embodiment 1

[0033] Figure 1 A flowchart of an API asset identification method provided in Embodiment 1 of the present invention is provided. The method can be applicable to situations where API assets are identified and classified. The method can be executed by an API asset identification device, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device. In this embodiment, the electronic device includes but is not limited to: computers and other devices.

[0034] like Figure 1 As shown, an API asset identification method provided in Embodiment 1 of the present invention includes the following steps:

[0035] S110. Obtain network traffic data in the cloud environment.

[0036] The cloud environment may be an operating environment of an enterprise system, and different systems may transmit information through interfaces in the cloud environment. Network traffic data may be data transmitted by the enterprise in the cloud environment.

[0037] In this embodiment, the network traffic data of the enterprise can be obtained from the cloud environment by setting a collection point. Figure 2 A schematic diagram of obtaining network traffic data provided by an embodiment of the present invention is shown in FIG. Figure 2As shown in the figure, in the cloud environment, there are both external systems that call the internal systems of the enterprise through interfaces, such as information query of product attributes exposed to the outside, processing of workflows, etc., and information sharing between internal systems through interfaces, such as employee information sharing query, product information sharing, etc. This requires setting up network traffic data collection points at the enterprise's outbound access port and the information convergence point of the intranet, and then selecting the appropriate switch port for traffic collection. After determining the collection point, the network traffic data collection device can be set up by copying the mirrored traffic of the switch port. In this way, the device performs real-time traffic replication to obtain the network traffic information of the cloud environment outbound access and the east-west network traffic information of the enterprise. The network traffic data can also be collected by default in bypass mode. The bypass mode is to bypass and copy the existing real-time traffic without intercepting the traffic, which does not affect the normal flow of the business. After the network traffic data is copied and collected, the traffic information can be stored in the clustered deployment data structure analysis device at the back end through asynchronous transmission.

[0038] In one embodiment, obtaining network traffic data in a cloud environment includes:

[0039] Collect initial network traffic data in the cloud environment through a collector;

[0040] The initial network traffic data is structured and the structured data is used as network traffic data in the cloud environment.

[0041] Among them, the collector can be a device for collecting network traffic data. The type of collector can be selected according to the type of network traffic data, and the location of the collector can be set according to the transmission path of the network data traffic. For example, the network traffic data in the cloud environment involves different types of data. For special data formats, a suitable collector should be selected and parsed through the data format that matches it. The collector of this embodiment can support the parsing of data formats such as HTML, XML, MIME, JSON, ASCII, and multiple mixed types, and support log data of various network devices. The initial network traffic data can be unprocessed data.

[0042] In this embodiment, the data collected from the cloud environment by the collector can be used as the initial network traffic data, and the initial network traffic data can be structured. Exemplarily, the structured processing of the initial network traffic data may include cleaning, conversion and enrichment. The cleaning of network traffic data is due to the fact that the network traffic data is relatively messy. The cleaning process may include removing invalid data, expired data, duplicate data and erroneous data to maintain the atomic consistency of the network traffic data. The conversion of traffic data is due to the fact that some standard parameter formats of the collected network traffic data are different, such as source parameter format, regional parameter format, time parameter format, etc., and these parameters need to be standardized and converted into a unified format with higher recognition. The enrichment of traffic data is due to the fact that the converted network traffic data has recognition, but lacks the common parameter part before storage, such as storage time parameters, collection time parameters, collection data source parameters, etc., and such parameters need to be enriched to better trace the network traffic data and multi-dimensional query operations.

[0043] In one embodiment, the network traffic data may also be stored via asynchronous clustering.

[0044] In this embodiment, after the network traffic data is structured, the data quality has been improved and the data has availability. Then, such data can be stored. In order to increase the storage speed, the data can be cached first. When the cache reaches a certain threshold, this part of the data is stored in the cluster database.

[0045] S120: Filter the network traffic data to obtain interface information.

[0046] The interface information may be information related to an API in network traffic data.

[0047] In this embodiment, the initial network traffic data in the cloud environment is converted into recognizable and regular structured data after structured analysis. This part of structured network traffic data includes network access logs, WAF access log data, firewall log data, DLP data and various business system data. Due to the large amount of data, diverse types, and complex structure, simply relying on regular matching of API interface type data has problems such as low processing efficiency, long running time, and low result accuracy. Therefore, this embodiment can first filter the network data traffic to remove non-real interface traffic, such as static resources or streaming media resources, JPG, PNG, GIT, AVI, MPEG, etc., and obtain the interface information that can be called after filtering. The obtained interface information mainly includes three types of interfaces: GraphQL, Restful and SOAP type interfaces.

[0048] S130: Identify different types of application programming interfaces (APIs) in the interface information, and classify the APIs to obtain classified API assets.

[0049] Application programming interfaces are predefined functions that allow applications and developers to access a set of routines based on certain software or hardware without having to access the source code or understand the details of the internal working mechanism. API assets can be all APIs used by an enterprise.

[0050] In this embodiment, different types of APIs in the interface information may be classified, so that APIs of the same type may be grouped together to obtain classified API assets.

[0051] In one embodiment, the identifying different types of application programming interfaces (APIs) in the interface information and classifying the APIs to obtain classified API assets includes:

[0052] The interface information is preliminarily classified according to the characteristics of different interface types to obtain classified interface information of different interface types; similar interfaces in the classified interface information are classified by a classification algorithm to obtain classified interface information; the classified interface information is aggregated by an aggregation algorithm to obtain classified API assets.

[0053] Among them, the classified interface information may include interfaces of the same interface type, that is, the classified interface information after preliminary classification only includes interfaces of the same type. For example, when the interface types in the interface information include GraphQL, Restful and SOAP, the classified interface information includes classified interface information of GraphQL type, classified interface information of Restful type and classified interface information of SOAP type. The classification algorithm may be an algorithm for further classifying interfaces of the same type that have been preliminarily classified. The classified interface information may be interface information after interfaces of the same type are merged. The aggregation algorithm may be an algorithm for aggregating interfaces including variable path interfaces.

[0054] In this embodiment, the interface information can be preliminarily classified by the response message and the request message in the interface information, and the type of the interface can be determined according to the parameters in the response message and the request message. After the classified interface information is obtained through classification, it can be further classified by the classification algorithm and the aggregation algorithm to obtain the classified API assets. Figure 3 A schematic diagram of a process of API asset classification provided by an embodiment of the present invention, such as Figure 3As shown, interfaces can be initially divided into three types according to the characteristics corresponding to different interface types. For example, GraphQL API is a query language used for APIs. It performs related query operations by means of types and fields. It is a query similar to the Json format, such as query{name{id}}. Therefore, GraphQL type API assets can be identified by identifying whether there are query, mutation or subscription key fields in the request. When the Json format is detected in the network data traffic, if the input parameter value is a special data structure, and the response parameters correspond one-to-one with the request parameters, it can be determined that the interface is of GraphQL type.

[0055] SOAP API transmits object information in XML format, which includes four different elements. Document mark information Envelope is a required element, and the message starts and ends with the envelope tag; Heager is an optional element that can be used to add new features and functions; Body is the actual message of the text and is also a required element; Fault is used to identify error messages and status information when a problem occurs during the processing. If the above required elements or required elements and optional elements are identified in the network traffic data, this interface is of SOAP type.

[0056] Restful API can be identified through a variety of judgment conditions and methods, including the verb methods in HTTP, such as GET, POST, and DELETE description operations; version control methods, such as the V1 and V2 version identifiers in the URL; in addition, the type of Restful API can be more accurately identified by analyzing the parameters of the Accept request header and counting the first few digits of the URL endpoint to see whether there are the same fields.

[0057] A method for identifying API assets is provided in a first embodiment of the present invention, and the method includes: obtaining network traffic data in a cloud environment; filtering the network traffic data to obtain interface information; identifying different types of application program interfaces API in the interface information, and classifying the API to obtain classified API assets. The method can obtain classified API assets by identifying APIs in the network traffic data of a cloud environment, thereby ensuring the clarity of API assets and thus ensuring data security.

[0058] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0059] In one embodiment, the classification algorithm includes a dictionary tree classification algorithm; accordingly, the similar interfaces in the classified interface information are classified by the classification algorithm to obtain the classified interface information, including:

[0060] Splitting each interface in the classified interface information by an identifier to obtain a tree structure corresponding to similar interfaces;

[0061] Calculate the uniform resource locator URL length information corresponding to each interface according to the tree structure;

[0062] The interfaces with the same URL length information and the same hierarchical attributes of non-leaf nodes are classified to obtain classified interface information.

[0063] Among them, the dictionary tree classification algorithm, also known as the cubic search tree or key tree, is a tree structure that is a variant of the hash tree. It is mainly used in data statistics, data sorting, and string classification scenarios. Its advantage is that it can be used for common prefixes of strings to reduce query time and maximize the inspection of irrelevant string comparisons, so the comparison and query efficiency is high.

[0064] Among them, the identifier can be a symbol used to divide the interface. For example, this embodiment can be divided by the identifier " / ". Similar interfaces can be interfaces with a common prefix. The tree structure can be a method of expressing the hierarchical structural properties in a graphical manner. The tree structure can be constructed through the hierarchical relationship between interfaces. The Uniform Resource Locator (URL) is the address of a given unique resource on the Web. Each valid URL points to a unique resource, which can be an HTML page, a CSS document, an image, and so on. The length information can be the length of the interface URL obtained according to the tree structure. Non-leaf nodes can be nodes other than leaf nodes in the tree structure. Hierarchical attributes can be attributes of nodes, and hierarchical attributes can include data types, letter types or other types.

[0065] In this embodiment, the classification algorithm can be a dictionary tree classification algorithm. After preliminary classification of structured network traffic data, classified interface information including three types of interface information is obtained. These interface information still have repeated interfaces with large data volume and similar shapes. Therefore, this embodiment can continue to merge and classify similar URLs under the same type of interface through the dictionary tree classification algorithm. For example, htpps: / / domain / a1b1 / c1 / 1001 and htpps: / / domain / a1b1 / c1 / 1002 can be aggregated into one API interface: htpps: / / domain / a1b1 / c1 / {str}.

[0066] For example, in the scenario of similar API identification, the interface information is first split by “ / ” to obtain a tree structure, such as the following API interface information:

[0067] http: / / domain / a1b1 / e1f1

[0068] http: / / domain / a1b1 / e2f2

[0069] http: / / domain / a2b2 / c1d1 / 1001

[0070] http: / / domain / a2b2 / c1d1 / 1002

[0071] http: / / domain / a2b2 / c1d1 / 1003

[0072] Figure 4 A tree structure diagram provided by an embodiment of the present invention can be constructed according to the above interface through a dictionary number classification algorithm. Figure 4 The tree structure shown in the figure can be used to count the URL length information of each interface based on the tree structure: the distance from the leaf node to the root node. If the URL length information of two interfaces is the same, the attributes of the same level of the tree structure can be further compared to see if they are the same. When the attributes of the same level are the same and the types of the leaf nodes are all digital types (or regular types), the two interfaces can be classified together. For example, if the hierarchical attributes of the interfaces htpps: / / domain / a1b1 / c1 / 1001 and htpps: / / domain / a1b1 / c1 / 1002 are the same in the tree structure, the two interfaces can be classified as htpps: / / domain / a2b2 / c1d1 / {str}. If the URL length information is the same, but the leaf nodes are non-digital types (or irregular types), they are judged to be different types of interfaces, that is, htpps: / / domain / a1b1 / e1f1 and htpps: / / domain / a1b1 / e2f2 are two different types of interfaces.

[0073] In one embodiment, the aggregation algorithm includes a cosine similarity aggregation algorithm. Accordingly, the aggregation process of the classified interface information by the aggregation algorithm to obtain the classified API assets includes:

[0074] Segmenting the variable paths of the interfaces in the classified interface information to obtain segmentation results;

[0075] Determine the frequency of each word in the word segmentation result appearing in the interface;

[0076] Calculating cosine similarities between different interfaces based on the frequencies;

[0077] The interfaces whose cosine similarity meets the preset threshold are aggregated to obtain classified API assets.

[0078] Among them, the cosine similarity aggregation algorithm is a clustering method based on cosine similarity. It calculates the cosine similarity between samples and classifies samples with high similarity into one category, thereby realizing data clustering. The value range of cosine similarity is between -1 and 1. The closer the value is to 1, the more similar the two vectors are, and the closer the value is to -1, the less similar the two vectors are.

[0079] The variable path may be a variable text in the path. The word segmentation result may be the result of the variable path being split into characters. The word segmentation may be a character in the word segmentation result. The frequency may be the number of times each word segmentation appears in the interface. The preset threshold may be a value that meets the aggregation condition, and the preset threshold may be set according to actual conditions.

[0080] In this embodiment, the interfaces in the classified interface information can be further aggregated, and interfaces with the same path length, the same separator, the existence of variable paths and the same symbols except the variable paths in the classified interface information are selected, and the variable paths of each interface are segmented to obtain segmentation results, and the frequency of occurrence of the words in each segmentation result in each interface is calculated, and the cosine similarity between different interfaces is calculated according to the frequency. When the cosine similarity meets the preset threshold, different interfaces can be aggregated together. When all interfaces in the classified interface information are processed, the classified API assets are obtained.

[0081] Exemplarily, the interfaces in the classified interface information obtained by the dictionary tree classification algorithm belong to the same business system, have the same path length, have the same path, and have variable path interfaces, such as the following interface information:

[0082] Interface 1: http: / / domain / a1b1-e1f1-J1k1 / c1d1 / 1001

[0083] Interface 2: http: / / domain / a1b2-e1f2-J2k2 / c1d1 / 1002

[0084] If this type of interface is matched with a regular expression, the result is three different interfaces, but through analysis, it can be found that these interfaces are of the same type, but have variable paths. Therefore, this embodiment can aggregate these interfaces with variable paths through the cosine similarity aggregation algorithm, specifically including:

[0085] First, segment the attributes of the variable path. The variable paths of the above interface information are a1b1-e1f1-J1k1 and a1b2-e1f2-J2k2.

[0086] Interface 1 word segmentation (separated by slashes): a1 / b1 / - / e1 / f1 / - / J1 / k1

[0087] Interface 2 word segmentation (separated by slashes): a1 / b2 / - / e1 / f2 / - / J2 / k2

[0088] It can be obtained that all the segmented words are a1 / b1 / - / e1 / f1 / J1 / k1 / b2 / f2 / J2 / k2. The frequency of each segmented word in the interface is calculated. A1(1) represents the number of times segmented word a1 appears in interface 1. The frequency of segmented words in the two types of interfaces is as follows:

[0089] Interface 1 frequency: a1(1) / b1(1) / -(3) / e1(1) / f1(1) / J1(1) / k1(1) / b2(0) / f2(0) / J2(0) / k2(0)

[0090] Interface 2 frequency: a1(1) / b1(0) / -(3) / e1(1) / f1(0) / J1(0) / k1(0) / b2(1) / f2(1) / J2(1) / k2(1)

[0091] List the word frequency vectors of the segmented words according to their frequency

[0092] The word vector of interface 1: (1, 1, 3, 1, 1, 1, 1, 0, 0, 0, 0)

[0093] The word vector of interface 2: (1, 0, 3, 1, 0, 0, 0, 1, 1, 1, 1)

[0094] The cosine similarity value is calculated according to the following formula:

[0095]

[0096] Among them, A is the word segmentation vector of interface 1, and B is the word segmentation vector of interface 2. The cosine similarity can be obtained:

[0097]

[0098] The calculated cosine similarity is 0.733, which is close to 1. If the preset threshold is set to 0.7, then interface 1 is very similar to interface 2. Therefore, interface 1 and interface 2 are aggregated, and the aggregated interface is http: / / domain / {str} / c1d1 / {str}. By aggregating similar interfaces, we can sort out the assets and quantities of APIs that are close to the real ones.

[0099] In one embodiment, the method further comprises:

[0100] Perform real-time monitoring of data transmitted by the API in the API asset;

[0101] If sensitive data appears in the data, the staff will be warned.

[0102] Among them, sensitive data can be data that enterprises or individuals cannot disclose to the outside.

[0103] In this embodiment, after the API assets are identified, the APIs in the API assets can be monitored in real time. If the business information of the enterprise or the sensitive data of an individual is found in the input and output parameters of the interface, an alarm can be issued to the staff. Figure 5 A flowchart of an API asset identification method provided by an embodiment of the present invention is shown as follows: Figure 5 As shown, after asset identification of the API, sensitive data in the API can be monitored.

[0104] The monitoring scope can be all identified API assets, and the call response information of these interfaces can be checked in real time. The inspection rules can be used in conjunction with sensitive data detection methods for identification, or sensitive databases can be configured for key information matching. When sensitive data leakage is found in certain API assets, on the one hand, the exposure surface can be converged and the business team can be notified to deal with it in time. On the other hand, the leakage information can be collected to assess the loss, including the time of leakage and the amount of leaked data, and then the loss caused by the leakage to the enterprise or individual can be assessed, including the loss of the company's brand and reputation. Finally, the cause of the data leakage incident is thoroughly investigated, the existing security vulnerabilities are analyzed, and they are repaired to form a closed-loop disposal to protect personal privacy and corporate information security.

[0105] In one embodiment, the method further comprises:

[0106] Perform vulnerability scanning on the API assets using an automated scanning tool to obtain scanning results;

[0107] When the scan results indicate that the API asset has a vulnerability, the staff is alerted.

[0108] The automated scanning tool may be a tool that can automatically scan for vulnerabilities. The scanning result may be a scanning result of a vulnerability, and the scanning result may include whether a vulnerability exists or does not exist, which is not limited in this embodiment.

[0109] In this embodiment, for the identified API assets, vulnerability scanning can be performed through various detection methods to obtain scanning results. If it is determined that the API assets have vulnerabilities based on the scanning results, the staff can be alerted. For example, automated scanning tools can be used to perform vulnerability scanning, such as using Burp, AppScan, etc. to discover authentication and authorization defects, SQL injection defects, path traversal defects, etc. of the interface; detection can be performed by simulating hacker attack methods, and penetration testing can be performed on the API, such as using "bypass authentication", "input verification" and other means to verify interface defects; through privilege escalation vulnerabilities, higher permissions of the API can be obtained, thereby performing interface detection.

[0110] After detecting and discovering API asset vulnerabilities, this embodiment can handle the vulnerabilities through email or the company's work order process, timely discover and respond to potential security threats and quickly repair the vulnerabilities, thereby protecting the security of the API interface in the cloud environment.

[0111] The API asset identification method of this embodiment collects and detects the system access traffic on the cloud environment in real time, performs structured analysis on the collected network traffic data, and performs closed-loop disposal of API risks through API asset identification, real-time monitoring of sensitive data in the API, and timely detection of API vulnerability information. In this way, the API asset information can be effectively managed to reduce the exposure surface, and the sensitive data in the API interface can be fully protected from unauthorized access and abuse, ensuring the data security of the enterprise cloud environment and the healthy development of the business.

[0112] Embodiment 2

[0113] Figure 6 This is a schematic diagram of the structure of an API asset identification device provided in the second embodiment of the present invention. The device can be used to identify and classify API assets, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device.

[0114] like Figure 6 As shown, the device comprises:

[0115] An acquisition module 210 is used to acquire network traffic data in a cloud environment;

[0116] A filtering module 220, configured to filter the network traffic data to obtain interface information;

[0117] The identification module 230 is used to identify different types of application programming interfaces (APIs) in the interface information and classify the APIs to obtain classified API assets.

[0118] This embodiment provides an API asset identification device, including: an acquisition module for acquiring network traffic data in a cloud environment; a filtering module for filtering the network traffic data to obtain interface information; and an identification module for identifying different types of application program interfaces API in the interface information, and classifying the API to obtain classified API assets. By identifying the API in the network traffic data of the cloud environment, the classified API assets can be obtained, which ensures the clarity of the API assets and thus ensures data security.

[0119] Furthermore, the identification module 230 includes:

[0120] A classification unit, used to preliminarily classify the interface information according to the characteristics of different interface types, and obtain classified interface information of different interface types;

[0121] A classification unit, used for classifying similar interfaces in the classified interface information by using a classification algorithm to obtain the classified interface information;

[0122] The aggregation unit is used to aggregate the classified interface information through an aggregation algorithm to obtain classified API assets.

[0123] Furthermore, the classification algorithm includes a dictionary tree classification algorithm; accordingly, the classification unit includes:

[0124] Splitting each interface in the classified interface information by an identifier to obtain a tree structure corresponding to similar interfaces;

[0125] Calculate the uniform resource locator URL length information corresponding to each interface according to the tree structure;

[0126] The interfaces with the same URL length information and the same hierarchical attributes of non-leaf nodes are classified to obtain classified interface information.

[0127] Furthermore, the aggregation algorithm includes a cosine similarity aggregation algorithm, and accordingly, the aggregation unit includes:

[0128] Segmenting the variable paths of the interfaces in the classified interface information to obtain segmentation results;

[0129] Determine the frequency of each word in the word segmentation result appearing in the interface;

[0130] Calculating cosine similarities between different interfaces based on the frequencies;

[0131] The interfaces whose cosine similarity meets the preset threshold are aggregated to obtain classified API assets.

[0132] Furthermore, the acquisition module 210 includes:

[0133] Collect initial network traffic data in the cloud environment through a collector;

[0134] The initial network traffic data is structured and the structured data is used as network traffic data in the cloud environment.

[0135] Furthermore, the device comprises:

[0136] Perform real-time monitoring of data transmitted by the API in the API asset;

[0137] If sensitive data appears in the data, the staff will be warned.

[0138] Furthermore, the device comprises:

[0139] Perform vulnerability scanning on the API assets using an automated scanning tool to obtain scanning results;

[0140] When the scan results indicate that the API asset has a vulnerability, the staff is alerted.

[0141] The above-mentioned API asset identification device can execute the API asset identification method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0142] Embodiment 3

[0143] Figure 7 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0144] like Figure 7As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0145] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0146] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the API asset identification method.

[0147] In some embodiments, the API asset identification method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the API asset identification method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the API asset identification method in any other appropriate manner (e.g., by means of firmware).

[0148] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0149] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0150] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0151] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0152] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0153] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0154] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0155] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An API asset identification method, characterized in that: The method comprises: Obtain network traffic data in a cloud environment; the cloud environment is the operating environment of the enterprise system, and different systems transmit information through interfaces in the cloud environment. The systems in the cloud environment include external systems and internal systems; the external system calls the enterprise's internal system through an interface, and the external system calls the internal system to query information on product attributes exposed to the outside and process workflows; the internal systems share information through interfaces, and information sharing includes employee information sharing and product information sharing; the network traffic data is data transmitted by the enterprise in the cloud environment; Filtering the network traffic data to obtain interface information; Identifying different types of application programming interfaces (APIs) in the interface information, and classifying the APIs to obtain classified API assets; The identifying different types of application program interfaces API in the interface information and classifying the API to obtain classified API assets includes: Preliminarily classifying the interface information according to the characteristics of different interface types to obtain classified interface information of different interface types; Classifying similar interfaces in the classified interface information by a classification algorithm to obtain classified interface information; Aggregate the classified interface information using an aggregation algorithm to obtain classified API assets; The classification algorithm includes a dictionary tree classification algorithm; accordingly, the similar interfaces in the classified interface information are classified by the classification algorithm to obtain the classified interface information, including: Each interface in the classified interface information is divided by an identifier to obtain a tree structure corresponding to similar interfaces; wherein each interface in the classified interface information corresponds to a URL link, and the similar interfaces are interfaces with a common prefix; Calculate the uniform resource locator URL length information corresponding to each interface according to the tree structure; Classify the interfaces with the same URL length information and the same hierarchical attributes of non-leaf nodes to obtain classified interface information; The aggregation algorithm includes a cosine similarity aggregation algorithm. Accordingly, the classified interface information is aggregated by the aggregation algorithm to obtain the classified API assets, including: Segmenting the variable paths of the interfaces in the classified interface information to obtain segmentation results; wherein the interfaces in the classified interface information are interfaces with the same path length, the same separator, the presence of variable paths, and the same symbols except for the variable paths; Determine the frequency of each word in the word segmentation result appearing in the interface; Calculating cosine similarities between different interfaces based on the frequencies; The interfaces whose cosine similarity meets the preset threshold are aggregated to obtain classified API assets.

2. The method according to claim 1, characterized in that The obtaining of network traffic data in the cloud environment includes: Collect initial network traffic data in the cloud environment through a collector; The initial network traffic data is structured and the structured data is used as network traffic data in the cloud environment.

3. The method according to claim 1, characterized in that The method further comprises: Perform real-time monitoring of data transmitted by the API in the API asset; If sensitive data appears in the data, the staff will be warned.

4. The method according to claim 1, characterized in that: The method further comprises: Perform vulnerability scanning on the API assets using an automated scanning tool to obtain scanning results; When the scan results indicate that the API asset has a vulnerability, the staff is alerted.

5. An API asset identification device, characterized in that: The device comprises: An acquisition module is used to acquire network traffic data in a cloud environment; the cloud environment is the operating environment of an enterprise system, and different systems transmit information through interfaces in the cloud environment. The systems in the cloud environment include external systems and internal systems; the external system calls the internal system of the enterprise through an interface, and the external system calls the internal system to query information on product attributes exposed to the outside and process workflows; the internal systems share information through interfaces, and information sharing includes employee information sharing and product information sharing; the network traffic data is data transmitted by the enterprise in the cloud environment; A filtering module, used for filtering the network traffic data to obtain interface information; An identification module, used to identify different types of application program interfaces API in the interface information, and classify the APIs to obtain classified API assets; The identification module comprises: A classification unit, used to preliminarily classify the interface information according to the characteristics of different interface types, and obtain classified interface information of different interface types; A classification unit, used for classifying similar interfaces in the classified interface information by using a classification algorithm to obtain the classified interface information; An aggregation unit, used to aggregate the classified interface information through an aggregation algorithm to obtain classified API assets; The classification algorithm includes a dictionary tree classification algorithm; accordingly, the classification unit includes: Each interface in the classified interface information is divided by an identifier to obtain a tree structure corresponding to similar interfaces; wherein each interface in the classified interface information corresponds to a URL link, and the similar interfaces are interfaces with a common prefix; Calculate the uniform resource locator URL length information corresponding to each interface according to the tree structure; Classify the interfaces with the same URL length information and the same hierarchical attributes of non-leaf nodes to obtain classified interface information; The aggregation algorithm includes a cosine similarity aggregation algorithm. Accordingly, the aggregation unit includes: Segmenting the variable paths of the interfaces in the classified interface information to obtain segmentation results; wherein the interfaces in the classified interface information are interfaces with the same path length, the same separator, the presence of variable paths, and the same symbols except for the variable paths; Determine the frequency of each word in the word segmentation result appearing in the interface; Calculating cosine similarities between different interfaces based on the frequencies; The interfaces whose cosine similarity meets the preset threshold are aggregated to obtain classified API assets.

6. The device according to claim 5, characterized in that The acquisition module comprises: Collect initial network traffic data in the cloud environment through a collector; The initial network traffic data is structured and the structured data is used as network traffic data in the cloud environment.

7. The device according to claim 5, characterized in that The device comprises: Perform real-time monitoring of data transmitted by the API in the API asset; If sensitive data appears in the data, the staff will be warned.

8. The device according to claim 5, characterized in that The device comprises: Perform vulnerability scanning on the API assets using an automated scanning tool to obtain scanning results; When the scan results indicate that the API asset has a vulnerability, the staff is alerted.

9. An electronic device, characterized in that: The device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the API asset identification method according to any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the API asset identification method according to any one of claims 1 to 4 when executed.

Images