Data security monitoring methods and devices

Abstract

This invention discloses a data security monitoring method and apparatus. The method includes: acquiring application interface (API) traffic in an application environment; parsing and reconstructing the API traffic to obtain corresponding API data; parsing network access requests and feedback data based on those requests from the API data; generating a complete event in the application environment based on the network access requests and feedback data; determining the risk value of the API data passing through the API interface based on the complete event and preset dimensions, wherein the preset dimensions include at least: API interface input / output data, API data flow path, and the business logic of the complete event; and determining that high-risk API data exists in the application environment when the risk value exceeds a risk threshold. This invention solves the technical problem of low reliability in related technologies used for API data security monitoring.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and more specifically, to a data security monitoring method and apparatus. Background Technology

[0002] As enterprises migrate more and more data and applications to the cloud, Application Programming Interfaces (APIs) are becoming a key focus for successful digital transformation. The booming development of cloud computing, big data, and artificial intelligence means that more and more application development relies heavily on API calls. As a communication bridge between systems, APIs are becoming a prime target for attackers, with their security vulnerabilities becoming increasingly apparent with the increase in call volume. Therefore, API data security risk monitoring has become paramount. Malicious attackers may exploit APIs to launch various attacks, such as unauthorized access, data breaches, and denial-of-service attacks. To improve system security, building an efficient API data security risk monitoring system has become a critical task.

[0003] In API data security risk monitoring, the key is to achieve efficient monitoring, tracing, and response. By recording key information about API calls, such as source, purpose, and operation history, rapid data security tracing and problem investigation can be supported. Simultaneously, real-time monitoring can help detect abnormal behavior early and take appropriate measures.

[0004] Existing similar products are usually API data security monitoring systems that have evolved from traditional WAF (Web Application Firewall) technology. They are used to record API call information, analyze abnormal API call behavior, and issue real-time alerts after triggering threat alert policies. These systems may include the following structures and characteristics: 1) Product deployment structure: Existing similar products are typically connected in series in the business network, with traffic directly identified through device interfaces, or specific agents are installed on the business hosts to be monitored to capture corresponding traffic data; 2) API asset management: Existing similar products typically use manual import of API data or integration with existing API asset management systems to maintain and update asset data on the monitoring system; 3) API vulnerability management: Existing similar products are based on common and specific vulnerability rules of middleware, databases, etc., and use artificial intelligence learning algorithms to continuously analyze attackers' attack methods and behavioral patterns, extract attacker feature vectors based on this information, and autonomously adjust their own rules and strategies; 4) API risk monitoring: Existing similar products monitor API calls in real time, match abnormal interface access request behavior and monitor dangerous parameters transmitted in network requests based on built-in alarm rules, so as to detect and take measures in a timely manner when anomalies or risks occur. This includes functions such as real-time alerts and logging; 5) Data security auditing and tracing: Existing similar products rely on system logs and security alert events written to the database as raw data, and query and analyze the stored data through an interface or query language. This may include queries for specific time periods, specific APIs, etc.

[0005] While existing products have played a role in the field of API data security monitoring, they still have some limitations, such as a lack of flexibility in asset management, insufficient comprehensiveness and scientific approach to vulnerability management, a lack of diversity in risk warning dimensions, one-sidedness in upgrade traceability information, and insufficient correlation.

[0006] The following are some limitations of existing products:

[0007] 1) High product usage cost: Due to the existing product architecture design and deployment mode, the equipment adopts the traditional serial mode. This requires changes to the network structure of the already built network system, and serial connection in the network can easily cause performance bottlenecks for the equipment, thereby affecting business operations. Using the agent method for data collection often requires plug-in security on the data carrier host, as well as a series of system adaptation tasks. For some high-load, high-density services, performance and risk impact assessments are also required, so the usage cost is relatively high.

[0008] 2) Poor API asset maintainability: In existing products, API asset management mainly relies on manual updates and maintenance. If automatic updates are implemented by connecting to an API asset management platform, it becomes dependent on the platform's data refresh rate. Furthermore, existing products haven't made usability improvements to the merging, aggregation, and display of API assets; they only provide simple data display and listing. Therefore, the maintainability of API assets is relatively poor, resulting in a poor user experience.

[0009] 3) Insufficient comprehensiveness in API vulnerability management: Existing products primarily rely on traditional network security approaches for vulnerability identification and assessment, such as SQL injection attacks, unauthorized exploitation attacks, security configuration vulnerability exploitation attacks, code design vulnerability attacks, and parameter traversal attacks. However, to evade detection by existing security devices and increase their success rate, attackers are increasingly employing methods such as business logic vulnerabilities and simulating real user requests to conceal their attack paths. These methods may then be interpreted by security devices as normal business access. Therefore, API vulnerability management requires a multi-faceted approach to identification and assessment, taking into account various business perspectives.

[0010] 4) Insufficient granularity in real-time API risk monitoring: Real-time risk monitoring must be based on the perspective of API assets. However, an enterprise's API assets may be launched or decommissioned as business scenarios change, or changes may occur during technical architecture upgrades. These changes will cause the API attack surface to change dynamically. Attackers' attack methods targeting API assets are becoming more diversified, covert, and automated, easily bypassing basic protection measures such as frequency limits, usage limits, and authentication and authorization for APIs. In addition, most attackers exploit the logical vulnerabilities listed in the 2023 OWASP API Security Top 10 (object-level authorization failure, identity authentication failure, object attribute-level authorization failure, unlimited resource consumption, function-level authorization failure, etc.) to launch attacks. It is difficult for enterprises to extract characteristic information that distinguishes them from normal users from traffic, thereby blocking the attacks. The main problems with logical attacks on APIs are as follows: ①. Attackers simulate normal API requests, using legitimate API parameters and protocols. This makes it difficult for existing enterprise products to distinguish between attack traffic and normal traffic; ② Attackers achieve their attack objectives by making multiple requests for different API combinations, but existing products struggle to understand the complete context of the attack and cannot conduct in-depth analysis of the relationship and interaction between multiple API requests, resulting in low accuracy and effectiveness in detection; ③ Existing products mainly focus on network protocols and data formats, making it difficult to understand the types and content of sensitive data transmitted in the traffic, which leads to an inability to accurately detect and identify malicious attacks involving sensitive data.

[0011] 5) Difficulty in tracing data security incidents: For tracing the source of abnormal behavior and troubleshooting problems, existing product API log management generally suffers from fragmented log records, non-standard formats, and poor manageability between logs. In the event of a network failure or security incident, it is impossible to quickly identify the responsible party and the leakage path. This affects the timely response and handling of security incidents.

[0012] There is currently no effective solution to the problem of low reliability of the methods used for API data security monitoring in the aforementioned related technologies. Summary of the Invention

[0013] This invention provides a data security monitoring method and apparatus to at least address the technical problem of low reliability in related technologies for API data security monitoring.

[0014] According to one aspect of the present invention, a data security monitoring method is provided, comprising: acquiring application interface (API) traffic in an application environment; performing traffic parsing and reconstruction on the API traffic to obtain API data corresponding to the API traffic; parsing network access requests and feedback data based on the network access requests from the API data; generating a complete event in the application environment based on the network access requests and the feedback data; determining a risk value of the API data passing through the API interface from a preset dimension based on the complete event, wherein the preset dimension includes at least: input / output data of the API interface, the flow path of the API data, and the business logic of the complete event; and determining that high-risk API data exists in the application environment when the risk value is higher than a risk threshold.

[0015] Optionally, obtaining API traffic in the application environment includes: when a mirror port exists in the application environment, sending a first traffic acquisition request to the mirror port, and acquiring the API traffic based on the traffic returned by the mirror port based on the first traffic acquisition request, wherein the first traffic acquisition request carries the identification information of the API interface; when an agent instance exists in the application interface, sending a second traffic acquisition request to the agent instance, and acquiring the API traffic based on the traffic returned by the agent instance based on the second traffic acquisition request, wherein the first traffic acquisition request carries the identification information of the API interface.

[0016] Optionally, performing traffic parsing and restoration on the API traffic to obtain API data corresponding to the API traffic includes: sending the API traffic to a traffic restoration component via a gateway, so that the traffic restoration component uses the API data to simulate the application environment to perform traffic parsing and restoration on the API traffic; and obtaining the data generated in the application environment by simulating the API data to obtain the API data.

[0017] Optionally, generating a complete event in the application environment based on the network access request and the feedback data includes: determining the network access operation type of the API traffic request based on the operation identifier requested by the network access request, wherein the operation identifier corresponds one-to-one with the operation type; determining the operation result of the network access operation of the API traffic request based on the feature information of the feedback data, wherein the feature information includes the following: data integrity and data type; generating the complete event in the application environment based on the network access operation type and the operation result, wherein the complete event is used to represent an event from the network access operation to the target device of the network access operation providing feedback based on the network access operation.

[0018] Optionally, after generating a complete event in the application environment based on the network access request and the feedback data, the method further includes: obtaining an HTTP data stream transmitted in the application environment based on the Hypertext Transfer Protocol (HTTP); identifying the API traffic through the HTTP data stream to obtain the identification information and application data of the API interface; storing the identification information and the application data in a first storage medium, wherein the first storage medium is connected to a front-end device, and the front-end device, upon receiving a call request, retrieves the identification information and / or the application data from the first storage medium and displays the identification information and / or the application data.

[0019] Optionally, after generating a complete event in the application environment based on the network access request and the feedback data, the method further includes: obtaining an HTTP data stream transmitted in the application environment based on the Hypertext Transfer Protocol (HTTP); synchronizing the network access request, the feedback data, the complete event, and the HTTP data stream to a second storage medium, wherein the second storage medium is connected to other business systems, and when the other business systems receive a data request, they retrieve one or all of the network access request, the feedback data, the complete event, and the HTTP data stream from the second storage medium.

[0020] Optionally, after determining that high-risk API data exists in the application environment, the method further includes: collecting the high-risk API data; performing data analysis on the high-risk API data according to different dimensions to obtain analysis results, wherein the dimensions include at least one of the following: data source, attack target, and attack result; and searching for security defense strategies in a defense strategy library based on the analysis results to deal with network attack behaviors corresponding to the high-risk API data, wherein the defense strategy library stores different defense strategies.

[0021] According to another aspect of the present invention, a data security monitoring device is also provided, comprising: a first acquisition unit, configured to acquire application interface (API) traffic in an application environment; a second acquisition unit, configured to perform traffic parsing and reconstruction on the API traffic to obtain API data corresponding to the API traffic; a parsing unit, configured to parse network access requests and feedback data based on the network access requests from the API data; a generation unit, configured to generate a complete event in the application environment based on the network access requests and the feedback data; a first determination unit, configured to determine the risk value of the API data passing through the API interface from a preset dimension based on the complete event, wherein the preset dimension includes at least: input / output data of the API interface, flow path of the API data, and business logic of the complete event; and a second determination unit, configured to determine that high-risk API data exists in the application environment when the risk value is higher than a risk threshold.

[0022] Optionally, the first acquisition unit includes: a first acquisition module, configured to send a first traffic acquisition request to the mirror port when a mirror port exists in the application environment, and acquire the API traffic based on the traffic returned by the mirror port based on the first traffic acquisition request, wherein the first traffic acquisition request carries the identification information of the API interface; and a second acquisition module, configured to send a second traffic acquisition request to the agent instance when an agent instance exists in the application interface, and acquire the API traffic based on the traffic returned by the agent instance based on the second traffic acquisition request, wherein the first traffic acquisition request carries the identification information of the API interface.

[0023] Optionally, the second acquisition unit includes: a restoration module, configured to send the API traffic to a traffic restoration component via a gateway, so that the traffic restoration component can use the API data to simulate the application environment and perform traffic parsing and restoration on the API traffic; and a third acquisition module, configured to acquire the data generated in the application environment by simulating the API data to obtain the API data.

[0024] Optionally, the generation unit includes: a first determining module, configured to determine the network access operation type of the API traffic request based on the operation identifier requested by the network access request, wherein the operation identifier corresponds one-to-one with the operation type; a second determining module, configured to determine the operation result of the network access operation of the API traffic request based on the feature information of the feedback data, wherein the feature information includes the following: data integrity and data type; and a generation module, configured to generate the complete event in the application environment based on the network access operation type and the operation result, wherein the complete event represents an event from the network access operation to the target device of the network access operation providing feedback based on the network access operation.

[0025] Optionally, the data security monitoring device further includes: a third acquisition unit, configured to acquire an HTTP data stream transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment after generating a complete event in the application environment based on the network access request and the feedback data; a fourth acquisition unit, configured to identify the API traffic through the HTTP data stream to obtain the identification information and application data of the API interface; and a storage unit, configured to store the identification information and the application data in a first storage medium, wherein the first storage medium is connected to a front-end device, and the front-end device, upon receiving a call request, retrieves the identification information and / or the application data from the first storage medium and displays the identification information and / or the application data.

[0026] Optionally, the data security monitoring device further includes: a fifth acquisition unit, configured to acquire an HTTP data stream transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment after generating a complete event in the application environment based on the network access request and the feedback data; and a synchronization unit, configured to synchronize the network access request, the feedback data, the complete event, and the HTTP data stream to a second storage medium, wherein the second storage medium is connected to other business systems, and when the other business systems receive a data request, they retrieve one or all of the network access request, the feedback data, the complete event, and the HTTP data stream from the second storage medium.

[0027] Optionally, the data security monitoring device further includes: a collection unit, used to collect the high-risk API data after determining that high-risk API data exists in the application environment; a sixth acquisition unit, used to perform data analysis on the high-risk API data according to different dimensions to obtain analysis results, wherein the dimensions include at least one of the following: data source, attack target, attack result; and a seventh acquisition unit, used to search for security defense strategies in the defense strategy library based on the analysis results to deal with network attack behaviors corresponding to the high-risk API data, wherein the defense strategy library stores different defense strategies.

[0028] According to another aspect of the present invention, a data security monitoring system is also provided, which uses any of the data security monitoring methods described above.

[0029] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein the program executes any of the data security monitoring methods described above.

[0030] According to another aspect of the present invention, a processor is also provided, the processor being used to run a program, wherein the program executes any of the data security monitoring methods described above when it runs.

[0031] In this embodiment of the invention, API traffic in the application environment is acquired; the API traffic is parsed and restored to obtain API data corresponding to the API traffic; network access requests and feedback data based on network access requests are parsed from the API data; a complete event in the application environment is generated based on the network access requests and feedback data; the risk value of the API data passing through the API interface is determined based on the complete event from preset dimensions, wherein the preset dimensions include at least: API interface input / output data, API data flow path, and business logic of the complete event; when the risk value is higher than the risk threshold, it is determined that high-risk API data exists in the application environment. Through the above technical solution, the purpose of generating a complete event in the application environment by parsing network access requests and feedback data from the API data obtained from parsing and restoring API traffic, and determining the risk value of API data from dimensions such as API interface input / output data, API data flow path, and business logic of the complete event based on the complete event, is achieved. This realizes the technical effect of judging whether API data is risky based on the risk value, improves the reliability of API data security monitoring, and thus solves the technical problem of low reliability in related technologies for API data security monitoring. Attached Figure Description

[0032] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0033] Figure 1 This is a hardware structure block diagram of a mobile terminal for a data security monitoring method according to an embodiment of the present invention;

[0034] Figure 2 This is a flowchart of a data security monitoring method according to an embodiment of the present invention;

[0035] Figure 3(a) is a schematic diagram of the data processing flow according to an embodiment of the present invention;

[0036] Figure 3(b) is a schematic diagram of an optional data processing flow according to an embodiment of the present invention;

[0037] Figure 4 This is a schematic diagram of a data security monitoring device according to an embodiment of the present invention. Detailed Implementation

[0038] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0039] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0040] As described in the background section, the methods used for API data security monitoring in related technologies have low reliability. To address these shortcomings, this invention provides a data security monitoring method and apparatus in its embodiments.

[0041] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.

[0042] The methods and embodiments provided in this invention can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a data security monitoring method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0043] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the data security monitoring method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0044] According to an embodiment of the present invention, a method embodiment for data security monitoring is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0045] Figure 2 This is a flowchart of a data security monitoring method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0046] Step S202: Obtain the API traffic in the application environment.

[0047] For example, when performing risk monitoring on API data, it is first necessary to obtain the API traffic of the application interface in the application environment, and then process the API traffic to obtain the API data that needs to be monitored for risk. The process of processing API traffic is described in the following steps and will not be repeated here.

[0048] According to the above embodiments of the present invention, in step S202, obtaining the application interface (API) traffic in the application environment includes: when a mirror port exists in the application environment, sending a first traffic acquisition request to the mirror port, and acquiring API traffic based on the traffic returned by the mirror port based on the first traffic acquisition request, wherein the first traffic acquisition request carries the identification information of the API interface; when an agent instance exists in the application interface, sending a second traffic acquisition request to the agent instance, and acquiring API traffic based on the traffic returned by the agent instance based on the second traffic acquisition request, wherein the second traffic acquisition request carries the identification information of the API interface.

[0049] Optionally, the aforementioned mirrored ports are used for monitoring and analyzing network traffic.

[0050] For example, port mirroring enables network monitoring by forwarding data traffic from one or more source ports to a designated port on a switch or router. This designated port is called the "mirror port" or "destination port." Without significantly impacting the normal throughput of the source ports, network traffic can be monitored and analyzed through the mirror port. In enterprises, mirroring is an excellent way to monitor and manage internal network data, allowing for rapid fault location when network failures occur.

[0051] The above embodiments of the present invention will now be described in detail with reference to FIG3(a), which is a schematic diagram of the data processing flow according to an embodiment of the present invention.

[0052] As shown in Figure 3(a), the original API traffic is obtained at the gateway through the mirror port or agent instance.

[0053] Step S204: Perform traffic parsing and reconstruction on the API traffic to obtain the API data corresponding to the API traffic.

[0054] For example, by parsing and reconstructing API traffic, the latest and most complete API data can be obtained in real time.

[0055] When analyzing API traffic, analysis can be based on traffic analysis or through data identification techniques. The technical design format of API identification can include: API format, data exposure surface analysis, API level, API function, API status, RESTful, SOAP, gRPC, GraphQL, etc.

[0056] According to the above embodiments of the present invention, in step S204, performing traffic parsing and restoration on API traffic to obtain API data corresponding to API traffic includes: sending API traffic to a traffic restoration component through a gateway, so that the traffic restoration component can use API data to simulate an application environment to perform traffic parsing and restoration on API traffic; obtaining data generated in the API data simulation application environment to obtain API data.

[0057] As shown in Figure 3(a) above, the gateway sends the obtained API traffic to the traffic restoration component for traffic parsing and restoration. Then, it writes events through Kafka to simulate the application environment using API data at the traffic restoration component, performs traffic parsing and restoration on the API traffic, and then obtains the API data generated in the simulated application environment.

[0058] Step S206: Parse the network access requests and feedback data based on the network access requests from the API data.

[0059] For example, automated API identification technology can be used here to structurally reconstruct API requests and responses in network traffic in order to obtain the corresponding data.

[0060] By structurally reconstructing network access requests from API traffic within business traffic, the system automatically builds an API list. API additions or deletions due to business changes and status changes can be automatically updated. Based on the system's built-in classification and grading algorithm, API assets can be appropriately aggregated and labeled, facilitating API management.

[0061] The classification and grading algorithms here may include:

[0062] 1) Functional level: Login API, Registration API, SMS verification code sending API, Export API, File upload API, File download API, etc.;

[0063] 2) Data exposure surface level: Data exposure API, data collection API, etc.;

[0064] 3) Other aspects: Service call API, human-computer access API, etc.;

[0065] 4) The levels can include: high sensitivity, medium sensitivity, low sensitivity, and no sensitivity.

[0066] By continuously monitoring and analyzing API interactions, we can identify sensitive data contained in network access requests and returned content within API traffic, and update the details of sensitive data exposure in a timely manner. This allows us to better understand the API's functionality, usage, data exposure, and potential security risks.

[0067] Step S208: Generate a complete event in the application environment based on the network access request and feedback data.

[0068] Optionally, the above complete event is used to represent an event from a network access operation to the target device of the network access operation responding based on the network access operation.

[0069] According to the above embodiments of the present invention, in step S208, generating a complete event in the application environment based on the network access request and feedback data includes: determining the network access operation type of the API traffic request based on the operation identifier requested by the network access request, wherein the operation identifier corresponds one-to-one with the operation type; determining the operation result of the network access operation of the API traffic request based on the feature information of the feedback data, wherein the feature information includes the following information: data integrity and data type; generating a complete event in the application environment based on the network access operation type and operation result, wherein the complete event is used to represent an event from the network access operation to the target device of the network access operation making a feedback based on the network access operation.

[0070] As shown in Figure 3(a) above, after the event handling component obtains API data from the Kafka component, it parses the events, generates complete events based on the parsed specific requests and returned data, and performs certain filtering and tagging processing.

[0071] According to the above embodiments of the present invention, after step S208, that is, after generating a complete event in the application environment based on network access requests and feedback data, the method further includes: obtaining an HTTP data stream transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment; identifying API traffic through the HTTP data stream to obtain API interface identification information and application data; storing the identification information and application data in a first storage medium, wherein the first storage medium is connected to a front-end device, and when the front-end device receives a call request, it retrieves the identification information and / or application data from the first storage medium and displays the identification information and / or application data.

[0072] Optionally, the above storage media may include, but are not limited to: MongoDB database, Cl House database, MySQL database, etc.

[0073] As shown in Figure 3(a) above, the interface discovery component can identify API and application data through the collected HTTP traffic and write the application, examples, and interfaces to the corresponding database for display and invocation by the front end. In addition, the data synchronization component will also synchronously write the data processed by the event handling component (full traffic events and monitoring traffic events) to the CK database for use by other business applications.

[0074] According to the above embodiments of the present invention, after step S208, that is, after generating a complete event in the application environment based on the network access request and feedback data, the method may further include: obtaining an HTTP data stream transmitted in the application environment based on the Hypertext Transfer Protocol (HTTP); synchronizing the network access request, feedback data, complete event, and HTTP data stream to a second storage medium, wherein the second storage medium is connected to other business systems, and when other business systems receive a data request, they retrieve one or all of the network access request, feedback data, complete event, and HTTP data stream from the second storage medium.

[0075] The above embodiments of the present invention will now be described in detail with reference to FIG3(b), which is a schematic diagram of an optional data processing flow according to an embodiment of the present invention.

[0076] As shown in Figures 3(a) and 3(b) above, the real-time calculation component performs calculations and analyses from the dimensions of account and IP (real-time statistics based on the API-IP-Date dimension and real-time statistics based on the API-Account-Date dimension), and then stores them into the corresponding database through the data synchronization component; the correlation analysis component reads the corresponding categorized data (IP dimension data and account dimension data) from the database, and then, according to the rules and plugins, identifies, merges, and splits various contents (obtaining IP perspective data by filtering IP perspective events and obtaining account perspective data by filtering account perspective events), and writes the obtained IP perspective data and account perspective data into the corresponding database for subsequent business calls.

[0077] Step S210: Determine the risk value of API data passing through the API interface from preset dimensions based on the complete event. The preset dimensions include at least: the input / output data of the API interface, the flow path of the API data, and the business logic of the complete event.

[0078] For example, traditional API security control methods mainly focus on basic authentication, authorization, and transport layer encryption, while neglecting risks in business logic. However, the product designed according to the technical solution provided in the above embodiments of the present invention can analyze the input and output of the API interface, data flow paths, and rules and constraints of business logic to identify inputs and operations that may lead to business logic vulnerabilities, assess business logic risks in the API system, discover and identify potential attack threats and security vulnerabilities, and identify situations that do not conform to expected logic and may lead to data tampering, unauthorized access, or illegal operations. This improves the ability to identify and prevent business logic risks, reducing the risk of attacks and losses. It not only emphasizes basic transport layer security but also focuses on discovering and fixing security vulnerabilities related to business logic, helping to build a more secure and reliable API ecosystem and effectively protecting the security of real enterprise assets while preventing new security risks.

[0079] Step S212: When the risk value is higher than the risk threshold, it is determined that there is high-risk API data in the application environment.

[0080] Optionally, the above risk thresholds are standards used to determine whether there is high-risk API data in the current application environment.

[0081] According to the above embodiments of the present invention, after step S212, that is, after determining that there is high-risk API data in the application environment, the method further includes: collecting high-risk API data; performing data analysis on the high-risk API data according to different dimensions to obtain analysis results, wherein the dimensions include at least one of the following: data source, attack target, attack result; and searching for security defense strategies in the defense strategy library based on the analysis results to deal with network attack behaviors corresponding to the high-risk API data, wherein the defense strategy library stores different defense strategies.

[0082] For example, traditional defense methods typically focus only on the security of the external boundary, neglecting internal API vulnerabilities and risks. However, the product designed according to the technical solution provided in the above embodiments of the present invention can proactively discover and identify APIs existing in the business environment, including public and potential APIs. Through comprehensive analysis of APIs, it can accurately identify API configurations, security vulnerabilities, and potential attack surfaces (attack surfaces refer to various entry points and vulnerabilities that a network or system faces potential attacks). This information helps to reveal the weaknesses and vulnerabilities of an enterprise, enabling the enterprise to take timely measures to fix vulnerabilities and reduce risks.

[0083] Furthermore, the use of a big data engine and rich detection rules can effectively detect API attacks that exploit API vulnerabilities, protecting customer networks from various risks caused by API attacks. The product designed according to the technical solution provided in the above embodiments of the present invention provides unified traceability capabilities while covering audit logs of APIs, applications, and data. It can not only restore the access path of a single piece of information, but also perform centralized analysis through batch traceability, helping enterprises to backtrack after a risk event, restore the risk path, and assess the impact, so as to further help enterprises grasp the API security threat situation and make scientific management decisions.

[0084] Here, we can examine the attack behaviors on APIs from three dimensions: data leakage, web attacks, and account security. Different risk detection models can be applied to different API types. Combined with our self-developed lightweight and high-performance big data engine, we can achieve real-time analysis and accurate identification. To achieve a balance between risk false alarms and performance, the product employs the following methods: 1) Categorizing APIs and only detecting critical, highly sensitive APIs; 2) Monitoring APIs with vulnerabilities, such as those with enumerable parameters or excessive data returns (by controlling the number of returned data entries in the request parameters); 3) Applying different risk detection models to different API types. For example, a high-frequency access model is used for general app APIs, primarily calculating the number of accesses. However, for data query interfaces, the amount of data queried is calculated. For data sharing APIs, account-level statistics are considered. For login APIs, a brute-force risk model is used. A self-developed noise reduction engine is employed to automatically initiate noise reduction processing logic for abnormal behaviors that match risk scenarios, thus reducing the noise in API alerts and ensuring their accuracy, while also reducing manual operational costs associated with false alarms; 4) Identifying and recording various attributes of normal data access behavior and establishing a baseline for API behavior. This identifies attacker scanning and abnormal behaviors, and by comparing them with normal behavior, accurately determines malicious activities. When API behavior changes, the baseline is automatically adjusted to adapt to new behavior patterns.

[0085] As described above, the steps involve: first, acquiring API traffic in the application environment; parsing and restoring the API traffic to obtain corresponding API data; extracting network access requests and feedback data based on those requests from the API data; generating complete events in the application environment based on the network access requests and feedback data; determining the risk value of the API data passing through the API interface based on the complete events from preset dimensions, including at least: API interface input / output data, API data flow path, and the business logic of the complete events; and confirming the presence of high-risk API data in the application environment when the risk value exceeds a risk threshold. This achieves the goal of generating complete events in the application environment by parsing network access requests and feedback data from the API data obtained from the parsed and restored API traffic, and determining the risk value of API data based on dimensions such as API interface input / output data, API data flow path, and the business logic of the complete events. This technical effect of determining whether API data poses a risk based on risk values ​​improves the reliability of API data security monitoring.

[0086] Therefore, the technical solution provided by the above embodiments of the present invention solves the technical problem of low reliability of the methods used for API data security monitoring in the related art.

[0087] Compared with similar products, the product designed according to the technical solution provided in the above embodiments of the present invention also has the following advantages: 1) Product architecture upgrade: In addition to supporting the traditional Agent data collection mode, it adds full traffic analysis capability through traffic analysis and data identification technology; 2) Improved vulnerability management capability: It integrates the OWASP API's ten major security risks and includes 50+ vulnerability rules, covering data exposure, data permissions, security specifications, high-risk interfaces, password authentication and other rule dimensions, to identify potential vulnerabilities and defects in the API, search for logical calls, hard-coded keys, Web security defects and the possibility of API traffic being simulated and intruded, and combine the unique data leakage behavior analysis to analyze the impact of the vulnerability, and provide targeted remediation suggestions and measures to strengthen the security and compliance of the API, which can help enterprises protect the weaknesses of the API.

[0088] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0089] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0090] According to embodiments of the present invention, a data security monitoring device for implementing the above-described data security monitoring method is also provided. Figure 4 This is a schematic diagram of a data security monitoring device according to an embodiment of the present invention, such as... Figure 4As shown, the device includes: a first acquisition unit 401, a second acquisition unit 403, a parsing unit 405, a generation unit 407, a first determination unit 409, and a second determination unit 411. The data security monitoring device will now be described in detail.

[0091] The first acquisition unit 401 is used to acquire application interface API traffic in the application environment.

[0092] The second acquisition unit 403 is used to perform traffic parsing and restoration on API traffic to obtain the API data corresponding to the API traffic.

[0093] Parsing unit 405 is used to parse network access requests and feedback data based on network access requests from API data in API traffic.

[0094] The generation unit 407 is used to generate complete events in the application environment based on network access requests and feedback data.

[0095] The first determining unit 409 is used to determine the risk value of API data passing through the API interface from a preset dimension based on the complete event. The preset dimension includes at least: the input / output data of the API interface, the flow path of the API data, and the business logic of the complete event.

[0096] The second determining unit 411 is used to determine that there is high-risk API data in the application environment when the risk value is higher than the risk threshold.

[0097] It should be noted that the first acquisition unit 401, the second acquisition unit 403, the parsing unit 405, the generation unit 407, the first determination unit 409, and the second determination unit 411 mentioned above correspond to steps S202 to S212 in the above embodiments. The six units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiments.

[0098] As can be seen from the above, in the solution described in the above embodiments of the present invention, the first acquisition unit can be used to acquire the API traffic of the application interface in the application environment; then the second acquisition unit can be used to parse and restore the API traffic to obtain the API data corresponding to the API traffic; then the parsing unit can be used to parse the network access request and the feedback data based on the network access request from the API data; then the generation unit can be used to generate a complete event in the application environment based on the network access request and the feedback data; then the first determination unit can be used to determine the risk value of the API data passing through the API interface from a preset dimension based on the complete event, wherein the preset dimension includes at least: the input / output data of the API interface, the flow path of the API data, and the business logic of the complete event; finally, the second determination unit can be used to determine that there is high-risk API data in the application environment when the risk value is higher than the risk threshold. This achieves the purpose of generating a complete event in the application environment by parsing the network access request and feedback data from the API data obtained by parsing and restoring the API traffic, and determining the risk value of the API data from the dimensions such as the input / output data of the API interface, the flow path of the API data, and the business logic of the complete event based on the complete event. This achieves the technical effect of judging whether API data has risks based on the risk value and improves the reliability of API data security monitoring.

[0099] Therefore, the technical solution provided by the above embodiments of the present invention solves the technical problem of low reliability of the methods used for API data security monitoring in the related art.

[0100] Optionally, the first acquisition unit includes: a first acquisition module, configured to send a first traffic acquisition request to the mirror port when a mirror port exists in the application environment, and acquire API traffic based on the traffic returned by the mirror port based on the first traffic acquisition request, wherein the first traffic acquisition request carries the identification information of the API interface; and a second acquisition module, configured to send a second traffic acquisition request to the agent instance when an agent instance exists in the application interface, and acquire API traffic based on the traffic returned by the agent instance based on the second traffic acquisition request, wherein the first traffic acquisition request carries the identification information of the API interface.

[0101] Optionally, the second acquisition unit includes: a restoration module, used to send API traffic to the traffic restoration component through the gateway, so that the traffic restoration component can use API data to simulate the application environment to perform traffic parsing and restoration on the API traffic; and a third acquisition module, used to acquire data generated in the API data simulation application environment to obtain API data.

[0102] Optionally, the generation unit includes: a first determining module, configured to determine the network access operation type of the API traffic request based on the operation identifier requested by the network access request, wherein the operation identifier corresponds one-to-one with the operation type; a second determining module, configured to determine the operation result of the network access operation of the API traffic request based on the feature information of the feedback data, wherein the feature information includes the following: data integrity and data type; and a generation module, configured to generate a complete event in the application environment based on the network access operation type and the operation result, wherein the complete event represents an event from the network access operation to the target device of the network access operation responding based on the network access operation.

[0103] Optionally, the data security monitoring device further includes: a third acquisition unit, used to acquire the HTTP data stream transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment after generating a complete event in the application environment based on network access requests and feedback data; a fourth acquisition unit, used to identify API traffic through the HTTP data stream to obtain the identification information and application data of the API interface; and a storage unit, used to store the identification information and application data in a first storage medium, wherein the first storage medium is connected to a front-end device, and the front-end device, upon receiving a call request, retrieves the identification information and / or application data from the first storage medium and displays the identification information and / or application data.

[0104] Optionally, the data security monitoring device further includes: a fifth acquisition unit, used to acquire the HTTP data stream transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment after generating a complete event in the application environment based on the network access request and feedback data; and a synchronization unit, used to synchronize the network access request, feedback data, complete event, and HTTP data stream to a second storage medium, wherein the second storage medium is connected to other business systems, and when other business systems receive a data request, they retrieve one or all of the network access request, feedback data, complete event, and HTTP data stream from the second storage medium.

[0105] Optionally, the data security monitoring device further includes: a collection unit for collecting high-risk API data after determining that high-risk API data exists in the application environment; a sixth acquisition unit for performing data analysis on the high-risk API data according to different dimensions to obtain analysis results, wherein the dimensions include at least one of the following: data source, attack target, and attack result; and a seventh acquisition unit for searching for security defense strategies in the defense strategy library based on the analysis results to deal with network attack behaviors corresponding to the high-risk API data, wherein the defense strategy library stores different defense strategies.

[0106] According to another aspect of the present invention, a data security monitoring system is also provided, which uses any of the above-described data security monitoring methods.

[0107] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein the program executes any of the above-described data security monitoring methods.

[0108] Optionally, in this embodiment, the computer-readable storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any communication device in a group of communication devices.

[0109] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: acquiring application interface (API) traffic in the application environment; parsing and restoring the API traffic to obtain API data corresponding to the API traffic; parsing network access requests and feedback data based on network access requests from the API data; generating a complete event in the application environment based on the network access requests and feedback data; determining the risk value of the API data passing through the API interface from preset dimensions based on the complete event, wherein the preset dimensions include at least: input / output data of the API interface, flow path of the API data, and business logic of the complete event; and determining that high-risk API data exists in the application environment when the risk value is higher than a risk threshold.

[0110] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: when a mirror port exists in the application environment, a first traffic acquisition request is sent to the mirror port, and API traffic is acquired based on the traffic returned by the mirror port based on the first traffic acquisition request, wherein the first traffic acquisition request carries identification information of the API interface; when an agent instance exists in the application interface, a second traffic acquisition request is sent to the agent instance, and API traffic is acquired based on the traffic returned by the agent instance based on the second traffic acquisition request, wherein the first traffic acquisition request carries identification information of the API interface.

[0111] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: sending API traffic to a traffic restoration component via a gateway, whereby the traffic restoration component uses API data to simulate an application environment to perform traffic parsing and restoration on the API traffic; and obtaining data generated in the API data simulation application environment to obtain API data.

[0112] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: determining the network access operation type of the API traffic request based on the operation identifier requested by the network access request, wherein the operation identifier corresponds one-to-one with the operation type; determining the operation result of the network access operation of the API traffic request based on the feature information of the feedback data, wherein the feature information includes the following information: data integrity and data type; generating a complete event in the application environment based on the network access operation type and the operation result, wherein the complete event is used to represent an event from the network access operation to the target device of the network access operation making a response based on the network access operation.

[0113] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: obtaining HTTP data streams transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment; identifying API traffic through the HTTP data streams to obtain API interface identification information and application data; storing the identification information and application data in a first storage medium, wherein the first storage medium is connected to a front-end device, and when the front-end device receives a call request, it retrieves the identification information and / or application data from the first storage medium and displays the identification information and / or application data.

[0114] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: obtaining an HTTP data stream transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment; synchronizing network access requests, feedback data, complete events, and the HTTP data stream to a second storage medium, wherein the second storage medium is connected to other business systems, and when other business systems receive a data request, they retrieve one or all of the network access requests, feedback data, complete events, and HTTP data streams from the second storage medium.

[0115] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: collecting high-risk API data; performing data analysis on the high-risk API data according to different dimensions to obtain analysis results, wherein the dimensions include at least one of the following: data source, attack target, attack result; searching for security defense strategies in the defense strategy library based on the analysis results to deal with network attack behaviors corresponding to the high-risk API data, wherein the defense strategy library stores different defense strategies.

[0116] According to another aspect of the present invention, a processor is also provided, which is used to run a program, wherein the program executes any of the above-described data security monitoring methods during runtime.

[0117] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0118] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0119] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0120] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0121] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0122] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0123] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A data security monitoring method, characterized in that, include: Obtain application interface API traffic in the application environment; The API traffic is parsed and restored to obtain the API data corresponding to the API traffic; Parse the network access requests and feedback data based on the network access requests from the API data; Generate a complete event in the application environment based on the network access request and the feedback data; The risk value of the API data passing through the API interface is determined from preset dimensions based on the complete event, wherein the preset dimensions include at least: the input / output data of the API interface, the flow path of the API data, and the business logic of the complete event; When the risk value is higher than the risk threshold, it is determined that there is high-risk API data in the application environment; The process, after determining that high-risk API data exists in the application environment, further includes: collecting the high-risk API data; performing data analysis on the high-risk API data according to different dimensions to obtain analysis results, wherein the dimensions include at least one of the following: data source, attack target, and attack result; and searching for security defense strategies in a defense strategy library based on the analysis results to deal with network attack behaviors corresponding to the high-risk API data, wherein the defense strategy library stores different defense strategies.

2. The data security monitoring method according to claim 1, characterized in that, Obtain application interface API traffic in the application environment, including: When a mirror port exists in the application environment, a first traffic acquisition request is sent to the mirror port, and the API traffic is acquired based on the traffic returned by the mirror port based on the first traffic acquisition request, wherein the first traffic acquisition request carries the identification information of the API interface; When an agent instance exists in the application interface, a second traffic acquisition request is sent to the agent instance. The API traffic is acquired based on the traffic returned by the agent instance based on the second traffic acquisition request. The first traffic acquisition request carries the identification information of the API interface.

3. The data security monitoring method according to claim 1, characterized in that, The API traffic is parsed and restored to obtain the API data corresponding to the API traffic, including: The API traffic is sent to the traffic restoration component via the gateway, whereby the traffic restoration component uses the API data to simulate the application environment and perform traffic parsing and restoration on the API traffic. The API data is obtained by simulating data generated in the application environment.

4. The data security monitoring method according to claim 1, characterized in that, Generate a complete event in the application environment based on the network access request and the feedback data, including: The network access operation type of the API traffic request is determined based on the operation identifier requested by the network access request, wherein the operation identifier and the operation type correspond one-to-one. The operation result of the network access operation of the API traffic request is determined based on the feature information of the feedback data, wherein the feature information includes the following: data integrity and data type; The complete event in the application environment is generated based on the network access operation type and the operation result, wherein the complete event is used to represent an event from the network access operation to the target device of the network access operation responding based on the network access operation.

5. The data security monitoring method according to claim 1, characterized in that, After generating a complete event in the application environment based on the network access request and the feedback data, the process also includes: Obtain the HTTP data stream transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment; The API traffic is identified by the HTTP data stream to obtain the API interface's identification information and application data; The identification information and the application data are stored in a first storage medium, wherein the first storage medium is connected to a front-end device, and when the front-end device receives a call request, it retrieves the identification information and / or the application data from the first storage medium and displays the identification information and / or the application data.

6. The data security monitoring method according to claim 1, characterized in that, After generating a complete event in the application environment based on the network access request and the feedback data, the process also includes: Obtain the HTTP data stream transmitted based on the Hypertext Transfer Protocol (HTTP) in the application environment; The network access request, the feedback data, the complete event, and the HTTP data stream are synchronized to a second storage medium, wherein the second storage medium is connected to other business systems, and when the other business systems receive a data request, they retrieve one or all of the network access request, the feedback data, the complete event, and the HTTP data stream from the second storage medium.

7. A data security monitoring device, characterized in that, include: The first acquisition unit is used to acquire application interface API traffic in the application environment; The second acquisition unit is used to perform traffic parsing and restoration on the API traffic to obtain the API data corresponding to the API traffic. The parsing unit is used to parse the network access requests and feedback data based on the network access requests from the API data in the API traffic. A generation unit is configured to generate a complete event in the application environment based on the network access request and the feedback data. The first determining unit is used to determine the risk value of the API data passing through the API interface from a preset dimension based on the complete event, wherein the preset dimension includes at least: the input / output data of the API interface, the flow path of the API data, and the business logic of the complete event; The second determining unit is used to determine that high-risk API data exists in the application environment when the risk value is higher than the risk threshold. The data security monitoring device further includes: a collection unit for collecting high-risk API data after determining that high-risk API data exists in the application environment; a sixth acquisition unit for analyzing the high-risk API data according to different dimensions to obtain analysis results, wherein the dimensions include at least one of the following: data source, attack target, and attack result; and a seventh acquisition unit for searching for security defense strategies in a defense strategy library based on the analysis results to deal with network attack behaviors corresponding to the high-risk API data, wherein the defense strategy library stores different defense strategies.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program executes the data security monitoring method according to any one of claims 1 to 6.

9. A processor, characterized in that, The processor is used to run a program, wherein the program executes the data security monitoring method according to any one of claims 1 to 6 when it runs.

Images