API asset security management method and system, electronic device, and storage medium

Abstract

The disclosed embodiments disclose an API asset security management method and system, electronic device, and storage medium. The method includes: obtaining API asset data, matching rules on the API asset data, and determining the total number of triggered rules; if the total number of triggered rules is greater than zero, determining the risk value and error rate of the triggered rules; determining a comprehensive risk value based on the total number of triggered rules, risk value, and error rate; if the comprehensive risk value is greater than a preset risk value, determining that there is an API security risk, and performing API risk blocking. The method can determine the existence of API security risks by obtaining a comprehensive risk value, and timely perform API risk blocking to improve the security of API assets.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to an API asset security management method and system, electronic equipment, and storage medium. Background Art

[0002] With the development of information technology, API (Application Programming Interface) technology has been rapidly developed and applied. API can greatly reduce code redundancy and enhance software reusability. It can also better support distributed systems and microservice architectures, and is widely used in business systems in various industries.

[0003] However, due to design flaws, developers' lack of security awareness, and neglect of security, API interfaces may have security vulnerabilities, which may lead to serious consequences such as data leakage, information hijacking, and malicious attacks. Summary of the invention

[0004] In view of this, the embodiments of the present disclosure provide an API asset security management method and system, electronic device, and storage medium, which can determine the existence of API security risks by obtaining a comprehensive risk value, and block API risks in a timely manner to improve the security of API assets.

[0005] In a first aspect, the present disclosure provides an API asset security management method, which adopts the following technical solutions:

[0006] Acquire API asset data, perform rule matching on the API asset data, and determine the total number of triggered rules;

[0007] If the total number of the triggered rules is greater than zero, determining the risk value and error rate of the triggered rules;

[0008] Determine a comprehensive risk value based on the total number of the triggered rules, the risk value and the error rate;

[0009] If the comprehensive risk value is greater than the preset risk value, it is determined that there is an API security risk and API risk blocking is performed.

[0010] Optionally, performing rule matching on the API asset data to determine the total number of triggered rules includes:

[0011] Matching the API traffic data included in the API asset data with the risk information rules included in the rules to determine the total number of triggered rules;

[0012] Among them, the risk information rules include at least one or more of threat intelligence, blacklist terms, and sensitive information rules.

[0013] Optionally, performing rule matching on the API asset data to determine the total number of triggered rules includes:

[0014] Matching the API traffic data included in the API asset data with the risk information rules included in the rules;

[0015] Based on the API operation behavior audit log included in the API asset data, counting API access data, and matching the API access data with the access rules included in the rules;

[0016] Determining the total number of the triggered rules based on the matching results;

[0017] Among them, the risk information rules include at least one or more of threat intelligence, blacklist terms, and sensitive information rules.

[0018] Optionally, the comprehensive risk value is y:

[0019]

[0020] Wherein, m and n are preset parameters; j is the total number of the triggered rules; x is the total number of the rules; f i is the risk value of the triggered rule numbered i; l i is the error rate of the triggered rule number i.

[0021] Optionally, the error rate of a rule is a ratio of a total number of false triggers of the rule to a total number of triggers.

[0022] Optionally, the determining that there is an API security risk and performing API risk blocking includes:

[0023] The risk level is determined based on the comprehensive risk value, and a blocking strategy of a corresponding level is selected based on the risk level to perform API risk blocking.

[0024] Optionally, after selecting a blocking strategy of a corresponding level based on the risk level to perform API risk blocking, the method further includes:

[0025] If the API risk blocking fails, the blocking strategy is upgraded and the upgraded blocking strategy is used to perform API risk blocking.

[0026] In a second aspect, the embodiment of the present disclosure also provides an API asset security management system, which adopts the following technical solutions:

[0027] A total number acquisition module is used to acquire API asset data, perform rule matching on the API asset data, and determine the total number of triggered rules;

[0028] A first determination module, configured to determine a risk value and an error rate of the triggered rules if the total number of the triggered rules is greater than zero;

[0029] A second determination module, configured to determine a comprehensive risk value based on the total number of the triggered rules, the risk value and the error rate;

[0030] The risk blocking module is used to determine that there is an API security risk and perform API risk blocking if the comprehensive risk value is greater than a preset risk value.

[0031] In a third aspect, the present disclosure also provides an electronic device, which adopts the following technical solution:

[0032] The electronic device comprises:

[0033] at least one processor; and,

[0034] a memory communicatively connected to the at least one processor; wherein,

[0035] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the API asset security management methods described above.

[0036] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned API asset security management methods.

[0037] The API asset security management method provided by the embodiment of the present disclosure obtains API asset data and performs rule matching to determine the total number of triggered rules. If the total number of triggered rules is greater than zero, a comprehensive risk value is determined by comprehensively considering the triggering of multiple rules. When the comprehensive risk value exceeds the preset risk value, an API risk blocking operation can be automatically performed, which can prevent potential security vulnerabilities from being exploited, reduce losses caused by risks, protect API assets in a timely manner, and improve the security and protection level of API assets.

[0038] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the following preferred embodiments are specifically cited and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 A flowchart of the API asset security management method provided in the embodiment of the present disclosure;

[0041] Figure 2 A principle block diagram of the API asset security management system provided in the embodiment of the present disclosure;

[0042] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0043] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0044] It should be clear that the following embodiments of the present disclosure are described by specific specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0045] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0046] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0047] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0048] Reference Figure 1 The present disclosure provides an API asset security management method, comprising the following steps:

[0049] S1: Obtain API asset data, perform rule matching on the API asset data, and determine the total number of triggered rules.

[0050] The API asset data includes API flow data. The API asset security management system disclosed in the present invention is deployed in series between the source and destination of the API interface call, and when the source sends API flow data to the destination, the API flow data is collected when the API flow data flows through the API asset security management system path.

[0051] Collect or construct rules, the rules include risk information rules, risk information rules include at least one or more of threat intelligence, blacklist terms, and sensitive information rules, threat intelligence includes at least one or more of IP intelligence, URL intelligence, domain name intelligence, file intelligence, and email intelligence, blacklist terms include at least one or more of IP terms, URL terms, and API interface path terms, and sensitive information rules include at least one or more of ID card rules, mobile phone number rules, and email rules.

[0052] The API asset data also includes API operation behavior audit logs. API operation behaviors are recorded in log files, which are obtained and recorded as API operation behavior audit logs. Rules also include access rules, which include at least one or more of abnormal time period access rules, abnormal access number rules, and individual abnormal access number rules.

[0053] Match the API traffic data with the risk information rules. If the match is successful, the rule is triggered.

[0054] Based on the API operation behavior audit log, API access data is counted. The API access data includes the number of API accesses in the abnormal time period, the number of daily API accesses, and the number of daily API accesses by the same IP. The abnormal time period is from 11 pm to 5 am. If the number of API accesses in the abnormal time period is greater than the first access threshold, it means that the abnormal time period access rule is triggered. If the daily API access number is greater than the second access threshold, it means that the abnormal access number rule is triggered. If the daily API access number of the same IP is greater than the third access threshold, it means that the individual abnormal access number rule is triggered.

[0055] Each time a rule is triggered, the number of triggered rules increases by one. When the API asset data matches all the rules, the total number of triggered rules is counted.

[0056] S2: Determine whether the total number of triggered rules is greater than zero; if not, execute S3; if yes, execute S4.

[0057] S3: Determine that the comprehensive risk value is equal to the first preset value, and execute S8.

[0058] The total number of triggered rules must be greater than or equal to zero. Therefore, if the total number of triggered rules is not greater than zero, it means that the total number of triggered rules is equal to zero. At this time, it is determined that the comprehensive risk value is equal to the first preset value.

[0059] S4: Determine the risk value and error rate of the triggered rule.

[0060] Each rule has a risk value. When a rule is triggered, the risk value of the rule is recorded. A rule may be triggered by mistake. The total number of triggers and the total number of false triggers of each rule are recorded. The error rate of a rule is the ratio of the total number of false triggers of the rule to the total number of triggers. Therefore, each time a rule is triggered, the error rate of the triggered rule is also recorded.

[0061] S5: Determine a comprehensive risk value based on the total number of triggered rules, the risk value, and the error rate.

[0062] The calculation formula of the comprehensive risk value y is as follows:

[0063]

[0064] Wherein, m is the second preset value; j is the total number of triggered rules; x is the total number of rules; f i is the risk value of the triggered rule numbered i, and the maximum risk value among the triggered rules is f max , 0 <f max ≤t, t is the maximum risk value in the rule, t+m=100; n is the first preset value, 5≤n≤20; -n <y≤100;l iis the error rate of the triggered rule number i.

[0065] S6: Determine whether the comprehensive risk value is greater than the preset risk value; if so, execute S7; if not, execute S8.

[0066] In this disclosure, the default risk value is 50.

[0067] S7: Determine if there is an API security risk and block the API risk.

[0068] The risk level is determined based on the comprehensive risk value, and the corresponding blocking strategy is selected based on the risk level to perform API risk blocking. The blocking strategy includes at least one or more of the API interface blocking strategy, URL blocking strategy, system IP blocking strategy, firewall IP blocking strategy, and protocol blocking strategy. The relationship between the comprehensive risk value y, risk level D1, and blocking strategy level D2 is as follows:

[0069]

[0070] If the blocking policy level is 1, the API interface blocking strategy is adopted; if the blocking policy level is 2, the URL blocking strategy is adopted; if the blocking policy level is 3, the system IP blocking strategy is adopted; if the blocking policy level is 4, the firewall IP blocking strategy is adopted; if the blocking policy level is 5, the protocol blocking strategy is adopted.

[0071] Furthermore, if the API operation behavior audit log does not update the API operation behavior information and the API interface does not continue to output API traffic data, it means that the API risk blocking is successful; otherwise, it means that the API risk blocking fails, and the blocking strategy level is increased by one, that is, the blocking strategy is upgraded, and then the upgraded blocking strategy is used to block the API risk. If the API risk blocking still fails, the blocking strategy will continue to be upgraded until the API risk blocking is successful or the blocking strategy level is greater than 5. If the blocking strategy level is greater than 5, an alarm will be issued and mandatory network disconnection measures will be taken.

[0072] S8: Determine that there are no API security risks.

[0073] The API asset security management method disclosed in the present invention obtains API asset data and matches rules to determine the total number of triggered rules, thereby realizing a real-time risk assessment mechanism: by comprehensively considering the total number of triggered rules, risk value and error rate, the security risk level of API assets can be more accurately assessed. This mechanism is not just the triggering of a single rule, but automatically matches and identifies through multi-source data and threat intelligence, blacklist terms, and sensitive information rules. The behavior of API assets is analyzed through API operation behavior audit logs to determine the triggering of access rules. By comprehensively considering the triggering of multiple rules, the security status of API assets can be more comprehensively understood, so that the appropriate level of blocking strategy can be adopted in a timely and accurate manner to block API risks.

[0074] When the comprehensive risk value exceeds the preset risk value, the API risk blocking operation can be automatically performed to prevent potential security vulnerabilities from being exploited and reduce losses caused by risks. This automated blocking can improve security and does not require human intervention. From API monitoring to blocking and alarming, an integrated process is achieved to reduce operating costs.

[0075] In summary, this API asset security management method can help organizations promptly detect and respond to API security risks through real-time assessment, comprehensive analysis, and automated blocking, thereby improving the security and protection level of API assets.

[0076] Reference Figure 2 The present disclosure provides an API asset security management system, including:

[0077] The total number acquisition module 101 is used to acquire API asset data, perform rule matching on the API asset data, and determine the total number of triggered rules;

[0078] A first determination module 102, configured to determine the risk value and error rate of the triggered rules if the total number of triggered rules is greater than zero;

[0079] A second determination module 103, configured to determine a comprehensive risk value based on the total number of triggered rules, the risk value and the error rate;

[0080] The risk blocking module 104 is used to determine that there is an API security risk and perform API risk blocking if the comprehensive risk value is greater than a preset risk value.

[0081] The various variations and specific examples of the API asset security management method provided above are also applicable to the API asset security management system provided in the present disclosure. Through the above detailed description of the API asset security management method, those skilled in the art can clearly know the implementation method of the API asset security management system. For the sake of brevity of the specification, it will not be described in detail here.

[0082] The electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-temporary computer-readable instructions. Specifically, the memory may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, etc.

[0083] The processor may be a central processing unit (CPU) or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is used to run the computer-readable instructions stored in the memory, so that the electronic device performs all or part of the steps of the API asset security management method of each embodiment of the present disclosure.

[0084] Those skilled in the art should be able to understand that in order to solve the technical problem of how to obtain a good user experience, the present embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the protection scope of the present disclosure.

[0085] like Figure 3 The present invention provides a schematic diagram of the structure of an electronic device according to an embodiment of the present invention, which is suitable for implementing the electronic device in the embodiment of the present invention. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0086] like Figure 3 As shown, the electronic device may include a processor (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processor, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0087] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as magnetic tapes and hard disks; and communication devices. The communication device can allow the electronic device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 3An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0088] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the API asset security management method of the embodiment of the present disclosure are executed.

[0089] For detailed description of this embodiment, reference may be made to the corresponding descriptions in the aforementioned embodiments, which will not be repeated here.

[0090] According to the computer-readable storage medium of the embodiment of the present disclosure, non-transitory computer-readable instructions are stored thereon. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the API asset security management method of each embodiment of the present disclosure are executed.

[0091] The above-mentioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or mobile hard disk), media with built-in rewritable non-volatile memory (e.g., memory card) and media with built-in ROM (e.g., ROM box).

[0092] For detailed description of this embodiment, reference may be made to the corresponding descriptions in the aforementioned embodiments, which will not be repeated here.

[0093] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0094] In the present disclosure, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagram. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open words, referring to "including but not limited to", and can be used interchangeably with them. The words "or" and "and" used here refer to the words "and / or" and can be used interchangeably with them, unless the context clearly indicates otherwise. The words "such as" used here refer to the phrase "such as but not limited to", and can be used interchangeably with them.

[0095] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0096] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0097] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0098] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0099] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A method for secure management of API assets. It is characterized in that include: Acquire API asset data, perform rule matching on the API asset data, and determine the total number of triggered rules; If the total number of the triggered rules is greater than zero, determining the risk value and error rate of the triggered rules; Determine a comprehensive risk value based on the total number of the triggered rules, the risk value and the error rate; If the comprehensive risk value is greater than the preset risk value, it is determined that there is an API security risk, and API risk blocking is performed; Wherein, the comprehensive risk value is y: Wherein, m and n are preset parameters; j is the total number of the triggered rules; x is the total number of the rules; f i is the risk value of the triggered rule numbered i, and the maximum risk value among the triggered rules is f max , 0 <f max ≤t, t is the maximum risk value in the rule, t+m=100; n is the first preset value, 5≤n≤20; -n <y≤100;l i is the error rate of the triggered rule numbered i; The error rate of a rule is the ratio of the total number of false triggers of the rule to the total number of triggers; Wherein, determining that there is an API security risk and performing API risk blocking includes: Determine a risk level based on the comprehensive risk value, and select a blocking strategy of a corresponding level based on the risk level to perform API risk blocking; Specifically, if the blocking policy level is 1, the API interface blocking policy is adopted; if the blocking policy level is 2, the URL blocking policy is adopted; if the blocking policy level is 3, the system IP blocking policy is adopted; if the blocking policy level is 4, the firewall IP blocking policy is adopted; if the blocking policy level is 5, the protocol blocking policy is adopted; After selecting a blocking strategy of a corresponding level based on the risk level to perform API risk blocking, the method further includes: If the API risk blocking fails, the blocking strategy is upgraded and the upgraded blocking strategy is used to block the API risk; Specifically, if the API operation behavior audit log does not update the API operation behavior information and the API interface does not continue to output API traffic data, it means that the API risk is blocked successfully; otherwise, it means that the API risk blocking has failed, and the level of the blocking strategy is increased by one, that is, the blocking strategy is upgraded, and then the upgraded blocking strategy is used to block the API risk; if the API risk blocking still fails, the blocking strategy will continue to be upgraded until the API risk is blocked successfully or the level of the blocking strategy is greater than 5; if the level of the blocking strategy is greater than 5, an alarm will be issued and compulsory network disconnection measures will be taken.

2. The API asset security management method according to claim 1, It is characterized in that The performing rule matching on the API asset data to determine the total number of triggered rules includes: Matching the API traffic data included in the API asset data with the risk information rules included in the rules to determine the total number of triggered rules; Among them, the risk information rules include at least one or more of threat intelligence, blacklist terms, and sensitive information rules.

3. The API asset security management method according to claim 1, It is characterized in that The performing rule matching on the API asset data to determine the total number of triggered rules includes: Matching the API traffic data included in the API asset data with the risk information rules included in the rules; Based on the API operation behavior audit log included in the API asset data, counting API access data, and matching the API access data with the access rules included in the rules; Determining the total number of the triggered rules based on the matching results; Among them, the risk information rules include at least one or more of threat intelligence, blacklist terms, and sensitive information rules.

4. An API asset security management system, It is characterized in that include: A total number acquisition module is used to acquire API asset data, perform rule matching on the API asset data, and determine the total number of triggered rules; A first determination module, configured to determine a risk value and an error rate of the triggered rules if the total number of the triggered rules is greater than zero; A second determination module, configured to determine a comprehensive risk value based on the total number of the triggered rules, the risk value and the error rate; A risk blocking module, used to determine that there is an API security risk and perform API risk blocking if the comprehensive risk value is greater than a preset risk value; Wherein, the comprehensive risk value is y: Wherein, m and n are preset parameters; j is the total number of the triggered rules; x is the total number of the rules; f i is the risk value of the triggered rule numbered i, and the maximum risk value among the triggered rules is f max , 0 <f max ≤t, t is the maximum risk value in the rule, t+m=100; n is the first preset value, 5≤n≤20; -n <y≤100;l i is the error rate of the triggered rule numbered i; The error rate of a rule is the ratio of the total number of false triggers of the rule to the total number of triggers; Wherein, determining that there is an API security risk and performing API risk blocking includes: Determine a risk level based on the comprehensive risk value, and select a blocking strategy of a corresponding level based on the risk level to perform API risk blocking; Specifically, if the blocking policy level is 1, the API interface blocking policy is adopted; if the blocking policy level is 2, the URL blocking policy is adopted; if the blocking policy level is 3, the system IP blocking policy is adopted; if the blocking policy level is 4, the firewall IP blocking policy is adopted; if the blocking policy level is 5, the protocol blocking policy is adopted; After selecting a blocking strategy of a corresponding level based on the risk level to perform API risk blocking, the method further includes: If the API risk blocking fails, the blocking strategy is upgraded and the upgraded blocking strategy is used to block the API risk; Specifically, if the API operation behavior audit log does not update the API operation behavior information and the API interface does not continue to output API traffic data, it means that the API risk is blocked successfully; otherwise, it means that the API risk blocking has failed, and the level of the blocking strategy is increased by one, that is, the blocking strategy is upgraded, and then the upgraded blocking strategy is used to block the API risk; if the API risk blocking still fails, the blocking strategy will continue to be upgraded until the API risk is blocked successfully or the level of the blocking strategy is greater than 5; if the level of the blocking strategy is greater than 5, an alarm will be issued and compulsory network disconnection measures will be taken.

5. An electronic device, It is characterized in that The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the API asset security management method described in any one of claims 1-3.

6. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer instructions, which are used to enable a computer to execute the API asset security management method described in any one of claims 1-3.

Images