API security protection method and system

Abstract

The present application relates to an API security protection method and system, which belongs to the field of communication security technology. The API security protection method includes obtaining an initial learning sample set; generating parameter specifications for each sample request route according to the initial learning sample set; in response to the API gateway identifying request failure information, parsing the request failure information to obtain failed request routes and failed parameter attributes; based on the failed request route, comparing the failed parameter attributes with the parameter specifications of the matched sample request route to obtain a comparison result; in response to the comparison result being abnormal, processing the failed request route based on a preset processing rule, and improving the accuracy of API security protection by generating parameter specifications based on the initial learning sample set. The present application has the effect of improving the accuracy of API security protection.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to an API security protection method and system. Background Art

[0002] With the rapid development of the Internet, application programming interfaces (APIs) have become an important means of data exchange and integration between different systems. The security of APIs is becoming increasingly important, as hackers often exploit API vulnerabilities to obtain sensitive data, such as privacy information and user identities.

[0003] At present, in order to protect the security of APIs, many companies and organizations have adopted a variety of protection measures, such as input verification, parameter encoding, identity authentication, authorization and firewalls, etc. Usually, the means of preventing parameter attacks require more complex configuration, and the prevention parameters are relatively fixed and difficult to adjust flexibly, resulting in limitations in security protection. How to improve the accuracy of API security protection and improve the security of APIs is an urgent problem to be solved. Summary of the invention

[0004] In order to improve the accuracy of API security protection, the present application provides an API security protection method and system.

[0005] In the first aspect, the present application provides an API security protection method, which adopts the following technical solutions:

[0006] An API security protection method, comprising:

[0007] Obtain an initial learning sample set;

[0008] Generate parameter specifications for each sample request route based on the initial learning sample set;

[0009] In response to the API gateway identifying the request failure information, the request failure information is parsed to obtain the failed request route and the failed parameter attributes;

[0010] Based on the failed request route, the failed parameter attribute is compared with the parameter specification of the matched sample request route to obtain a comparison result; the parameter specification includes a required parameter specification and an optional parameter specification;

[0011] In response to the comparison result being abnormal, the failed request routing is processed based on preset processing rules.

[0012] By adopting the above technical solution, parameter specifications are generated through the initial learning sample set, and the request failure information of the API gateway is monitored in real time. When request failure information is identified, the request failure information is parsed to obtain the failed request route and failed parameter attributes, so as to compare the failed parameter attributes with the generated parameter specifications, and process them based on the abnormal comparison results using preset processing rules to ensure the security of the API. By generating parameter specifications based on the initial learning sample set, the accuracy of API security protection is improved, thereby improving the security of the API.

[0013] Optionally, also include:

[0014] In response to the API network identifying the request success information, the request success information is parsed to obtain the successful request route and the successful parameter attributes;

[0015] Added success request routing and success parameter attributes to the initial learning sample set.

[0016] By adopting the above technical solution, the API network recognizes that the request success information indicates that the request is normal, and adds the successful request route and successful parameter attributes to the initial learning sample set. It can continuously optimize the parameter specifications, dynamically adapt to the ever-changing attack patterns, and increase the diversity of the initial learning sample set so that the parameter specifications can be continuously adjusted and optimized.

[0017] Optionally, the parameter specification of each sample request route generated according to the initial learning sample set specifically includes:

[0018] Extracting the sample request routing and parameter information of each initial learning sample from the initial learning sample set; the parameter information includes a sample response header, a sample response body, a sample request header and a sample request body;

[0019] According to the sample request routing, the parameter information is classified to obtain a parameter information set;

[0020] Count the parameter information in the same type of parameter information set to obtain the number of samples of the sample request routing;

[0021] Extract all parameter names and values ​​corresponding to the parameter names contained in each parameter information from the same type of parameter information set;

[0022] According to the parameter name, the values ​​corresponding to the parameter name are clustered to obtain a parameter array corresponding to the parameter name; the parameter array includes all the values ​​corresponding to the parameter name;

[0023] According to the number of elements and samples contained in the parameter array, determine the required parameter name and optional parameter name of each parameter information;

[0024] Generate the data range of required parameter names or optional parameter names according to the parameter array;

[0025] The required parameter names and corresponding data ranges are used as required parameter specifications, and the optional parameter names and corresponding data ranges are used as optional parameter specifications;

[0026] Generate parameter specifications for each sample request route based on the required parameter specifications and the optional parameter specifications.

[0027] By adopting the above technical scheme, the request route and related parameter information of each sample are extracted from the initial learning sample set, the parameter information is classified according to the request route to form different parameter information sets, and each parameter information set is counted to obtain the number of samples for each route, and then the request header, request body, response header and response body of each initial learning sample are parsed to extract specific parameter names and values, and the values ​​are organized into the form of parameter arrays, and then by analyzing the relationship between the number of elements in the parameter array and the number of samples, the required parameter names and optional parameter names are determined and the corresponding data ranges are generated, thereby obtaining the required parameter specifications and optional parameter specifications corresponding to each sample request route, and the parameter specifications are jointly constituted from the required parameter specifications and the optional parameter specifications, thereby enriching the flexibility of the parameter specifications, so that the results are more reliable when using parameter specification comparison.

[0028] Optionally, the required parameter name and optional parameter name of each parameter information are determined according to the number of elements and the number of samples contained in the parameter array, specifically including:

[0029] Determine whether the number of elements contained in the parameter array is greater than the preset value;

[0030] If it is greater than the preset value, determine whether the number of elements contained in the parameter array is equal to the number of samples;

[0031] If it is equal to the number of samples, the parameter name corresponding to the parameter array is used as the required parameter name of the corresponding parameter information;

[0032] If it is not equal to the number of samples, the parameter name corresponding to the parameter array will be used as the optional parameter name of the corresponding parameter information.

[0033] By adopting the above technical solution, by comparing the number of elements in the parameter array with the preset value and the number of samples, it is determined whether the parameter name is required or optional. That is, first determine whether the number of elements contained in the parameter array is greater than the preset value. If the number of elements contained in the parameter array is less than the preset value, it means that the sample is not representative at this time. When the number of elements contained in the parameter array is greater than the preset value, continue to determine whether the number of elements is equal to the number of samples. If equal, it means that each sample contains the corresponding parameter name, and the parameter name is regarded as a required parameter name; otherwise, it is regarded as an optional parameter name. By analyzing historical sample information, it can adapt to actual conditions more flexibly and improve the accuracy of parameter specifications.

[0034] Optionally, generating a data range of a required parameter name or an optional parameter name according to the parameter array specifically includes:

[0035] Get the parameter type of the parameter array; the parameter type includes string type and value type;

[0036] If the parameter type is string type, the maximum and minimum lengths of all elements in the parameter array are counted, and the maximum and minimum lengths are used as the data range of the required parameter name or optional parameter name;

[0037] If the parameter type is a numeric type, the maximum and minimum values ​​of all elements in the parameter array are counted, and the maximum and minimum values ​​are used as the data range of the required parameter name or optional parameter name.

[0038] By adopting the above technical solution, different processing methods are adopted according to different parameter types to determine the data range of required or optional parameter names. For string type parameters, their maximum length and minimum length are counted as the data range; and for numeric type parameters, their maximum and minimum values ​​are counted as the data range. Combined with the characteristics of different types of parameters, the rationality and accuracy of the data range are ensured.

[0039] Optionally, based on the failed request routing, the failed parameter attribute is compared with the parameter specification of the matched sample request routing to obtain a comparison result, which specifically includes:

[0040] Get the parameter specification of the sample request route that matches the failed request route;

[0041] According to the parameter specification, extract all the parameter names and parameter values ​​to be compared in the failed parameter attributes;

[0042] Determine whether the parameter name to be compared covers all parameter names of the required parameter specifications;

[0043] If they are covered, then determine whether each parameter value to be compared is within the data range of the corresponding mandatory parameter specification or optional parameter specification;

[0044] If it is within the data range, the generated comparison result is normal;

[0045] If the parameter name is not within the data range or does not cover all required parameter specifications, the comparison result is abnormal.

[0046] By adopting the above technical solution, for the mandatory parameter specifications, the names of the parameters to be compared need to be fully covered and the values ​​of the parameters to be compared must also meet the corresponding data range, only then the comparison result is considered normal. For the optional parameter specifications, the names of the parameters to be compared may not be fully covered, and only the data range of the optional parameter names that appear in the names of the parameters to be compared needs to be compared. The comparison of the failed parameter attributes by the mandatory parameter specifications and the optional parameter specifications is more flexible and improves accuracy.

[0047] Optionally, the preset processing rules include retry limit rules, access control rules, identity authentication rules and current limiting rules.

[0048] By adopting the above technical solution, the retry limit rules, access control rules, identity authentication rules and current limiting rules provide a variety of preset processing rules, which makes it easy to select appropriate preset processing rules according to actual conditions.

[0049] In the second aspect, the present application provides an API security protection system, which adopts the following technical solutions:

[0050] An API security protection system, comprising:

[0051] A sample acquisition unit, used to acquire an initial learning sample set;

[0052] A specification generation unit, used for generating a parameter specification of each sample request route according to an initial learning sample set;

[0053] A failed request parsing unit, used for parsing the request failure information in response to the existence of the request failure information, and obtaining the failed request route and the failed parameter attributes;

[0054] A comparison unit, for comparing the failed parameter attribute with the parameter specification of the matched sample request route based on the failed request route, to obtain a comparison result; the parameter specification includes a required parameter specification and an optional parameter specification;

[0055] The processing unit is used to process the failed request routing based on a preset processing rule in response to the comparison result being abnormal.

[0056] In a third aspect, the present application provides a computer device, which adopts the following technical solution:

[0057] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program according to any one of the above methods.

[0058] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0059] A computer-readable storage medium includes a computer program that can be loaded by a processor and executed in any of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a flowchart of an API security protection method in one embodiment of the present application.

[0061] Figure 2 This is a flow chart of a method for generating parameter specifications in one embodiment of the present application.

[0062] Figure 3 This is a flowchart of a method for generating optional parameter names and required parameter names in one embodiment of the present application.

[0063] Figure 4 This is a flow chart of a method for generating comparison results in one embodiment of the present application.

[0064] Figure 5 It is a block diagram of an API security protection system in one embodiment of the present application. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0066] The present application embodiment discloses an API security protection method. Figure 1 , an API security protection method, comprising:

[0067] Step S101: obtaining an initial learning sample set;

[0068] Specifically, the initial learning sample set can be stored in a columnar database, for example, a ClickHouse database or an Hbase database. ClickHouse is a columnar database management system; HBase is a distributed, scalable column storage database.

[0069] Step S102: generating parameter specifications for each sample request route according to the initial learning sample set;

[0070] The sample request route includes the requested route url and request method. The request method is the request method of the HTTP protocol, including GET request, POST request, PUT request and DELETE request; GET is a common method for requesting the server to send a resource to the client, which is used to query data. POST request is used for data submission and addition operations. PUT request is used to modify the specific content of a resource. DELETE request is used to delete a resource on the server. The unique sample request route can be obtained through the requested route url and request method.

[0071] Among them, parameter specifications include mandatory parameter specifications and optional parameter specifications.

[0072] Step S103: In response to the API gateway identifying the request failure information, the request failure information is parsed to obtain the failed request route and the failed parameter attributes;

[0073] Specifically, the API gateway is used to collect traffic information, and before step S103, it also includes parsing the response message in the traffic information to obtain the status code, and judging whether the status code of the response message is "200". If the status code is not "200", the response message is judged to be a request failure message, that is, the API gateway recognizes the request failure message. Among them, the status code of the response message is "200", which means that the request is normal. Common status codes with status codes other than "200" include 400: client parameter error;

[0074] 401: Authentication failed; 404: Requested resource not found; 500: Server error.

[0075] Among them, the failed parameter attributes need to be extracted according to the parameter specification, that is, all items that need to be compared in the parameter specification are extracted.

[0076] Step S104: based on the failed request route, compare the failed parameter attribute with the parameter specification of the matched sample request route to obtain a comparison result;

[0077] Step S105: In response to the comparison result being abnormal, the failed request routing is processed based on a preset processing rule.

[0078] It should be noted that if the comparison result is normal, no operation is performed;

[0079] The preset processing rules include retry limit rules, access control rules, identity authentication rules and current limiting rules. The retry limit rules, access control rules, identity authentication rules and current limiting rules provide a variety of preset processing rules, which makes it easy to select the appropriate preset processing rules according to the actual situation.

[0080] In the above implementation, parameter specifications are generated through the initial learning sample set, and the request failure information of the API gateway is monitored in real time. When request failure information is identified, the request failure information is parsed to obtain the failed request route and failed parameter attributes, so as to compare the failed parameter attributes with the generated parameter specifications, and process them based on the abnormal comparison results using preset processing rules to ensure the security of the API. By generating parameter specifications based on the initial learning sample set, the accuracy of API security protection is improved, thereby improving the security of the API.

[0081] As a further implementation of the API security protection method, the API security protection method also includes:

[0082] In response to the API network identifying the request success information, the request success information is parsed to obtain the successful request route and successful parameter attributes; the successful request route and successful parameter attributes are added to the initial learning sample set.

[0083] It should be understood that the API network recognizes the request success information as the response message with a status code of "200" in the API gateway.

[0084] Among them, the failure parameter attributes and the success parameter attributes both include a response header, a response body, a request header, and a request body.

[0085] In the above implementation, the API network recognizes that the request success information indicates that the request is normal, and adds the successful request route and successful parameter attributes to the initial learning sample set, which can continuously optimize the parameter specifications, dynamically adapt to the ever-changing attack patterns, and increase the diversity of the initial learning sample set so that the parameter specifications can be continuously adjusted and optimized.

[0086] Reference Figure 2 As an implementation of step S102, step S102 specifically includes:

[0087] Step S1021: extracting sample request routing and parameter information of each initial learning sample from the initial learning sample set;

[0088] The parameter information includes a sample response header, a sample response body, a sample request header, and a sample request body;

[0089] Step S1022: classifying the parameter information according to the sample request routing to obtain a parameter information set;

[0090] Specifically, the parameter information of the same sample request route is classified into one category, that is, the sample request route corresponding to each parameter information in the parameter information set is consistent.

[0091] Step S1023: Count the parameter information in the same type of parameter information set to obtain the number of samples of the sample request routing;

[0092] Specifically, a hash table is created to store the sample request route and parameter information, and the sample request route is used as the key of the hash table, that is, the key is; the parameter information and the number of samples are used as the key values ​​of the hash table.

[0093] Step S1024: extracting all parameter names and values ​​corresponding to the parameter names contained in each parameter information from the same type of parameter information set;

[0094] Among them, all parameter names and values ​​corresponding to the parameter names contained in each parameter information refer to all parameter names and values ​​corresponding to the parameter names contained in the sample response header, all parameter names and values ​​corresponding to the parameter names contained in the sample response body, all parameter names and values ​​corresponding to the parameter names contained in the sample request header, and all parameter names and values ​​corresponding to the parameter names contained in the sample request body. For example, the parameter information is a sample request body, and two parameters are extracted from the sample request body, namely, parameter age and parameter name, which are parameter names, and the values ​​corresponding to the parameter name age are 12, 15, 17, 26, 34, 57, 89, 23, 45, 15, and 50, respectively, and the values ​​corresponding to the parameter name name are amy, jack, and david, respectively.

[0095] Step S1025: clustering the values ​​corresponding to the parameter names according to the parameter names to obtain a parameter array corresponding to the parameter names;

[0096] The parameter array includes all values ​​corresponding to the parameter name; for example, the parameter array of the parameter name age can be expressed as [12,15,17,26,34,57,89,23,45,15,50]; the parameter array of the parameter name can be expressed as ["amy", "jack", "david"].

[0097] Step S1026: Determine the required parameter name and optional parameter name of each parameter information according to the number of elements and the number of samples contained in the parameter array.

[0098] For example, when the parameter name is age, the corresponding parameter array is [12,15,17,26,34,57,89,23,45,15,50], and the number of elements in the parameter array is 11.

[0099] Step S1027: Generate a data range of a required parameter name or an optional parameter name according to the parameter array;

[0100] Step S1028: taking the required parameter name and the corresponding data range as the required parameter specification, and taking the optional parameter name and the corresponding data range as the optional parameter specification;

[0101] Step S1029: Generate parameter specifications for each sample request route based on the required parameter specifications and the optional parameter specifications.

[0102] Furthermore, in order to facilitate data storage and call, after step S1029, the parameter specification is structured into json format or yaml format, and filled into the preset template to obtain a static file J of the parameter specification, wherein J={"openapi": "3.0.0", "info": {"title": "Customize", "version": "1.0.0"}, "paths": {path1:operation1, path2:operation2, ..., pathn:operationn}}. openapi refers to the version number of openAPI, info is the information of the current structured document, including the title and version number, and paths is the structured parameter specification.

[0103] In the above implementation, the request route and related parameter information of each sample are extracted from the initial learning sample set, the parameter information is classified according to the request route to form different parameter information sets, and each parameter information set is counted to obtain the number of samples for each route, and then the request header, request body, response header and response body of each initial learning sample are parsed to extract specific parameter names and values, and the values ​​are organized into the form of a parameter array, and then by analyzing the relationship between the number of elements in the parameter array and the number of samples, the required parameter names and optional parameter names are determined and the corresponding data ranges are generated, thereby obtaining the required parameter specifications and optional parameter specifications corresponding to each sample request route, and the parameter specifications are jointly constituted from the required parameter specifications and the optional parameter specifications, thereby enriching the flexibility of the parameter specifications, so that the results are more reliable when using parameter specification comparison.

[0104] Reference Figure 3 As an implementation of step S1026, step S1026 specifically includes:

[0105] Step S10261: Determine whether the number of elements contained in the parameter array is greater than a preset value; if it is greater than the preset value, execute step S10262. If it is less than the preset value, execute step S10264.

[0106] The preset value can be set according to the actual situation, for example, the preset value can be set to 10. If the number of elements contained in the parameter array is less than the preset value, it means that the number of samples in the parameter array is too small and not representative. At this time, the corresponding parameter name is set as an optional item.

[0107] Step S10262: Determine whether the number of elements contained in the parameter array is equal to the number of samples; if it is equal to the number of samples, execute step S10263; if it is not equal to the number of samples, execute step S10264.

[0108] It should be understood that if the number of elements contained in the parameter array is equal to the number of samples, it means that each parameter information contains a corresponding parameter name, and the corresponding parameter name is a required parameter name.

[0109] Step S10263: taking the parameter name corresponding to the parameter array as the required parameter name of the corresponding parameter information;

[0110] Step S10264: Use the parameter name corresponding to the parameter array as the optional parameter name of the corresponding parameter information.

[0111] In the above implementation, by comparing the number of elements in the parameter array with the preset value and the number of samples, it is determined whether the parameter name is required or optional. That is, first determine whether the number of elements contained in the parameter array is greater than the preset value. If the number of elements contained in the parameter array is less than the preset value, it means that the sample is not representative at this time. When the number of elements contained in the parameter array is greater than the preset value, continue to determine whether the number of elements is equal to the number of samples. If equal, it means that each sample contains the corresponding parameter name, and the parameter name is regarded as a required parameter name; otherwise, it is regarded as an optional parameter name. By analyzing historical sample information, it can adapt to actual conditions more flexibly and improve the accuracy of parameter specifications.

[0112] As an implementation of step S1027, step S1027 specifically includes:

[0113] Step S10271: Obtain the parameter type of the parameter array;

[0114] Among them, the parameter types include string type and value type;

[0115] Step S10272: If the parameter type is a string type, the maximum length and the minimum length of all elements in the parameter array are counted, and the maximum length and the minimum length are used as the data range of the required parameter name or the optional parameter name;

[0116] Step S10273: If the parameter type is a numerical type, the maximum and minimum values ​​of all elements in the parameter array are counted, and the maximum and minimum values ​​are used as the data range of the required parameter name or the optional parameter name.

[0117] In the above implementation, different processing methods are adopted according to different parameter types to determine the data range of required or optional parameter names. For string type parameters, their maximum length and minimum length are counted as the data range; and for numeric type parameters, their maximum and minimum values ​​are counted as the data range. Combined with the characteristics of different types of parameters, the rationality and accuracy of the data range are ensured.

[0118] Reference Figure 4 As an implementation of step S104, step S104 specifically includes:

[0119] Step S1041: Obtain parameter specifications of a sample request route that matches the failed request route;

[0120] Step S1042: extract all the parameter names and parameter values ​​to be compared in the failed parameter attributes according to the parameter specification;

[0121] Among them, the names of the parameters to be compared and the values ​​of the parameters to be compared correspond one to one.

[0122] Step S1043: determine whether the parameter name to be compared covers the parameter names of all required parameter specifications; if so, execute step S1044; if not, execute step S1046;

[0123] Step S1044: determine whether each parameter value to be compared is within the data range of the corresponding required parameter specification or optional parameter specification; if it is within the data range, execute step S1045; if it is not within the data range, execute step S1046;

[0124] Step S1045: generating a comparison result that is normal;

[0125] Step S1046: Generate a comparison result that is abnormal.

[0126] In the above implementation, for the mandatory parameter specifications, the parameter names to be compared need to be fully covered and the parameter values ​​to be compared also need to meet the corresponding data range, only then the comparison result is considered normal. For the optional parameter specifications, the parameter names to be compared may not be fully covered, and only the data range of the optional parameter names that appear in the parameter names to be compared needs to be compared. The comparison of failed parameter attributes by the mandatory parameter specifications and the optional parameter specifications is more flexible and improves accuracy.

[0127] The present application embodiment discloses an API security protection system. Figure 5 , an API security protection system, comprising:

[0128] A sample acquisition unit, used to acquire an initial learning sample set;

[0129] A specification generation unit, used for generating a parameter specification of each sample request route according to an initial learning sample set;

[0130] A failed request parsing unit, used for parsing the request failure information in response to the existence of the request failure information, and obtaining the failed request route and the failed parameter attributes;

[0131] A comparison unit, for comparing the failed parameter attribute with the parameter specification of the matched sample request route based on the failed request route, to obtain a comparison result; the parameter specification includes a required parameter specification and an optional parameter specification;

[0132] The processing unit is used to process the failed request routing based on a preset processing rule in response to the comparison result being abnormal.

[0133] The API security protection system provided in this application can implement the above-mentioned API security protection method, and the specific working process of an API security protection system can refer to the corresponding process in the above-mentioned method embodiment.

[0134] It should be noted that in the above embodiments, the description of each embodiment has different emphases, and for the parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0135] Based on the same technical concept, the present invention also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program according to any of the above methods.

[0136] The present invention also discloses a computer-readable storage medium, which includes a computer program that can be loaded by a processor and executed as in any of the above methods.

[0137] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0138] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0139] The above are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Any feature disclosed in this specification (including the abstract and drawings), unless otherwise stated, can be replaced by other equivalent or alternative features with similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

Claims

1. An API security protection method, characterized in that: include: Obtain an initial learning sample set; Generate parameter specifications for each sample request route based on the initial learning sample set; In response to the API gateway identifying the request failure information, the request failure information is parsed to obtain the failed request route and the failed parameter attributes; Based on the failed request route, the failed parameter attribute is compared with the parameter specification of the matched sample request route to obtain a comparison result; the parameter specification includes a required parameter specification and an optional parameter specification; In response to the comparison result being abnormal, processing the failed request routing based on a preset processing rule; The parameter specification of each sample request route generated according to the initial learning sample set specifically includes: Extracting the sample request routing and parameter information of each initial learning sample from the initial learning sample set; the parameter information includes a sample response header, a sample response body, a sample request header and a sample request body; According to the sample request routing, the parameter information is classified to obtain a parameter information set; Count the parameter information in the same type of parameter information set to obtain the number of samples of the sample request routing; Extract all parameter names and values ​​corresponding to the parameter names contained in each parameter information from the same type of parameter information set; According to the parameter name, the values ​​corresponding to the parameter name are clustered to obtain a parameter array corresponding to the parameter name; the parameter array includes all the values ​​corresponding to the parameter name; According to the number of elements and samples contained in the parameter array, determine the required parameter name and optional parameter name of each parameter information; Generate the data range of required parameter names or optional parameter names according to the parameter array; The required parameter names and corresponding data ranges are used as required parameter specifications, and the optional parameter names and corresponding data ranges are used as optional parameter specifications; Generate parameter specifications for each sample request route based on the required parameter specifications and the optional parameter specifications.

2. The method according to claim 1, characterized in that Also includes: In response to the API network identifying the request success information, the request success information is parsed to obtain the successful request route and the successful parameter attributes; Added success request routing and success parameter attributes to the initial learning sample set.

3. The method according to claim 1, characterized in that The required parameter name and optional parameter name of each parameter information are determined according to the number of elements and the number of samples contained in the parameter array, specifically including: Determine whether the number of elements contained in the parameter array is greater than the preset value; If it is greater than the preset value, determine whether the number of elements contained in the parameter array is equal to the number of samples; If it is equal to the number of samples, the parameter name corresponding to the parameter array is used as the required parameter name of the corresponding parameter information; If it is not equal to the number of samples, the parameter name corresponding to the parameter array will be used as the optional parameter name of the corresponding parameter information.

4. The method according to claim 1, characterized in that: The data range of the required parameter name or the optional parameter name is generated according to the parameter array, specifically including: Get the parameter type of the parameter array; the parameter type includes string type and value type; If the parameter type is string type, the maximum and minimum lengths of all elements in the parameter array are counted, and the maximum and minimum lengths are used as the data range of the required parameter name or optional parameter name; If the parameter type is a numeric type, the maximum and minimum values ​​of all elements in the parameter array are counted, and the maximum and minimum values ​​are used as the data range of the required parameter name or optional parameter name.

5. The method according to claim 1, characterized in that Based on the failed request routing, the failed parameter attribute is compared with the parameter specification of the matched sample request routing to obtain a comparison result, which specifically includes: Get the parameter specification of the sample request route that matches the failed request route; According to the parameter specification, extract all the parameter names and parameter values ​​to be compared in the failed parameter attributes; Determine whether the parameter name to be compared covers all parameter names of the required parameter specifications; If they are covered, then determine whether each parameter value to be compared is within the data range of the corresponding mandatory parameter specification or optional parameter specification; If it is within the data range, the generated comparison result is normal; If the parameter name is not within the data range or does not cover all required parameter specifications, the comparison result is abnormal.

6. The method according to claim 1, characterized in that The preset processing rules include retry limit rules, access control rules, identity authentication rules and current limiting rules.

7. An API security protection system, characterized in that: include: A sample acquisition unit, used to acquire an initial learning sample set; A specification generation unit, used for generating a parameter specification of each sample request route according to an initial learning sample set; A failed request parsing unit, used for parsing the request failure information in response to the existence of the request failure information, and obtaining the failed request route and the failed parameter attributes; A comparison unit, for comparing the failed parameter attribute with the parameter specification of the matched sample request route based on the failed request route, to obtain a comparison result; the parameter specification includes a required parameter specification and an optional parameter specification; A processing unit, configured to process the failed request routing based on a preset processing rule in response to the comparison result being abnormal; The specification generation unit is configured to: Extracting the sample request routing and parameter information of each initial learning sample from the initial learning sample set; the parameter information includes a sample response header, a sample response body, a sample request header and a sample request body; According to the sample request routing, the parameter information is classified to obtain a parameter information set; Count the parameter information in the same type of parameter information set to obtain the number of samples of the sample request routing; Extract all parameter names and values ​​corresponding to the parameter names contained in each parameter information from the same type of parameter information set; According to the parameter name, the values ​​corresponding to the parameter name are clustered to obtain a parameter array corresponding to the parameter name; the parameter array includes all the values ​​corresponding to the parameter name; According to the number of elements and samples contained in the parameter array, determine the required parameter name and optional parameter name of each parameter information; Generate the data range of required parameter names or optional parameter names according to the parameter array; The required parameter names and corresponding data ranges are used as required parameter specifications, and the optional parameter names and corresponding data ranges are used as optional parameter specifications; Generate parameter specifications for each sample request route based on the required parameter specifications and the optional parameter specifications.

8. A computer device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program according to any one of the methods of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The method comprises storing a computer program which can be loaded by a processor and execute the method according to any one of claims 1 to 6.

Images