Interface audit method, device, electronic device and storage medium

Abstract

The present invention relates to an interface audit method, device, electronic device and storage medium, and relates to the field of computers. The method comprises: obtaining an access log of an entry controller in a target cluster, wherein an interface call request to the target cluster is forwarded to a corresponding service node in the target cluster via the entry controller; parsing target interface information from the access log, the target interface information identifying the interface called in the target cluster; determining the target audit type of the interface identified by the target interface information; and executing a corresponding audit process for the interface identified by the target interface information according to the target audit type. Thus, the interface in the target cluster can be fully and accurately discovered without deploying any third-party components in the target cluster, and the triggering timing of the interface discovery and audit process can be flexibly controlled to avoid wasting cluster resources, and unnecessary audit processes can be reduced, thereby improving audit efficiency and saving audit resources.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to an interface audit method, device, electronic equipment and storage medium. Background Art

[0002] In the automotive industry, as the degree of vehicle modernization increases, the electronic systems inside and outside the vehicle become more complex, and the application of cloud services is becoming more and more popular. By connecting to the cloud, vehicles can obtain real-time traffic information, vehicle health status, remote diagnosis and other services. In order to ensure the security, stability and availability of these cloud systems, cloud services can be monitored and audited. At present, the common practice is to deploy packet capture tools (such as TCPdump or kubeshark) in the cloud service cluster to monitor the interface request information in the cluster in real time, so as to discover the interface of the cloud service and then conduct interface audit.

[0003] However, deploying packet capture tools in the cloud service cluster consumes hardware resources, which will affect the performance of the cloud service cluster itself. In addition, the timing of triggering interface discovery and auditing cannot be flexibly controlled. The traffic in the cloud service cluster can only be continuously sniffed. This is not only inflexible, but also easily leads to a waste of cloud service cluster resources. Summary of the invention

[0004] The present invention provides an interface audit method, device, electronic device and storage medium to solve the technical problem in the prior art of deploying a packet capture tool in a cloud service cluster to monitor the interface request information in the cluster in real time, thereby discovering the waste of cloud service cluster resources caused by the cloud service interface.

[0005] In a first aspect, the present invention provides an interface audit method, the method comprising:

[0006] Obtaining an access log of an ingress controller in a target cluster, wherein an interface call request to the target cluster is forwarded to a corresponding service node in the target cluster via the ingress controller;

[0007] Parsing target interface information from the access log, where the target interface information identifies the called interface in the target cluster;

[0008] Determining a target audit type of the interface identified by the target interface information;

[0009] According to the target audit type, a corresponding audit process is executed on the interface identified by the target interface information.

[0010] In a possible implementation manner, determining the target audit type of the interface identified by the target interface information includes:

[0011] Searching for the target interface information in a plurality of preset interface classification sets, wherein the interface classification sets include interface information corresponding to interfaces of the same audit type, and different interface classification sets correspond to different audit types;

[0012] The audit type corresponding to the interface classification set hit by the target interface information is determined as the target audit type.

[0013] In a possible implementation manner, determining the target audit type of the interface identified by the target interface information further includes:

[0014] Constructing a corresponding Bloom filter for each of the interface classification sets to obtain a Bloom filter group;

[0015] The searching the target interface information in a preset plurality of interface classification sets includes:

[0016] Loading the Bloom filter bank;

[0017] The target interface information is submitted to the Bloom filter group, and the target interface information is searched for in a plurality of preset interface classification sets through the Bloom filter group.

[0018] In a possible implementation manner, determining the target audit type of the interface identified by the target interface information further includes:

[0019] In the case that the target interface information does not match any of the interface classification sets, obtaining an audit type marking operation for the target interface information;

[0020] In response to the audit type marking operation, the target interface information is stored in the corresponding interface classification set.

[0021] In a possible implementation manner, after determining the target audit type of the interface identified by the target interface information, the method further includes:

[0022] Marking the target interface information according to the target audit type;

[0023] Sending the target interface information marked with the target audit type to a set message queue;

[0024] The step of executing a corresponding audit process on the interface identified by the target interface information according to the target audit type includes:

[0025] Acquire the target interface information and the target audit type marked by the target interface information from the message queue;

[0026] According to the target audit type, a corresponding audit process is executed on the interface identified by the target interface information.

[0027] In a possible implementation, the performing a corresponding audit process on the interface identified by the target interface information according to the target audit type includes:

[0028] In the case that the number of the target audit types is two or more, the audit processes corresponding to different target audit types are executed in parallel on the interfaces identified by the target interface information.

[0029] In a second aspect, the present invention provides an interface auditing device, the device comprising:

[0030] A log acquisition module, used to acquire the access log of the ingress controller in the target cluster, wherein the interface call request to the target cluster is forwarded to the corresponding service node in the target cluster via the ingress controller;

[0031] An interface parsing module, used to parse target interface information from the access log, wherein the target interface information identifies the called interface in the target cluster;

[0032] An audit type determination module, used to determine a target audit type of the interface identified by the target interface information;

[0033] The audit execution module is used to execute a corresponding audit process on the interface identified by the target interface information according to the target audit type.

[0034] In a possible implementation, the audit type determination module includes:

[0035] An interface classification search unit, used to search for the target interface information in a plurality of preset interface classification sets, wherein the interface classification sets include interface information corresponding to interfaces of the same audit type, and different interface classification sets correspond to different audit types;

[0036] The audit type determination unit is used to determine the audit type corresponding to the interface classification set hit by the target interface information as the target audit type.

[0037] In a possible implementation manner, the audit type determination module further includes:

[0038] A Bloom filter construction unit, used to construct a corresponding Bloom filter for each of the interface classification sets to obtain a Bloom filter group;

[0039] The interface classification search unit is used to load the Bloom filter group; submit the target interface information to the Bloom filter group, and search for the target interface information in a plurality of preset interface classification sets through the Bloom filter group.

[0040] In a possible implementation manner, the audit type determination module further includes:

[0041] An audit type mark acquisition unit, configured to acquire an audit type mark operation for the target interface information when the target interface information does not match any of the interface classification sets;

[0042] The interface information storage unit is used to store the target interface information into the corresponding interface classification set in response to the audit type marking operation.

[0043] In a possible implementation manner, the audit type determination module further includes:

[0044] An audit type marking processing unit, used for marking the target interface information according to the target audit type;

[0045] A message queue sending unit, used for sending the target interface information marked with the target audit type to a set message queue;

[0046] The audit execution module includes:

[0047] A target interface information acquisition unit, used to acquire the target interface information and the target audit type marked by the target interface information from the message queue;

[0048] An audit process execution unit is used to execute a corresponding audit process on the interface identified by the target interface information according to the target audit type.

[0049] In a possible implementation, the audit execution module includes:

[0050] A parallel audit execution unit is used to execute the audit processes corresponding to different target audit types in parallel on the interface identified by the target interface information when the number of the target audit types is two or more.

[0051] In a third aspect, the present invention provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus.

[0052] Memory, used to store computer programs;

[0053] The processor is used to implement any interface audit method described in the first aspect when executing a program stored in the memory.

[0054] In a fourth aspect, the present invention further provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the interface audit method described in any one of the above items of the present invention.

[0055] The above technical solution provided by the embodiment of the present invention has the following advantages compared with the prior art: the interface audit method provided by the embodiment of the present invention, by obtaining the access log of the inlet controller of the target cluster, parsing the target interface information from the access log, because the interface call request of the target cluster is forwarded to the corresponding service node in the target cluster via the inlet controller, therefore, the external interface call situation of the target cluster can be accurately and comprehensively obtained from the access log, so that the interface in the target cluster can be accurately and comprehensively discovered, which helps to improve the accuracy of the interface audit of the target cluster, and the interface in the target cluster can be discovered without deploying any third-party components in the target cluster. By obtaining the access log of the inlet controller to trigger interface discovery and interface audit of the target cluster, the timing of triggering interface discovery and audit can be flexibly controlled, and the waste of cluster resources can be avoided. By determining the target audit type of the interface identified by the target interface information, according to the target audit type, the corresponding audit process is executed for the interface identified by the target interface information, so as to realize the targeted selection of audit tools and methods and the implementation of effective audit measures, which can improve the audit effect on the one hand, and remove unnecessary audit processes on the other hand, so as to effectively reduce the audit time, improve the audit efficiency, and save audit resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0058] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0059] Figure 1A schematic diagram of a system architecture provided by an embodiment of the present invention.

[0060] Figure 2 A flow chart of an embodiment of an interface audit method provided in an embodiment of the present invention.

[0061] Figure 3 A flow chart of another embodiment of an interface audit method provided in an embodiment of the present invention.

[0062] Figure 4 A flow chart of another embodiment of an interface audit method provided in an embodiment of the present invention.

[0063] Figure 5 A block diagram of an embodiment of an interface auditing device provided in an embodiment of the present invention.

[0064] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0067] In order to solve the technical problem in the prior art of deploying packet capture tools in a cloud service cluster to monitor interface request information in the cluster in real time, thereby discovering the waste of cloud service cluster resources caused by the interfaces of the cloud service, the present invention provides an interface auditing method, device, electronic device and storage medium, which can achieve comprehensive and accurate discovery of interfaces in a target cluster without deploying any third-party components in the target cluster, and flexibly control the timing of triggering interface discovery and auditing, thereby avoiding waste of cluster resources.

[0068] Figure 1 FIG. 1 is a schematic diagram of a system architecture involved in an embodiment of the present invention. Figure 1The system architecture shown includes: a vehicle-side application 11, a cloud service cluster 12, and an audit device 13. The cloud service cluster 12 includes an entry controller 121, a service gateway 122, and a service node 123. Among them, the vehicle-side application 11 is connected to the cloud service cluster 12 in communication, specifically connected to the entry controller 121 in the cloud service cluster 12. The entry controller 121 is also connected to the audit device 13 in communication. Here, the communication link used for the communication connection may include a wireless link, a wired link, or an optical fiber cable, etc., and the present invention does not limit this.

[0069] The cloud service cluster 12 is, for example, a Kubernetes cluster, which is a cluster consisting of multiple service nodes (such as Figure 1 A service node is a collection of computing resources consisting of service nodes 123 shown in the example, which work together to complete specific tasks or services. A service node refers to an application instance running in a Kubernetes cluster, usually a Pod.

[0070] The ingress controller 121 is the traffic entrance of the cloud service cluster 12, which is used to manage the traffic entering the cluster. When an external request enters the cluster, the ingress controller 121 will forward the external request to the service node 123 inside the cluster according to the configuration of the resources in the cloud service cluster 12, and then the service node 123 will proxy the external request to the corresponding application Pod, thereby realizing the final processing of the external request. It can be seen that all external requests to the cloud service cluster 12 will be forwarded to the cloud service cluster 12 via the ingress controller 121. Optionally, the ingress controller 121 is implemented using traffic proxy software such as Nginx.

[0071] The audit device 13 is the executor of the interface audit method provided in the embodiment of the present invention, and its specific implementation can be an independent device, or a component in the ingress controller 121. The embodiment of the present invention does not limit this. By executing the interface audit method provided in the embodiment of the present invention, the audit device 13 can realize comprehensive and accurate discovery of interfaces in the target cluster without deploying any third-party components in the target cluster, and flexibly control the timing of triggering interface discovery and auditing, thereby avoiding waste of cluster resources.

[0072] Figure 2 The following is a flow chart of an embodiment of an interface audit method provided by an embodiment of the present invention. In one embodiment, Figure 2 The process shown applies to Figure 1 The audit device 13 in the system architecture shown. Figure 2 As shown, the following steps are included:

[0073] Step 101: Obtain the access log of the ingress controller in the target cluster, wherein the interface call request to the target cluster is forwarded to the corresponding service node in the target cluster via the ingress controller.

[0074] The target cluster mentioned above refers to the cluster that needs to perform interface audit, for example Figure 1 The cloud service cluster 12 is shown in the example.

[0075] like Figure 1 As shown, the target cluster is equipped with an ingress controller, and all external requests to the target cluster will be forwarded to the target cluster via the ingress controller. This means that all interface call requests to the target cluster will also be forwarded to the corresponding service node in the target cluster via the ingress controller. Therefore, the ingress controller of the target cluster can record all interface call requests to the target cluster.

[0076] In one embodiment, the logging function of the ingress controller is enabled, and the log output format is configured according to the type of the ingress controller. When the logging function is enabled in the ingress controller, each time the ingress controller receives an interface call request, a log record may be generated for the interface call request, and the log record may be stored in the access log of the ingress controller. Typically, the log record contains key information such as request time, client IP, request method, request URL (including query parameters), request header, response status code, response time, etc.

[0077] It can be seen that the access log of the ingress controller can comprehensively record all interface call requests for the target cluster. On this basis, by obtaining the access log of the ingress controller in the target cluster, the interface call status of the target cluster can be obtained, thereby providing data support for monitoring and auditing the interface calls of the target cluster.

[0078] In one embodiment, the access log of the ingress controller in the target cluster is obtained in the following manner:

[0079] When deploying an ingress controller, add a specific label to the Pod it is in, such as "log-pod=true". In this way, you can use the Kubernetes API Server to easily find the Pods corresponding to all marked ingress controllers, and then obtain the log stream through the Pod's log interface, that is, get the access log of the ingress controller.

[0080] In one embodiment, the access log of the ingress controller may be obtained periodically, for example, the access log of the ingress controller may be obtained every set number of days. This means that the method provided in the embodiment of the present invention is periodically executed to implement periodic interface auditing of the target cluster.

[0081] In another embodiment, the access log of the ingress controller may be obtained in response to user operations. This means that the user may choose to execute the method provided in the embodiment of the present invention to perform interface audit on the target cluster according to actual needs.

[0082] It can be seen that the technical solution provided by the embodiment of the present invention supports flexible control of the timing of triggering interface discovery and auditing, and can avoid wasting cluster resources.

[0083] Step 102: parse the access log to obtain target interface information, where the target interface information identifies the interface called in the target cluster.

[0084] Each interface in the target cluster has a unique identification method in the target cluster, which is usually uniquely determined by the request path (i.e., request URL) and the request method. For example, different HTTP methods (GET, POST, etc.) acting on the same path will correspond to different interfaces. Therefore, the above-mentioned target interface information may include the request path and the request method. Of course, the target interface information may also include other parameters, such as request timestamp, response status code, request header information, request parameters, response time, etc., which are not limited in this embodiment of the present invention.

[0085] It can be known from the description in step 101 that the access log of the entry controller records the request URL (including query parameters) and the request method. Therefore, in step 102, the interface information of the interface called by the above-mentioned interface call request can be parsed from the access log (for the convenience of description, the interface information parsed from the access log will be referred to as the target interface information below).

[0086] In one embodiment, the access log obtained in step 101 is parsed line by line, and the interface information in each line is extracted using a regular expression to obtain the target interface information. A line in the access log represents a complete request information, including all relevant key information, such as request time, client IP, request method, request URL, request header, response status code, and response time. By parsing the access log line by line, it can be ensured that each interface call request can be accurately extracted and analyzed, thereby obtaining comprehensive and accurate target interface information for further analysis and processing.

[0087] It can be seen from the above description that in the technical solution of the embodiment of the present invention, there is no need to deploy any third-party components in the target cluster. The access log of the ingress controller in the target cluster can be obtained by using the log acquisition interface provided by the Kubernetes API, so that it can be used out of the box and reduce the deployment cost and resource consumption of the cluster. In addition, by obtaining the access log of the ingress controller, all interface call requests can be monitored, so that interface discovery does not require any additional tools or infrastructure, and only requires collecting the access logs to a specified location and using regular expressions or other parsing tools.

[0088] Step 103: Determine the target audit type of the interface identified by the target interface information.

[0089] Step 104: According to the target audit type, a corresponding audit process is executed on the interface identified by the target interface information.

[0090] For ease of understanding, step 103 and step 104 are described in a unified manner as follows:

[0091] The target audit type refers to the type of specific audit activity that needs to be performed on the interface identified by the target interface information. According to different audit objectives and requirements, interface audits can be divided into multiple types, each type corresponding to different audit aspects. The following shows several common interface audit types and their corresponding audit aspects:

[0092] (1) Security Audit

[0093] Auditing: Mainly focus on the security of the interface, including the security of data transmission, the effectiveness of interface authentication and authorization mechanisms, and the interface's ability to resist attacks.

[0094] Audit objective: Ensure that the interface is not accessed by unauthorized persons and prevent data leakage and tampering.

[0095] Audit content: Authentication and authorization: Ensure that the interface can only be accessed by authorized users or services. Input validation: Check whether the interface correctly handles user input to prevent common security vulnerabilities such as SQL injection and cross-site scripting (XSS). Encryption: Verify whether data transmission is carried out through encryption protocols such as HTTPS to ensure that data is not eavesdropped or tampered with during transmission.

[0096] (2) Stability Audit

[0097] Auditing: Pay attention to the stability of the interface to ensure that the interface can continue to work normally under long-term operation or high load conditions.

[0098] Goal: Reduce system downtime due to interface failures.

[0099] Audit content: Monitor the availability of interfaces to ensure that services can be provided normally within the specified time. Analyze the fault logs and performance indicators of the interfaces to identify potential problems and bottlenecks. Develop emergency response plans to deal with interface failures or abnormal situations.

[0100] (3) Availability Audit:

[0101] Interface accessibility: Ensure that the interface is accessible most of the time to avoid service interruptions due to system failures.

[0102] Fault tolerance mechanism: Check whether the interface can provide reasonable error responses or degraded services under abnormal circumstances (such as dependent services being unavailable).

[0103] Audit content: Logging: Verify whether the interface generates detailed logs so that backtracking and analysis can be performed when problems occur. Monitoring indicators: Ensure that the interface has appropriate monitoring indicators (such as number of requests, error rate, response time) for real-time monitoring and alarming of the system.

[0104] (4) Performance Audit:

[0105] Auditing: focus on the performance of the interface, including response time, throughput, concurrent processing capabilities, etc.

[0106] Audit objective: Ensure that the interface meets business needs and user experience requirements.

[0107] Audit content: Response time: measure the response speed of the interface to ensure fast response under high load. Throughput: evaluate the number of requests processed by the interface per unit time to determine the system's carrying capacity.

[0108] (5) Compliance audit

[0109] Auditing: Ensure that the design and implementation of the interface comply with relevant laws and regulations, industry standards and internal policies.

[0110] Audit objective: To prevent legal risks caused by improper interface design or illegal operations.

[0111] Audit content: Review whether the interface involves the transmission and processing of sensitive data and whether corresponding protection measures have been taken. Check whether the interface complies with relevant laws and regulations on data privacy protection, such as GDPR (General Data Protection Regulation of the European Union). Verify whether the interface meets the requirements of industry standards and internal policies, such as whether the payment interface complies with PCI DSS (Payment Card Industry Data Security Standard).

[0112] It can be seen from the above examples that different audit types correspond to different audit contents, so different audit types correspond to different audit processes. Accordingly, in step 103 and step 104, by determining the target audit type of the interface identified by the target interface information, and then executing the corresponding audit process for the interface identified by the target interface information according to the target audit type, it is possible to select audit tools and methods in a targeted manner, implement effective audit measures, and ultimately ensure the safety and reliability of the entire system. At the same time, unnecessary audit processes can also be removed, which can effectively reduce audit time and improve audit efficiency on the one hand, and save audit resources on the other.

[0113] The interface audit method provided by the embodiment of the present invention obtains the access log of the inlet controller of the target cluster, and parses the target interface information from the access log. Since the interface call request of the target cluster is forwarded to the corresponding service node in the target cluster via the inlet controller, the interface call situation of the external target cluster can be accurately and comprehensively obtained from the access log, so that the interface in the target cluster can be accurately and comprehensively discovered, which helps to improve the accuracy of the interface audit of the target cluster, and the interface in the target cluster can be discovered without deploying any third-party components in the target cluster. By obtaining the access log of the inlet controller to trigger interface discovery and interface audit of the target cluster, the timing of triggering interface discovery and audit can be flexibly controlled, and the waste of cluster resources can be avoided. By determining the target audit type of the interface identified by the target interface information, according to the target audit type, the corresponding audit process is executed for the interface identified by the target interface information, and the audit tools and methods are selected in a targeted manner, and effective audit measures are implemented. This can improve the audit effect on the one hand, and remove unnecessary audit processes on the other hand, so that the audit time can be effectively reduced, the audit efficiency can be improved, and audit resources can be saved.

[0114] In one embodiment, the specific implementation of determining the target audit type of the interface identified by the target interface information includes: searching for the target interface information in a plurality of preset interface classification sets, and determining the audit type corresponding to the interface classification set hit by the target interface information as the target audit type.

[0115] In this embodiment, one interface classification set includes interface information corresponding to interfaces of the same audit type, and different interface classification sets correspond to different audit types, that is, each interface classification set corresponds to a specific audit type. Accordingly, when it is necessary to determine the audit type of the interface identified by the target interface information, it can be searched in these preset interface classification sets, and the audit type corresponding to the interface classification set hit by the target interface information is determined as the target audit type.

[0116] It should be noted that the interface information in the above-mentioned interface classification set can be dynamically maintained. For example, when a new interface is discovered, the interface information of the interface is added to the corresponding interface classification set. Thereafter, when an interface call request for the interface is received again, the audit type of the interface can be determined by searching the interface information of the interface in the interface classification set.

[0117] It can be seen that the above embodiments can realize classified management of interface information and quickly determine the audit type of the interface identified by the target interface information.

[0118] Furthermore, in one embodiment, in order to improve the efficiency of searching for target interface information, a Bloom filter is used. A Bloom filter is an efficient set query tool, and is particularly suitable for processing element query problems of large data sets. The Bloom filter is implemented by a bit array and multiple hash functions, and can quickly determine whether an element belongs to a set, thereby improving the search efficiency. Figure 3 The embodiment shown.

[0119] Figure 3 A flow chart of another embodiment of an interface audit method provided in an embodiment of the present invention. Figure 3 The process shown in Figure 2 Based on the process shown, the following steps are included:

[0120] Step 301: construct a corresponding Bloom filter for each interface classification set to obtain a Bloom filter group.

[0121] The above-mentioned Bloom filter group refers to a set composed of Bloom filters corresponding to each interface classification set, wherein each Bloom filter corresponds to one interface classification set.

[0122] In practical applications, constructing a corresponding Bloom filter for the above interface classification set includes the following steps:

[0123] Step 1: Initialize a bit array: Initialize a bit array for each interface classification set. The size of this array depends on the expected number of elements and the acceptable false alarm rate.

[0124] Step 2. Select hash functions: Select a set of hash functions that will be used to map the interface information to different locations in the bit array. The number and type of hash functions will affect the performance and false positive rate of the filter.

[0125] Step 3, add elements to the Bloom filter: For each interface information in each interface classification set, use the selected hash function to map it to the bit array. Specifically: For each interface information, use each hash function to generate a hash value. Take each hash value modulo the length of the bit array to get an array index. Set the bit array positions corresponding to these indexes to 1.

[0126] Step 302: Obtain the access log of the ingress controller in the target cluster.

[0127] Step 303: parse the target interface information from the access log.

[0128] The description of the above steps 302 to 303 can refer to the relevant description in the above embodiment, which will not be repeated here.

[0129] Step 304: Load the Bloom filter group.

[0130] Step 305: Submit the target interface information to the Bloom filter group, and search for the target interface information in the preset multiple interface classification sets through the Bloom filter group. When the target interface information is found in the preset multiple interface classification sets, execute step 306; when the target interface information is not found in the preset multiple interface classification sets, execute step 307.

[0131] In step 305, the interface information is submitted to the Bloom filter group, each Bloom filter therein is traversed in turn, and the traversed Bloom filter is queried. The querying of the traversed Bloom filter includes the following process:

[0132] Using the same hash function group as in step 301, a set of hash values ​​is calculated for the target interface information, and the bit array positions corresponding to these hash values ​​are checked one by one. If the bit array positions corresponding to all hash values ​​are 1, it means that the interface information may exist in the interface classification set corresponding to the current Bloom filter. If the bit array position corresponding to any hash value is 0, it can be determined that the interface information does not exist in the interface classification set corresponding to the current Bloom filter.

[0133] The search results are recorded in a pre-initialized variable or data structure, and the search results of all Bloom filters are summarized to determine whether the target interface information is included in multiple interface classification sets.

[0134] Step 306: Determine the audit type corresponding to the interface classification set hit by the target interface information as the target audit type.

[0135] Step 307: Obtain the audit type marking operation for the target interface information.

[0136] Step 308: In response to the audit type marking operation, the target interface information is stored in the corresponding interface classification set.

[0137] For ease of understanding, steps 306 to 308 are described in a unified manner as follows:

[0138] Submit the target interface information to multiple preset Bloom filter groups, which represent different interface classification sets. Search for the target interface information in multiple preset interface classification sets (represented by Bloom filter groups). If the target interface information is found in one or more interface classification sets, that is, it "hit" a Bloom filter, it means that the interface information belongs to the corresponding interface classification set. According to the hit interface classification set, determine the audit type corresponding to the target interface information. This audit type is pre-associated with the interface classification set. If the target interface information is not found in multiple preset interface classification sets, that is, it is not "hit" in all Bloom filters, it means that the interface information does not belong to any preset interface classification set. At this time, its audit type can be determined by manual marking.

[0139] Optionally, the manual marking process includes: analyzing the nature and purpose of the interface identified by the target interface information, manually determining a suitable audit type according to a preset audit type standard, and associating the audit type with the target interface information.

[0140] After determining the audit type of the target interface information, add the target interface information to the corresponding Bloom filter. The next time the same target interface information is submitted to the Bloom filter group for search again, the Bloom filter can identify the target interface information (i.e., hit) because the target interface information has been added to the Bloom filter before. At the same time, the corresponding audit type can be directly determined, avoiding the manual marking step again.

[0141] Step 309: According to the target audit type, execute the corresponding audit process for the interface identified by the target interface information.

[0142] In the embodiment of the present invention, through the application of Bloom filter, efficient interface information query and storage are realized, the performance and responsiveness of the system are improved, and the possibility of data loss and error is reduced. When the target interface information is not found in the preset multiple interface classification sets, the audit type marking operation of the target interface information is obtained, and the target interface information is stored in the corresponding interface classification set, which provides a reliable data basis for subsequent data analysis, decision-making and auditing. At the same time, the target interface information update mechanism greatly reduces the need for long-term manual intervention, so that the system can continue to adapt to the ever-changing interface information environment, and improve the automation level of the system.

[0143] Figure 4A flow chart of another embodiment of an interface audit method provided by an embodiment of the present invention is as follows: Figure 4 As shown, the following steps are included:

[0144] Step 401: construct a corresponding Bloom filter for each interface classification set to obtain a Bloom filter group.

[0145] Step 402: Obtain the access log of the ingress controller in the target cluster.

[0146] Step 403: parse the target interface information from the access log.

[0147] Step 404: Load the Bloom filter group.

[0148] Step 405: Submit the target interface information to the Bloom filter group, and search for the target interface information in the preset multiple interface classification sets through the Bloom filter group. When the target interface information is found in the preset multiple interface classification sets, execute step 406; when the target interface information is not found in the preset multiple interface classification sets, execute step 407.

[0149] Step 406: Determine the audit type corresponding to the interface classification set hit by the target interface information as the target audit type.

[0150] Step 407: Obtain the audit type marking operation for the target interface information.

[0151] Step 408: In response to the audit type marking operation, the target interface information is stored in the corresponding interface classification set.

[0152] The description of the above steps 401 to 408 can refer to the relevant description in the above embodiment, which will not be repeated here.

[0153] Step 409: Mark the target interface information according to the target audit type.

[0154] The above-mentioned marking process refers to adding the identifier of the target audit type to the target interface information so that subsequent processing can identify and operate according to the corresponding audit type.

[0155] For example, the URL to be audited is as follows:

[0156] / remote-diagnosis-config / download / {fileServerFileUuid}

[0157] / remote-diagnosis-config / check

[0158] / remote-diagnosis-config / upload

[0159] Assuming that the audit type corresponding to the above URL address is stability audit, the marked URL is as follows:

[0160] / remote-diagnosis-config / download / {fileServerFileUuid},stability

[0161] / remote-diagnosis-config / check,stability

[0162] / remote-diagnosis-config / upload,stability

[0163] Among them, stability indicates that the audit type is stability audit.

[0164] Step 410: Send the target interface information marked with the target audit type to the set message queue.

[0165] Step 411: Obtain target interface information and the target audit type marked by the target interface information from the message queue.

[0166] Step 412: According to the target audit type, execute the corresponding audit process on the interface identified by the target interface information.

[0167] For ease of understanding, steps 410 to 412 are described in a unified manner as follows:

[0168] The message queue is a middleware for storing and transmitting data, which can decouple the producer and consumer of data. Here, the producer refers to the interface discovery thread, which sends the target interface information marked with the target audit type to the message queue by executing the above step 410. The consumer refers to the interface audit thread, which obtains the target interface information and the target audit type marked with the target interface information from the message queue by executing step 411.

[0169] The optional structured data sent to the message queue is as follows:

[0170] {

[0171] "url": " / remote-diagnosis-config / check",

[0172] "excuteTime": "20ms",

[0173] "type": "stability",

[0174] "respnoseCode": "",

[0175] "request": "",

[0176] "response": ""

[0177] }

[0178] url is the URL path of the interface for this audit; excutTime indicates the execution time of this interface extracted from the access log; type is the audit type; request is the request parameter of the interface; response is the return information of the interface request; and responseCode is the response code of the interface.

[0179] Based on this, the type field in the above structure can be used to determine the audit type and then determine the audit process that needs to be executed.

[0180] It can be seen that by applying the message queue mechanism, interface discovery and interface auditing can be decoupled, so that interface discovery and interface auditing tasks can be processed asynchronously, which helps to improve the scalability and processing efficiency of the system. It can not only achieve loose coupling and flexible expansion of modules, but also improve the performance and response speed of the overall system through asynchronous and parallel processing.

[0181] In step 412, the corresponding audit process is executed according to the audit type read from the message queue. For example, if the target interface information is marked as requiring a security audit, the process of security audit will be started for the interface identified by the target interface information; if the target interface information is marked as requiring a performance audit, the process of performance audit will be started for the interface identified by the target interface information. It can be seen that different audit types correspond to different audit processes, and the technical solution of the embodiment of the present invention can execute the corresponding audit process according to the audit type mark identified by the target interface information.

[0182] In one embodiment, when the number of target audit types is two or more, the audit processes corresponding to different target audit types are executed in parallel for the interface identified by the target interface information. Here, by executing different audit processes in parallel, it is helpful to shorten the overall audit time, thereby significantly improving the audit efficiency and avoiding the delay caused by serial processing. For example, if an interface needs to perform security audit and performance audit at the same time, then these two audit processes will be started at the same time to efficiently complete the audit task.

[0183] In the technical scheme of the embodiment of the present invention, the target interface information is marked according to the target audit type, which helps the execution subject of the embodiment of the present invention to clearly distinguish different types of audit requirements, thereby implementing effective audit measures and removing unnecessary audit processes. The marked target interface information is sent to the set message queue, and then the target interface information and the corresponding target audit type are obtained from the message queue. On the one hand, this ensures the orderly and effective transmission of information, simplifies the data extraction and processing steps, ensures the orderliness and traceability of information transmission, and helps the distribution and subsequent processing of data. On the other hand, it can decouple the interface discovery and interface audit, thereby improving the performance and response speed of the overall system. According to the target audit type, the corresponding audit process is executed for the interface identified by the target interface information, so that the system can flexibly adapt to different audit requirements, thereby improving the pertinence and effectiveness of the audit. When the number of target audit types is two or more, different audit processes are executed in parallel for the interface identified by the target interface information, which greatly improves the parallel processing capability of the system, reduces the audit time, and improves the overall processing efficiency of the system. It can be seen that the technical scheme provided by the embodiment of the present invention can realize efficient, accurate and flexible interface auditing, can adapt to various audit requirements, and ensure the performance and reliability of the overall system.

[0184] Figure 5 The following is a block diagram of an embodiment of an interface auditing device provided by an embodiment of the present invention. Figure 5 As shown, the device comprises:

[0185] A log acquisition module 51 is used to acquire the access log of the ingress controller in the target cluster, wherein the interface call request to the target cluster is forwarded to the corresponding service node in the target cluster via the ingress controller;

[0186] An interface parsing module 52, configured to parse target interface information from the access log, wherein the target interface information identifies the interface called in the target cluster;

[0187] An audit type determination module 53, used to determine a target audit type of the interface identified by the target interface information;

[0188] The audit execution module 54 is used to execute a corresponding audit process on the interface identified by the target interface information according to the target audit type.

[0189] In a possible implementation, the audit type determination module 53 includes:

[0190] An interface classification search unit, used to search for the target interface information in a plurality of preset interface classification sets, wherein the interface classification sets include interface information corresponding to interfaces of the same audit type, and different interface classification sets correspond to different audit types;

[0191] The audit type determination unit is used to determine the audit type corresponding to the interface classification set hit by the target interface information as the target audit type.

[0192] In a possible implementation, the audit type determination module 53 further includes:

[0193] A Bloom filter construction unit, used to construct a corresponding Bloom filter for each of the interface classification sets to obtain a Bloom filter group;

[0194] The interface classification search unit is used to load the Bloom filter group; submit the target interface information to the Bloom filter group, and search for the target interface information in a plurality of preset interface classification sets through the Bloom filter group.

[0195] In a possible implementation, the audit type determination module 53 further includes:

[0196] An audit type mark acquisition unit, configured to acquire an audit type mark operation for the target interface information when the target interface information does not match any of the interface classification sets;

[0197] The interface information storage unit is used to store the target interface information into the corresponding interface classification set in response to the audit type marking operation.

[0198] In a possible implementation, the audit type determination module 53 further includes:

[0199] An audit type marking processing unit, used for marking the target interface information according to the target audit type;

[0200] A message queue sending unit, used for sending the target interface information marked with the target audit type to a set message queue;

[0201] The audit execution module 54 includes:

[0202] A target interface information acquisition unit, used to acquire the target interface information and the target audit type marked by the target interface information from the message queue;

[0203] An audit process execution unit is used to execute a corresponding audit process on the interface identified by the target interface information according to the target audit type.

[0204] In a possible implementation, the audit execution module 54 includes:

[0205] A parallel audit execution unit is used to execute the audit processes corresponding to different target audit types in parallel on the interface identified by the target interface information when the number of the target audit types is two or more.

[0206] like Figure 6 As shown, an embodiment of the present invention provides an electronic device, including a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0207] A memory 113, for storing computer programs;

[0208] In one embodiment of the present invention, the processor 111 is used to implement the interface audit method provided by any one of the above method embodiments when executing the program stored in the memory 113, including:

[0209] Obtaining an access log of an ingress controller in a target cluster, wherein an interface call request to the target cluster is forwarded to a corresponding service node in the target cluster via the ingress controller;

[0210] Parsing target interface information from the access log, where the target interface information identifies the called interface in the target cluster;

[0211] Determining a target audit type of the interface identified by the target interface information;

[0212] According to the target audit type, a corresponding audit process is executed on the interface identified by the target interface information.

[0213] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the interface audit method provided in any of the aforementioned method embodiments are implemented.

[0214] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0215] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the relevant technology, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.

[0216] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0217] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. An interface audit method, characterized in that: The method comprises: Obtaining an access log of an ingress controller in a target cluster, wherein an interface call request to the target cluster is forwarded to a corresponding service node in the target cluster via the ingress controller; Parsing target interface information from the access log, where the target interface information identifies the called interface in the target cluster; Determining a target audit type of the interface identified by the target interface information; According to the target audit type, executing a corresponding audit process on the interface identified by the target interface information; The determining the target audit type of the interface identified by the target interface information includes: Searching for the target interface information in a plurality of preset interface classification sets, wherein the interface classification sets include interface information corresponding to interfaces of the same audit type, and different interface classification sets correspond to different audit types; The audit type corresponding to the interface classification set hit by the target interface information is determined as the target audit type.

2. The method according to claim 1, characterized in that The method further comprises: Constructing a corresponding Bloom filter for each of the interface classification sets to obtain a Bloom filter group; The searching the target interface information in a preset plurality of interface classification sets includes: Loading the Bloom filter bank; The target interface information is submitted to the Bloom filter group, and the target interface information is searched for in a plurality of preset interface classification sets through the Bloom filter group.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: In the case that the target interface information does not match any of the interface classification sets, obtaining an audit type marking operation for the target interface information; In response to the audit type marking operation, the target interface information is stored in the corresponding interface classification set.

4. The method according to claim 1, characterized in that: After determining the target audit type of the interface identified by the target interface information, the method further includes: Marking the target interface information according to the target audit type; Sending the target interface information marked with the target audit type to a set message queue; The step of executing a corresponding audit process on the interface identified by the target interface information according to the target audit type includes: Acquire the target interface information and the target audit type marked by the target interface information from the message queue; According to the target audit type, a corresponding audit process is executed on the interface identified by the target interface information.

5. The method according to claim 1, characterized in that The step of executing a corresponding audit process on the interface identified by the target interface information according to the target audit type includes: In the case that the number of the target audit types is two or more, the audit processes corresponding to different target audit types are executed in parallel on the interfaces identified by the target interface information.

6. An interface auditing device, characterized in that: The device comprises: A log acquisition module, used to acquire the access log of the ingress controller in the target cluster, wherein the interface call request to the target cluster is forwarded to the corresponding service node in the target cluster via the ingress controller; An interface parsing module, used to parse target interface information from the access log, wherein the target interface information identifies the called interface in the target cluster; An audit type determination module, used to determine a target audit type of the interface identified by the target interface information; An audit execution module, used to execute a corresponding audit process on the interface identified by the target interface information according to the target audit type; The audit type determination module includes: An interface classification search unit, used to search for the target interface information in a plurality of preset interface classification sets, wherein the interface classification sets include interface information corresponding to interfaces of the same audit type, and different interface classification sets correspond to different audit types; The audit type determination unit is used to determine the audit type corresponding to the interface classification set hit by the target interface information as the target audit type.

7. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, used to implement the interface audit method described in any one of claims 1 to 5 when executing a program stored in a memory.

8. A computer storage medium, characterized in that: Computer executable instructions are stored, and the computer executable instructions are used to execute the interface audit method described in any one of claims 1 to 5.

Images