Data processing method and device, equipment and storage medium

Abstract

The application discloses a data processing method and device, equipment and a storage medium, and belongs to the technical field of data security. The method comprises the following steps: extracting API traffic of API service successful calls from business data traffic; dividing the API traffic according to API service types to obtain an API traffic initial sample set comprising API traffic initial samples of each API service type in N API service types; extracting the calling logic sequence of the API traffic initial samples in the API traffic initial sample set to obtain an API calling sequence rule set comprising API calling sequence rules corresponding to the API traffic initial samples of each API service type; and determining whether there is an illegal API calling behavior in the API traffic initial samples of the i-th API service type based on the number of the API calling sequence rules corresponding to the API traffic initial samples of the i-th API service type. In this way, the automatic carding of the API calling logic and sequence can be realized, the artificial dependence of API over-authorization identification is reduced, and the occurrence of API data leakage accidents is avoided.

Description

Technical Field

[0001] This application belongs to the field of data security technology, and in particular relates to a data processing method, apparatus, device and storage medium. Background Technology

[0002] In recent years, Application Programming Interface (API) privilege escalation attacks have become increasingly common. Attackers impersonate or exploit other users' identity information to access or manipulate resources or data without authorization, causing data leaks, illegal appropriation of service resources, and other problems that seriously affect normal business functions. Therefore, to prevent API privilege escalation attacks, the legitimacy of API calls is usually verified by checking the order of API calls.

[0003] In related technologies, security devices such as Web Application Firewalls (WAFs) and security gateways typically verify API call order rules by manually configuring these rules in the security device's management backend. These rules are then compared to the actual API call order in use to identify unauthorized API calls. However, as the types of API services proliferate and change frequently, the frequency of manually configuring API call order rules increases. Therefore, relying solely on manual configuration cannot meet the demands of such frequent adjustments. If API call order control is not strict, it can easily lead to numerous unauthorized calls and API data breaches. Summary of the Invention

[0004] This application provides a data processing method, apparatus, device, and storage medium that can solve the problems of low efficiency and easy API data leakage caused by manually sorting out API call order rules in related technologies.

[0005] In a first aspect, embodiments of this application provide a data processing method, which may include:

[0006] Extract application programming interface (API) traffic from business data traffic; API traffic refers to the traffic from APIs that have been successfully called by the API business.

[0007] API traffic is divided according to API business type to obtain an initial sample set of API traffic. The initial sample set of API traffic includes the initial sample of API traffic for each of the N API business types, where N is an integer greater than 1.

[0008] The API call order rule set is obtained by extracting the call logic order from the initial API traffic samples in the initial API traffic sample set. The API call order rule set includes the API call order rule corresponding to the initial API traffic sample of each API business type in N API business types.

[0009] Based on the number of API call order rules corresponding to the initial sample of API traffic for the i-th API business type among N API business types, determine whether there is any illegal API call behavior in the initial sample of API traffic for the i-th API business type, i∈[1,N].

[0010] Secondly, embodiments of this application provide a data processing apparatus, which may include:

[0011] The extraction module is used to extract application programming interface (API) traffic from business data traffic. API traffic refers to the traffic of APIs that have been successfully called by the API business.

[0012] The segmentation module is used to segment API traffic according to API business type to obtain an initial sample set of API traffic. The initial sample set of API traffic includes the initial sample of API traffic for each of the N API business types, where N is an integer greater than 1.

[0013] The extraction module is used to extract the call logic order of the initial API traffic samples in the initial API traffic sample set to obtain the API call order rule set. The API call order rule set includes the API call order rules corresponding to the initial API traffic samples of each API business type in N API business types.

[0014] The determination module is used to determine whether there is any illegal API call behavior in the initial sample of API traffic of the i-th API business type, i∈[1,N], based on the number of API call order rules corresponding to the initial sample of API traffic of the i-th API business type among N API business types.

[0015] Thirdly, embodiments of this application provide a computer device, which includes: a processor and a memory storing computer program instructions;

[0016] When the processor executes computer program instructions, it implements the data processing method as described in the first aspect.

[0017] Fourthly, embodiments of this application provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the data processing method as described in the first aspect.

[0018] Fifthly, embodiments of this application provide a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the data processing method as shown in the first aspect.

[0019] In a sixth aspect, embodiments of this application provide a computer program product stored in a storage medium, which is executed by at least one processor to implement the data processing method as described in the first aspect.

[0020] The data processing method, apparatus, device, and storage medium of this application embodiment extract Application Programming Interface (API) traffic from business data traffic. API traffic refers to the traffic of APIs successfully called by API services. The API traffic is divided according to API service type to obtain an initial sample set of API traffic, which includes initial samples of API traffic for each of N API service types. The initial samples of API traffic in the initial sample set are then processed to extract the call logic order, resulting in an API call order rule set. This set includes API call order rules corresponding to the initial samples of API traffic for each of the N API service types. Based on the number of API call order rules corresponding to the initial samples of API traffic for the i-th API service type, it is determined whether there are any illegal API call behaviors in the initial samples of API traffic for the i-th API service type. This automates the sorting of API call logic and order, transforming traditional manual business sorting into sorting of initial sample streams of API traffic. This meets the need for sorting API call order rules when frequently adjusting API service types, helping security builders reduce their reliance on manual API privilege escalation detection. Furthermore, by using a self-learning approach to categorize initial API traffic samples under different business types, the API call logic and sequence for each business type can be automatically sorted out. This helps to strengthen accurate early warning and timely handling of illegal behaviors that deviate from the API call logic, helps to establish a continuous and dynamic protection mechanism against API privilege escalation attacks, continuously warns and identifies business vulnerabilities, strictly controls the API call sequence, and avoids API data leakage incidents. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0023] Figure 2 This is a schematic diagram of the structure of a data processing system provided in an embodiment of this application;

[0024] Figure 3 This is a schematic diagram of the structure of a data processing apparatus provided in one embodiment of this application;

[0025] Figure 4 A schematic diagram of the hardware structure of a computer device provided for some embodiments of this application. Detailed Implementation

[0026] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0027] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0028] The acquisition, storage, use, and processing of data (including but not limited to features and information mentioned in the text) in this application all comply with relevant national laws and regulations. To address the aforementioned technical problems, embodiments of this application provide a data processing method, apparatus, computer equipment, and storage medium.

[0029] Based on this, the following will be combined with the appendix Figures 1 to 4 This application describes in detail the data processing methods, apparatus, computer equipment, and storage media of the embodiments. It should be noted that these embodiments are not intended to limit the scope of this application.

[0030] Therefore, in order to better illustrate the content of the embodiments of this application, the following will be combined with... Figure 1 The following describes a data processing method provided in an embodiment of this application.

[0031] Figure 1 This is a flowchart of a data processing method provided in an embodiment of this application.

[0032] like Figure 1 As shown, this data processing method can be applied to the data processing system provided in the embodiments of this application. Here, the data processing method specifically includes the following steps:

[0033] Step 110: Extract Application Programming Interface (API) traffic from business data traffic. API traffic refers to the traffic of APIs successfully called by API business. Step 120: Divide the API traffic according to API business type to obtain an initial sample set of API traffic. The initial sample set of API traffic includes initial samples of API traffic for each of the N API business types, where N is an integer greater than 1. Step 130: Extract the calling logic order from the initial samples of API traffic in the initial sample set of API traffic to obtain an API calling order rule set. The API calling order rule set includes API calling order rules corresponding to the initial samples of API traffic for each of the N API business types. Step 140: Based on the number of API calling order rules corresponding to the initial samples of API traffic for the i-th API business type among the N API business types, determine whether there is any illegal API calling behavior in the initial samples of API traffic for the i-th API business type, where i∈[1,N].

[0034] This approach automates the analysis of API call logic and sequence, transforming traditional manual process analysis into analysis of initial API traffic sample streams. It addresses the need for frequent adjustments to API business types to refine API call sequence rules, reducing the reliance on manual API privilege escalation detection for security builders. Furthermore, by using a self-learning method to categorize initial API traffic samples under different business types, the automated analysis of API call logic and sequence for each business type facilitates more accurate early warnings and timely responses to illegal behaviors deviating from API call logic. This helps establish a continuous and dynamic protection mechanism against API privilege escalation attacks, continuously identifying and monitoring business vulnerabilities, strictly controlling API call sequence, and preventing API data breaches.

[0035] The steps described above are explained in detail below.

[0036] First, regarding step 110, in some embodiments of this application, step 110 may specifically include steps 1101 and 1102.

[0037] Step 1101: Filter target API traffic from business data traffic according to the traffic attributes of business data traffic; wherein, the traffic attributes include at least one of the following: data format, network service protocol.

[0038] Step 1102: Filter out API traffic with abnormal requests and API traffic from the target API traffic to obtain the API traffic.

[0039] For example, traffic from APIs that were not successfully invoked by API services can be distinguished and collected. Specifically, such as... Figure 2 As shown, the access business data flow is distinguished from WEB traffic and API traffic based on WEB Uniform Resource Locator (URL) characteristics, data formats such as JSON or XML, and Web service protocols such as RESTful or SOAP. Then, by analyzing the API access logs, the log records of successfully called APIs are obtained. Based on the log records of successfully called APIs, API traffic with abnormal requests and API traffic that failed to be called are quickly filtered and discarded from the API traffic to obtain the traffic of APIs that were successfully called. In this embodiment of the application, this is the API traffic.

[0040] Secondly, regarding step 120, in some embodiments of this application, step 120 may specifically include steps 1201 to 1203.

[0041] Step 1201: According to the API business type, the call requests and response data of the APIs that have been successfully called are clustered using the k-means clustering algorithm to obtain N clusters. The i-th cluster in the N clusters includes at least two similar call requests and response data of similar call requests, and the similarity between the at least two similar call requests is greater than or equal to the preset similarity.

[0042] Step 1202: Based on the cluster features of each of the N clusters, divide the API traffic to obtain the initial sample of API traffic corresponding to each cluster; wherein, the cluster features include at least one of the following: API call time, API call duration, caller identity, and caller type.

[0043] Step 1203: Generate a set of initial API traffic samples corresponding to N clusters based on the initial API traffic samples corresponding to each cluster.

[0044] For example, by using the k-means clustering algorithm to filter the collected API traffic according to API business categories, similar API call requests and response data can be grouped into the same cluster. Then, by using cluster features such as API call time, API call duration, caller identity, and caller type, the initial samples of API traffic for different API business categories can be filtered and classified, thereby forming initial samples of API traffic for different API business types.

[0045] Next, regarding step 130, in some embodiments of this application, step 120 may specifically include steps 1301 and 1302.

[0046] Step 1301: Using the interface business call logic algorithm, extract the call logic order of the initial API traffic samples for each API business type from the initial API traffic sample set to obtain the API call order rule corresponding to the initial API traffic samples for each API business type.

[0047] The interface business call logic algorithm includes at least one of the following: depth-first search algorithm, logging API call algorithm, debugger code execution tracing algorithm, and application performance monitoring algorithm.

[0048] The following sections will provide a detailed explanation of step 1301 for each of the different interface business call logic algorithms.

[0049] In some embodiments, step 1301 may specifically include:

[0050] When the interface business call logic algorithm includes a depth-first search algorithm, the interface order of API traffic corresponding to the initial sample of API traffic for each API business type is extracted by the depth-first search algorithm to obtain the API call order rule corresponding to the initial sample of API traffic for each API business type.

[0051] For example, a depth-first search (DFS) algorithm is used to extract the business interface call order of the API traffic corresponding to the initial sample of API traffic for each API business type, and generate the API call order rule corresponding to the initial sample of API traffic for each API business type.

[0052] In other embodiments, step 1301 may specifically include:

[0053] When the API call logic algorithm includes the logging API call algorithm, the log files of the API traffic corresponding to the initial sample of API traffic for each API business type are analyzed to obtain the API call order rules corresponding to the initial sample of API traffic for each API business type.

[0054] Therefore, by analyzing the log files of the API traffic interfaces corresponding to the initial sample of API traffic for each API business type, the API call order rules corresponding to the initial sample of API traffic for each API business type can be determined. In this way, the accuracy and completeness of the API call order rules corresponding to the initial sample of API traffic for each type of API business can be guaranteed by the accuracy and completeness of the log files.

[0055] In some other embodiments, step 1301 may specifically include:

[0056] When the interface business call logic algorithm includes the debugger tracing the code execution algorithm, the API call order rules corresponding to the initial API traffic sample of each API business type can be obtained through the API call stack in the debugger. The debugger is used to trace the processing flow of API traffic of the initial API traffic sample of the API business type and the code execution.

[0057] For example, a debugger can be used to trace the code execution flow and pause the program when an API call is executed. By observing the API call stack in the debugger, the API call order rules can be determined. For example, the Cuckoo sandbox tool can record the API call order rules that occur during software execution.

[0058] In some other embodiments, step 1301 may specifically include:

[0059] When the interface business call logic algorithm includes an application performance monitoring algorithm, the application's runtime information corresponding to the initial API traffic sample of the API business type is collected by the application performance monitoring tool. The runtime information includes the API call timestamps of the application calling the API during the application's operation. According to the order of the API call timestamps, the API call order rules corresponding to the initial API traffic sample of each API business type are obtained.

[0060] For example, a performance monitoring tool can be used to monitor the operation of an application and record API call timestamps. By analyzing the timestamps, the order of API calls can be determined.

[0061] Step 1302: Generate an API call order rule set based on the API call order rules corresponding to the initial API traffic samples for each API business type.

[0062] Then, regarding step 140, the data processing method provided in this application embodiment can determine whether there is illegal API call behavior in the initial sample of API traffic based on the number of API call order rules. Based on this, step 140 may specifically include the following two possibilities.

[0063] In some embodiments of this application, step 140 may specifically include:

[0064] If the number of API call order rules corresponding to the initial sample of API traffic for the i-th API business type among N API business types is less than or equal to a preset number, it is determined that there is no illegal API call behavior in the initial sample of API traffic for the i-th API business type.

[0065] In other embodiments of this application, step 140 may specifically include:

[0066] If the number of API call order rules corresponding to the initial sample of API traffic for the i-th API business type out of N API business types is greater than a preset number, it is determined that there is an illegal API call behavior in the initial sample of API traffic for the i-th API business type.

[0067] Here, since API call order rules only exist in the initial design phase, the legality of API call order rules is generally determined by setting a single legal interface call order. Therefore, when it is found that the initial sample of successful API call traffic has only one API call order rule, it can be compared with the established legal sample API call order rule to directly determine that this type is a legal call order and report it to the decision system. The corresponding legal API call order for the business is automatically generated in the security device for identification.

[0068] At this point, if it is determined that there is an illegal API call in the initial sample of API traffic for the i-th API business type, the data processing method may further include the following after step 140:

[0069] Provide early warnings or block API traffic corresponding to the initial sample of API traffic for the i-th API business type.

[0070] In addition, to ensure the accuracy of the determined API call order rules, after step 140, the data processing method provided in this application embodiment can also re-verify the existence of illegal API call behavior in the initial sample of API traffic for the i-th API business type.

[0071] Based on this, the data processing method provided in the embodiments of this application may further include steps 1501 to 1503.

[0072] Step 1501: If it is determined that there is an illegal API call behavior in the initial sample of API traffic of the i-th API business type, obtain M API call order rules corresponding to the initial sample of API traffic of the i-th API business type, where M is an integer greater than a preset number.

[0073] Step 1502: Using a graph convolutional neural network, process the initial API traffic sample corresponding to each API call order rule in the M API call order rules to obtain the business call profile of the initial API traffic sample of the i-th API business type.

[0074] Step 1503: Based on the business call profile, modify the call order rules of the M APIs to determine the target API call order rules. The number of target API call order rules is less than or equal to a preset number of integers.

[0075] For example, when it is found that there is more than one API call order rule in the initial sample of API traffic for the i-th API business type, it can be determined that there is illegal API call behavior in the initial sample of API traffic for the i-th API business type. It can be reported to the early warning platform to execute the early warning or block, and enter the correction and verification stage. When there is no legal API call order rule for a single business type, the intelligent judgment system takes the initial sample of API traffic with M API call order rules as the judgment object within a certain time interval, and uses graph convolutional neural network (GCN) to carry out the profile judgment of business calls.

[0076] Specifically, in some embodiments of this application, the business call profile includes the relative call frequency of API call order rules, and step 1502 may specifically include steps 15021 to 15023.

[0077] Step 15021: Record the initial API traffic samples corresponding to each API call order rule in a concatenated manner using JSON format to obtain the API call sequence corresponding to each API call order rule.

[0078] For example, the initial sample of API traffic corresponding to each API call order rule in the M API call order rules is recorded and stored in JSON format, and the JSON files are concatenated to form an API call sequence corresponding to each API call order rule.

[0079] Step 15022: Based on the API call sequence corresponding to each API call order rule, generate an API call order graph corresponding to each API call order rule. The API call order graph includes M nodes and directed edges connecting any two nodes among the M nodes. The direction of the directed edges is used to represent the call order relationship between adjacent APIs. The target feature information of a node is determined by the first feature information of the node itself and the second feature information of the nodes connected to the node. M is an integer greater than 1.

[0080] For example, by using nodes to represent APIs and using directed edges to represent the sequential call relationships between adjacent APIs, sequences of arbitrary length can be transformed into graph structures of fixed size. By performing convolution operations on the target feature information of each node, the second feature information of all neighboring nodes directly connected to the current node can be collected, and the current node's features can be updated using weighted averaging or other methods to obtain the target feature information of the current node.

[0081] Step 15023: Input the API call order graph corresponding to each API call order rule into the graph convolutional neural network to calculate the relative call frequency of each API call order rule.

[0082] In other embodiments of this application, based on the content involved in step 1502 above, the business call profile includes the relative call frequencies of M API call order rules. Based on this, step 1503 may specifically include steps 15031 and 15032.

[0083] Step 15031: Filter the target relative call frequency from the relative call frequencies of the M API call order rules. The target relative call frequency is greater than or equal to the preset relative call frequency.

[0084] Step 15032: Determine the API call order rule corresponding to the target relative call frequency as the target API call order rule.

[0085] For example, after a large number of samples have been processed, the call order rule sample with the smallest relative number is defaulted as a legitimate call order behavior. This can be used as a legitimate API call order feature and automatically pushed to the security device for identification by the decision-making system. Simultaneously, call order rule samples with more frequent API calls are defaulted as legitimate call order behaviors, while other API call orders are considered illegal calls. These are reported to the early warning platform for alert or blocking, along with an unauthorized call bug report. This step ensures that legitimate call order features are output as soon as possible, minimizing the time for unauthorized calls to occur, while also providing feedback on call order errors.

[0086] Therefore, in this embodiment, API business call logic and sequence can be automatically sorted out through traffic self-learning, transforming the traditional manual business sorting action into a manual sample flow sorting action; the identification logic is optimized, and the illegal behavior that deviates from the API call logic is given more accurate early warning and timely handling measures; it helps security builders reduce the manual dependence of API privilege escalation identification business, continuously warn and identify business vulnerabilities, and help users continuously and dynamically establish a protection mechanism against API privilege escalation attacks suitable for local business, realizing the decoupling of sample flow and business flow. This can help security builders reduce the manual dependence of API privilege escalation identification business, reduce the false alarm rate of business identification, and help establish a continuous and dynamic protection mechanism against API privilege escalation attacks.

[0087] It should be noted that the data processing method provided in the embodiments of this application may further include the step of training a graph convolutional neural network. Based on this, as... Figure 2 As shown, prior to step 1502, the data processing method may further include steps 1601 to 1604.

[0088] Step 1601: Record the initial sample API traffic corresponding to the sample API call order rule in a concatenated manner using JSON format to obtain the sample API call sequence corresponding to the sample API call order rule.

[0089] Step 1602: Based on the sample API call sequence corresponding to the sample API call order rule, generate a sample API call order graph corresponding to the sample API call order rule. The sample API call order graph includes P sample nodes and directed connection edges connecting any two sample nodes among the P sample nodes. The direction of the directed connection edges is used to represent the sample call order relationship between adjacent sample APIs. The sample target feature information of the sample node is determined by the first sample feature information of the sample node itself and the second sample feature information of the sample node connected to the sample node. P is an integer greater than 1.

[0090] Step 1603: Input the sample API call sequence graph corresponding to the sample API call sequence rule into the sample graph convolutional neural network, and calculate the first sample relative call frequency of the sample API call sequence rule.

[0091] Step 1604: Based on the difference between the relative call frequency of the first sample in the sample API call order rule and the relative call frequency of the second sample in the sample API call order rule, train the sample graph convolutional neural network until the preset training conditions are met to obtain the graph convolutional neural network.

[0092] For example, the degree of difference can be represented by the log-likelihood loss function (LogLoss), which reflects the average deviation between the relative call frequencies of the first sample and the relative call frequencies of the second sample. The log-likelihood loss function can be calculated by the following formula (1):

[0093]

[0094] Among them, y i The label of the positive sample is the relative call frequency of the second sample, y j The probability of predicting the corresponding category for the model is the relative call frequency of the first sample, and N is the total number of data samples, i.e., the total number of sample API call order rules.

[0095] It should be noted that, for any call sequence, the API call sequence graph in this embodiment can be converted into a graph G = (V, E) containing M nodes, where any node v n ∈V, any edge (v i ,v j )∈E. Where V is the set of software call API nodes, V={v1,V2,……,V M Let M be the total number of APIs, and E be the set of directed edges in the API call sequence graph, where each directed edge represents two adjacent APIs in the API call sequence rule. During software operation, new APIs may be continuously called to complete certain actions, thus changing the corresponding API call graph. During this process, new API nodes may be added, or new connections may be formed. These subtle changes may reflect specific behaviors of API calls. Based on this, the API call sequence graph corresponding to each API call sequence rule can be updated based on the real-time call logic order, resulting in an updated API call sequence graph; and a sample graph convolutional neural network can be trained based on the updated API call sequence graph.

[0096] In this way, the data processing method based on API traffic self-learning to identify API privilege escalation attacks can effectively monitor API access traffic and learn and identify API privilege escalation attacks during long-term self-learning. It can accurately detect and block attack behaviors, which can help enterprises and organizations better identify and block API privilege escalation attacks, improve system security, reduce the risk of API privilege escalation attacks, and avoid security problems such as data leakage and data damage.

[0097] Furthermore, in the training process of the convolutional neural network for the sample graph in this application embodiment, trend analysis, periodic analysis, and anomaly detection of business volume can be performed using historical data. Based on the historical data of business volume, peak and trough periods of business are determined. Different target values ​​for sampling frequency are set for peak and trough periods. A higher sampling frequency is set for peak periods, and a lower sampling frequency can be set for trough periods. Specifically, linear regression models, logistic regression models, etc., can be used to establish a mathematical model of business peak and trough models based on business volume and the number of anomaly detections to determine the dynamic sampling frequency. Based on the determined dynamic sampling frequency, samples are randomly selected for verification during business processing. Random sampling can be performed according to time intervals, event triggers, etc., to ensure the representativeness of the samples. (The text continues with further details about the process.) Figure 2 As shown, steps 120 to 160 are performed on randomly sampled data to analyze whether the sampling results meet the expected goals. If the sampling results are unsatisfactory, the set target value range can be manually adjusted or the model of dynamic sampling frequency can be optimized, and the data processing method provided in this application embodiment can be re-executed. Therefore, a dynamic frequency of random sampling can be established based on a business peak-and-trough model. With the assistance of machine learning and manual judgment, the legality of single business samples can be continuously judged, and the judgment conditions can be corrected and trained. Over time, a more accurate feature of the legitimate API call sequence can be gradually established.

[0098] This application also provides a data processing apparatus, specifically combined with... Figure 3 Please provide a detailed explanation.

[0099] Figure 3 This is a schematic diagram of the structure of a data processing apparatus provided in one embodiment of this application.

[0100] In some embodiments of this application, Figure 3 The data processing device shown can be installed in the computer equipment provided in the embodiments of this application.

[0101] like Figure 3 As shown, the data processing device 30 may specifically include:

[0102] Extraction module 301 is used to extract application programming interface (API) traffic from business data traffic. API traffic is the traffic of APIs that have been successfully called by API business.

[0103] The segmentation module 302 is used to segment API traffic according to API business type to obtain an initial sample set of API traffic. The initial sample set of API traffic includes the initial sample of API traffic for each of the N API business types, where N is an integer greater than 1.

[0104] The extraction module 303 is used to extract the call logic order of the initial API traffic samples in the initial API traffic sample set to obtain the API call order rule set. The API call order rule set includes the API call order rules corresponding to the initial API traffic samples of each API business type in N API business types.

[0105] The determination module 304 is used to determine whether there is any illegal API call behavior in the initial sample of API traffic of the i-th API business type, i∈[1,N], based on the number of API call order rules corresponding to the initial sample of API traffic of the i-th API business type among N API business types.

[0106] This approach automates the analysis of API call logic and sequence, transforming traditional manual process analysis into analysis of initial API traffic sample streams. It addresses the need for frequent adjustments to API business types to refine API call sequence rules, reducing the reliance on manual API privilege escalation detection for security builders. Furthermore, by using a self-learning method to categorize initial API traffic samples under different business types, the automated analysis of API call logic and sequence for each business type facilitates more accurate early warnings and timely responses to illegal behaviors deviating from API call logic. This helps establish a continuous and dynamic protection mechanism against API privilege escalation attacks, continuously identifying and monitoring business vulnerabilities, strictly controlling API call sequence, and preventing API data breaches.

[0107] The data processing device 30 in the embodiments of this application will be described in detail below.

[0108] In some embodiments of this application, the extraction module 301 in this application embodiment can be specifically used to filter target API traffic from business data traffic according to the traffic attributes of business data traffic; wherein, the traffic attributes include at least one of the following: data format, network service protocol; and filter out API traffic of abnormal requests and API traffic of API services that have not been successfully called from the target API traffic to obtain API traffic.

[0109] In some embodiments of this application, the partitioning module 302 in this application embodiment can be specifically used to cluster the call requests and response data of the APIs that have been successfully called by the API business type using the k-means clustering algorithm to obtain N clusters. The i-th cluster in the N clusters includes at least two similar call requests and response data of similar call requests, and the similarity between the at least two similar call requests is greater than or equal to a preset similarity.

[0110] Based on the cluster features of each of the N clusters, the API traffic is divided to obtain the initial sample of API traffic corresponding to each cluster; wherein, the cluster features include at least one of the following: API call time, API call duration, caller identity, and caller type;

[0111] Based on the initial API traffic sample corresponding to each cluster, generate a set of initial API traffic samples corresponding to N clusters.

[0112] In some embodiments of this application, the extraction module 303 in this application embodiment can be specifically used to extract the API call logic order of the API traffic initial sample in the API traffic initial sample set corresponding to each API business type through the interface business call logic algorithm, so as to obtain the API call order rule corresponding to the API traffic initial sample of each API business type.

[0113] Based on the API call order rules corresponding to the initial API traffic samples for each API business type, an API call order rule set is generated; where...

[0114] The API business call logic algorithm includes at least one of the following: depth-first search algorithm, logging API call algorithm, debugger code execution tracing algorithm, and application performance monitoring algorithm.

[0115] In some embodiments of this application, the extraction module 303 in this application embodiment can be specifically used to extract the interface order of API traffic corresponding to the initial sample of API traffic for each API business type by using the depth-first search algorithm when the interface business call logic algorithm includes a depth-first search algorithm, so as to obtain the API call order rule corresponding to the initial sample of API traffic for each API business type.

[0116] When the API call logic algorithm includes the logging API call algorithm, the log files of the API traffic corresponding to the initial sample of API traffic for each API business type are analyzed to obtain the API call order rules corresponding to the initial sample of API traffic for each API business type.

[0117] When the interface business call logic algorithm includes the debugger tracing code execution algorithm, the API call order rules corresponding to the initial API traffic sample of each API business type are obtained through the API call stack in the debugger. The debugger is used to trace the processing flow of API traffic of the initial API traffic sample of the API business type and the code execution.

[0118] When the interface business call logic algorithm includes an application performance monitoring algorithm, the application's runtime information corresponding to the initial API traffic sample of the API business type is collected by the application performance monitoring tool. The runtime information includes the API call timestamps of the application calling the API during the application's operation. According to the order of the API call timestamps, the API call order rules corresponding to the initial API traffic sample of each API business type are obtained.

[0119] In some embodiments of this application, the determining module 304 is used to determine that there is no illegal API call behavior in the initial sample of API traffic of the i-th API business type when the number of API call order rules corresponding to the initial sample of API traffic of the i-th API business type among N API business types is less than or equal to a preset number.

[0120] If the number of API call order rules corresponding to the initial sample of API traffic for the i-th API business type out of N API business types is greater than a preset number, it is determined that there is an illegal API call behavior in the initial sample of API traffic for the i-th API business type.

[0121] In some embodiments of this application, the data processing apparatus 30 provided in the embodiments of this application may further include a first processing module; wherein,

[0122] The first processing module is used to issue warnings or block API traffic corresponding to the initial sample of API traffic for the i-th API business type when it is determined that there is illegal API call behavior in the initial sample of API traffic for the i-th API business type.

[0123] In some embodiments of this application, the data processing apparatus 30 provided in the embodiments of this application may further include an acquisition module, a second processing module, and a correction module; wherein,

[0124] The acquisition module is used to acquire M API call order rules corresponding to the initial sample of API traffic for the i-th API business type when it is determined that there is illegal API call behavior in the initial sample of API traffic for the i-th API business type. M is an integer greater than a preset number.

[0125] The second processing module is used to process the initial API traffic sample corresponding to each API call order rule in the M API call order rules through a graph convolutional neural network to obtain the business call profile of the initial API traffic sample of the i-th API business type.

[0126] The correction module is used to correct the call order rules of M APIs based on the business call profile, and to determine the target API call order rules. The number of target API call order rules is less than or equal to a preset number of integers.

[0127] In some embodiments of this application, the second processing module can be specifically used to record the initial API traffic sample corresponding to each API call order rule in a concatenated manner using JSON format when the business call profile includes the relative call frequency of API call order rules, so as to obtain the API call sequence corresponding to each API call order rule;

[0128] Based on the API call sequence corresponding to each API call order rule, an API call order graph corresponding to each API call order rule is generated. The API call order graph includes M nodes and directed edges connecting any two nodes among the M nodes. The direction of the directed edges is used to represent the call order relationship between adjacent APIs. The target feature information of a node is determined by the first feature information of the node itself and the second feature information of the nodes connected to the node. M is an integer greater than 1.

[0129] The API call order graph corresponding to each API call order rule is input into a graph convolutional neural network to calculate the relative call frequency of each API call order rule.

[0130] In some embodiments of this application, the correction module can be specifically used to filter a target relative call frequency from the relative call frequencies of the M API call order rules when the business call profile includes the relative call frequencies of M API call order rules, wherein the target relative call frequency is greater than or equal to a preset relative call frequency.

[0131] The API call order rule corresponding to the relative call frequency of the target is determined as the target API call order rule.

[0132] In some embodiments of this application, the data processing apparatus 30 provided in the embodiments of this application may further include a recording module, a generation module, an input module, and a training module; wherein,

[0133] The recording module is used to record the initial sample API traffic corresponding to the sample API call order rule in a concatenated manner using JSON format, so as to obtain the sample API call sequence corresponding to the sample API call order rule.

[0134] The generation module is used to generate a sample API call sequence graph corresponding to the sample API call sequence rule based on the sample API call sequence rule. The sample API call sequence graph includes P sample nodes and directed connection edges connecting any two sample nodes among the P sample nodes. The direction of the directed connection edges is used to represent the sample call sequence relationship between adjacent sample APIs. The sample target feature information of the sample node is determined by the first sample feature information of the sample node itself and the second sample feature information of the sample node connected to the sample node. P is an integer greater than 1.

[0135] The input module is used to input the sample API call order graph corresponding to the sample API call order rule into the sample graph convolutional neural network to calculate the relative call frequency of the first sample of the sample API call order rule;

[0136] The training module is used to train the sample graph convolutional neural network based on the difference between the relative call frequency of the first sample in the sample API call order rule and the relative call frequency of the actual second sample in the sample API call order rule, until the preset training conditions are met, and the graph convolutional neural network is obtained.

[0137] Therefore, the data processing apparatus provided in this application embodiment can extract application programming interface (API) traffic from business data traffic. API traffic refers to the traffic of APIs successfully called by API services. The API traffic is divided according to API service type to obtain an initial API traffic sample set, which includes initial API traffic samples for each of the N API service types. The initial API traffic samples in the initial API traffic sample set are then processed to extract the call logic order, resulting in an API call order rule set. This set includes API call order rules corresponding to the initial API traffic samples of each of the N API service types. Based on the number of API call order rules corresponding to the initial API traffic samples of the i-th API service type, it is determined whether there are any illegal API call behaviors in the initial API traffic samples of the i-th API service type. This automates the sorting of API call logic and order, transforming traditional manual business sorting into sorting of initial API traffic sample streams. This meets the need for sorting API call order rules when frequently adjusting API service types, helping security builders reduce the reliance on manual API privilege escalation detection. Furthermore, by using a self-learning approach to categorize initial API traffic samples under different business types, the API call logic and sequence for each business type can be automatically sorted out. This helps to strengthen accurate early warning and timely handling of illegal behaviors that deviate from the API call logic, helps to establish a continuous and dynamic protection mechanism against API privilege escalation attacks, continuously warns and identifies business vulnerabilities, strictly controls the API call sequence, and avoids API data leakage incidents.

[0138] This application also provides a computer device. (Specifically combined with...) Figure 4 Please provide a detailed explanation.

[0139] Figure 4 This is a schematic diagram of the structure of a computer device provided in one embodiment of this application.

[0140] like Figure 4 As shown, the computer device may include at least one of the following as described in the embodiments of this application: an electronic device, a server. The computer device may include a processor 401 and a memory 402 storing computer program instructions.

[0141] Specifically, the processor 401 may include a central processing unit (CPU), or an application-specific integrated circuit (ASTC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0142] Memory 402 may include a large-capacity memory for data or instructions. For example, and not limitingly, memory 402 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 402 may include removable or non-removable (or fixed) media. Where appropriate, memory 402 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 402 is non-volatile solid-state memory. In a particular embodiment, memory 402 includes solid-state storage (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0143] The processor 401 implements any of the data processing methods described in the above embodiments by reading and executing computer program instructions stored in the memory 402.

[0144] In one example, the computer device may also include a communication interface 403 and a bus 410. Wherein, as... Figure 4 As shown, the processor 401, memory 402, and communication interface 403 are connected through bus 410 and complete communication with each other.

[0145] The communication interface 403 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0146] Bus 410 includes hardware, software, or both, that couples components of a flow control device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard System (ETSA) bus, a Front Side Bus (FSB), an HyperTransport (HT) interconnect, an Industry Standard System (TSA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel System (MCA) bus, a Peripheral Component Interconnect (PCT) bus, a PCT-Express (PCT-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 410 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0147] The payment device can execute the data processing method described in the embodiments of this application, thereby achieving a combination Figures 1 to 4 The data processing methods and apparatus described.

[0148] Furthermore, in conjunction with the data processing methods in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when executed by a processor, these computer program instructions implement any of the data processing methods in the above embodiments.

[0149] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0150] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASTCs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0151] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0152] The above are merely specific embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A data processing method, characterized in that, include: Extract application programming interface (API) traffic from business data traffic, where API traffic refers to the traffic from APIs that have been successfully invoked by the API business. According to the API business type, the API traffic is divided to obtain an initial sample set of API traffic. The initial sample set of API traffic includes the initial sample of API traffic for each of the N API business types, where N is an integer greater than 1. The API call logic order is extracted from the initial API traffic samples in the initial API traffic sample set to obtain an API call order rule set. The API call order rule set includes the API call order rules corresponding to the initial API traffic samples of each of the N API business types. Based on the number of API call order rules corresponding to the initial sample of API traffic for the i-th API business type among the N API business types, determine whether there is any illegal API call behavior in the initial sample of API traffic for the i-th API business type, i∈[1,N].

2. The method according to claim 1, characterized in that, The extraction of application programming interface (API) traffic from business data traffic includes: Target API traffic is filtered from the business data traffic according to the traffic attributes of the business data traffic; wherein, the traffic attributes include at least one of the following: data format, network service protocol; The API traffic is obtained by filtering out API traffic with abnormal requests and API traffic that failed to be called from the target API traffic.

3. The method according to claim 1, characterized in that, The API traffic is segmented according to API business type to obtain an initial sample set of API traffic, including: According to the API business type, the call requests and response data of the APIs that have been successfully called by the API business are clustered by the k-means clustering algorithm to obtain N clusters. The i-th cluster of the N clusters includes at least two similar call requests and response data of the similar call requests. The similarity between the at least two similar call requests is greater than or equal to a preset similarity. Based on the cluster characteristics of each of the N clusters, the API traffic is divided to obtain an initial sample of API traffic corresponding to each cluster; wherein, the cluster characteristics include at least one of the following: API call time, API call duration, caller identity, and caller type; Based on the initial API traffic sample corresponding to each cluster, generate the initial API traffic sample set corresponding to the N clusters.

4. The method according to claim 1, characterized in that, The step of extracting the API call order from the initial API traffic samples in the initial API traffic sample set to obtain the API call order rule set includes: By using the interface business call logic algorithm, the call logic order of the initial API traffic samples of each API business type in the initial API traffic sample set is extracted to obtain the API call order rule corresponding to the initial API traffic samples of each API business type. Based on the API call order rules corresponding to the initial API traffic samples for each API business type, an API call order rule set is generated; wherein... The interface business call logic algorithm includes at least one of the following: depth-first search algorithm, logging API call algorithm, debugger code tracing execution algorithm, and application performance monitoring algorithm.

5. The method according to claim 4, characterized in that, The method involves using an interface business call logic algorithm to extract the call logic order of initial API traffic samples for each API business type from the initial API traffic sample set, thereby obtaining API call order rules corresponding to the initial API traffic samples for each API business type. This includes: When the interface business call logic algorithm includes the depth-first search algorithm, the interface order of API traffic corresponding to the initial sample of API traffic for each API business type is extracted by the depth-first search algorithm to obtain the API call order rule corresponding to the initial sample of API traffic for each API business type. When the interface business call logic algorithm includes the log recording API call algorithm, the log files of the interface corresponding to the API traffic initial sample of each API business type are analyzed to obtain the API call order rules corresponding to the API traffic initial sample of each API business type. When the interface business call logic algorithm includes the debugger code execution tracing algorithm, the API call order rules corresponding to the initial API traffic sample of each API business type are obtained through the API call stack in the debugger. The debugger is used to trace the processing flow of API traffic of the initial API traffic sample of the API business type. When the interface business call logic algorithm includes the application performance monitoring algorithm, the application's runtime information corresponding to the initial API traffic sample of the API business type is collected by the application performance monitoring tool. The runtime information includes the API call timestamps of the API calls made by the application during the running process. According to the order of the API call timestamps, the API call order rules corresponding to the initial API traffic sample of each API business type are obtained.

6. The method according to claim 1, characterized in that, The determination of whether there are illegal API call behaviors in the initial sample of API traffic for the i-th API business type based on the number of API call order rules corresponding to the initial sample of API traffic for the i-th API business type among the N API business types includes: If the number of API call order rules corresponding to the initial sample of API traffic for the i-th API business type among the N API business types is less than or equal to a preset number, it is determined that there is no illegal API call behavior in the initial sample of API traffic for the i-th API business type. If the number of API call order rules corresponding to the initial sample of API traffic for the i-th API business type among the N API business types is greater than the preset number, it is determined that there is an illegal API call behavior in the initial sample of API traffic for the i-th API business type.

7. The method according to claim 1 or 6, characterized in that, The method further includes: If it is determined that there is an illegal API call in the initial sample of API traffic for the i-th API business type, the API traffic corresponding to the initial sample of API traffic for the i-th API business type will be alerted or blocked.

8. The method according to claim 1 or 6, characterized in that, The method further includes: If it is determined that there is an illegal API call behavior in the initial sample of API traffic for the i-th API business type, obtain M API call order rules corresponding to the initial sample of API traffic for the i-th API business type, where M is an integer greater than a preset number; By using a graph convolutional neural network, the initial API traffic sample corresponding to each of the M API call order rules is processed to obtain the business call profile of the initial API traffic sample of the i-th API business type. Based on the business call profile, the M API call order rules are modified to determine the target API call order rules. The number of target API call order rules is an integer less than or equal to the preset number.

9. The method according to claim 8, characterized in that, The business call profile includes the relative call frequency of the API call order rules; The process of using a graph convolutional neural network to process the initial API traffic sample corresponding to each of the M API call order rules to obtain the business call profile of the initial API traffic sample of the i-th API business type includes: By recording the initial API traffic samples corresponding to each API call order rule in a concatenated manner using JSON format, an API call sequence corresponding to each API call order rule is obtained; Based on the API call sequence corresponding to each API call order rule, an API call order graph corresponding to each API call order rule is generated. The API call order graph includes M nodes and directed edges connecting any two nodes among the M nodes. The direction of the directed edges is used to characterize the call order relationship between adjacent APIs. The target feature information of the node is determined by the first feature information of the node itself and the second feature information of the node connected to the node. M is an integer greater than 1. The API call order graph corresponding to each API call order rule is input into the graph convolutional neural network to calculate the relative call frequency of each API call order rule.

10. The method according to claim 9, characterized in that, The business call profile includes the relative call frequency of the M API call order rules; The step of modifying the call order rules of the M APIs based on the business call profile to determine the target API call order rules includes: Filter the target relative call frequency from the relative call frequencies of the M API call order rules, wherein the target relative call frequency is greater than or equal to the preset relative call frequency; The API call order rule corresponding to the relative call frequency of the target is determined as the target API call order rule.

11. The method according to claim 8, characterized in that, The method further includes: By using JSON format and recording the initial samples of sample API traffic corresponding to the sample API call order rule in a concatenated manner, a sample API call sequence corresponding to the sample API call order rule is obtained. Based on the sample API call sequence corresponding to the sample API call order rule, a sample API call order graph corresponding to the sample API call order rule is generated. The sample API call order graph includes P sample nodes and a directed connection edge connecting any two sample nodes among the P sample nodes. The direction of the directed connection edge is used to characterize the sample call order relationship between adjacent sample APIs. The sample target feature information of the sample node is determined by the first sample feature information of the sample node itself and the second sample feature information of the sample node connected to the sample node. P is an integer greater than 1. Input the sample API call sequence graph corresponding to the sample API call sequence rule into the sample graph convolutional neural network to calculate the first sample relative call frequency of the sample API call sequence rule; Based on the difference between the first sample relative call frequency of the sample API call order rule and the actual second sample relative call frequency of the sample API call order rule, the sample graph convolutional neural network is trained until the preset training conditions are met, and the graph convolutional neural network is obtained.

12. A data processing apparatus, characterized in that, include: The extraction module is used to extract application programming interface (API) traffic from business data traffic, wherein the API traffic is the traffic of APIs that have been successfully called by API business. The segmentation module is used to segment the API traffic according to the API business type to obtain an initial sample set of API traffic. The initial sample set of API traffic includes the initial sample of API traffic for each of the N API business types, where N is an integer greater than 1. An extraction module is used to extract the call logic order of the initial API traffic samples in the initial API traffic sample set to obtain an API call order rule set. The API call order rule set includes the API call order rules corresponding to the initial API traffic samples of each of the N API business types. The determination module is used to determine whether there is any illegal API call behavior in the initial sample of API traffic of the i-th API business type, i∈[1,N], based on the number of API call order rules corresponding to the initial sample of API traffic of the i-th API business type among the N API business types.

13. A computer device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the data processing method as described in any one of claims 1-11.

14. A computer program product, characterized in that, The program product is stored in a non-transient storage medium, and the program product is executed by at least one processor to implement the steps of the data processing method as described in any one of claims 1-11.

Images