API-based website abnormal request judgment method, device, medium, and equipment

Abstract

The present invention provides a method, apparatus, medium, and device for determining abnormal website requests based on an API. The method comprises: obtaining API instances of a preset website within a first time period through automatic discovery; performing statistics on the API instances and constructing an abnormality baseline based on the statistical results; upon receiving a current access request from the preset website, extracting the request source region and client from the current access request, and counting a first number of visits, where the first number of visits is the number of access requests within the time period in which the current access request is received; and determining whether the current access request is an abnormal website request based on the request source region and client extracted from the current access request, the first number of visits, and the abnormality baseline. The present invention can improve the accuracy of anomaly detection.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to an API-based website abnormal request determination method, device, medium, and equipment. Background Art

[0002] With the rapid development of the Internet and the widespread use of website applications, ensuring website security and stability has become a critical task. Currently, abnormal website requests are mainly detected by comparing current access request data with previous baselines. When the baseline is exceeded, it indicates an abnormal access. Current statistical methods mainly count the number of access requests within a specified time period from the website dimension. These statistics are not detailed and comprehensive enough, and some hidden problems cannot be discovered. Fluctuations in the number of visits to different APIs on a website cannot be effectively detected from the dimension of website requests, and cannot effectively reflect the abnormal change trend of the API call distribution on the website. Sometimes, there is no obvious abnormality in the number of access requests within a specified time period, but the area or client accessing the website may have undergone significant changes, which cannot be observed using the current website abnormal request method. Summary of the Invention

[0003] In response to at least one of the above technical problems, embodiments of the present invention provide an API-based website abnormal request determination method, apparatus, medium, and device.

[0004] In a first aspect, an API-based website abnormal request determination method provided by an embodiment of the present invention includes:

[0005] Obtain the API instance of the preset website in the first time period through automatic discovery;

[0006] Collect statistics on the API instances and construct an anomaly baseline based on the statistical results; the anomaly baseline includes a time baseline, a region baseline, and a client baseline; the time baseline includes a baseline of the number of access requests corresponding to each time period of the day; the region baseline includes a set of request source regions corresponding to each time period of the day and a baseline of the number of requests from each request source region in each time period;

[0007] When receiving the access request for the preset website, extracting the request source region and the client from the access request, and counting a first number of visits, where the first number of visits is the number of access requests within the time period when the access request is received;

[0008] Whether the current access request is an abnormal website request is determined based on the request source region and the client, the first page views, and the abnormal baseline extracted from the current access request.

[0009] In one embodiment, obtaining the API instance of the preset website within the first time period by automatic discovery includes:

[0010] Dividing each website request of the preset website within the first time period into corresponding groups according to the request method, and generating a corresponding tree structure according to the URL of each website request in each group;

[0011] If the number of website requests for the preset website within the first time period reaches a preset number, each node in the tree structure is merged; wherein each child node in the merged tree structure is the API instance.

[0012] In one embodiment, the merging of nodes in each tree structure includes:

[0013] Calculate the number of child nodes under each parent node that has child nodes;

[0014] If the number of child nodes is greater than the specified threshold or the child node matches the specified regular expression, the similarity between each of the child nodes under the corresponding parent node is calculated to form a similarity matrix, and the mean of the similarity matrix is ​​calculated;

[0015] Based on the similarity matrix, the Z-score is used to calculate the discrete values ​​of all child nodes under the parent node;

[0016] Based on the similarity matrix, calculate the entropy values ​​of all child nodes under the parent node;

[0017] Calculate the merge scores corresponding to all child nodes under the parent node according to the mean, the discrete value, and the entropy value;

[0018] If the merge score exceeds a preset threshold, all child nodes under the parent node are merged to obtain a merged API instance;

[0019] The combined score is calculated using a first calculation formula, which is:

[0020] R=a*sb*kc*h

[0021] Wherein, a, b, and c are weights, R is the merge score, s is the mean, k is the discrete value, and h is the entropy value.

[0022] In one embodiment, the process of constructing the regional baseline includes:

[0023] Determine the request source region corresponding to the access request for each API instance in each time period of each day within the first time period;

[0024] By sliding the time window, the distribution of request source regions in each time period of each day in the current time window is calculated to obtain the set of request source regions in each time period of each day in the current time window. The average number of requests corresponding to each request source region in each time period of each day in the current time window is calculated, and this average number of requests is used as the baseline number of requests for the request source region in that time period in the current time window.

[0025] In one embodiment, the process of constructing the time baseline includes:

[0026] Count the number of access requests for each API instance in each time period of each day within the current time window to obtain the set of access request counts for the API instance in the time period;

[0027] Remove the maximum and minimum values ​​from the set of access request counts for each API instance in each time period, calculate the average value of each data after removing the maximum value, and use the average value as the baseline of the access request count of the API instance in the time period.

[0028] In one embodiment, the process of building the client baseline includes:

[0029] The currently determined normal clients are sorted to determine the regular matching expression of the normal clients; or the currently determined abnormal clients are sorted to determine the regular matching expression of the abnormal clients; the regular matching expression of the normal clients or the regular matching expression of the abnormal clients is used as the client baseline.

[0030] In one embodiment, determining whether the access request is an abnormal website request based on the request source region and the client, the first page views, and the abnormal baseline extracted from the access request includes:

[0031] Determine the correction factor p that changes with the time period;

[0032] Determine whether the request source region of the current access request is included in the request source region set corresponding to the time period in which the current access request was received in the regional baseline; if not, the current access request is an abnormal website request; if so, determine whether the number of requests from the request source region of the current access request within the time period exceeds (p+1) times the corresponding request count baseline; if so, determine that the current access request is an abnormal website request; if not, proceed to the next step;

[0033] Determine whether the first visit volume exceeds (p+1) times the baseline of the number of access requests in the corresponding time period in the time baseline; if so, the access request is an abnormal website request; if not, proceed to the next step;

[0034] Determine whether the client of the current access request matches the regular matching expression of the normal client. If so, the current access request is a normal request for the website; if not, the current access request is an abnormal request for the website; or, determine whether the client of the current access request matches the regular matching expression of the abnormal client. If not, the current access request is a normal request for the website; if so, the current access request is an abnormal request for the website.

[0035] According to a second aspect, an embodiment of the present invention provides an API-based website abnormal request determination device including:

[0036] A first acquisition module is used to acquire an API instance of a preset website within a first time period through automatic discovery;

[0037] A baseline construction module is configured to collect statistics on the API instances and construct an anomaly baseline based on the statistical results. The anomaly baseline includes a time baseline, a region baseline, and a client baseline. The time baseline includes a baseline for the number of access requests corresponding to each time period of the day. The region baseline includes a set of request source regions corresponding to each time period of the day and a baseline for the number of requests from each request source region in each time period.

[0038] an information determination module configured to, upon receiving a current access request from the preset website, extract a request source region and a client from the current access request, and count a first number of visits, where the first number of visits is the number of access requests within a time period in which the current access request is received;

[0039] The baseline comparison module is used to determine whether the current access request is an abnormal website request based on the request source region and the client, the first page views and the abnormal baseline extracted from the current access request.

[0040] According to a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method provided in the first aspect.

[0041] According to a fourth aspect, an embodiment of the present invention provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0042] The API-based website abnormal request judgment method, device, medium, and equipment provided by the embodiment of the present invention obtains the API instance of the preset website within the first time period through automatic discovery, and then performs statistics on the API instance, and constructs an abnormal baseline based on the statistical results. The abnormal baseline includes a time baseline, a regional baseline, and a client baseline. When the current access request of the preset website is received, the request source region and client are extracted from the current access request, and the first access volume is counted, and then the abnormal baseline is used for comparison to obtain a judgment result. It can be seen that the embodiment of the present invention improves the accuracy of website abnormal request detection by building an abnormal baseline on the API instance and refining the judgment of abnormal requests from the dimension of the API instance. At the same time, the access request is judged to be abnormal based on the three dimensions of region, time, and client. Compared with the traditional abnormal request, this judgment method performs detection from different dimensions, which improves the accuracy of abnormal detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 1 is a flow chart of a method for determining abnormal website requests based on an API in one embodiment of the present invention;

[0044] Figure 2 A schematic diagram of four access requests grouped into one group according to an embodiment of the present invention;

[0045] Figure 3 Based on Figure 2 A schematic diagram of the tree structure constructed by the access request in ;

[0046] Figure 4 This is a structural block diagram of an API-based website abnormal request determination device in one embodiment of the present invention. DETAILED DESCRIPTION

[0047] In the first aspect, the embodiment of the present invention provides a method for determining abnormal website requests based on an API. Figure 1 The method includes the following steps S110 to S140:

[0048] S110, obtaining an API instance of a preset website within a first time period through automatic discovery;

[0049] The first time period is, for example, the most recent month.

[0050] In one embodiment, obtaining the API instance of the preset website within the first time period by automatic discovery in S110 may include:

[0051] S111, dividing each website request of the preset website within the first time period into corresponding groups according to the request method, and generating a corresponding tree structure according to the URL of each website request in each group;

[0052] For example, there are four request methods: GET, POST, DELETE, and PUT. In this way, the requests of each website in the first time period can be divided into four groups, and then a corresponding tree structure is generated according to the URLs of the requests of each website in each group.

[0053] For example, for each access request with the request method of GET, see Figure 2 The tree structure corresponding to the groups formed by each access request based on the GET request method is Figure 3 ,exist Figure 3 It includes a root node and two first-level child nodes, and each child node includes its own child nodes.

[0054] S112: If the number of website requests for the preset website within the first time period reaches a preset number, merge the nodes in each tree structure; wherein each child node in the merged tree structure is the API instance.

[0055] Each time a request is received, it is determined whether the number of currently received requests has reached a preset number or whether the first time period has been reached. If so, aggregation processing is performed on the child nodes in the tree structure.

[0056] The merging process of the nodes in each tree structure in S112 may include the following steps 1-6:

[0057] 1. Calculate the number of child nodes under each parent node that has child nodes;

[0058] 2. If the number of child nodes is greater than the specified threshold or the child node matches the specified regular expression, the similarity between all child nodes under the corresponding parent node is calculated to form a similarity matrix, and the mean of the similarity matrix is ​​calculated;

[0059] In other words, if the number of child nodes under a node is greater than a specified threshold, or if a child node matches a specified regular expression, the similarity between each of these child nodes is calculated. For example, the Jaccard similarity index is used to calculate the similarity between two child nodes. The similarity between each of these child nodes is used to construct a similarity matrix. The mean of each element in the similarity matrix is ​​then calculated and used as the evaluation value for these child nodes.

[0060] 3. Based on the similarity matrix, use Z-score to calculate the discrete values ​​of all child nodes under the parent node;

[0061] 4. Based on the similarity matrix, calculate the entropy values ​​of all child nodes under the parent node;

[0062] 5. Calculate the merge scores corresponding to all child nodes under the parent node based on the mean, the discrete value, and the entropy value;

[0063] The combined score may be calculated using a first calculation formula, which is:

[0064] R=a*sb*kc*h

[0065] Wherein, a, b, and c are weights, R is the merge score, s is the mean, k is the discrete value, and h is the entropy value.

[0066] 6. If the merge score exceeds a preset threshold, all child nodes under the parent node are merged to obtain a merged API instance.

[0067] It can be seen that if the merge score exceeds the preset threshold, it is considered that all child nodes under the parent node can be merged into a unified representation, so the merge process is performed, and the merged node is used as an API instance.

[0068] S120: Collect statistics on the API instance and construct an anomaly baseline based on the statistical results; the anomaly baseline includes a time baseline, a region baseline, and a client baseline; the time baseline includes a baseline of the number of access requests corresponding to each time period of the day; the region baseline includes a set of request source regions corresponding to each time period of the day and a baseline of the number of requests from each request source region in each time period;

[0069] A sliding time window can be used to calculate sample data for a specified number of days from the current time. As the sample data slides forward in time, the abnormal baseline of website visits also changes.

[0070] The process of constructing the regional baseline may include:

[0071] 1. Determine the request source region corresponding to each API instance access request in each time period of each day within the first time period;

[0072] 2. Using a sliding time window, calculate the distribution of request source regions for each time period of each day within the current time window, obtaining the set of request source regions for each time period of each day within the current time window. Calculate the average number of requests for each request source region in each time period of each day within the current time window, and use this average number of requests as the baseline number of requests for that request source region within that time period within the current time window.

[0073] For example, a day is divided into 24 time periods, with each hour being a time period.

[0074] For example, if the time window is 7 days, the baseline number of requests from source region a2 in time period a1 is the average number of requests from source region a2 during the seven time periods a1 during those seven days. The source regions of all access requests in the seven time periods a1 during those seven days are aggregated to obtain the set of source regions corresponding to time period a1. For example, time period a1 is from 8:00 AM to 9:00 AM.

[0075] Among them, in the process of building the regional baseline, requests from the same IP address to the same site are treated as one request to prevent a large number of requests from the same IP from diluting the sample.

[0076] The process of constructing the time baseline may include:

[0077] 1. Count the number of access requests for each API instance in each time period of each day within the current time window to obtain the set of access request counts for the API instance in that time period;

[0078] 2. Remove the maximum and minimum values ​​from the set of access request counts for each API instance in each time period, and calculate the average value of each data after removing the maximum value. Use this average value as the baseline for the number of access requests for the API instance in that time period.

[0079] For example, consider a time window of 7 days. Count the number of access requests for API instance x1 between 8:00 AM and 9:00 AM for each of the 7 days within the current time window. These 7 statistical values ​​form the set of access request counts for API instance x1 between 8:00 AM and 9:00 AM. Remove the maximum and minimum values ​​from this set. This can reduce the interference of abnormal data samples on the sample data. After removing the maximum value, average the remaining 5 statistical values. The resulting average value becomes the baseline for the number of access requests for API instance x1 between 8:00 AM and 9:00 AM.

[0080] The process of building the client baseline may include:

[0081] The currently determined normal clients are sorted to determine the regular matching expression of the normal clients; or the currently determined abnormal clients are sorted to determine the regular matching expression of the abnormal clients; the regular matching expression of the normal clients or the regular matching expression of the abnormal clients is used as the client baseline.

[0082] The set formed by the currently determined abnormal clients can be enumerated as the regular matching expression of the abnormal clients, and the set formed by the currently determined normal clients can be used as the regular matching expression of the normal and abnormal clients.

[0083] S130. When receiving a current access request from the preset website, extract the request source region and client from the current access request, and count a first number of visits, where the first number of visits is the number of access requests within a time period when the current access request is received;

[0084] S140: Determine whether the current access request is an abnormal website request based on the request source region and the client, the first page views, and the abnormal baseline extracted from the current access request.

[0085] In one embodiment, determining whether the access request is an abnormal website request based on the request source region and the client, the first page views, and the abnormal baseline extracted from the access request in S140 may include S141 to S144:

[0086] S141. Determine a correction factor p that changes due to a change in the time period;

[0087] The correction factor is used to correct for abnormal data in the seasonal variation of time series data. Since the variation of certain data across different seasons or time periods can cause the accuracy of judgment results to decrease with the introduction of abnormal values, the introduction of the correction factor can eliminate this effect and obtain more accurate judgment results.

[0088] Understandably, website visitation often fluctuates seasonally due to uncertainties such as holidays and special events. Different time periods sometimes exhibit unique characteristics. If the baseline sample contains data from unusual time periods, this can significantly impact forecasts. Therefore, when collecting statistics on website access request samples, we can construct a correction factor for website visits based on historical website visit behavior, using a weekly time period. The default correction factor for normal website visits is 0.15, and the website's request volume fluctuates between 0.85 and 1.15 of the normal request volume. Different website businesses have their own seasonal variations, and correction factors p are introduced based on the specific circumstances of the website.

[0089] S142. Determine whether the request source region of the current access request is included in the request source region set corresponding to the time period in which the current access request is received in the regional baseline; if not, the current access request is an abnormal website request; if so, determine whether the number of requests from the request source region of the current access request within the time period exceeds (p+1) times the corresponding request number baseline; if so, determine that the current access request is an abnormal website request; if not, proceed to the next step;

[0090] That is, determine whether the request source region of this access request exists in the request source region set of the corresponding time period in the regional baseline. If so, continue to determine whether the number of requests from the request source region of this access request in this time period is greater than (p+1) times the request number baseline of this time period. If so, this access request is considered an abnormal website request. If not, further judgment is required based on the time baseline and client baseline.

[0091] S143. Determine whether the first access volume exceeds (p+1) times the baseline of the number of access requests in the corresponding time period in the time baseline; if so, the access request is an abnormal website request; if not, proceed to the next step;

[0092] In other words, if the number of access requests during the time period of the current access request does not exceed (p+1) times the baseline number of access requests corresponding to this time period in the time baseline, then further judgment is required based on the client baseline. If it exceeds, the access request is considered an abnormal website request.

[0093] S144. Determine whether the client of the current access request matches the regular matching expression of the normal client. If so, the current access request is a normal request for the website; if not, the current access request is an abnormal request for the website; or, determine whether the client of the current access request matches the regular matching expression of the abnormal client. If not, the current access request is a normal request for the website; if so, the current access request is an abnormal request for the website.

[0094] That is, if the client of this access request is a normal client, it is considered that this access request is a normal request to the website. If the client of this access request is an abnormal client, it is considered that this access request is an abnormal request to the website.

[0095] The embodiment of the present invention realizes the detection of abnormal requests of the website through the dimension of API instances. In order to be able to detect through the dimension of API instances, a set of automatic discovery methods of API instances is proposed. The number of access requests to the website will undergo periodic changes with the differences in the website's own services. However, in addition to the periodic changes, some abnormal interference will affect the sample values ​​and ultimately generate an inaccurate baseline. The embodiment of the present invention reduces the impact of this situation on the data through a "correction factor" and improves the accuracy of judgment. At the same time, the detection of anomalies is not only the statistics of the number of visits, but also the statistics of the request source region and client, making the detection of website anomalies more comprehensive.

[0096] As can be seen, the embodiments of the present invention improve the accuracy of abnormal request detection on websites by building abnormal baselines on API instances, with different baselines for API instances with different functions. This refines abnormal requests from the perspective of API instances, thereby improving the accuracy of abnormal request detection on websites. Furthermore, abnormality judgments are made on access requests based on three dimensions: region, time, and client. Compared with traditional abnormal request judgments, this method detects abnormal requests from different dimensions, improving the accuracy of anomaly detection.

[0097] In the second aspect, the embodiment of the present invention provides an API-based website abnormal request determination device, see Figure 4 , the device comprises:

[0098] A first acquisition module is used to acquire an API instance of a preset website within a first time period through automatic discovery;

[0099] A baseline construction module is configured to collect statistics on the API instances and construct an anomaly baseline based on the statistical results. The anomaly baseline includes a time baseline, a region baseline, and a client baseline. The time baseline includes a baseline for the number of access requests corresponding to each time period of the day. The region baseline includes a set of request source regions corresponding to each time period of the day and a baseline for the number of requests from each request source region in each time period.

[0100] an information determination module configured to, upon receiving a current access request from the preset website, extract a request source region and a client from the current access request, and count a first number of visits, where the first number of visits is the number of access requests within a time period in which the current access request is received;

[0101] The baseline comparison module is used to determine whether the current access request is an abnormal website request based on the request source region and the client, the first page views and the abnormal baseline extracted from the current access request.

[0102] In one embodiment, the first acquisition module includes:

[0103] a request grouping unit, configured to group each website request of the preset website within the first time period into corresponding groups according to the request mode, and generate a corresponding tree structure according to the URL of each website request in each group;

[0104] The node merging unit is used to merge the nodes in each tree structure if the number of website requests for the preset website within the first time period reaches a preset number; wherein each child node in the merged tree structure is the API instance.

[0105] In one embodiment, the node merging unit is specifically used to: calculate the number of child nodes under each parent node with child nodes; if the number of child nodes is greater than a specified threshold or the child node matches a specified regular expression, calculate the similarity between each pair of child nodes under the corresponding parent node to form a similarity matrix, and calculate the mean of the similarity matrix; based on the similarity matrix, use the Z-score to calculate the discrete values ​​of all child nodes under the parent node; based on the similarity matrix, calculate the entropy value of all child nodes under the parent node; calculate the merge score corresponding to all child nodes under the parent node according to the mean, the discrete value and the entropy value; if the merge score exceeds a preset threshold, merge all child nodes under the parent node to obtain a merged API instance; wherein, the merge score is calculated using a first calculation formula, and the first calculation formula is:

[0106] R=a*sb*kc*h

[0107] Wherein, a, b, and c are weights, R is the merge score, s is the mean, k is the discrete value, and h is the entropy value.

[0108] In one embodiment, the baseline building block includes:

[0109] The regional baseline construction unit is used to determine the request source region corresponding to the access request of each API instance in each time period of each day within the first time period; through a sliding time window, count the distribution of the request source region in each time period of each day under the current time window, and obtain the request source region set for each time period of each day in the current time window; count the average number of requests corresponding to each request source region in each time period of each day in the current time window, and use the average number of requests as the request number baseline of the request source region in the time period under the current time window.

[0110] In one embodiment, the baseline building block includes:

[0111] The time baseline construction unit is used to count the number of access requests for each API instance in each time period of each day within the current time window to obtain the set of access request numbers for the API instance in the time period; remove the maximum and minimum values ​​in the set of access request numbers for each API instance in each time period, and calculate the average value of each data after removing the maximum value, and use the average value as the baseline of the access request number of the API instance in the time period.

[0112] In one embodiment, the baseline building block includes:

[0113] The client baseline construction unit is used to organize the currently determined normal clients to determine the regular matching expression of the normal clients; or to organize the currently determined abnormal clients to determine the regular matching expression of the abnormal clients; and use the regular matching expression of the normal client or the regular matching expression of the abnormal client as the client baseline.

[0114] In one embodiment, the baseline comparison module is specifically used to: determine the correction factor p that changes due to the change of the time period; determine whether the request source region of the current access request is included in the request source region set corresponding to the time period when the current access request is received in the regional baseline; if not, the current access request is an abnormal website request; if so, determine whether the number of requests from the request source region of the current access request within the time period exceeds (p+1) times the corresponding request number baseline; if exceeded, the current access request is an abnormal website request; if not, proceed to the next step; determine whether the first visit volume exceeds The method further comprises the following steps: determining whether the client of the current access request matches the regular matching expression of the normal client, if so, the access request is a normal request for the website, and if not, the access request is an abnormal request for the website; or determining whether the client of the current access request matches the regular matching expression of the abnormal client, if not, the access request is a normal request for the website, and if so, the access request is an abnormal request for the website.

[0115] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the device provided by the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0116] In a third aspect, an embodiment of the present invention provides a computer-readable medium having computer instructions stored thereon. When the computer instructions are executed by a processor, the processor executes the method provided in the first aspect.

[0117] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0118] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0119] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0120] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0121] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0122] It is understandable that the explanation, specific implementation methods, beneficial effects, examples, etc. of the relevant contents in the computer-readable medium provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0123] In a fourth aspect, an embodiment of this specification provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method in any one of the embodiments in the specification.

[0124] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the computing device provided by the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0125] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences from other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0126] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention may be implemented using hardware, software, widgets, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0127] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for determining abnormal website requests based on an API, characterized in that: include: Obtain the API instance of the preset website in the first time period through automatic discovery; Collect statistics on the API instances and construct an anomaly baseline based on the statistical results; the anomaly baseline includes a time baseline, a region baseline, and a client baseline; the time baseline includes a baseline of the number of access requests corresponding to each time period of the day; the region baseline includes a set of request source regions corresponding to each time period of the day and a baseline of the number of requests from each request source region in each time period; When receiving the access request for the preset website, extracting the request source region and the client from the access request, and counting a first number of visits, where the first number of visits is the number of access requests within the time period when the access request is received; Whether the current access request is an abnormal website request is determined based on the request source region and the client, the first page views, and the abnormal baseline extracted from the current access request.

2. The method according to claim 1, characterized in that The step of automatically discovering an API instance of a preset website within a first time period includes: Dividing each website request of the preset website within the first time period into corresponding groups according to the request method, and generating a corresponding tree structure according to the URL of each website request in each group; If the number of website requests for the preset website within the first time period reaches a preset number, each node in the tree structure is merged; wherein each child node in the merged tree structure is the API instance.

3. The method according to claim 2, characterized in that The merging process of the nodes in each tree structure includes: Calculate the number of child nodes under each parent node that has child nodes; If the number of child nodes is greater than the specified threshold or the child node matches the specified regular expression, the similarity between each of the child nodes under the corresponding parent node is calculated to form a similarity matrix, and the mean of the similarity matrix is ​​calculated; Based on the similarity matrix, the Z-score is used to calculate the discrete values ​​of all child nodes under the parent node; Based on the similarity matrix, calculate the entropy values ​​of all child nodes under the parent node; Calculate the merge scores corresponding to all child nodes under the parent node according to the mean, the discrete value, and the entropy value; If the merge score exceeds a preset threshold, all child nodes under the parent node are merged to obtain a merged API instance; The combined score is calculated using a first calculation formula, which is: R=a*sb*kc*h Wherein, a, b, and c are weights, R is the merge score, s is the mean, k is the discrete value, and h is the entropy value.

4. The method according to claim 1, wherein The process of constructing the regional baseline includes: Determine the request source region corresponding to the access request for each API instance in each time period of each day within the first time period; By sliding the time window, the distribution of request source regions in each time period of each day in the current time window is calculated to obtain the set of request source regions in each time period of each day in the current time window. The average number of requests corresponding to each request source region in each time period of each day in the current time window is calculated, and this average number of requests is used as the baseline number of requests for the request source region in that time period in the current time window.

5. The method according to claim 1, wherein The process of constructing the time baseline includes: Count the number of access requests for each API instance in each time period of each day within the current time window to obtain the set of access request counts for the API instance in the time period; Remove the maximum and minimum values ​​from the set of access request counts for each API instance in each time period, calculate the average value of each data after removing the maximum value, and use the average value as the baseline of the access request count of the API instance in the time period.

6. The method according to claim 1, characterized in that The process of building the client baseline includes: The currently determined normal clients are sorted to determine the regular matching expression of the normal clients; or the currently determined abnormal clients are sorted to determine the regular matching expression of the abnormal clients; the regular matching expression of the normal clients or the regular matching expression of the abnormal clients is used as the client baseline.

7. The method according to claim 6, characterized in that The determining whether the access request is an abnormal website request based on the request source region and the client, the first page views, and the abnormal baseline extracted from the access request includes: Determine the correction factor p that changes with the time period; Determine whether the request source region of the current access request is included in the request source region set corresponding to the time period in which the current access request was received in the regional baseline; if not, the current access request is an abnormal website request; if so, determine whether the number of requests from the request source region of the current access request within the time period exceeds (p+1) times the corresponding request count baseline; if so, determine that the current access request is an abnormal website request; if not, proceed to the next step; Determine whether the first visit volume exceeds (p+1) times the baseline of the number of access requests in the corresponding time period in the time baseline; if so, the access request is an abnormal website request; if not, proceed to the next step; Determine whether the client of the current access request matches the regular matching expression of the normal client. If so, the current access request is a normal request for the website; if not, the current access request is an abnormal request for the website; or, determine whether the client of the current access request matches the regular matching expression of the abnormal client. If not, the current access request is a normal request for the website; if so, the current access request is an abnormal request for the website.

8. A website abnormal request determination device based on API, characterized in that: include: A first acquisition module is used to acquire an API instance of a preset website within a first time period through automatic discovery; A baseline construction module is configured to collect statistics on the API instances and construct an anomaly baseline based on the statistical results. The anomaly baseline includes a time baseline, a region baseline, and a client baseline. The time baseline includes a baseline for the number of access requests corresponding to each time period of the day. The region baseline includes a set of request source regions corresponding to each time period of the day and a baseline for the number of requests from each request source region in each time period. an information determination module configured to, upon receiving a current access request from the preset website, extract a request source region and a client from the current access request, and count a first number of visits, where the first number of visits is the number of access requests within a time period in which the current access request is received; The baseline comparison module is used to determine whether the current access request is an abnormal website request based on the request source region and the client, the first page views and the abnormal baseline extracted from the current access request.

9. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

10. A computing device, characterized in that The method comprises a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 7 is implemented.

Images