A detection method, apparatus, device, storage medium, and computer program product

Abstract

The application provides a detection method, device, equipment, storage medium and program product. The method comprises the following steps: obtaining first log data of an API gateway within a preset time, constructing a first calling relationship based on the first log data; obtaining a second node related to the first node based on the first calling relationship; determining first node data corresponding to the first node and second node data corresponding to the second node; determining first feature information corresponding to the first node according to the first node data and the second node data; training the first feature information and the first log data to obtain a first model; and performing abnormality detection on second log data collected in real time by the API gateway based on the first model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer networks, and particularly relates to a detection method and device, equipment, a storage medium and a computer program product. BACKGROUND

[0002] With the rise of cloud services and the widespread use of Application Programming Interface (API) technology, many network capabilities of operators are usually exported in the form of APIs to empower others. API gateways have become an important way for north-south and east-west system interconnection and data sharing. With the increasing number of APIs and the frequency of calls, there are many problems in actual calls, such as hackers using API vulnerabilities to attack enterprise systems and cause data leakage, overload traffic access will cause pressure on the network and consume system resources, directly affecting the satisfaction of operator customers and customer retention. However, the existing API gateway anomaly detection method usually relies on manually preset rules or API gateway data collected in real time for model training and detection, resulting in poor detection intelligence. SUMMARY

[0003] The present application provides a detection method, device, equipment, storage medium and computer program product, which can improve the detection intelligence.

[0004] The technical solution of the present application is implemented as follows:

[0005] In a first aspect, the present application provides a detection method, which comprises:

[0006] obtaining first log data of an API gateway within a preset time, and constructing a first call relationship based on the first log data;

[0007] obtaining a second node related to the first node based on the first call relationship, and determining first node data corresponding to the first node and second node data corresponding to the second node;

[0008] determining first feature information corresponding to the first node according to the first node data and the second node data;

[0009] training using the first feature information and the first log data to obtain a first model;

[0010] performing anomaly detection on second log data collected in real time by the API gateway based on the first model.

[0011] In the above solution, the first call relationship is constructed based on the first log data, which comprises:

[0012] determine parameter information corresponding to the first log data;

[0013] construct a second calling relationship based on the parameter information;

[0014] obtain registration information of the API gateway, and construct a third calling relationship according to the registration information;

[0015] merge the second calling relationship and the third calling relationship to obtain the first calling relationship.

[0016] In the above scheme, the first feature information corresponding to the first node is determined according to the first node data and the second node data, comprising:

[0017] input the first node data and the second node data into a second model to obtain second feature information corresponding to the first node;

[0018] input the second feature information into a third model to obtain the first feature information.

[0019] In the above scheme, the first model is obtained by training the first feature information and the first log data, comprising:

[0020] at least one fourth model is trained using the first feature information to obtain at least one training data;

[0021] the first model is obtained by training based on the at least one training data and the first log data.

[0022] In the above scheme, the first model is obtained by training based on the at least one training data and the first log data, comprising:

[0023] determine abnormal data from the first log data;

[0024] train an initial first model based on the abnormal data and the at least one training data to obtain a loss function;

[0025] update the model parameters according to the loss function to obtain the first model.

[0026] In the above scheme, the loss function is obtained by training the initial first model based on the abnormal data and the at least one training data, comprising:

[0027] train the initial first model according to the at least one training data to obtain a trained first model;

[0028] train the trained first model based on the abnormal data to obtain the loss function.

[0029] In a second aspect, the present application provides a detection device, the device comprising:

[0030] a construction unit configured to obtain first log data of an API gateway within a preset time, and construct a first calling relationship based on the first log data;

[0031] a first determination unit configured to obtain a second node related to a first node based on the first calling relationship, and determine first node data corresponding to the first node and second node data corresponding to the second node;

[0032] determine first feature information corresponding to the first node according to the first node data and the second node data;

[0033] a training unit configured to train the first feature information and the first log data to obtain a first model;

[0034] a detection unit configured to perform anomaly detection on second log data collected in real time by the API gateway based on the first model.

[0035] In a third aspect, the present application provides a detection device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the above methods.

[0036] In a fourth aspect, the present application provides a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the above methods.

[0037] In a fifth aspect, the present application provides a computer program product comprising a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above methods.

[0038] The application provides a detection method, device, equipment, storage medium and computer program product. The method comprises the following steps: acquiring first log data of an API gateway within a preset time, constructing a first calling relationship based on the first log data; acquiring a second node related to the first node based on the first calling relationship; determining first node data corresponding to the first node and second node data corresponding to the second node; determining first feature information corresponding to the first node according to the first node data and the second node data; training the first feature information and the first log data to obtain a first model; and performing abnormality detection on second log data collected in real time by the API gateway based on the first model. By using the above implementation scheme, the first calling relationship is constructed based on the first log data within the preset time, which represents the change of the first log data within the preset time. The first model is obtained by training the first feature information determined based on the first calling relationship, and the abnormality detection on the log data changing in real time can be realized, thereby improving the detection intelligence. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 A flowchart of a detection method provided in an embodiment of the application is shown in the figure.

[0040] Figure 2 An exemplary schematic diagram of an API gateway abnormality detection system module provided in an embodiment of the application is shown in the figure.

[0041] Figure 3 A flowchart of an API gateway network flow abnormality detection provided in an embodiment of the application is shown in the figure.

[0042] Figure 4 A structural schematic diagram of a detection device provided in an embodiment of the application is shown in the figure.

[0043] Figure 5 A structural schematic diagram of a detection device provided in an embodiment of the application is shown in the figure. DETAILED DESCRIPTION

[0044] In order to enable more detailed understanding of the features and technical contents of the embodiments of the application, the implementation of the embodiments of the application is described in detail below with reference to the accompanying drawings, and the accompanying drawings are only used for reference and are not used to limit the embodiments of the application.

[0045] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the application belongs. The terms used herein are only for the purpose of describing the embodiments of the application and are not intended to limit the application.

[0046] In the following description, "some embodiments" are referred to, which describe a subset of all possible embodiments, but it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. It should also be noted that the terms "first", "second", "third" and the like used in the embodiments of the present application are only used to distinguish similar objects, and do not represent a specific order of the objects. It can be understood that "first", "second", "third" and the like can be interchanged in a specific order or sequence as allowed, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0047] The embodiments of the present application provide a detection method, Figure 1 A flowchart of a detection method provided by the embodiments of the present application is shown in Figure 1 As shown, the method can include:

[0048] S101, acquiring first log data of the API gateway within a preset time, and constructing a first calling relationship based on the first log data.

[0049] In the embodiments of the present application, the first log data can be monitoring log data of the API gateway. That is, the monitoring log data of the API gateway within a certain time period (preset time) is acquired.

[0050] In the embodiments of the present application, constructing the first calling relationship based on the first log data specifically includes: determining parameter information corresponding to the first log data; constructing a second calling relationship based on the parameter information; acquiring registration information of the API gateway, and constructing a third calling relationship according to the registration information; and merging and processing the second calling relationship and the third calling relationship to obtain the first calling relationship.

[0051] Wherein, determining the parameter information corresponding to the first log data can be understood as preprocessing the first log data to determine the parameter information. The preprocessing process can be determined according to actual conditions, which is not limited here, and as an example, the preprocessing process specifically includes: first, eliminating invalid information in the first log data, including repeated information and useless information, etc., and then parsing the first log data to extract parameter information in the first log data according to the event template. The parameter information can be any parameter information related to the API gateway, and the specific content can be determined according to actual conditions, which is not limited here, and as an example, the parameter information specifically includes calling application name, calling party Internet Protocol (IP), called service name, called API name, API description, API type, request method, request time, request parameter, request traffic size, response traffic size, gateway forwarding time, response time, response result, response data, whether to trigger API gateway configuration policy, and trigger policy name.

[0052] In the embodiment of the present application, the second calling relationship can be understood as a network relationship graph constructed according to the data of the calling party and the data of the called party in the first log data. Wherein, the calling party and the called party can be regarded as nodes in the constructed network relationship graph, and the node type can be determined according to the actual situation, which is not limited here, as an example, the calling party is a south node, and the called party is a north node; or the calling party can be a north node, and the called party is a south node, or the calling party is a south node, and the called party is also a south node, etc. It should be noted that the same node can be both a calling party and a called party, which can be determined according to the actual situation.

[0053] Wherein, the second calling relationship is constructed based on the parameter information, which can be understood as determining the first attribute information of the calling party node and the second attribute information of the called party according to the parameter information, and constructing the second calling relationship based on the first attribute information and the second attribute information; the specific process of construction can be exemplified as follows: if node A and node B send a calling behavior through the API gateway once, then connect A and B nodes, and the calling relationship includes north calling south, and serial calling between south and south; if there is a subscription relationship between node A and node B, then connect A and B nodes, and the calling frequency in a unit time represents the weight of the edge.

[0054] It should be noted that the first attribute information and the second attribute information contain the same content, and the specific content can be determined according to the actual situation, which is not limited here, as an example, the attribute information can include: application type, application name, application description, daily response traffic, daily request traffic, daily call times, gateway forwarding frequency, registered gateway API number, and registered gateway API information.

[0055] For easy understanding, in actual application, the network relationship graph at a certain moment can be represented as G t =(V,E,W,A), wherein V represents a node set, E represents an edge set, W is a weight matrix of the edge, and A is an attribute set of each node. The network relationship graph on the time flow is constructed for the data of different time periods, that is, the second calling relationship can be represented as G={G1,G2,…,G T}, wherein T is the total number of time snapshot steps.

[0056] In the embodiment of the present application, the registration information of the API gateway can be the information obtained when the API network is registered, and the specific content can be determined according to the actual situation, which is not limited here, as an example, the registration information of the API gateway can include the name information when the API gateway is registered, system information, etc. The third calling relationship can be understood as a network relationship graph constructed based on the registration information, which can also be called a feature similarity graph G' in actual application.

[0057] Constructing a third calling relationship based on registration information can be understood as performing text processing on the registration information to obtain the text information corresponding to the nodes in the registration information, calculating the similarity between node features based on the text information, and constructing a third calling relationship based on the similarity.

[0058] Specifically, the process of text processing the registration information can be described as follows: all text information such as north-south system descriptions and API descriptions are merged into a corpus, and the text features of the nodes are obtained using the Bidirectional Encoder Representation from Transformers (BERT) language model.

[0059] The similarity between node features can be calculated using formulas (1) and (2), as follows:

[0060]

[0061] L gsr =||A l || (2)

[0062] Where, ε′ i,j E(X) represents the similarity, ε∈[0,1] represents the threshold controlling the density of the generated feature similarity map, and E(X) represents the similarity. i ',X' j The symbol () represents the similarity calculation between two nodes, and the commonly used calculation method is cosine similarity; L gsr Let A represent the structural sparsity regularizer, which is introduced through the Manhattan (L1) norm to ensure the sparsity of the feature similarity graph G', and A is the adjacency matrix of G'.

[0063] The second and third call relationships are merged to obtain the first call relationship; this can be understood as merging the original network graph G and the generated feature-similar graph G' to obtain a new dynamic network graph. Specifically, the merging process can be as follows: if two nodes in G' are connected, but two identical nodes in G are not connected, then the two nodes in the merged graph are connected, and the edge weight is the same as the edge weight in G'; if both G' and two identical nodes in G are connected, then the edge weight in the merged graph is the same as the edge weight in G.

[0064] The solution in this application embodiment generates a new refined network relationship graph based on metric learning, which can solve some of the problems of inactive southbound APIs.

[0065] S102: Obtain a second node related to the first node based on the first calling relationship; and determine first node data corresponding to the first node and second node data corresponding to the second node.

[0066] In the embodiments of the present application, the first node can be any node in the first calling relationship, which can be determined according to actual conditions, and is not limited herein. The second node can be understood as a neighboring node in the first node; it should be noted that the number of the second node can be one or more.

[0067] Based on the first calling relationship, the second node related to the first node can be understood as obtaining all second nodes adjacent to the first node in the network relationship graph.

[0068] The first node data and the second node data can be understood as attribute data of the node; the determination process of the node data can be obtained from the first log data. The first node data and the second node data can specifically include: application type, application name, application description, daily response traffic, daily request traffic, daily call times, gateway forwarding frequency, registered gateway API number, and registered gateway API information.

[0069] S103: Determine the first feature information corresponding to the first node according to the first node data and the second node data.

[0070] In the embodiments of the present application, the specific process of determining the first feature information corresponding to the first node according to the first node data and the second node data includes: inputting the first node data and the second node data into the second model to obtain the second feature information corresponding to the first node; inputting the second feature information into the third model to obtain the first feature information.

[0071] The second model can be any neural network model, which can be determined according to actual conditions. As an example, the second model can be a relational graph convolutional neural network model (R-GCN). The third model can be any time-related network model. As an example, the third model can be an attention mechanism model.

[0072] It should be noted that the process of obtaining the second feature information can also be referred to as structure dimension-based node embedding learning in actual application; the process of obtaining the first feature information according to the second feature information can also be referred to as time dimension-based node embedding learning in actual application.

[0073] The second feature information can be understood as the structure information of the network relationship graph obtained by the first node. In actual application, the second feature information can be an embedding identifier of the first node at different time snapshots, which can be represented as where v represents the specified node, and T represents the total number of time snapshot steps. The first feature information can be understood as the structure and time information of the network relationship graph obtained by the first node, and in actual application, the second feature information can be represented as wherein, F' represents the dimension of the output, and T represents the total number of time snapshot steps.

[0074] For the convenience of understanding, the specific process of obtaining the first feature information is exemplarily illustrated as follows:

[0075] Node embedding learning based on structure dimension: using relation-based R-GCN to learn node embedding, Z=R-GCN(X,A,R) represents the R-GCN model, wherein X is an attribute feature matrix, and A is an adjacency matrix of R. R-GCN considers different types of relationships between two nodes when aggregating neighborhood features, and the hierarchical propagation rule is shown in formula (3). The embedding vector of the neighbor node is normalized and weighted summed, and then added to the embedding vector of the center node itself after weighted addition, and then a nonlinear transformation is performed, and then the center node is updated. Formula (3) is as follows:

[0076]

[0077] wherein, represents the representation of the node at the l+1 layer, W l represents the learning weight, N r represents the neighbor set of node i under the relationship r, and σ(·) is a nonlinear activation function, c i,r is a normalization constant, which is generally defined as (the number of neighbors of edge type r).

[0078] The node embedding representation of the specified node v at different time snapshots obtained by the R-GCN model is

[0079] Node embedding learning based on time dimension: using scaled dot-product attention mechanism to capture the changes of the time hierarchy of the graph structure. The input is the representation sequence of the specified node v at different time snapshot structure dimensions, i.e. wherein T is the total number of time snapshot steps, and D' is the dimension of the input representation. The output is a new representation sequence of the node at each time snapshot, i.e. F' represents the dimension of the output. Three attention vectors are set as Queries, Keys and Values, and Queries, Keys and Values are projected through linear projection matrices W q ∈R D'×F' , W k ∈R D'×F , Wv ∈R D'×F' are transformed to different spaces respectively, where the formulae (4), (5) and (6) of the time attention are as follows:

[0080] Z v =β v (X v W v ) (4)

[0081]

[0082]

[0083] wherein Z v is a new representation sequence of nodes at each time snapshot, X v is a representation sequence of nodes in different time snapshot structure dimensions, i and j are different nodes, W q is a projection matrix corresponding to Queries, W k is a projection matrix corresponding to Keys, and W v is a projection matrix corresponding to Values, β v ∈R T×T is an attention weight matrix obtained by the multiplicative attention function, M∈R T×T is a mask matrix, M ij ∈{-∞, 0} is used to enhance the autoregressive property, and M is defined for encoding the time sequence, and the definition of M is shown in formula (7) as follows:

[0084]

[0085] The scheme of the embodiments of the application comprehensively considers the graph structure information and the time dimension information to learn the node features of the heterogeneous graph node embedding, and can improve the accuracy of the detection model.

[0086] S104: training is performed by using the first feature information and the first log data to obtain the first model.

[0087] In the embodiments of the application, the first model can be understood as an anomaly detection model; and the specific process of obtaining the first model includes: training at least one fourth model by using the first feature information to obtain at least one training data; and training based on the at least one training data and the first log data to obtain the first model.

[0088] The fourth model can be any neural network model, which can be determined according to actual conditions, and is not limited herein. The number of fourth models can also be determined according to actual conditions, and is not limited herein. As an example, the number of fourth models can be four. When the number of fourth models is four, the fourth model can include an eXtreme Gradient Boosting (XGB), a Light Gradient Boosting Trees (LGBT), a Random Forest (RF), and a Deep Neural Networks (DNN).

[0089] The first feature information is used to train the at least one fourth model to obtain at least one training data. It can be understood that the first feature information is subjected to feature division processing to obtain at least one third feature information, and each fourth model in the at least one fourth model is trained based on the at least one third feature information to obtain the at least one training data.

[0090] It can be understood that the feature division process can be determined according to actual conditions, and is not limited herein. As an example, the first feature information can be subjected to feature division processing to obtain five equal parts, the first four equal parts of feature information are used to train each fourth model to obtain the at least one training data, and the last equal part of feature information is used to verify the training data. It should be noted that the at least one training data can be understood as a prediction result of the at least one fourth model in actual application.

[0091] In the embodiments of the present application, the process of training the first model based on the at least one training data and the first log data includes: determining abnormal data from the first log data; training an initial first model based on the abnormal data and the at least one training data to obtain a loss function; and updating model parameters according to the loss function to obtain the first model.

[0092] It can be understood that the process of determining abnormal data from the first log data can be determined according to actual conditions, and is not limited herein. As an example, the abnormal data can be determined by manual labeling.

[0093] The specific process of training the initial first model based on the abnormal data and the at least one training data to obtain the loss function includes: training the initial first model based on the at least one training data to obtain a trained first model; and training the trained first model based on the abnormal data to obtain the loss function.

[0094] The initial first model can be any anomaly detection model, which is not limited herein, and as an example, the initial first model can be a logistic classification model.

[0095] The trained first model is trained according to the abnormal data to obtain a loss function; it can be understood that the abnormal data is sampled to obtain a support set and a query set, the trained first model is trained based on the support set, and the loss function is calculated based on the query set as a verification set.

[0096] The model parameter is updated according to the loss function to obtain the first model; it can be understood that the trained first model is updated based on the loss function until the model converges, and the first model is obtained.

[0097] For convenience of understanding, in actual application, the specific process of obtaining the first model can be exemplified as follows:

[0098] Anomaly prediction module based on stacked generalization (stacking): using supervised learning for anomaly detection, using the node embedding features obtained in step two as input for model training. The stacking model fusion method is used to fuse the prediction results of multiple single models to improve the accuracy of anomaly prediction. In the initial model construction, the attack behavior in the collected data needs to be manually labeled. The specific steps are as follows:

[0099] (1) Select the first T-1 time snapshots as the training set, and the node embedding features obtained in step two as the feature input, to construct and predict the first layer model. The selected models include XGB, LGBT, RF, DNN, and five-fold cross-validation is used to divide the training set data into five equal parts. The first four parts are used to train the model, and the fifth part is used for validation.

[0100] (2) The prediction results of each model are used as the feature input of the second layer integrated model to construct a new model. The second layer model can use a logistic classification model, and finally the abnormal nodes in the network relationship graph are obtained.

[0101] Classification model module based on meta-learning optimization: in the actual network environment, the occurrence of abnormal events belongs to a small sample scenario. This module optimizes the prediction model based on the model-agnostic meta-learning (MAML) algorithm, which is mainly applied to the second layer model in the stacking model structure to improve the generalization ability of the integrated classification model in small sample tasks. Meta-learning is divided into meta-training and meta-testing processes, and the specific steps are as follows:

[0102] (1) Given a set of tasks T defined as different types of anomaly event detection problems, sample data for each task τ∈T to obtain support set S τ and query set Q τ .

[0103] (2) For each training task τ i , train the model based on support set S τ as training data, perform gradient descent, calculate loss function L τ based on query set Q τ as validation set, update parameters through the loss of the model on the query set, and one gradient step parameter update can be represented by formula (8), which is as follows:

[0104]

[0105] Wherein, is the learning rate, θ is the initial parameter set of the model, f θ is the base learner, θ i ' is the updated model parameter set, and L τ is the loss function.

[0106] (3) Optimize the updated meta-model parameter θ i ' to minimize the average validation loss on all tasks, and the update formula (9) is as follows:

[0107]

[0108] Wherein, is the learning rate, θ i ' is the model parameter obtained after formula (8), L is the loss function, θ on the left side of the arrow is the model parameter updated after formula (9), and θ on the right side of the arrow is the initial parameter set of the model.

[0109] (4) Repeat steps (2)-(3) until convergence, and obtain the final model parameter θ.

[0110] (5) Take the parameter θ as the initialization parameter of the meta-test model, input the support set into the model, and continue to optimize the parameter by calculating the loss function, input the query set into the model as the test set, and predict the query set sample label.

[0111] The scheme of the embodiment of the application adopts the meta-learning algorithm to optimize the anomaly detection model, which can improve the generalization ability of the model in the small sample scene.

[0112] S105: Perform anomaly detection on the second log data collected by the API gateway in real time based on the first model.

[0113] It should be noted that the first model is independently deployed to the API gateway forwarding server without directly intervening in the operation of the gateway, and the model can be trained, established and optimized by using offline logs.

[0114] Figure 2 An exemplary API gateway anomaly detection system module provided by the embodiment of the application is schematically shown in the figure, Figure 2 The model includes an API gateway, a Kafka, an Elasticsearch (ES) log library, an anomaly detection artificial intelligence (AI) model, a real-time analysis distributed stream data engine (flink) service, a gateway (Apisix) rule configuration, an API calling party and an access route; the Kafka can collect logs of the API gateway, the anomaly detection AI model is independently deployed to the API gateway forwarding server, data in the Elasticsearch log library can be used for training and offline optimization, the real-time analysis flink service calls the anomaly detection AI model to detect the collected real-time logs, and the obtained detection structure is fed back to the API gateway, wherein the Apisix rule configuration can be used to cooperatively realize intelligent management and control of the gateway.

[0115] The scheme of the embodiment of the application trains a first model by using first log data and first feature information, realizes training of a detection model by using offline log data, the first feature information fuses first node data and second node data, the accuracy of the detection model can be improved, the first model is directly used for anomaly detection of API gateway data collected in real time, errors caused by dependence on manual detection are avoided, and the security of the API gateway system is improved.

[0116] Based on the above embodiment, the embodiment of the application provides an API gateway network flow anomaly detection method, Figure 3 An exemplary API gateway network flow anomaly detection flowchart is provided for the embodiment of the application; as shown in the figure, Figure 3

[0117] 1. Network dynamic relationship graph construction module: based on API gateway monitoring logs and metric learning refinement, a network dynamic relationship graph between application systems is constructed.

[0118] 2. Heterogeneous graph node embedding module based on graph neural network learning: a relationship-based graph convolutional neural network is used to learn graph structure features, and an attention neural network is used to learn time dimension features.

[0119] 3. Abnormal prediction module based on stacking: the prediction results of multiple single models are fused to improve the accuracy of abnormal prediction. ​

[0120] 4. The classification model optimization module based on meta-learning: The second layer prediction model of the integrated model is optimized based on the MAML meta-learning algorithm to improve the generalization ability of the model in small sample tasks.

[0121] 5. API gateway exception intelligent detection system module: independently deployed to the API gateway forwarding server to indirectly implement intelligent management and control of the network.

[0122] The embodiment of the application provides a detection device, Figure 4 A structural diagram of a detection device provided by the embodiment of the application is shown in the figure Figure 4 As shown in the figure, the detection device 400 comprises:

[0123] The construction unit 401 is configured to obtain first log data of the API gateway within a preset time, and construct a first call relationship based on the first log data;

[0124] The determination unit 402 is configured to obtain a second node related to the first node based on the first call relationship, and determine first node data corresponding to the first node and second node data corresponding to the second node;

[0125] The first feature information corresponding to the first node is determined according to the first node data and the second node data;

[0126] The training unit 403 is configured to train the first feature information and the first log data to obtain a first model;

[0127] The detection unit 404 is configured to perform anomaly detection on second log data collected in real time by the API gateway based on the first model.

[0128] Optionally, the construction unit 401 is further configured to determine parameter information corresponding to the first log data, construct a second call relationship based on the parameter information, obtain registration information of the API gateway, construct a third call relationship according to the registration information, and perform merging processing on the second call relationship and the third call relationship to obtain the first call relationship.

[0129] Optionally, the determination unit 402 is further configured to input the first node data and the second node data into a second model to obtain second feature information corresponding to the first node, and input the second feature information into a third model to obtain the first feature information.

[0130] Optionally, the training unit 403 is further configured to train at least one fourth model using the first feature information to obtain at least one training data, and train the first model based on the at least one training data and the first log data.

[0131] Optionally, the training unit 403 is further configured to determine abnormal data from the first log data, train the initial first model based on the abnormal data and the at least one training data to obtain a loss function, and update model parameters according to the loss function to obtain the first model.

[0132] Optionally, the training unit 403 is further configured to train the initial first model based on the at least one training data to obtain a trained first model, and train the trained first model based on the abnormal data to obtain the loss function.

[0133] The embodiment of the present application further provides a detection device, Figure 5 As shown in the structure diagram of the detection device provided in the embodiment of the present application, the detection device 500 comprises a processor 501 and a memory 503, and optionally, the detection device 500 can further comprise a communication bus 502. Figure 5 In the process of the specific embodiment, the processor 501 can be at least one of an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing image processing device (DSPD), a programmable logic image processing device (PLD), a field programmable gate array (FPGA), a CPU, a controller, a microcontroller, and a microprocessor. It can be understood that for different devices, the electronic device used to realize the function of the processor can also be other devices, and the embodiment is not limited specifically.

[0134] In the embodiment of the present application, the communication bus 502 is used to realize the connection and communication between the processor 501 and the memory 503; and the processor 501 realizes the following detection method when executing the running program stored in the memory 503.

[0135]

[0136] ​The API gateway acquires first log data within a preset time, constructs a first calling relationship based on the first log data, acquires a second node related to the first node based on the first calling relationship, and determines first node data corresponding to the first node and second node data corresponding to the second node; determines first feature information corresponding to the first node according to the first node data and the second node data; trains the first feature information and the first log data to obtain a first model; and performs anomaly detection on second log data collected in real time by the API gateway based on the first model.

[0137] Further, the processor 501 is further configured to determine parameter information corresponding to the first log data, construct a second calling relationship based on the parameter information, acquire registration information of the API gateway, construct a third calling relationship according to the registration information, and perform merging processing on the second calling relationship and the third calling relationship to obtain the first calling relationship.

[0138] The processor 501 is further configured to input the first node data and the second node data into a second model to obtain second feature information corresponding to the first node, and input the second feature information into a third model to obtain the first feature information.

[0139] The processor 501 is further configured to train at least one fourth model using the first feature information to obtain at least one training data, and train the first model based on the at least one training data and the first log data.

[0140] The processor 501 is further configured to determine abnormal data from the first log data, train an initial first model based on the abnormal data and the at least one training data to obtain a loss function, and perform model parameter updating according to the loss function to obtain the first model.

[0141] The embodiment of the present application provides a storage medium having a computer program stored thereon, the computer readable storage medium stores one or more programs, the one or more programs can be executed by one or more processors, and the computer program implements the detection method.

[0142] Based on the above embodiment, the embodiment of the present application provides a computer program product including a computer program, the computer program can be executed by one or more processors, and the computer program implements the detection method.

[0143] It should be noted that, in the present document, the terms "comprising", "containing" or any other variational thereon are intended to encompass non-exclusive inclusions, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element preceded by "comprises a... " does not, without further recitation, preclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0144] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, or optical disc) and includes a number of instructions for causing an image display device (which can be a mobile phone, computer, server, air conditioner, or network device) to perform the methods described in various embodiments of the present disclosure.

[0145] The above merely describes preferred embodiments of the present application, but is not intended to limit the scope of protection of the present application.

Claims

1. A method of detection, characterized in that, The method comprises: acquiring first log data of an application programming interface (API) gateway within a preset time, and constructing a first calling relationship based on the first log data; acquiring a second node related to a first node based on the first calling relationship, and determining first node data corresponding to the first node and second node data corresponding to the second node; determining first feature information corresponding to the first node according to the first node data and the second node data; training using the first feature information and the first log data to obtain a first model; performing anomaly detection on second log data collected in real time by the API gateway based on the first model; the first calling relationship is constructed based on the first log data, comprising: determining parameter information corresponding to the first log data; constructing a second calling relationship based on the parameter information; acquiring registration information of the API gateway, and constructing a third calling relationship according to the registration information; merging the second calling relationship and the third calling relationship to obtain the first calling relationship.

2. The method of claim 1, wherein, The first feature information corresponding to the first node is determined according to the first node data and the second node data, comprising: inputting the first node data and the second node data into a second model to obtain second feature information corresponding to the first node; inputting the second feature information into a third model to obtain the first feature information.

3. The method of claim 1, wherein, The first model is obtained by training using the first feature information and the first log data, comprising: training at least one fourth model using the first feature information to obtain at least one training data; training based on the at least one training data and the first log data to obtain the first model.

4. The method of claim 3, wherein, The first model is obtained by training based on the at least one training data and the first log data, comprising: determining abnormal data from the first log data; training an initial first model based on the abnormal data and the at least one training data to obtain a loss function; updating model parameters according to the loss function to obtain the first model.

5. The method of claim 4, wherein, The loss function is obtained by training the initial first model based on the abnormal data and the at least one training data, comprising: training the initial first model based on the at least one training data to obtain a trained first model; training the trained first model based on the abnormal data to obtain the loss function.

6. A detection device characterized by comprising: The device comprises: a construction unit configured to acquire first log data of an API gateway within a preset time, and construct a first calling relationship based on the first log data; a determination unit configured to acquire a second node related to a first node based on the first calling relationship, and determine first node data corresponding to the first node and second node data corresponding to the second node; and determine first feature information corresponding to the first node according to the first node data and the second node data; a training unit configured to train using the first feature information and the first log data to obtain a first model; The detection unit is configured to perform anomaly detection on second log data collected by the API gateway in real time based on the first model. The construction unit is further configured to determine parameter information corresponding to the first log data, construct a second calling relationship based on the parameter information, acquire registration information of the API gateway, construct a third calling relationship according to the registration information, and perform merging processing on the second calling relationship and the third calling relationship to obtain the first calling relationship.

7. A detection device, characterized by Computer program comprising a memory, a processor and a computer program stored on the memory and loadable into the processor, the processor implementing the steps of the method according to any one of claims 1 to 5 when executing the program.

8. A storage medium having stored thereon a computer program, characterized in that The computer program implements the steps of the method according to any one of claims 1 to 5 when executed by the processor.

9. A computer program product comprising a computer program, characterized in that, The computer program implements the steps of the method according to any one of claims 1 to 5 when executed by the processor. The computer program implements the steps of the method according to any one of claims 1 to 5 when executed by the processor.

Images