Shadow API interface detection method and device, server, medium and product

Abstract

Embodiments of the present application provide a shadow API interface detection method and device, a server, a medium and a product. The method comprises: receiving an API interface document sent by a management terminal; obtaining all API interfaces in network traffic data; forming a plurality of API interface baselines according to the API interface document and all API interfaces; inputting any API interface baseline into a trained large language model to output a plurality of API interfaces corresponding to any API interface baseline; determining a plurality of to-be-detected API interfaces according to the network traffic data and the plurality of API interfaces; constructing a request body of each to-be-detected API interface and sending the request body of each to-be-detected API interface to each to-be-detected API interface to obtain a response result; wherein the response result contains a status code; if it is determined that the status code exists in a preset status code set, each to-be-detected API interface corresponding to the status code is determined as a shadow API interface. The method is used to improve the efficiency and accuracy of detecting shadow API interfaces.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to a shadow API interface detection method and device, a server, a medium and a product. BACKGROUND

[0002] A shadow API (Application Programming Interface, application programming interface) refers to an application programming interface that is not officially documented, unofficially released or not publicly disclosed. During the software development process, developers may create temporary API interfaces to test functions, and these API interfaces may not be cleaned up after the project is completed, thereby becoming shadow API interfaces. These shadow API interfaces not only consume resources, but also may introduce security risks.

[0003] Currently, the prior art detects shadow API interfaces in a code library through a manual code audit method.

[0004] However, for large and complex applications, as the code is frequently changed and updated, manual code audits may not cover all code libraries, and shadow API interfaces that are not explicitly indicated in code comments or documents cannot be discovered through manual code audits, resulting in reduced efficiency and accuracy of detecting shadow API interfaces. SUMMARY

[0005] The embodiments of the present application provide a shadow API interface detection method, device, server, medium and product to improve the efficiency and accuracy of detecting shadow API interfaces.

[0006] In a first aspect, the embodiments of the present application provide a shadow API interface detection method, comprising: receiving an API interface document sent by a management terminal; capturing network traffic data and obtaining all API interfaces in the network traffic data; forming a plurality of API interface baselines according to the API interface document and the all API interfaces; inputting any API interface baseline into a trained large language model to output a plurality of API interfaces corresponding to the any API interface baseline; determining a plurality of to-be-detected API interfaces according to the network traffic data and the plurality of API interfaces; constructing a request body of each to-be-detected API interface and sending the request body of each to-be-detected API interface to each to-be-detected API interface to obtain a response result; wherein the response result contains a status code; determining whether the status code exists in a preset status code set; if it is determined that the status code exists in the preset status code set, determining each to-be-detected API interface corresponding to the status code as a shadow API interface.

[0007] In a possible implementation, after the plurality of API interface baselines are formed, the method further includes: obtaining API specification interface naming information and an API specification interface naming example set; taking the API specification interface naming information and the API specification interface naming example set as a first specification interface naming training set; obtaining a second specification interface naming training set according to the API interface document and all API interfaces; performing specification interface naming training on the first large language model according to the first specification interface naming training set and the second specification interface naming training set, to obtain a second large language model; obtaining a dynamic parameter training set according to the API interface document and all API interfaces; and performing dynamic parameter training on the second large language model according to the dynamic parameter training set, to obtain the trained large language model.

[0008] In a possible implementation, the plurality of API interface baselines are formed according to the API interface document and all API interfaces, including: performing deduplication on all API interfaces to obtain a plurality of deduplicated API interfaces; and merging the API interface document with the same API interfaces in the plurality of deduplicated API interfaces to form the plurality of API interface baselines.

[0009] In a possible implementation, the plurality of API interfaces include a plurality of API interfaces containing dynamic parameters and a plurality of API interfaces not containing dynamic parameters; and accordingly, the plurality of API interfaces to be detected are determined according to the network traffic data and the plurality of API interfaces, including: obtaining, from the network traffic data, dynamic parameter values corresponding to the dynamic parameters in each API interface containing dynamic parameters; replacing the dynamic parameters in each API interface containing dynamic parameters with the dynamic parameter values to obtain each API interface in which a dynamic parameter value exists; and determining all API interfaces in which a dynamic parameter value exists and the plurality of API interfaces not containing dynamic parameters as the plurality of API interfaces to be detected.

[0010] In a possible implementation, after the API interfaces to be detected corresponding to the status codes are determined as shadow API interfaces, the method further includes: saving all shadow API interfaces to a shadow API interface management account; and sending the shadow API interface management account to an operation and maintenance terminal, so that the operation and maintenance terminal performs management according to the shadow API interface management account.

[0011] In a second aspect, an embodiment of the present application provides a shadow API interface detection device, including:

[0012] The receiving module is configured to receive the API interface document sent by the management terminal.

[0013] The capturing module is configured to capture network traffic data and obtain all API interfaces in the network traffic data.

[0014] The acquisition module is configured to form a plurality of API interface baselines according to the API interface document and all API interfaces.

[0015] The output module is configured to input any API interface baseline into the trained large language model to output a plurality of API interfaces corresponding to the any API interface baseline.

[0016] The determination module is configured to determine a plurality of to-be-detected API interfaces according to the network traffic data and the plurality of API interfaces.

[0017] The construction module is configured to construct a request body of each to-be-detected API interface, and send the request body of each to-be-detected API interface to the to-be-detected API interface to obtain a response result; wherein the response result contains a status code.

[0018] The judgment module is configured to judge whether the status code exists in a preset status code set.

[0019] The determination module is configured to determine each to-be-detected API interface corresponding to the status code as a shadow API interface if it is determined that the status code exists in the preset status code set.

[0020] In a possible implementation, the device further includes a training module configured to acquire API specification interface naming information and an API specification interface naming example set; take the API specification interface naming information and the API specification interface naming example set as a first specification interface naming training set; acquire a second specification interface naming training set according to the API interface document and all API interfaces; perform training of specification interface naming on a first large language model according to the first specification interface naming training set and the second specification interface naming training set to obtain a second large language model; acquire a dynamic parameter training set according to the API interface document and all API interfaces; perform training of dynamic parameters on the second large language model according to the dynamic parameter training set to obtain the trained large language model.

[0021] In a third aspect, an embodiment of the present application provides a server, including: a memory, a processor;

[0022] The memory stores computer execution instructions.

[0023] The processor executes the computer execution instructions stored in the memory, so that the processor executes the first aspect and / or various possible implementation manners of the first aspect.

[0024] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect.

[0025] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program which, when executed by a processor, implements the first aspect and / or various possible implementation manners of the first aspect.

[0026] The shadow API interface detection method, device, server, medium and product provided by the embodiments of the present application. All API interfaces in network traffic data are obtained, and an API interface baseline is formed according to API interface documents and all API interfaces. A plurality of API interfaces of any API interface baseline are obtained by using a trained large language model, and then a plurality of to-be-detected API interfaces are obtained. The request body of each to-be-detected API interface is sent to each to-be-detected API interface, and a response result is obtained. If it is determined that the status code in the response result exists in a preset status code set, each to-be-detected API interface corresponding to the status code is determined as a shadow API interface. Even if the code is frequently changed and updated, all code libraries can be covered through network traffic data. With the help of the trained large language model, each to-be-detected API interface is obtained, and whether it is a shadow API interface is determined according to the status code, without the help of code annotations or shadow API interfaces explicitly indicated in the document, thereby improving the efficiency and accuracy of detecting shadow API interfaces. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application.

[0028] Figure 1 A scene schematic diagram of the shadow API interface detection method provided by the embodiments of the present application;

[0029] Figure 2 A flowchart of the shadow API interface detection method provided by the embodiments of the present application;

[0030] Figure 3 A structure schematic diagram of the shadow API interface detection device provided by the embodiments of the present application;

[0031] Figure 4 A structure schematic diagram of the server provided by the embodiments of the present application.

[0032] Through the above-described drawings, the specific embodiments of the present application have been shown, and more detailed descriptions will be given hereinafter. These drawings and textual descriptions are not intended to limit the scope of the concept of the present application by any means, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0033] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, like reference numerals refer to like elements, unless indicated otherwise. The following exemplary embodiments described herein represent the best currently known way of implementing aspects of the application. However, natural variations and equivalents that are well-known to those having ordinary skill in the art are encompassed by the present application. Furthermore, the exemplary embodiments described herein are merely examples not limiting, and the scope of the application is not to be determined by the embodiments described herein and the drawings.

[0034] Figure 1 The scene schematic diagram of the detection method of the shadow API interface provided by the embodiments of the present application is shown in FIG. 1, and the specific application scenarios of the present application include a management device 101, a server 102 and an operation and maintenance terminal 103. Figure 1

[0035] Referring to FIG. 1, the management terminal 101 sends an API interface document to the server 102; the server 102 captures network traffic data and obtains all API interfaces in the network traffic data; the server 102 forms a plurality of API interface baselines according to the API interface document and all API interfaces; inputs any API interface baseline into a trained large language model to output a plurality of API interfaces corresponding to any API interface baseline, thereby determining a plurality of to-be-detected API interfaces; constructs a request body of each to-be-detected API interface and sends the request body of each to-be-detected API interface to each to-be-detected API interface to obtain a response result; if a status code in the response result exists in a preset status code set, each to-be-detected API interface corresponding to the status code is determined as a shadow API interface. The server 102 sends all shadow API interfaces to the operation and maintenance terminal 103 for management. Figure 1 A shadow API (Application Programming Interface) refers to an application programming interface that is not officially documented, not officially released or not disclosed. During the software development process, developers may create temporary API interfaces to test functions, and these API interfaces may not be cleaned up after the project is completed, thereby becoming shadow API interfaces. These shadow API interfaces not only consume resources, but also may introduce security risks. Currently, the prior art detects shadow API interfaces in a code library through manual code auditing. However, for large and complex applications, with frequent changes and updates to the code, manual code auditing may not cover all code libraries, and shadow APIs that are not explicitly indicated in code comments or documents cannot be discovered through manual code auditing, resulting in reduced efficiency and accuracy of detecting shadow API interfaces.

[0036]

[0037] ​​To solve the above technical problems, the embodiment of the present application proposes the following technical idea: all API interfaces in network traffic data are acquired, API interface baselines are formed according to API interface documents and all API interfaces, a plurality of API interfaces of any API interface baseline are acquired by using a trained large language model, and then a plurality of to-be-detected API interfaces are obtained; the request body of each to-be-detected API interface is sent to each to-be-detected API interface, and a response result is obtained; if it is determined that the status code in the response result exists in a preset status code set, each to-be-detected API interface corresponding to the status code is determined as a shadow API interface. Even if the code is frequently changed and updated, all code libraries can be covered through network traffic data; by means of the trained large language model, each to-be-detected API interface is acquired, and whether it is a shadow API interface is determined according to the status code, without the aid of code annotations or shadow API interfaces explicitly indicated in the document, so that the efficiency and accuracy of detecting shadow API interfaces are improved.

[0038] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0039] Figure 2 The flowchart of the shadow API interface detection method provided by the embodiment of the present application is shown as Figure 2 The method comprises the following steps.

[0040] S201: receiving API interface documents sent by a management terminal.

[0041] The management terminal exports all disclosed and legal API interface documents from an existing API interface management system, including HTTP methods, request paths, request body templates and response body examples.

[0042] S202: capturing network traffic data and acquiring all API interfaces in the network traffic data.

[0043] Specifically, a tool is used to capture network traffic data, HTTP requests are filtered from the captured network traffic data, the paths, methods, parameters and response bodies of the requests are checked, and API interfaces in the network traffic data are identified and acquired.

[0044] Optionally, the network traffic data can be captured by a network packet capturing tool, API gateway logs and application server access logs.

[0045] S203: forming a plurality of API interface baselines according to API interface documents and all API interfaces.

[0046] wherein, the API interface baseline refers to a known, legitimate API interface call pattern, including but not limited to API interface HTTP method, request path, request body, and response body, etc.

[0047] Specifically, all API interfaces are de-duplicated to obtain a plurality of de-duplicated API interfaces; the API interface document is merged with the same API interface in the plurality of de-duplicated API interfaces to form a plurality of API interface baselines.

[0048] Specifically, the API interfaces existing in the API interface document and the plurality of de-duplicated API interfaces are merged.

[0049] Exemplarily, the baseline API interface is:

[0050] Interface name: List Devices

[0051] Application: console-dmp.cuiot.cn

[0052] Interface: / dmp-web / dmp-device / device / listDevices

[0053] Request method: GET

[0054] Interface description: Get device list

[0055] Request parameters:

[0056] • page (optional, int): page number, default is 1.

[0057] • size (optional, int): number of devices displayed per page, default is 10

[0058] • status (optional, string): device status, such as "online", "offline", default is to query all states.

[0059] Request header:

[0060] • Content-Type: application / json

[0061] Optionally, new API interfaces can be added and old API interfaces can be abandoned. Therefore, it is necessary to update the API interface baseline regularly to ensure its accuracy and integrity.

[0062] S204: input any API interface baseline into the trained large language model to output a plurality of API interfaces corresponding to any API interface baseline.

[0063] Optionally, the trained Large Language Model (LLM) infers any API interface baseline from the aspects of interface request mode, interface naming mode and structure, business logic relationship and version number, etc., to output multiple API interfaces.

[0064] Illustratively, for the API interface baseline "GET / dmp-web / dmp-device / device / get", the trained Large Language Model infers other possible HTTP operations such as POST, PUT and DELETE, etc., such as:

[0065] Create device: POST / dmp-web / dmp-device / device / create

[0066] Device login: POST / dmp-web / dmp-device / device / login

[0067] Device logout: POST / dmp-web / dmp-device / device / logout

[0068] Active device: GET / dmp-web / dmp-device / device / active

[0069] Inactive device: GET / dmp-web / dmp-device / device / inactive

[0070] Device list v1: / v1 / dmp-web / dmp-device / device / listDevices

[0071] Device list v2: / v2 / dmp-web / dmp-device / device / listDevices

[0072] Device command:

[0073] GET / dmp-web / dmp-device / device / {DeviceKey} / commands

[0074] Device log: GET / dmp-web / dmp-device / device / {DeviceKey} / logs

[0075] Filter devices by organization:

[0076] GET / dmp-web / dmp-device / device?org={orgName}

[0077] Search for a device by name:

[0078] GET / dmp-web / dmp-device / device?search={DeviceName}

[0079] In this embodiment, assuming v2 is the current version, then v1 and earlier versions can be shadow API interfaces, such as:

[0080] v1 device list: / v1 / dmp-web / dmp-device / device / listDevices

[0081] v0.1 device creation: POST / v0.1 / dmp-web / dmp-device / device

[0082] v0.2 device update:

[0083] PUT / v0.2 / dmp-web / dmp-device / device / {DeviceKey}

[0084] v0.3 device deletion:

[0085] DELETE / v0.3 / dmp-web / dmp-device / device / {DeviceKey}

[0086] S205: Determine a plurality of to-be-detected API interfaces according to network traffic data and the plurality of API interfaces.

[0087] Among the plurality of API interfaces, a plurality of API interfaces containing dynamic parameters and a plurality of API interfaces not containing dynamic parameters are included.

[0088] Specifically, step S205 includes S2051-S2053:

[0089] S2051: Obtain, from the network traffic data, dynamic parameter values corresponding to dynamic parameters in each API interface containing dynamic parameters.

[0090] Exemplarily, the dynamic parameter in "GET / dmp-web / dmp-device / device / {DeviceKey} / logs" is {DeviceKey}, the real value of {DeviceKey} is obtained from the network traffic data, such as A123456789, and a dynamic parameter set {DeviceKey}={A123456789, B123456789, C123456789} is generated as the dynamic parameter value of the dynamic parameter according to A123456789.

[0091] S2052: Replace the dynamic parameter in each API interface containing the dynamic parameter with the dynamic parameter value to obtain each API interface in which the dynamic parameter value exists.

[0092] Exemplarily, each API interface in which the dynamic parameter value exists is as follows:

[0093] GET / dmp-web / dmp-device / device / A123456789 / logs

[0094] GET / dmp-web / dmp-device / device / B123456789 / logs

[0095] GET / dmp-web / dmp-device / device / C123456789 / logs

[0096] S2053: Determine all API interfaces in which the dynamic parameter value exists and a plurality of API interfaces not containing the dynamic parameter as a plurality of to-be-detected API interfaces.

[0097] S206: Construct the request body of each to-be-detected API interface, and send the request body of each to-be-detected API interface to each to-be-detected API interface to obtain a response result; wherein the response result contains a status code.

[0098] In this embodiment, the construction process includes necessary HTTP methods, URL paths, request headers, and request bodies. Alternatively, the request body can be constructed by a command, such as a curl command.

[0099] S207: Determine whether the status code exists in a preset status code set.

[0100] S208: If it is determined that the status code exists in the preset status code set, determine each to-be-detected API interface corresponding to the status code as a shadow API interface.

[0101] Specifically, the status codes in the preset status code set include 200, 201, 202, 204, 301, 302, 304, and 405.

[0102] Wherein, 200 represents that the request has been successful, and the desired response of the request has been presented in the body; 201 represents that a new resource has been created through a POST or PUT request; 202 represents that the request has been accepted but not yet processed completely, which does not mean that the request has been successful, but at least confirms that the API interface is valid; 204 has successfully processed the request, but has not returned any content; 301 and 302 represent that the resource has been moved to a new location, but both status codes indicate that the original URL once existed and can now be found through the URL in the Location header; 304 represents that when using conditional GET, such as with If-Modified-Since or If-None-Match headers, if the resource has not been modified since the last request, this status code will be returned. This also indicates that the API interface exists; 405 represents that the API interface exists, but the method of the HTTP request is not allowed, and the returned status code is 405, which also indicates that the API exists.

[0103] In summary, all API interfaces in network traffic data are obtained, and an API interface baseline is formed according to API interface documents and all API interfaces. A plurality of API interfaces of any API interface baseline are obtained by using a trained large language model, and a plurality of to-be-detected API interfaces are obtained. The request body of each to-be-detected API interface is sent to each to-be-detected API interface, and a response result is obtained. If it is determined that the status code in the response result exists in a preset status code set, each to-be-detected API interface corresponding to the status code is determined as a shadow API interface. Even if the code is frequently changed and updated, all code libraries can be covered through network traffic data. By means of the trained large language model, each to-be-detected API interface is obtained, and whether it is a shadow API interface is determined according to the status code, without the aid of code annotations or shadow API interfaces explicitly indicated in the documents, thereby improving the efficiency and accuracy of detecting shadow API interfaces.

[0104] On the basis of the above-mentioned embodiments, all shadow API interfaces are saved to a shadow API interface management account book, and the shadow API interface management account book is sent to an operation and maintenance terminal, so that the operation and maintenance terminal manages according to the shadow API interface management account book.

[0105] Specifically, the shadow API interface can be sent by a wireless communication mode, or the shadow API interface can be sent by a wired communication mode.

[0106] In summary, the confirmed shadow API interfaces are saved to the shadow API interface management account book, dynamic updating is realized, the workload of manual maintenance is reduced, and the comprehensiveness and real-time performance of the shadow API interfaces are ensured.

[0107] Based on the above embodiments, this embodiment describes the process of training a large language model, as detailed below:

[0108] S301: Obtain API specification interface naming information and API specification interface naming example set.

[0109] Optionally, obtain RESTful specification interface naming information and a set of RESTful specification interface naming examples.

[0110] S302: Use the API specification interface naming information and the API specification interface naming example set as the first specification interface naming training set.

[0111] S303: Based on the API interface documentation and all API interfaces, obtain the training set for the second specification interface naming.

[0112] Specifically, based on the API interface documentation and all API interfaces, a large number of API interface naming examples and corresponding descriptions or functional specifications are obtained as a training set for the second specification interface naming.

[0113] S304: Based on the first and second standardized interface naming training sets, train the first language model using standardized interface naming to obtain the second language model.

[0114] In this embodiment, the rules for training through the first specification interface naming mainly include:

[0115] a. Use nouns to represent resources, and use plural nouns to represent resource collections, such as / users representing a collection of user resources. Individual resources are accessed by ID, such as / users / {userId}.

[0116] b. Avoid using verbs in the interface, and instead use HTTP methods to express operations on resources, such as GET for reading, POST for creating, PUT or PATCH for updating, and DELETE for deleting.

[0117] S305: Obtain the dynamic parameter training set based on the API interface documentation and all API interfaces.

[0118] Specifically, by utilizing the API interface documentation and all API interfaces, we identify dynamic parameters, obtain their commonalities and patterns of change, such as whether the dynamic parameters are related to timestamps, user identities or session IDs, or operation or data IDs, and use these dynamic parameters as a training set.

[0119] S306: Based on the dynamic parameter training set, train the dynamic parameters of the second large language model to obtain a trained large language model.

[0120] In summary, by performing standardized interface naming and dynamic parameter training, a model for inferring API interface baselines is established, and multiple API interfaces corresponding to each API interface baseline are output, providing data support for subsequent shadow API interface detection and management.

[0121] Figure 3 The structure diagram of the shadow API interface detection device provided by the embodiment of the application is shown in Figure 3 The shadow API interface detection device provided by the embodiment of the application includes a receiving module 301, a capturing module 302, an obtaining module 303, an output module 304, a determining module 305, a constructing module 306, a judging module 307, and a determining module 308.

[0122] The receiving module 301 is configured to receive an API interface document sent by a management terminal.

[0123] The capturing module 302 is configured to capture network traffic data and obtain all API interfaces in the network traffic data.

[0124] The obtaining module 303 is configured to form multiple API interface baselines according to the API interface document and the all API interfaces.

[0125] The output module 304 is configured to input any API interface baseline into a trained large language model to output multiple API interfaces corresponding to the any API interface baseline.

[0126] The determining module 305 is configured to determine multiple to-be-detected API interfaces according to the network traffic data and the multiple API interfaces.

[0127] The constructing module 306 is configured to construct a request body of each to-be-detected API interface, send the request body of each to-be-detected API interface to each to-be-detected API interface, and obtain a response result, wherein the response result includes a status code.

[0128] The judging module 307 is configured to determine whether the status code exists in a preset status code set.

[0129] The determining module 308 is configured to determine each to-be-detected API interface corresponding to the status code as a shadow API interface if the status code exists in the preset status code set.

[0130] In a possible implementation, the detection apparatus of the shadow API interface further includes a training module configured to: acquire API specification interface naming information and an API specification interface naming example set; take the API specification interface naming information and the API specification interface naming example set as a first specification interface naming training set; acquire a second specification interface naming training set according to API interface documents and all API interfaces; perform specification interface naming training on the first large language model according to the first specification interface naming training set and the second specification interface naming training set, to obtain a second large language model; acquire a dynamic parameter training set according to the API interface documents and all API interfaces; and perform dynamic parameter training on the second large language model according to the dynamic parameter training set, to obtain the trained large language model.

[0131] In a possible implementation, the acquisition module 303 is specifically configured to: perform deduplication on all API interfaces, to obtain a plurality of deduplicated API interfaces; and merge the API interface documents with the same API interfaces in the plurality of deduplicated API interfaces, to form a plurality of API interface baselines

[0132] In a possible implementation, the plurality of API interfaces include a plurality of API interfaces containing dynamic parameters and a plurality of API interfaces not containing dynamic parameters; accordingly, the determination module 305 is specifically configured to: acquire, from the network traffic data, dynamic parameter values corresponding to the dynamic parameters in each API interface containing dynamic parameters; replace the dynamic parameters in each API interface containing dynamic parameters with the dynamic parameter values, to obtain each API interface in which the dynamic parameter values exist; and determine, as the plurality of API interfaces to be detected, all API interfaces in which the dynamic parameter values exist and the plurality of API interfaces not containing dynamic parameters

[0133] In a possible implementation, the detection apparatus of the shadow API interface further includes a sending module configured to: save all shadow API interfaces to a shadow API interface management account; and send the shadow API interface management account to an operation and maintenance terminal, to enable the operation and maintenance terminal to perform management according to the shadow API interface management account.

[0134] The detection apparatus of the shadow API interface provided in this embodiment can perform the method provided in the method embodiments, and has similar implementation principles and technical effects, which will not be described here in detail.

[0135] Figure 4 A structural diagram of a server provided in an embodiment of the present application is shown in FIG. 4. As shown in FIG. 4, the server provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 40 further includes a communication component 403. The processor 401, the memory 402, and the communication component 403 are connected through a bus 404. Figure 4 ​

[0136] In the implementation process, the at least one processor 401 executes the computer execution instructions stored in the memory 402, so that the at least one processor 401 executes the above-mentioned method.

[0137] The specific implementation process of the processor 401 can refer to the method embodiments described above, which have similar implementation principles and technical effects, and will not be described here in detail.

[0138] In the above embodiments, it should be understood that the processor can be a central processing unit (English: Central Processing Unit, for short: CPU), and can also be other general-purpose processors, digital signal processors (English: Digital Signal Processor, for short: DSP), application specific integrated circuits (English: Application Specific Integrated Circuit, for short: ASIC), etc. The general-purpose processor can be a microprocessor, or the processor can also be any conventional processor, etc. The steps of the method disclosed in combination with the application can be directly embodied as hardware processor execution, or executed by hardware and software modules in the processor.

[0139] The memory can include a random access memory (Random Access Memory, RAM), and can also include a non-volatile memory (Non-volatile Memory, NVM), for example, at least one disk memory.

[0140] The bus can be an industry standard architecture (Industry Standard Architecture, ISA) bus, a peripheral component interconnect (Peripheral Component, PCI) bus, or an extended industry standard architecture (Extended Industry Standard Architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, the bus in the drawings of the present application does not limit only one bus or one type of bus.

[0141] The present application also provides a computer program product, comprising a computer program, which is executed by a processor to implement the above-mentioned method.

[0142] The present application also provides a computer readable storage medium, which stores computer execution instructions, and when the processor executes the computer execution instructions, the above-mentioned method is implemented.

[0143] The above-mentioned readable storage medium can be realized by any type of volatile or nonvolatile storage devices or their combinations, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0144] An exemplary readable storage medium is coupled to the processor, so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0145] The division of units is only a logical functional division, and in actual implementation, there can be another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0146] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment.

[0147] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0148] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the technical solutions that essentially contribute to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the method of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0149] It can be understood by those skilled in the art that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware. The aforementioned program can be stored in a computer readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, and various media that can store program codes.

[0150] Finally, it should be noted that: those skilled in the art will easily think of other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application that follow the general principles of the present application and include common knowledge or conventional technical means in the art that are not disclosed in the present application, and is not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is only limited by the appended claims.

Claims

1. A method for detecting a shadow API interface, the method comprising: Applied to a server, comprising: receiving an API interface document sent by a management terminal; capturing network traffic data and obtaining all API interfaces in the network traffic data; forming a plurality of API interface baselines according to the API interface document and the all API interfaces; inputting any API interface baseline into a trained large language model to output a plurality of API interfaces corresponding to the any API interface baseline; determining a plurality of to-be-detected API interfaces according to the network traffic data and the plurality of API interfaces; constructing a request body of each to-be-detected API interface and sending the request body of each to-be-detected API interface to the each to-be-detected API interface to obtain a response result; wherein the response result contains a status code; determining whether the status code exists in a preset status code set; if it is determined that the status code exists in the preset status code set, determining each to-be-detected API interface corresponding to the status code as a shadow API interface.

2. The method of claim 1, wherein, After the plurality of API interface baselines are formed, further comprising: obtaining API specification interface naming information and an API specification interface naming example set; taking the API specification interface naming information and the API specification interface naming example set as a first specification interface naming training set; obtaining a second specification interface naming training set according to the API interface document and the all API interfaces; training a first large language model for specification interface naming according to the first specification interface naming training set and the second specification interface naming training set to obtain a second large language model; obtaining a dynamic parameter training set according to the API interface document and the all API interfaces; training the second large language model for dynamic parameters to obtain a trained large language model.

3. The method of claim 1, wherein, The plurality of API interfaces include a plurality of API interfaces containing dynamic parameters and a plurality of API interfaces not containing dynamic parameters; Accordingly, the plurality of to-be-detected API interfaces are determined according to the network traffic data and the plurality of API interfaces, comprising: obtaining dynamic parameter values corresponding to dynamic parameters in each API interface containing dynamic parameters from the network traffic data; 4. The method of claim 1, wherein, replacing the dynamic parameters in the each API interface containing dynamic parameters with the dynamic parameter values to obtain each API interface with a dynamic parameter value; determining all API interfaces with dynamic parameter values and the plurality of API interfaces not containing dynamic parameters as the plurality of to-be-detected API interfaces. After the each to-be-detected API interface corresponding to the status code is determined as a shadow API interface, further comprising: saving all shadow API interfaces to a shadow API interface management account; ​ 5. The method according to any one of claims 1 to 4, characterized in that, ​ ​ The shadow API interface management account is sent to an operation and maintenance terminal, so that the operation and maintenance terminal manages according to the shadow API interface management account.

6. A detection apparatus of a shadow API interface, characterized by, Applied to a server, comprising: A receiving module is configured to receive an API interface document sent by a management terminal; A capturing module is configured to capture network traffic data and obtain all API interfaces in the network traffic data; An obtaining module is configured to form a plurality of API interface baselines according to the API interface document and the all API interfaces; An output module is configured to input any API interface baseline into a trained large language model to output a plurality of API interfaces corresponding to the any API interface baseline; A determining module is configured to determine a plurality of to-be-detected API interfaces according to the network traffic data and the plurality of API interfaces; A constructing module is configured to construct a request body of each to-be-detected API interface and send the request body of the each to-be-detected API interface to the each to-be-detected API interface to obtain a response result; wherein the response result contains a status code; A judging module is configured to judge whether the status code exists in a preset status code set; A determining module is configured to determine each to-be-detected API interface corresponding to the status code as a shadow API interface if it is determined that the status code exists in the preset status code set.

7. The apparatus of claim 6, wherein, The device further comprises a training module configured to obtain API specification interface naming information and an API specification interface naming example set; and take the API specification interface naming information and the API specification interface naming example set as a first specification interface naming training set; obtain a second specification interface naming training set according to the API interface document and the all API interfaces; train a first large language model for specification interface naming to obtain a second large language model according to the first specification interface naming training set and the second specification interface naming training set; obtain a dynamic parameter training set according to the API interface document and the all API interfaces; and train the second large language model for dynamic parameters to obtain the trained large language model.

8. A server, characterized by Comprise: A memory and a processor; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory, so that the processor executes the method of any one of claims 1-5.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method of any one of claims 1-5.

10. A computer program product, characterised in that, The computer program is executed by the processor to implement the method of any one of claims 1-5.

Images