Interface data security monitoring method and device, storage medium and electronic equipment

Abstract

The invention relates to the technical field of data security, in particular to an interface data security monitoring method and device, a storage medium and electronic equipment, and the method comprises the steps: scanning a dynamic interface and a static interface in a data platform, and recognizing to obtain a target interaction interface; inputting the data transmitted in the target interaction interface into a sensitive data identification model to obtain sensitive data in the sensitive data identification model; and performing real-time anomaly analysis on the interface access behavior corresponding to the sensitive data, identifying an abnormal access behavior, and giving an alarm. According to the invention, through combination of an automatic tool and the hybrid neural network model, comprehensive monitoring of interface data and accurate identification of sensitive data are realized, the security of the data center is enhanced, and potential security threats are warned in time through real-time monitoring and anomaly detection.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and specifically to an interface data security monitoring method, device, storage medium and electronic equipment. Background Art

[0002] In the existing technology, the interface security monitoring methods of the data center usually rely on traditional rule matching and signature detection technologies. These methods identify and filter potential security threats through predefined security rules and signature libraries. In addition, protocol analysis and traffic monitoring technologies are also widely used to parse data transmission protocols and monitor network traffic in order to detect abnormal behaviors in a timely manner.

[0003] However, existing technologies have certain limitations when dealing with complex and changing network environments. First, rule matching and signature detection methods rely on predefined rules and feature libraries, which are difficult to deal with new and unknown attacks. Second, traditional monitoring technologies often fail to provide real-time and comprehensive security protection, especially when dealing with a large number of dynamic data interfaces, which are prone to missed and misidentified situations. In addition, existing technologies lack accurate identification and protection of sensitive data, and cannot effectively prevent data leakage and illegal access. Summary of the invention

[0004] The present invention provides an interface data security monitoring method, device, storage medium and electronic device, which overcome the deficiencies of the above-mentioned prior art and can effectively solve the problems of low accuracy in identifying abnormal access behaviors, and prone to missed identification and false alarms in the existing interface data security monitoring methods.

[0005] One of the technical solutions of the present invention is achieved by the following measures: a method for monitoring interface data security, comprising:

[0006] Scan the dynamic and static interfaces in the data center to identify the target interactive interface;

[0007] Input the data transmitted in the target interactive interface into the sensitive data recognition model to obtain the sensitive data therein, wherein the sensitive data recognition model is obtained by training a hybrid neural network model using a number of samples containing sensitive data and non-sensitive data, and the hybrid neural network model includes a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction;

[0008] Conduct real-time anomaly analysis on interface access behaviors corresponding to sensitive data, identify abnormal access behaviors, and issue alarms.

[0009] The following are further optimizations and / or improvements to the above technical solutions:

[0010] The dynamic and static interfaces in the platform are scanned in the above data, and the target interactive interface is identified, including:

[0011] Choose an automation tool and load a library of predefined rules and patterns;

[0012] Use automated tools to scan interfaces within the data center;

[0013] Analyze the captured data packets based on protocol analysis technology to identify the key information of each data packet, including source address, destination address, transmission protocol type, and data content;

[0014] Capture and analyze network traffic based on traffic monitoring technology to obtain the traffic pattern of each data packet;

[0015] Perform pattern matching on each data packet of the interface based on predefined rules and pattern libraries, and if the predefined rules and patterns are met, mark the interface as a target interaction interface;

[0016] Repeat the above steps until all interfaces in the data center are traversed using automated tools.

[0017] The above hybrid neural network model includes:

[0018] Input layer, obtains data from the target interactive interface;

[0019] The position encoding module receives the output of the input layer, encodes the character position of the data, and generates a position encoding vector;

[0020] The multi-scale convolution feature extraction module uses a multi-layer convolutional neural network with different convolution kernel sizes to process the position encoding vector and generate a multi-scale feature vector;

[0021] The time series feature extraction module uses a bidirectional long short-term memory network to process multi-scale feature vectors and generate time series feature vectors;

[0022] The self-attention aggregation module uses the self-attention mechanism to perform weighted processing on the time series feature vector to generate an aggregated feature vector;

[0023] The cross-feature fusion module uses the tensor decomposition network to cross-fuse different feature dimensions in the aggregated feature vector to generate a high-dimensional fused feature vector;

[0024] The classification module classifies the data based on the high-dimensional fusion feature vector and outputs the identification results of sensitive data.

[0025] The above-mentioned real-time abnormal analysis of the interface access behavior corresponding to sensitive data, identification of abnormal access behavior, and alarming include:

[0026] Obtain interface access behavior data including sensitive data;

[0027] The density-based anomaly detection method is used to determine the data density of each interface access behavior data, and potential abnormal behavior data is screened according to the preset density threshold;

[0028] Isolation forest algorithm is used to identify abnormal access behaviors in potential abnormal behavior data;

[0029] Provide early warning and record of abnormal access behavior.

[0030] The above-mentioned real-time abnormal analysis of the interface access behavior corresponding to sensitive data, identification of abnormal access behavior, and alarming include:

[0031] Obtain interface access behavior data including sensitive data and pre-process it;

[0032] Determine the feature type and extract the corresponding feature value from the interface access behavior data including sensitive data;

[0033] The feature value is scored as a difference from the feature mean of normal behavior;

[0034] The difference scoring result is compared with the difference threshold. In response to the difference being greater than the difference threshold, the corresponding interface access behavior is marked as abnormal access behavior and an alarm is issued.

[0035] The second technical solution of the present invention is achieved by the following measures: an interface data security monitoring device, comprising:

[0036] An interface scanning unit scans the dynamic interfaces and static interfaces in the data center to identify the target interactive interface;

[0037] A sensitive data identification unit inputs the data transmitted in the target interactive interface into a sensitive data identification model to obtain the sensitive data therein, wherein the sensitive data identification model is obtained by training a hybrid neural network model using a number of samples containing sensitive data and non-sensitive data, and the hybrid neural network model includes a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction;

[0038] The behavior recognition unit performs real-time anomaly analysis on the interface access behavior corresponding to sensitive data, identifies abnormal access behavior, and issues alarms.

[0039] The following are further optimizations and / or improvements to the above technical solutions:

[0040] The above interface scanning unit comprises:

[0041] Tool selection module, selects automation tools and loads predefined rule and pattern libraries;

[0042] The scanning module uses automated tools to scan the interfaces in the data center. It uses protocol analysis technology to parse the captured data packets and identify the key information of each data packet, including the source address, destination address, transmission protocol type, and data content. It uses traffic monitoring technology to capture and analyze network traffic and obtain the traffic pattern of each data packet.

[0043] The matching module performs pattern matching on each data packet of the interface based on predefined rules and pattern library. If the predefined rules and patterns are met, the interface is marked as a target interaction interface.

[0044] The above-mentioned behavior recognition unit includes:

[0045] Identify and select the module, select the abnormal access behavior identification module;

[0046] The first identification module includes:

[0047] Obtain interface access behavior data including sensitive data;

[0048] The density-based anomaly detection method is used to determine the data density of each interface access behavior data, and potential abnormal behavior data is screened according to the preset density threshold;

[0049] Isolation forest algorithm is used to identify abnormal access behaviors in potential abnormal behavior data;

[0050] Early warning and recording of abnormal access behaviors;

[0051] The second identification module includes:

[0052] Obtain interface access behavior data including sensitive data and pre-process it;

[0053] Determine the feature type and extract the corresponding feature value from the interface access behavior data including sensitive data;

[0054] The feature value is scored as a difference from the feature mean of normal behavior;

[0055] The difference scoring result is compared with the difference threshold, and in response to the difference being greater than the difference threshold, the corresponding interface access behavior is marked as abnormal access behavior.

[0056] The beneficial effects of the present invention include:

[0057] (1) By using automated tools based on specific rules and pattern matching, combined with protocol analysis and traffic monitoring technology, we can achieve comprehensive scanning and identification of dynamic and static interfaces in the data center, ensuring that all interactive interfaces are accurately detected.

[0058] (2) The sensitive data recognition model trained by the hybrid neural network model can accurately identify sensitive data in the data content transmitted in the target interactive interface, including ID card numbers and bank account information, which significantly improves the accuracy and efficiency of sensitive data recognition.

[0059] (3) Based on the identification results of sensitive data, the access behavior of interfaces containing sensitive data is monitored in real time, the flow of sensitive data is effectively tracked and recorded, and the security of sensitive data during transmission is ensured.

[0060] (4) The application of anomaly detection algorithms can identify and warn of abnormal access and data leakage risks in interface access, and timely discover and respond to potential security threats through real-time warning mechanisms, thereby improving overall security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Attached Figure 1 It is a schematic diagram of the flow of the interface data security monitoring method of the present invention.

[0062] Attached Figure 2 The figure is a flowchart of the target interactive interface identification method in the present invention.

[0063] Attached Figure 3 The figure is a flowchart of a method for identifying abnormal access behavior in the present invention.

[0064] Attached Figure 4 The figure is a flowchart of another abnormal access behavior identification method in the present invention.

[0065] Attached Figure 5 It is a schematic diagram of the structure of the interface data security monitoring device of the present invention. DETAILED DESCRIPTION

[0066] The present invention is not limited by the following embodiments, and specific implementation methods can be determined based on the technical solution of the present invention and actual conditions.

[0067] The present invention will be further described below in conjunction with embodiments and drawings:

[0068] Embodiment 1: As attached Figure 1 As shown, an embodiment of the present invention discloses a method for monitoring interface data security, including:

[0069] Step S110, scanning the dynamic interface and static interface in the data center to identify the target interactive interface;

[0070] Step S120, inputting the data transmitted in the target interactive interface into a sensitive data recognition model to obtain the sensitive data therein, wherein the sensitive data recognition model is obtained by training a hybrid neural network model using a number of samples containing sensitive data and non-sensitive data, the hybrid neural network model including a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction;

[0071] Step S130: Perform real-time abnormal analysis on the interface access behavior corresponding to the sensitive data, identify abnormal access behavior, and issue an alarm.

[0072] The present invention discloses an interface data security monitoring method, which realizes comprehensive scanning and identification of dynamic and static interfaces in the data center, ensures that all interactive interfaces are accurately detected, and uses a sensitive data identification model obtained by training a hybrid neural network model to accurately identify sensitive data in the data content transmitted in the target interactive interface, significantly improving the accuracy and efficiency of sensitive data identification. Further application of anomaly detection algorithms can identify and warn of abnormal access and data leakage risks in interface access, and timely discover and respond to potential security threats through a real-time warning mechanism, thereby improving the overall security protection capability.

[0073] Embodiment 2: The embodiment of the present invention discloses a method for monitoring interface data security, comprising:

[0074] Step S210, scanning the dynamic interface and the static interface in the data center to identify the target interactive interface.

[0075] The purpose of this step is to scan and identify target interactive interfaces in the data center by using automated tools based on specific rules and pattern matching to ensure comprehensive coverage of dynamic and static interfaces.

[0076] As attached Figure 2 As shown, the above step S210 specifically includes:

[0077] Step S211, select an automation tool and load a predefined rule and pattern library.

[0078] The above automation tools can be obtained in several ways. You can choose from a variety of existing open source or commercial network monitoring and protocol analysis tools, such as Wireshark, Snort, Zeek (formerly Bro), etc., but it should be noted that the selected tool must have protocol analysis and traffic monitoring functions, and can be extended through plug-ins or scripts to adapt to specific needs. You can also choose suitable existing tools and customize and extend them according to the needs of the present invention. For example, write specific rules and pattern matching plug-ins so that these tools can scan and identify specific types of interactive interfaces.

[0079] Furthermore, an automated tool can also be developed independently according to the needs of the present invention. During the development process, it is necessary to use appropriate programming languages ​​and network programming libraries, such as Python and Scapy libraries, or C++ and libpcap libraries. The independently developed tool needs to implement the following functional modules: the protocol analysis module is used to parse data packets of various network protocols and extract key information of the data packets (such as source address, destination address, protocol type, data content, etc.); the traffic monitoring module captures and analyzes network traffic in real time, identifies and records the activities of dynamic interfaces; the rule and pattern matching module matches the captured and parsed data based on predefined rules and patterns, and identifies the target interactive interface.

[0080] After selecting the automation tool, you need to initialize the automation tool first, and then load the predefined rule and pattern library. The rules and patterns include regular expressions, protocol features, and specific matching patterns. These rules and patterns can help the tool identify various types of interface activities.

[0081] Step S212, use an automated tool to scan the interfaces in the data center.

[0082] This step starts the automation tool to perform a comprehensive scan of the data center. The specific automation tool will capture all possible interface data through network packet capture and log analysis. The data center usually contains a large number of interactive interfaces, which may be static or dynamically generated. Therefore, the automation tool needs to traverse all known and unknown interfaces to ensure that no potential interaction points are missed.

[0083] Step S213, parse the captured data packets based on protocol analysis technology to identify key information of each data packet, where the key information includes source address, destination address, transmission protocol type, and data content.

[0084] In this step, the automated tool uses protocol analysis technology to perform detailed analysis on the captured data packets, where protocol analysis technology can identify and parse various data transmission protocols (such as HTTP, HTTPS, FTP, TCP, etc.) to understand the structure and content of the data packets. Through protocol analysis, the automated tool can extract key information of each data packet, including source address, destination address, transmission protocol type, and data content, so this step is crucial for accurately understanding and identifying data flows.

[0085] Step S214, capturing and analyzing network traffic based on traffic monitoring technology to obtain the traffic pattern of each data packet.

[0086] In this step, the automation tool also applies traffic monitoring technology to monitor the dynamic interface activities of the data center in real time. The specific traffic monitoring technology captures and analyzes network traffic to understand the data flow in the system. The automation tool will record and analyze the traffic pattern of each data packet in real time to identify potential dynamic interfaces. Traffic monitoring can also detect abnormal large-scale data transmission activities or unusual communication patterns, which is particularly important for discovering dynamic interfaces.

[0087] Step S215, pattern matching is performed on each data packet of the interface based on predefined rules and pattern libraries, and if the predefined rules and patterns are met, the interface is marked as a target interaction interface.

[0088] This step is after completing protocol analysis and traffic monitoring. The automated tool performs pattern matching on the parsed and monitored data packets. The specific pattern matching process compares the captured data with predefined rules and patterns to identify qualified interaction interfaces. For example, if a specific URL format, data field, or protocol feature is defined in the rule, the tool will check whether the captured data matches these features. Once a match is successful, the automated tool marks these interfaces as target interaction interfaces.

[0089] Step S216, loop the above steps until all interfaces in the data center are traversed using automated tools.

[0090] In this step, after using the automated tool to traverse all interfaces in the data center, the automated tool generates a list of target interactive interfaces. This list contains detailed information of all identified interactive interfaces, such as interface address, protocol type, and traffic characteristics; the generated list will be used for subsequent sensitive data identification and real-time monitoring steps to ensure the security and integrity of the data center.

[0091] Step S220, input the data transmitted in the target interactive interface into a sensitive data recognition model to obtain the sensitive data therein, wherein the sensitive data recognition model is obtained by training a hybrid neural network model using several samples containing sensitive data and non-sensitive data, and the hybrid neural network model includes a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction.

[0092] In this step, the data transmitted in the target interactive interface is input into the sensitive data recognition model. Since the target interactive interface identified by the automated tool will transmit a large amount of data content, these data contents may contain various types of information, including text, numbers, images, etc., and therefore need to be input into the sensitive data recognition model in an appropriate format. Furthermore, before inputting into the sensitive data recognition model, it needs to be preprocessed. The preprocessing includes data cleaning, formatting, and word segmentation. For text data, it may be necessary to remove noise characters, unify the encoding format, and perform word segmentation for model analysis. For structured data, the preprocessing steps may include data type conversion, missing value processing, etc.

[0093] In this step, the sensitive data identification model is obtained by training a hybrid neural network model using several samples containing sensitive data and non-sensitive data. The hybrid neural network model is usually composed of multiple layers of neural networks, including convolutional neural networks (CNN) for feature extraction, recurrent neural networks (RNN) or long short-term memory networks (LSTM) for processing sequence data, and finally classification and prediction through a fully connected layer. During the processing, the model will extract high-level features of the data layer by layer, and finally output the prediction results, that is, obtain the sensitive data, which includes ID card numbers and bank account information.

[0094] In this step, the data transmitted in the target interactive interface is input into the sensitive data identification model to obtain the sensitive data therein, including:

[0095] (1) Data preprocessing: Extract raw data from the target interactive interface and perform preprocessing operations such as cleaning, formatting, and word segmentation.

[0096] (2) Data input: Input the preprocessed data into the trained hybrid neural network model.

[0097] (3) Feature extraction and classification: The model extracts data features through the convolutional layer, processes sequence information through the recurrent layer, and finally performs classification through the fully connected layer.

[0098] (4) Sensitive data identification: The model outputs classification results, marks data segments containing sensitive data, and records the specific type.

[0099] (5) Result output: The identification results containing sensitive data are output to facilitate real-time monitoring and anomaly detection in subsequent steps.

[0100] The hybrid neural network model includes:

[0101] Input layer, obtains data from the target interactive interface;

[0102] Specifically, the data in the target interactive interface can be in various forms, including text, numerical values, and sequence data. The design of the input layer needs to be able to flexibly process these different forms of data and convert them into vector representations suitable for neural network processing.

[0103] The position encoding module receives the output of the input layer, encodes the character position of the data, and generates a position encoding vector;

[0104] Specifically, the purpose of position encoding is to add position information to the input data so that the neural network can capture the sequence characteristics of the data. In specific implementation, the position encoding module generates position encoding vectors by mapping the position of each character to a high-dimensional vector; these high-dimensional vectors are combined with the feature vector of the input data, so that the neural network can take into account the specific position of the character in the sequence during processing.

[0105] It should also be noted that in the position encoding module, high-dimensional vectors are used to represent the specific position of characters in the sequence. In the specific implementation process, position encoding vectors are usually generated using fixed encoding functions, which can map the position of characters into a high-dimensional space, thereby enhancing the ability of neural networks to process sequence data. Position encoding usually uses a technology called position embedding. This technology is widely used in the field of natural language processing (NLP), especially when processing sequence data (such as text, time series data). Position embedding can generate high-dimensional vectors in two main ways: position encoding based on sine and cosine functions and trainable position embedding vectors.

[0106] (1) Position encoding based on sine and cosine functions:

[0107] In this method, the position pos of each character is mapped to a fixed high-dimensional vector. The specific formula is as follows:

[0108]

[0109] Among them, pos represents the position of the character in the sequence, i represents the dimension index, and d represents the dimension of the position embedding vector. The high-dimensional vector generated by this method is periodic and can capture the relative order and global position information of the character positions.

[0110] (2) Trainable position embedding vector:

[0111] In this approach, each position pos has a corresponding trainable vector. The model automatically adjusts the values ​​of these vectors during training to optimize its performance in a specific task. In practice, the position embedding vectors can be initialized to random values ​​and then optimized during training. The trainable position embedding vectors are used as parameters in the neural network model and are trained and updated together with other model parameters.

[0112] In the specific implementation, you first need to decide which method to use to generate the position encoding vector. If you choose position encoding based on sine and cosine functions, then in data preprocessing, calculate the position encoding vector of each character and combine it with the character feature vector. If you choose a trainable position embedding vector, create a position embedding matrix when the model is initialized, in which each row corresponds to a high-dimensional vector of a position.

[0113] The specific steps to generate a position encoding vector are as follows:

[0114] For the method based on sine and cosine functions, the position encoding vector of each character is calculated in the data preprocessing stage. Assuming that the input sequence length is L and the dimension of the position embedding vector is d, the position encoding vector is calculated according to the above formula for each position pos (from 0 to L-1). These position encoding vectors are then element-wise added or concatenated with the character feature vector (such as the word embedding vector) to generate the final input vector.

[0115] For the trainable position embedding method, when the model is initialized, a position embedding matrix of size L×d is created, where L is the maximum length of the sequence and d is the embedding dimension. Each position pos corresponds to a row of vectors in the matrix. During model training, these vectors are updated and optimized along with other model parameters.

[0116] Through the above steps, the position encoding module can effectively map the position of each character into a high-dimensional vector, thereby providing additional position information for the neural network and improving the model's ability to process sequence data.

[0117] Furthermore, the position encoding module is specifically used for:

[0118] Receive the data content output by the input layer;

[0119] Embed the position of each character in the sequence in the data content into a high-dimensional vector, and perform hierarchical processing on the high-dimensional vector to generate a hierarchical position encoding vector;

[0120] Combine the hierarchical positional encoding vector with the character embedding vector to generate a positional encoding vector.

[0121] First, the position encoding module receives the data content output by the input layer. The data content output by the input layer is usually a sequence data, containing multiple characters or tokens. The specific position of each character in the sequence is very important for subsequent processing because it can affect the learning effect and prediction accuracy of the neural network.

[0122] Next, the position encoding module embeds the position of each character in the sequence in the data content into a high-dimensional vector. To achieve this, the position embedding technology can be used. This technology can generate high-dimensional vectors in two main ways: position encoding based on sine and cosine functions and trainable position embedding vectors. For clarity of explanation, it is assumed that the position encoding of sine and cosine functions is used.

[0123] In this method, the position pos of each character is mapped to a fixed high-dimensional vector. In specific implementation, the position encoding function converts the position pos into a high-dimensional vector, where the value of each dimension is calculated by the sine and cosine functions. This method can capture the relative order and global position information of the character positions, thereby enhancing the model's ability to understand sequence data.

[0124] The calculation formula of the position encoding vector is as follows:

[0125] For position pos and dimension i, the 2i-th element of the positional encoding vector is:

[0126]

[0127] The 2i+1th element of the position encoding vector is:

[0128]

[0129] Among them, d represents the dimension of the position encoding vector. Through these formulas, a corresponding high-dimensional vector can be generated for each character in the sequence.

[0130] Then, these high-dimensional vectors are layered to generate hierarchical position encoding vectors. The purpose of layered processing is to better capture the hierarchical relationships and complex patterns in the data. In specific implementations, the position encoding vectors can be subjected to multiple layers of linear transformations. After each layer of transformation, a nonlinear activation function (such as ReLU) is applied so that the generated hierarchical position encoding vectors can better represent the position information of characters at different levels.

[0131] Next, the hierarchical position encoding vector is combined with the character embedding vector to generate the final encoding vector. The character embedding vector is a vector that represents the characteristics of the character itself, usually obtained by pre-training a word embedding model (such as Word2Vec, GloVe, or BERT). The combination process can use element-level addition or vector concatenation. Element-level addition is to add the element values ​​of corresponding positions, and vector concatenation is to directly concatenate two vectors together to form a longer vector. The specific method can be adjusted according to the actual application requirements and model performance.

[0132] Through these steps, the position encoding module can effectively map the position of each character into a high-dimensional vector, and combine it with the character embedding vector to generate an encoding vector containing position information and character features. These encoding vectors will serve as input for subsequent neural network processing, improving the model's ability to understand and process sequence data.

[0133] The following is the reference implementation code of the input layer and position encoding module in the hybrid neural network model:

[0134]

[0135]

[0136]

[0137] In the above code, we first define an `InputLayer` class to receive input data. Then we define the `PositionalEncoding` class to generate positional encoding vectors using the sine and cosine functions. Next, we define the `CharacterEmbedding` class to generate character embedding vectors.

[0138] In the `PositionEncodingModule` class, the character embedding vector and the position encoding vector are combined to generate the final encoding vector. Finally, the actual calculation is performed by instantiating these classes and passing the input data.

[0139] The multi-scale convolution feature extraction module uses a multi-layer convolutional neural network with different convolution kernel sizes to process the position encoding vector and generate a multi-scale feature vector;

[0140] Specifically, convolution kernels of different sizes in multi-layer convolutional neural networks can capture feature information of different granularities. Small convolution kernels focus on local details, while large convolution kernels focus on global structures. Through multi-layer convolution operations, multi-scale feature vectors are generated, which contain rich features of the input data at different scales.

[0141] Furthermore, the multi-scale convolution feature extraction module is specifically used for:

[0142] receiving an output position encoding vector of a position encoding module;

[0143] Convolution operations are performed using three different sizes of convolution kernels, the sizes of which are 3×3, 5×5, and 7×7 respectively;

[0144] A spatial transformer network is applied after each convolution kernel to dynamically adjust the spatial distribution of feature maps;

[0145] Perform batch normalization on the convolution results to standardize the convolution features;

[0146] Apply the ReLU activation function to the normalized features to increase nonlinearity;

[0147] The feature maps generated by different convolution kernels are concatenated to form a multi-scale feature vector.

[0148] First, the multi-scale convolution feature extraction module receives the output position encoding vector from the position encoding module. The position encoding vector contains the position information and character features of the input data, which provides the necessary basis for subsequent convolution operations.

[0149] Next, the received position encoding vector is convolved. Three different sizes of convolution kernels are used for convolution operations, and the sizes of the convolution kernels are 3×3, 5×5, and 7×7. These three different sizes of convolution kernels can capture feature information of different granularities: the 3×3 convolution kernel can capture local details, the 5×5 convolution kernel can capture features in a slightly larger range, and the 7×7 convolution kernel can capture global features in a larger range. In this way, through multi-scale convolution operations, rich feature representations can be obtained.

[0150] After each convolution kernel, a spatial transformer network (STN) is applied. The purpose of the spatial transformer network is to dynamically adjust the spatial distribution of the feature map so that the convolutional features can better adapt to the geometric changes of the input data. Specifically, STN learns affine transformation parameters to rotate, translate, and scale the feature map, thereby enhancing the flexibility and robustness of the feature representation.

[0151] Then, batch normalization is performed on the convolution results. Batch normalization is a commonly used regularization technique that standardizes the mean and variance of each small batch of data to eliminate the deviation of data distribution and stabilize and accelerate the training process of the neural network. Batch normalization can prevent the gradient from disappearing or exploding, making the convolution features more stable and efficient in the subsequent training process.

[0152] After normalization, the ReLU activation function is applied to the feature map. ReLU (Rectified Linear Unit) is a nonlinear activation function, defined as f(x) = max(0,x). The ReLU activation function can introduce nonlinear characteristics, allowing the neural network to learn more complex features and patterns. At the same time, ReLU has the advantages of simple calculation and fast convergence speed, and is widely used in deep learning.

[0153] Finally, the feature maps generated by different convolution kernels are concatenated to form a multi-scale feature vector. The concatenation operation is to connect the feature maps obtained using different convolution kernels along the channel dimension to form a larger feature map. These feature maps contain feature information of different scales, provide rich feature representation, and help subsequent feature extraction and classification tasks.

[0154] Through the above detailed steps, the multi-scale convolutional feature extraction module can effectively process the position encoding vector and generate a feature vector containing multi-scale feature information. According to these instructions, the multi-scale convolutional feature extraction module can be accurately implemented to ensure rich feature extraction and representation, providing strong support for subsequent steps such as temporal feature extraction and self-attention aggregation.

[0155] The reference implementation code of the multi-scale convolution feature extraction module is as follows:

[0156]

[0157]

[0158]

[0159] In the above code, we first define a `SpatialTransformerNetwork` class to implement the spatial transformer network (STN), which can dynamically transform the feature map in space, such as rotation, translation, and scaling. Next, we define the `MultiScaleConvolutionalFeatureExtraction` class, which contains three convolutional layers with different sizes of convolution kernels (3×3, 5×5, 7×7), as well as the corresponding spatial transformer network and batch normalization layer. The ReLU activation function is used to increase nonlinearity. Finally, the feature maps obtained using different convolution kernels are connected along the channel dimension through a splicing operation to form a multi-scale feature vector.

[0160] The time series feature extraction module uses a bidirectional long short-term memory network to process multi-scale feature vectors and generate time series feature vectors;

[0161] Specifically, the Bi-LSTM network can process sequence data and capture the dependencies between the previous and next data. Through bidirectional processing, the Bi-LSTM can simultaneously consider the forward and backward information of the sequence and generate time series feature vectors. These time series feature vectors can better represent the dynamic characteristics of the data in the time dimension.

[0162] Furthermore, the time series feature extraction module is specifically used for:

[0163] Receiving an output multi-scale feature vector of a multi-scale convolutional feature extraction module;

[0164] Performing temporal analysis on multi-scale feature vectors using an improved bidirectional long short-term memory network, wherein the improved bidirectional long short-term memory network includes introducing residual connections between LSTM units to better capture long-distance dependencies;

[0165] A dynamic attention mechanism is applied to the output of each LSTM unit. The dynamic attention mechanism dynamically adjusts the importance of each time step according to the contextual information of the current time step and the historical time steps.

[0166] Generate a weighted time series feature vector.

[0167] First, the time series feature extraction module receives the output multi-scale feature vectors from the multi-scale convolution feature extraction module. These feature vectors already contain rich feature information of the input data at different scales, providing a solid foundation for subsequent time series analysis.

[0168] Next, the improved bidirectional long short-term memory network (Bi-LSTM) is used to perform time series analysis on the multi-scale feature vectors. Bi-LSTM can process the forward and backward information of sequence data at the same time, so it is particularly suitable for capturing the temporal dependencies in the data. In the specific implementation, residual connections are introduced to improve the traditional Bi-LSTM structure. Residual connections add direct jump connections between LSTM units, allowing the network to directly access the activation values ​​of the previous layers when propagating gradients. This improvement can better capture long-distance dependencies, alleviate the gradient vanishing problem, and improve the learning ability and stability of the model.

[0169] After the residual connection is introduced between LSTM units, each LSTM unit not only receives the output of the previous time step, but also directly receives part of the initial input information. This design ensures that information can be transmitted more smoothly in the network, which helps the model capture long-term dependencies. For example, suppose the input of the current LSTM unit is x t , the hidden state of the previous time step is h t-1 , then under the residual connection, the actual information input to the current LSTM unit is x t+h t-1 .

[0170] A dynamic attention mechanism is applied to the output of each LSTM unit. The role of the dynamic attention mechanism is to dynamically adjust the importance of each time step based on the contextual information of the current time step and the historical time steps. Specifically, the dynamic attention mechanism calculates the attention weights for each time step, which reflect the relative importance of each time step in the current context. The calculation method usually includes the following steps: first, the hidden state of the current time step is compared with the hidden state of all historical time steps to calculate the attention score; then, these scores are normalized into attention weights using a soft attention method; finally, these weights are used to perform a weighted summation of the hidden states of the historical time steps to generate a weighted time series feature vector.

[0171] The dynamic attention mechanism can effectively highlight the time step information that is more important in the current context and suppress the time step information that is less relevant, thereby improving the model's ability to represent temporal features. For example, assuming that the hidden state of the current time step is h t , the hidden states of all historical time steps are h1,h2,…,h t-1 , then the attention score can be obtained by dot product operation. Then, the softmax function is used to convert these scores into attention weights, and finally the hidden state of the historical time step is weighted summed to obtain the weighted time series feature vector.

[0172] Through the above detailed steps, the temporal feature extraction module can receive multi-scale convolutional feature vectors and use the improved bidirectional long short-term memory network for temporal analysis. The dynamic attention mechanism further optimizes the feature extraction process and generates weighted temporal feature vectors. These steps ensure that the module can accurately capture the temporal dependencies in the data, improve the temporal feature representation capability, and provide high-quality feature input for subsequent self-attention aggregation and feature fusion steps.

[0173] The reference implementation code of the temporal feature extraction module is as follows:

[0174]

[0175]

[0176]

[0177] The above code implements the time series feature extraction module and describes in detail the process from receiving feature vectors from the multi-scale convolutional feature extraction module to generating weighted time series feature vectors.

[0178] The self-attention aggregation module uses the self-attention mechanism to perform weighted processing on the time series feature vector to generate an aggregated feature vector;

[0179] Specifically, the self-attention mechanism is used to perform weighted processing on the time series feature vectors to highlight important feature information. The self-attention mechanism calculates the correlation between each feature vector and assigns different weights to them, thereby aggregating and generating new feature vectors. The generated aggregated feature vectors can better represent the global features and key details of the data.

[0180] Furthermore, the self-attention aggregation module is specifically used to:

[0181] receiving a weighted temporal feature vector outputted by a temporal feature extraction module;

[0182] Split the time series feature vector into multiple sub-vector groups, where each sub-vector group is processed by an independent multi-head self-attention mechanism;

[0183] The multi-head self-attention mechanism performs multi-layer self-attention calculations on each sub-vector group, and improves the feature expression capability through inter-layer normalization and residual connections;

[0184] Multiple weighted feature vectors are concatenated to generate an aggregated feature vector.

[0185] First, the self-attention aggregation module receives the weighted temporal feature vectors output by the temporal feature extraction module. These feature vectors already contain rich temporal information, providing a solid foundation for subsequent self-attention processing.

[0186] Next, the received time series feature vector is split into multiple sub-vector groups. This step is to use the multi-head self-attention mechanism to process the time series feature vector. The multi-head self-attention mechanism can process multiple sub-vector groups in parallel, allowing the model to focus on different feature subspaces, thereby capturing richer and more diverse feature information. Assuming that the dimension of the time series feature vector is d, it is split into h sub-vector groups, and the dimension of each sub-vector group is d / h.

[0187] Each sub-vector group is then processed by an independent multi-head self-attention mechanism. The multi-head self-attention mechanism performs self-attention calculations on each sub-vector group separately. Specifically, for each sub-vector group, its attention weight is first calculated, and then weighted summed to generate a weighted sub-vector. In the self-attention calculation process, the calculation method of the attention weight usually includes the following steps: first, the sub-vector of the current time step is dot-producted with the sub-vectors of all time steps to obtain the attention score; then, the attention score is normalized using the softmax function to obtain the attention weight; finally, these weights are used to weighted sum the sub-vectors of all time steps to obtain the weighted sub-vector.

[0188] In order to improve the feature expression ability, the multi-head self-attention mechanism performs multi-layer self-attention calculations on each sub-vector group. The learning ability and stability of the model can be further enhanced through the design of inter-layer normalization and residual connection. Inter-layer normalization can standardize the output of each layer, making the model more stable and efficient during training. And residual connection can alleviate the gradient vanishing problem and ensure the smooth propagation of information in the multi-layer network.

[0189] In inter-layer normalization, LayerNorm is usually used to normalize the output of each layer. LayerNorm can standardize the feature dimension of each input sample so that the features of each sample have the same mean and variance. This operation can improve the training speed and performance of the model.

[0190] The introduction of residual connection adds a direct jump connection in each layer of self-attention calculation, adding the input directly to the output. This design can make information propagate more smoothly in the network and enhance the robustness and expressiveness of the model.

[0191] Finally, multiple weighted feature vectors are concatenated to generate an aggregated feature vector. The concatenation operation is to connect the weighted feature vectors obtained using different sub-vector groups along the channel dimension to form a larger feature vector. In this way, the aggregated feature vector not only contains the information of different sub-vector groups, but also integrates the processing results of the multi-head self-attention mechanism, thereby providing a rich feature representation.

[0192] Through the above detailed steps, the self-attention aggregation module can effectively process the weighted time series feature vector and generate an aggregated feature vector containing multi-head self-attention information. These steps ensure that the model can capture more diverse and rich feature information, providing high-quality feature input for subsequent cross-feature fusion and classification steps.

[0193] The cross-feature fusion module uses the tensor decomposition network to cross-fuse different feature dimensions in the aggregated feature vector to generate a high-dimensional fused feature vector;

[0194] Specifically, the cross-feature fusion module uses a tensor decomposition network (TDN) to cross-fuse different feature dimensions in the aggregated feature vector. The tensor decomposition network decomposes the high-dimensional feature vector into multiple low-rank tensors to achieve cross-fusion of feature dimensions. The generated high-dimensional fused feature vector contains the interactive information of the input data in different dimensions, which improves the richness and expressiveness of feature representation.

[0195] Furthermore, the cross feature fusion module is specifically used for:

[0196] Receive the output aggregate feature vector from the attention aggregation module;

[0197] Processing the aggregated feature vector using a high-dimensional tensor decomposition network, wherein the high-dimensional tensor decomposition network includes a three-dimensional tensor decomposition layer, which decomposes the high-dimensional feature tensor into multiple low-rank tensors to achieve cross-fusion of feature dimensions;

[0198] The decomposed low-rank tensors are recombined through the attention weighted mechanism to generate a high-dimensional fused feature vector.

[0199] First, the cross-feature fusion module receives the output aggregated feature vectors from the self-attention aggregation module. These aggregated feature vectors have been processed by the multi-head self-attention mechanism and contain rich feature information, providing a solid foundation for subsequent feature fusion.

[0200] Next, the aggregated feature vectors are processed using a high-dimensional tensor decomposition network. The high-dimensional tensor decomposition network aims to achieve cross-fusion of feature dimensions by decomposing a high-dimensional feature tensor into multiple low-rank tensors. Specifically, a high-dimensional feature tensor is a multidimensional array that contains information from different feature dimensions. Through tensor decomposition, this high-dimensional tensor can be split into multiple low-rank tensors, thereby reducing the complexity of the feature dimensions while maintaining the intrinsic connections between the features.

[0201] In the high-dimensional tensor decomposition network, the three-dimensional tensor decomposition layer is one of the key components. The three-dimensional tensor decomposition layer achieves compact representation of features by representing the input high-dimensional feature tensor as the product of several low-rank tensors. These low-rank tensors capture the main information in the high-dimensional feature tensor and reduce the computation and storage requirements. For example, assuming that the dimension of the input feature tensor is d1×d2×d3, the tensor decomposition layer decomposes it into several low-rank tensors whose sum of dimensions is less than the dimension of the original feature tensor.

[0202] After the tensor decomposition is completed, the low-rank tensors are recombined through the attention weighting mechanism to generate a high-dimensional fused feature vector. The attention weighting mechanism is used to determine the importance of each low-rank tensor in the final feature vector. Specifically, the attention mechanism assigns a weight to each low-rank tensor, and these weights are dynamically adjusted according to the feature representation and contextual information of the low-rank tensor. The steps to calculate the attention weights usually include the following aspects: first, perform a dot product operation on each low-rank tensor and the contextual information to obtain an attention score; then, use the softmax function to normalize the attention score to obtain the attention weight; finally, use these weights to perform a weighted summation on the low-rank tensors to generate a high-dimensional fused feature vector.

[0203] In the attention weighting mechanism, linear transformation and activation function are usually used to calculate the attention score. Assuming that the dimension of the low-rank tensor is d and the dimension of the context information is c, the attention score can be expressed as the dot product of the two vectors. After that, the score is converted into weights through the softmax function, which reflect the importance of each low-rank tensor in the current context. The weighted summation process is to add all low-rank tensors according to the weights to obtain the final high-dimensional fused feature vector.

[0204] Through the above detailed steps, the cross-feature fusion module can effectively process the aggregated feature vectors from the self-attention aggregation module and generate a high-dimensional fused feature vector. These steps ensure that the model can capture the complex relationship between features and achieve compact representation and dynamic weighted combination of features through tensor decomposition and attention mechanism. The high-dimensional fused feature vector generated in this way not only contains rich feature information, but also retains the intrinsic connection between features, providing high-quality feature input for subsequent classification tasks.

[0205] The code of the cross feature fusion module

[0206] First, you can define a `TensorDecompositionLayer` class, which implements cross-fusion of feature dimensions by decomposing a high-dimensional feature tensor into multiple low-rank tensors. During the tensor decomposition process, three independent tensor decomposition parameters are used, which act on each dimension of the input tensor.

[0207] Next, you can define an AttentionWeightedCombination class to recombine the decomposed low-rank tensors through the attention weighting mechanism. This class calculates the attention score of each low-rank tensor, then converts the score to a weight using the softmax function, and finally generates the final high-dimensional fused feature vector through weighted summation.

[0208] Finally, the above two modules can be combined together through the `CrossFeatureFusion` class to form a complete cross feature fusion module.

[0209] The classification module classifies the data based on the high-dimensional fusion feature vector and outputs the identification results of sensitive data.

[0210] Specifically, the classification module includes a fully connected layer and a Softmax layer. The fully connected layer is used to further convert the high-dimensional feature vector into a low-dimensional vector suitable for classification, and the Softmax layer is used to classify the data and output the recognition results of sensitive data. The fully connected layer nonlinearly combines the features through linear transformation and activation function, and the Softmax layer scores each category through probability distribution and finally outputs the most likely category label.

[0211] Furthermore, the reference implementation code of the classification module is as follows:

[0212]

[0213]

[0214] After the above-mentioned sensitive data identification model training is completed, the model needs to undergo rigorous evaluation and testing, using cross-validation and various performance indicators (such as accuracy, response time, etc.) to verify the effectiveness and reliability of the model to ensure that its performance in actual applications meets system requirements.

[0215] Furthermore, this embodiment can also continuously monitor the performance and actual application effects of the sensitive data identification model, collect new data for iterative updating and optimization of the sensitive data identification model, ensure that the sensitive data identification model can adapt to environmental changes and new needs, and continue to provide efficient and accurate data security monitoring solutions.

[0216] Step S230: Perform real-time abnormal analysis on the interface access behavior corresponding to the sensitive data, identify abnormal access behavior, and issue an alarm.

[0217] Embodiment 3: The embodiment of the present invention discloses a method for monitoring interface data security, comprising:

[0218] Step S310, scanning the dynamic interface and static interface in the data center to identify the target interactive interface;

[0219] Step S320, inputting the data transmitted in the target interactive interface into a sensitive data recognition model to obtain the sensitive data therein, wherein the sensitive data recognition model is obtained by training a hybrid neural network model using a number of samples containing sensitive data and non-sensitive data, the hybrid neural network model including a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction;

[0220] Step S330: Perform real-time abnormal analysis on the interface access behavior corresponding to the sensitive data, identify abnormal access behavior, and issue an alarm.

[0221] The monitoring system will collect relevant data in real time when the interface access behavior occurs, including but not limited to the access time, visitor identity, access content, access frequency, etc. For each access behavior containing sensitive data, the system will specially mark it and record it in detail. These records will form an access log to save all important information about the access behavior.

[0222] Based on data collection and recording, the system applies anomaly detection algorithms to analyze real-time monitoring data. Anomaly detection algorithms need to combine historical data and normal operating behavior patterns to identify abnormal access behaviors through comparative analysis. Common anomaly detection methods include but are not limited to methods based on statistical analysis, methods based on machine learning, and methods based on rule matching.

[0223] This embodiment performs abnormal analysis based on statistical analysis to identify abnormal access behaviors. Figure 3 As shown, including:

[0224] Step S331, obtaining interface access behavior data including sensitive data, and preprocessing the data;

[0225] The above preprocessing includes data cleaning, feature extraction and standardization.

[0226] Step S332, determining the feature type, and extracting the corresponding feature value from the interface access behavior data including sensitive data;

[0227] The above-mentioned feature types include access frequency, data transmission volume, visitor identity, etc.

[0228] Step S333, performing a difference score between the feature value and the feature mean of normal behavior;

[0229]

[0230] Among them, x represents the characteristic value of the current data point, μ represents the mean in the baseline model, and σ represents the standard deviation in its line model. The characteristic mean of normal behavior here is to obtain the historical data of normal behavior, build the baseline model of each characteristic type through the historical data of normal behavior, and thus obtain the mean of the baseline model under normal behavior.

[0231] Step S334, comparing the difference scoring result with the difference threshold, and in response to the difference being greater than the difference threshold, marking the corresponding interface access behavior as abnormal access behavior and issuing an alarm.

[0232] The above-mentioned abnormal access behavior will immediately trigger the early warning mechanism. The early warning mechanism can include various forms, such as sending alarm notifications, recording alarm logs, triggering automatic defense measures, etc. The early warning notification can be sent to relevant security managers via email, SMS or instant messaging to ensure that they can respond in time. Automatic defense measures can include blocking abnormal access, restricting access rights, launching emergency response procedures, etc. to prevent potential data leakage risks.

[0233] Embodiment 4: The embodiment of the present invention discloses a method for monitoring interface data security, comprising:

[0234] Step S410, scanning the dynamic interface and static interface in the data center to identify the target interactive interface;

[0235] Step S420, inputting the data transmitted in the target interactive interface into a sensitive data recognition model to obtain the sensitive data therein, wherein the sensitive data recognition model is obtained by training a hybrid neural network model using a number of samples containing sensitive data and non-sensitive data, the hybrid neural network model including a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction;

[0236] Step S430: Perform real-time abnormal analysis on the interface access behavior corresponding to the sensitive data, identify abnormal access behavior, and issue an alarm.

[0237] This embodiment uses a machine learning method to perform anomaly analysis and identify abnormal access behaviors. Figure 4 As shown, including:

[0238] Step S431, obtaining interface access behavior data including sensitive data;

[0239] When the above-mentioned real-time monitoring of interface access behavior is carried out, access records containing sensitive data will be captured. These data include access time, visitor identity, access content and other related information. These monitoring data are interface access behavior data including sensitive data.

[0240] Step S432, using a density-based anomaly detection method to determine the data density of each interface access behavior data, and screening potential abnormal behavior data according to a preset density threshold;

[0241] The above-mentioned density-based anomaly detection method is used to perform a preliminary screening of the interface access behavior data. The density detection method identifies abnormal behavior by analyzing the density of data points. This method assumes that normal access behavior will be concentrated in certain areas with higher density, while abnormal behavior will appear in areas with lower density. Specifically, the local outlier factor (LOF) can be used to calculate the data density of each access behavior. The higher the LOF value, the more likely the data point is an outlier. In this step, the data density of each interface access behavior data is calculated, and potential abnormal behavior data is screened out according to the preset density threshold.

[0242] Step S433, using an isolation forest algorithm to determine abnormal access behavior in the potential abnormal behavior data;

[0243] The isolation forest algorithm is applied to further detect the potential abnormal behavior data. The isolation forest algorithm is a tree-structured anomaly detection method. Its principle is to randomly select data features for segmentation to form multiple decision trees. The isolation forest algorithm determines the degree of abnormality by calculating the average path length of each data point in these decision trees. The shorter the path, the more likely the data point is an anomaly. In the specific implementation, multiple randomly sub-sampled decision trees are first constructed. Each tree is constructed by recursively partitioning the sample data space. For each data point, its average path length in the forest is calculated, and then it is judged whether it is an abnormal access behavior based on the preset anomaly scoring formula.

[0244] Step S434: warn and record abnormal access behavior.

[0245] Once abnormal access behavior is determined, this embodiment will issue an early warning and record relevant information. The early warning mechanism includes sending notifications to security managers, recording detailed information about abnormal behavior, and triggering corresponding defensive measures. Notifications can be sent via email, text messages, or other instant messaging methods to ensure that security personnel can handle them in a timely manner. The recorded information includes access time, visitor identity, specific abnormal characteristics, etc. These records will be stored in log files for subsequent analysis and auditing. Defensive measures can include temporarily blocking suspicious access behavior, increasing the monitoring level of the visitor, etc. to prevent potential data leaks and security threats.

[0246] Among them, the isolation forest algorithm includes the following steps:

[0247] Construct multiple randomly sub-sampled decision trees to form a forest, where each decision tree is constructed by recursively splitting the sample data space, and the split points are selected based on sensitive data and access behavior characteristics;

[0248] According to the following formula 1, the average path length h(x) of each data point in the forest is calculated:

[0249]

[0250] Among them, n t is the number of trees in the forest; T i is the i-th tree; the path length path_length represents the data point x in the tree T i The length of the path to reach the leaf node;

[0251] According to the following formula 2, the anomaly score s(x) is calculated:

[0252]

[0253] Where cn is the regularization constant of the path length, defined as follows:

[0254]

[0255] Among them, H(n) is the nth harmonic number;

[0256] The calculated abnormal score s(x) is compared with the preset threshold. When s(x) exceeds the preset threshold, it is determined to be an abnormal access.

[0257] First, multiple randomly subsampled decision trees are constructed to form a forest. Each decision tree is constructed by recursively partitioning the sample data space, and the partitioning point is selected based on the sensitive data and access behavior characteristics. Specifically, the decision tree construction process includes randomly selecting a subset from the sample data, and then randomly selecting a feature and a partitioning point in this subset, and dividing the data into two parts according to this partitioning point. This process is recursively performed until the stopping condition is met, such as the maximum depth of the tree or the number of samples in the node reaches a minimum. In this way, multiple decision trees are constructed to form a forest, and each tree can be regarded as a partition of the data space from a different perspective.

[0258] Next, we need to calculate the average path length of each data point in the forest. Path length refers to the length of the path that a data point takes to reach a leaf node in a decision tree. To calculate the average path length, we first need to calculate the path length of each data point in each tree. The formula for calculating the average path length is:

[0259]

[0260] Among them, n t is the number of trees in the forest; T i is the i-th tree; the path length path_length represents the data point x in the tree T i The path length to the leaf node in the forest. When calculating specifically, traverse each decision tree, track the path length of the data point from the root node to the leaf node, and take the average of these path lengths to get the average path length hx of the data point in the forest.

[0261] Next, the anomaly score s(x) is calculated based on the average path length hx. The calculation formula for the anomaly score is:

[0262]

[0263] Where cn is the regularization constant of the path length. The regularization constant cn is defined as follows:

[0264]

[0265] Where H(n) is the nth harmonic number. The role of the regularization constant is to standardize the path length so that data sets of different sizes can be compared.

[0266] Finally, the calculated anomaly score s(x) is compared with the preset threshold. If \(s(x)\) exceeds the preset threshold, the data point is determined to be an abnormal access. The preset threshold is set according to the specific application scenario and risk preference, and is usually determined through experiments and tuning. The higher the anomaly score, the more likely the data point is an abnormal access.

[0267] Therefore, through the above steps, the anomaly detection algorithm steps of the present invention can be accurately implemented, including receiving data, preliminary screening, further detection and early warning records, ensuring that abnormal access behavior can be effectively identified and processed, and protecting the security and integrity of the data center.

[0268] Embodiment 5: As attached Figure 5 As shown, an embodiment of the present invention discloses an interface data security monitoring device, comprising:

[0269] An interface scanning unit scans the dynamic interfaces and static interfaces in the data center to identify the target interactive interface;

[0270] A sensitive data identification unit inputs the data transmitted in the target interactive interface into a sensitive data identification model to obtain the sensitive data therein, wherein the sensitive data identification model is obtained by training a hybrid neural network model using a number of samples containing sensitive data and non-sensitive data, and the hybrid neural network model includes a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction;

[0271] The behavior recognition unit performs real-time anomaly analysis on the interface access behavior corresponding to sensitive data, identifies abnormal access behavior, and issues alarms.

[0272] The above interface scanning unit comprises:

[0273] Tool selection module, selects automation tools and loads predefined rule and pattern libraries;

[0274] The scanning module uses automated tools to scan the interfaces in the data center. It uses protocol analysis technology to parse the captured data packets and identify the key information of each data packet, including the source address, destination address, transmission protocol type, and data content. It uses traffic monitoring technology to capture and analyze network traffic and obtain the traffic pattern of each data packet.

[0275] The matching module performs pattern matching on each data packet of the interface based on predefined rules and pattern library. If the predefined rules and patterns are met, the interface is marked as a target interaction interface.

[0276] The above-mentioned behavior recognition unit includes:

[0277] Identify and select the module, select the abnormal access behavior identification module;

[0278] The first identification module includes:

[0279] Obtain interface access behavior data including sensitive data;

[0280] The density-based anomaly detection method is used to determine the data density of each interface access behavior data, and potential abnormal behavior data is screened according to the preset density threshold;

[0281] Isolation forest algorithm is used to identify abnormal access behaviors in potential abnormal behavior data;

[0282] Early warning and recording of abnormal access behaviors;

[0283] The second identification module includes:

[0284] Obtain interface access behavior data including sensitive data and pre-process it;

[0285] Determine the feature type and extract the corresponding feature value from the interface access behavior data including sensitive data;

[0286] The feature value is scored as a difference from the feature mean of normal behavior;

[0287] The difference scoring result is compared with the difference threshold, and in response to the difference being greater than the difference threshold, the corresponding interface access behavior is marked as abnormal access behavior.

[0288] Embodiment 6: The embodiment of the present invention discloses a storage medium, on which is stored a computer program that can be read by a computer, and the computer program is configured to execute an interface data security monitoring method when running.

[0289] The above storage medium may include, but is not limited to: a USB flash drive, a read-only memory, a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0290] Embodiment 7: The embodiment of the present invention discloses an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the computer program is loaded and executed by the processor to implement an interface data security monitoring method.

[0291] The processor may be a central processing unit (CPU), a general purpose processor, a digital signal processor (DSP), an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. It may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The memory may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory, a mobile hard disk, a magnetic disk or an optical disk.

[0292] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0293] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0294] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0295] The above technical features constitute the best embodiment of the present invention, which has strong adaptability and best implementation effect. Non-essential technical features can be added or reduced according to actual needs to meet the requirements of different situations.

Claims

1. A method for monitoring interface data security, characterized in that: include: Scan the dynamic and static interfaces in the data center to identify the target interactive interface; Input the data transmitted in the target interactive interface into the sensitive data recognition model to obtain the sensitive data therein, wherein the sensitive data recognition model is obtained by training a hybrid neural network model using a number of samples containing sensitive data and non-sensitive data, and the hybrid neural network model includes a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction; Conduct real-time anomaly analysis on interface access behaviors corresponding to sensitive data, identify abnormal access behaviors, and issue alarms.

2. The interface data security monitoring method according to claim 1, characterized in that: The scanning data includes the dynamic interface and the static interface in the platform, and identifying the target interactive interface, including: Choose an automation tool and load a library of predefined rules and patterns; Use automated tools to scan interfaces within the data center; Analyze the captured data packets based on protocol analysis technology to identify the key information of each data packet, including source address, destination address, transmission protocol type, and data content; Capture and analyze network traffic based on traffic monitoring technology to obtain the traffic pattern of each data packet; Perform pattern matching on each data packet of the interface based on predefined rules and pattern libraries, and if the predefined rules and patterns are met, mark the interface as a target interaction interface; Repeat the above steps until all interfaces in the data center are traversed using automated tools.

3. The interface data security monitoring method according to claim 1 or 2, characterized in that: The hybrid neural network model includes: Input layer, obtains data from the target interactive interface; The position encoding module receives the output of the input layer, encodes the character position of the data, and generates a position encoding vector; The multi-scale convolution feature extraction module uses a multi-layer convolutional neural network with different convolution kernel sizes to process the position encoding vector and generate a multi-scale feature vector; The time series feature extraction module uses a bidirectional long short-term memory network to process multi-scale feature vectors and generate time series feature vectors; The self-attention aggregation module uses the self-attention mechanism to perform weighted processing on the time series feature vector to generate an aggregated feature vector; The cross-feature fusion module uses the tensor decomposition network to cross-fuse different feature dimensions in the aggregated feature vector to generate a high-dimensional fused feature vector; The classification module classifies the data based on the high-dimensional fusion feature vector and outputs the identification results of sensitive data.

4. The interface data security monitoring method according to any one of claims 1 to 3, characterized in that: The real-time abnormal analysis of the interface access behavior corresponding to the sensitive data, identification of abnormal access behavior, and alarming include: Obtain interface access behavior data including sensitive data; The density-based anomaly detection method is used to determine the data density of each interface access behavior data, and potential abnormal behavior data is screened according to the preset density threshold; Isolation forest algorithm is used to identify abnormal access behaviors in potential abnormal behavior data; Provide early warning and record of abnormal access behavior.

5. The interface data security monitoring method according to any one of claims 1 to 3, characterized in that: The real-time abnormal analysis of the interface access behavior corresponding to the sensitive data, identification of abnormal access behavior, and alarming include: Obtain interface access behavior data including sensitive data and pre-process it; Determine the feature type and extract the corresponding feature value from the interface access behavior data including sensitive data; The feature value is scored as a difference from the feature mean of normal behavior; The difference scoring result is compared with the difference threshold. In response to the difference being greater than the difference threshold, the corresponding interface access behavior is marked as abnormal access behavior and an alarm is issued.

6. An interface data security monitoring device using the method as claimed in any one of claims 1 to 5, characterized in that: include: An interface scanning unit scans the dynamic interfaces and static interfaces in the data center to identify the target interactive interface; A sensitive data identification unit inputs the data transmitted in the target interactive interface into a sensitive data identification model to obtain the sensitive data therein, wherein the sensitive data identification model is obtained by training a hybrid neural network model using a number of samples containing sensitive data and non-sensitive data, and the hybrid neural network model includes a convolutional neural network for features, a recurrent neural network or a long short-term memory network for processing sequence data, and a fully connected layer for completing classification and prediction; The behavior recognition unit performs real-time anomaly analysis on the interface access behavior corresponding to sensitive data, identifies abnormal access behavior, and issues an alarm.

7. The interface data security monitoring device according to claim 1, characterized in that: The interface scanning unit comprises: Tool selection module, selects automation tools and loads predefined rule and pattern libraries; The scanning module uses automated tools to scan the interfaces in the data center. It uses protocol analysis technology to parse the captured data packets and identify the key information of each data packet, including the source address, destination address, transmission protocol type, and data content. It uses traffic monitoring technology to capture and analyze network traffic and obtain the traffic pattern of each data packet. The matching module performs pattern matching on each data packet of the interface based on predefined rules and pattern library. If the predefined rules and patterns are met, the interface is marked as a target interaction interface.

8. The interface data security monitoring device according to claim 6 or 7, characterized in that: The behavior recognition unit includes: Identify and select the module, select the abnormal access behavior identification module; The first identification module includes: Obtain interface access behavior data including sensitive data; The density-based anomaly detection method is used to determine the data density of each interface access behavior data, and potential abnormal behavior data is screened according to the preset density threshold; Isolation forest algorithm is used to identify abnormal access behaviors in potential abnormal behavior data; Early warning and recording of abnormal access behaviors; The second identification module includes: Obtain interface access behavior data including sensitive data and pre-process it; Determine the feature type and extract the corresponding feature value from the interface access behavior data including sensitive data; The feature value is scored as a difference from the feature mean of normal behavior; The difference scoring result is compared with the difference threshold, and in response to the difference being greater than the difference threshold, the corresponding interface access behavior is marked as abnormal access behavior.

9. A storage medium, characterized in that: The storage medium stores a computer program that can be read by a computer, and the computer program is configured to execute the interface data security monitoring method according to any one of claims 1 to 5 when running.

10. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a computer program, and the computer program is loaded and executed by the processor to implement the interface data security monitoring method as claimed in any one of claims 1 to 5.

Images