API management method and system

Abstract

The present invention provides an API management method and system, which deploys an API interface on a distributed server; collects historical API interface data as a training set for training to obtain an API interface anomaly prediction model; when requesting to call an API gateway, the API interface anomaly prediction model is used to predict in real time whether an anomaly will occur on the server after the API interface is called; the API gateway processes the request according to the prediction result. The present invention obtains an API interface traffic anomaly prediction model and an API interface attack anomaly prediction model by training historical API interface data, performs real-time anomaly prediction on the called API interface traffic, and performs real-time attack anomaly prediction on the called API interface, which greatly improves the efficiency of monitoring API interface calls and reduces labor costs.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to an API management method; in addition, the present invention also relates to an API management system. Background Art

[0002] With the continuous development of front-end technology, the complexity of front-end projects has gradually increased, and a front-end project may have multiple interfaces. When a user starts to call an API interface, he needs to send a call request to the API gateway, which is responsible for managing and monitoring the call request.

[0003] In traditional log analysis systems, some manual experience and business rules are usually used to analyze and monitor API calls. However, this will generate a lot of work, which is not only time-consuming and labor-intensive, but also difficult to achieve real-time monitoring and prediction of API calls. Summary of the invention

[0004] In order to solve the problems existing in the prior art, at least one embodiment of the present invention provides an API management method, which greatly improves the efficiency of monitoring API interface calls and reduces labor costs. To this end, at least one embodiment of the present invention also provides an API management system.

[0005] In a first aspect, an embodiment of the present invention provides an API management method, the method comprising:

[0006] Deploy the API interface on distributed servers;

[0007] Collect historical API interface data as a training set for training to obtain an API interface anomaly prediction model;

[0008] When a request is made to the API gateway to call an API interface, the API interface anomaly prediction model is used to predict in real time whether an anomaly will occur on the server after the API interface is called;

[0009] The API Gateway processes the request based on the predicted result.

[0010] In some embodiments, in the API management method provided by the present invention, the API interface data includes historical interface traffic data and historical interface attack behavior data.

[0011] In some embodiments, the API management method provided by the present invention trains historical interface traffic data through a regression model to obtain an API interface traffic anomaly prediction model, and uses the API interface traffic anomaly prediction model to predict in real time whether the API interface requested to be called will have traffic anomalies; if the API interface is predicted to have traffic anomalies, the API gateway limits the number of requests for calling the API interface.

[0012] In some embodiments, the API management method provided by the present invention trains historical interface attack behavior data through a supervised learning model to obtain an API interface attack anomaly prediction model, and uses the API interface attack anomaly prediction model to predict in real time whether the API interface requested to be called will experience an attack anomaly; if the API interface is predicted to experience an attack anomaly, the API gateway will issue an early warning for the API interface.

[0013] In some embodiments, the API management method provided by the present invention deploys the API interface on a distributed server, including:

[0014] Modify and maintain the parameters of the API interface on the distributed server.

[0015] In a second aspect, an embodiment of the present invention further provides an API management system, including:

[0016] Deployment module, used to deploy API interfaces on distributed servers;

[0017] Collection module, used to collect historical API interface data;

[0018] The training module is used to train historical API interface data to obtain an API interface anomaly prediction model;

[0019] The prediction module is used to predict in real time whether the server will have an exception after the API interface is called through the API interface anomaly prediction model when requesting the API gateway to call the API interface;

[0020] The processing module is used by the API gateway to process the request based on the predicted results.

[0021] In some embodiments, the API management system provided by the present invention further includes:

[0022] The maintenance module is used to modify and maintain the parameters of the API interface on the distributed server.

[0023] In a third aspect, an embodiment of the present invention further provides an API management device, comprising at least one processor; a memory coupled to the at least one processor, the memory storing executable instructions, which when executed by the at least one processor implement the steps of any one of the methods of the first aspect above.

[0024] In a fourth aspect, an embodiment of the present invention further provides a chip for executing the steps of the method in the first aspect. Specifically, the chip includes: a processor for calling and running a computer program from a memory, so that a device equipped with the chip is used to execute the steps of the method in the first aspect.

[0025] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect above are implemented.

[0026] It can be seen that an API management method and system in an embodiment of the present invention obtains an API interface traffic anomaly prediction model and an API interface attack anomaly prediction model by training historical API interface data, performs real-time anomaly prediction on the called API interface traffic, and performs real-time attack anomaly prediction on the called API interface, which greatly improves the efficiency of monitoring API interface calls and reduces labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0028] Figure 1 Shown is a structural schematic diagram of an API management method in an embodiment of the present invention;

[0029] Figure 2 Shown is a schematic diagram of the framework of an API management system in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. In this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0032] [Example 1]

[0033] The inventor of this solution found that in the prior art, some manual experience and business rules are usually used to analyze and monitor API interface calls. However, this will generate a lot of work, which is not only time-consuming and labor-intensive, but also difficult to achieve real-time monitoring and prediction of API interface calls. Embodiment 1 of the present invention provides the following solution:

[0034] like Figure 1 As shown, this embodiment provides an API management method, the method comprising:

[0035] Deploy the API interface on distributed servers;

[0036] Collect historical API interface data as a training set for training to obtain an API interface anomaly prediction model;

[0037] When a request is made to the API gateway to call an API interface, the API interface anomaly prediction model is used to predict in real time whether an anomaly will occur on the server after the API interface is called;

[0038] The API Gateway processes the request based on the predicted result.

[0039] It should be noted that deploying the API interface on a distributed server can reduce the traffic pressure on the server, thereby improving the efficiency of the system operation. When the API interface is predicted by the API interface anomaly prediction model, if the server anomaly is predicted, the API gateway will limit the number of requests for the API to be called or issue an alarm; if the server anomaly is not predicted, the API gateway will respond to the request and allow the API interface to be called by the user.

[0040] In some embodiments, the PI interface data includes historical interface traffic data and historical interface attack behavior data. The historical interface traffic data is used as a training sample for training to obtain an API interface traffic anomaly prediction model; the historical interface attack behavior data is used as a training sample for training to obtain an API interface attack anomaly prediction model.

[0041] In some embodiments, the historical interface traffic data is trained through a regression model to obtain an API interface traffic anomaly prediction model, and the API interface traffic anomaly prediction model is used to predict in real time whether the requested API interface will have traffic anomalies. If the API interface is predicted to have traffic anomalies, the API gateway limits the number of requests for calling the API interface.

[0042] It should be noted that the continuous time periods in the historical interface traffic data are used as independent variables, and the statistical traffic corresponding to each time period is used as the dependent variable to establish multiple regression models. The regression model established in this embodiment mainly includes a linear regression equation. Multiple regression equations are established. By discovering the intrinsic correlation between the dependent variable and the independent variable, a linear function about the dependent variable and the independent variable is constructed for fitting. Multiple regression models are screened according to the confidence R-Square and root mean square error RMSE of each regression model, mainly including screening regression equations with confidence R-Square>0.7 and RMSE<0.04, so as to predict future traffic data.

[0043] In some embodiments, the historical interface attack behavior data is trained through a supervised learning model to obtain an API interface attack anomaly prediction model, and the API interface attack anomaly prediction model is used to predict in real time whether the requested API interface will be attacked abnormally. If the API interface is predicted to be attacked abnormally, the API gateway will issue an early warning to the API interface.

[0044] It should be noted that the above supervised learning method manually annotates the attack behavior features in the collected data, such as annotating the application behavior status and service response status corresponding to the key performance indicator time slice. The basic log information is used as input, the annotated key performance indicators are used as output, and the comprehensive impact factor is used as the division standard. The SVM algorithm is used to train the samples with the comprehensive impact factor in the first 90% of its interval, and the genetic algorithm-optimized multi-layer feedforward network (GA-BP) is used to train the samples with the comprehensive impact factor in the last 10% of its interval. An API interface attack anomaly prediction model based on the GA-BP and SVM composite algorithm is constructed. The attack behavior features are identified through the constructed API interface attack anomaly prediction model, and it is predicted whether the requested API interface will be attacked abnormally.

[0045] In some embodiments, the method includes modifying and maintaining the parameters of the API interface on the distributed server. Specifically, the API interface parameters are edited and adjusted during maintenance; when an API interface has been abandoned or invalidated, it can be deleted in time during maintenance.

[0046] [Example 2]

[0047] like Figure 2 As shown, this embodiment provides an API management system, including a deployment module, a collection module, a training module, a prediction module and a processing module.

[0048] The deployment module is used to deploy the API interface on a distributed server; the collection module is used to collect historical API interface data; the training module is used to train the historical API interface data to obtain an API interface anomaly prediction model; the prediction module is used to predict in real time whether an anomaly will occur on the server after the API interface is called when requesting the API gateway to call the API interface through the API interface anomaly prediction model; the processing module is used for the API gateway to process the request according to the prediction result.

[0049] It should be noted that deploying the API interface on a distributed server can reduce the traffic pressure on the server, thereby improving the efficiency of the system operation. When the API interface is predicted by the API interface anomaly prediction model, if the server anomaly is predicted, the API gateway will limit the number of requests for the API to be called or issue an alarm; if the server anomaly is not predicted, the API gateway will respond to the request and allow the API interface to be called by the user.

[0050] In some embodiments, the PI interface data includes historical interface traffic data and historical interface attack behavior data. The historical interface traffic data is used as a training sample for training to obtain an API interface traffic anomaly prediction model; the historical interface attack behavior data is used as a training sample for training to obtain an API interface attack anomaly prediction model.

[0051] In some embodiments, the historical interface traffic data is trained through a regression model to obtain an API interface traffic anomaly prediction model, and the API interface traffic anomaly prediction model is used to predict in real time whether the requested API interface will have traffic anomalies. If the API interface is predicted to have traffic anomalies, the API gateway limits the number of requests for calling the API interface.

[0052] It should be noted that the continuous time periods in the historical interface traffic data are used as independent variables, and the statistical traffic corresponding to each time period is used as the dependent variable to establish multiple regression models. The regression model established in this embodiment mainly includes a linear regression equation. Multiple regression equations are established. By discovering the intrinsic correlation between the dependent variable and the independent variable, a linear function about the dependent variable and the independent variable is constructed for fitting. Multiple regression models are screened according to the confidence R-Square and root mean square error RMSE of each regression model, mainly including screening regression equations with confidence R-Square>0.7 and RMSE<0.04, so as to predict future traffic data.

[0053] In some embodiments, the historical interface attack behavior data is trained through a supervised learning model to obtain an API interface attack anomaly prediction model, and the API interface attack anomaly prediction model is used to predict in real time whether the requested API interface will be attacked abnormally. If the API interface is predicted to be attacked abnormally, the API gateway will issue an early warning to the API interface.

[0054] It should be noted that the above supervised learning method manually annotates the attack behavior features in the collected data, such as annotating the application behavior status and service response status corresponding to the key performance indicator time slice. The basic log information is used as input, the annotated key performance indicators are used as output, and the comprehensive impact factor is used as the division standard. The SVM algorithm is used to train the samples with the comprehensive impact factor in the first 90% of its interval, and the genetic algorithm-optimized multi-layer feedforward network (GA-BP) is used to train the samples with the comprehensive impact factor in the last 10% of its interval. An API interface attack anomaly prediction model based on the GA-BP and SVM composite algorithm is constructed. The attack behavior features are identified through the constructed API interface attack anomaly prediction model, and it is predicted whether the requested API interface will be attacked abnormally.

[0055] In some embodiments, the system further includes a maintenance module, which is used to modify and maintain the parameters of the API interface on the distributed server. Specifically, the API interface parameters are edited and adjusted during maintenance; when an API interface has been abandoned or invalidated, it can be deleted in time during maintenance.

[0056] [Example 3]

[0057] This embodiment provides an API management device, including:

[0058] At least one processor; a memory coupled to the at least one processor, the memory storing executable instructions, wherein the executable instructions, when executed by the at least one processor, implement the method steps of embodiment 1 of the present invention.

[0059] In an API management device provided by an embodiment of the present invention, a processor and a memory may be provided separately or integrated together.

[0060] For example, the memory may include a random access memory, a flash memory, a read-only memory, a programmable read-only memory, a non-volatile memory or a register, etc. The processor may be a central processing unit (CPU), etc., or a graphic processing unit (GPU). The memory may store executable instructions. The processor may execute the executable instructions stored in the memory to implement the various processes described herein.

[0061] It can be understood that the memory in this embodiment can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a ROM (Read-Only Memory), a PROM (Programmable ROM), an EPROM (Erasable PROM), an EEPROM (Electrically EPROM), or a flash memory. The volatile memory can be a RAM (Random Access Memory), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as SRAM (Static RAM), DRAM (Dynamic RAM), SDRAM (Synchronous DRAM), DDR SDRAM (Double Data Rate SDRAM), ESDRAM (Enhanced SDRAM), SLDRAM (Synchlink DRAM), and DRRAM (Direct Rambus RAM). The memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

[0062] In some embodiments, the memory stores the following elements, upgrade packages, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system and an application program.

[0063] The operating system includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application program includes various application programs, which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application program.

[0064] In the embodiment of the present invention, the processor calls a program or instruction stored in the memory, specifically, a program or instruction stored in an application program, and the processor is used to execute the method steps of the embodiment 1 of the present invention.

[0065] [Example 4]

[0066] This embodiment provides a chip for executing the method of the above-mentioned embodiment 1 of the present invention. Specifically, the chip includes: a processor for calling and running a computer program from a memory, so that a device equipped with the chip is used to execute the method of the embodiment 1 of the present invention.

[0067] [Example 5]

[0068] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method of Embodiment 1 of the present invention are implemented.

[0069] For example, machine-readable storage media may include, but are not limited to, various known and unknown types of non-volatile memory.

[0070] In summary, embodiments 1-5 of the present invention provide an API management method and system, which obtain an API interface traffic anomaly prediction model and an API interface attack anomaly prediction model by training historical API interface data, perform real-time anomaly prediction on the called API interface traffic, and perform real-time attack anomaly prediction on the called API interface, thereby greatly improving the efficiency of monitoring API interface calls and reducing labor costs.

[0071] It will be appreciated by those skilled in the art that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0072] In the embodiments of the present application, the disclosed systems, devices and methods can be implemented in other ways. For example, the division of units is only a logical function division, and there can be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system. In addition, the coupling between the various units can be direct coupling or indirect coupling. In addition, the various functional units in the embodiments of the present application can be integrated into a processing unit, or can be separate physical existences, etc.

[0073] It should be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0074] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a machine-readable storage medium. Therefore, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a machine-readable storage medium, which can include several instructions to enable an electronic device to perform all or part of the technical solution described in the embodiments of the present application. The above-mentioned storage medium may include various media that can store program codes, such as ROM, RAM, removable disk, hard disk, magnetic disk or optical disk.

[0075] The above contents are only specific implementation methods of the present application, and the protection scope of the present application is not limited thereto. Those skilled in the art may make changes or substitutions within the technical scope disclosed in the present application, and these changes or substitutions shall be within the protection scope of the present application.

Claims

1. An API management method, characterized in that: The method comprises: Deploy the API interface on distributed servers; Collect historical API interface data as a training set for training to obtain an API interface anomaly prediction model; When requesting to call an API interface to the API gateway, the API interface anomaly prediction model is used to predict in real time whether an anomaly will occur on the server after the API interface is called; The API interface data includes historical interface traffic data and historical interface attack behavior data; The continuous time periods in the historical interface traffic data are used as independent variables, and the statistical traffic corresponding to each time period is used as the dependent variable to establish multiple regression models; by discovering the internal correlation between the dependent variable and the independent variable, a linear function of the dependent variable and the independent variable is constructed for fitting; multiple regression models are screened according to the confidence and root mean square error of each regression model, and regression equations with a confidence greater than 0.7 and a root mean square error less than 0.04 are selected to predict future traffic data; First, the attack behavior features in the collected data are manually annotated, and the supervised learning method is used; the basic log information is used as input, and the annotated key performance indicators are used as output. The comprehensive impact factor is used as the division standard. The SVM algorithm is used to train the samples with the comprehensive impact factor in the first 90% of its interval, and the multi-layer feedforward network optimized by the genetic algorithm is used to train the samples with the comprehensive impact factor in the last 10% of its interval. The API interface attack anomaly prediction model based on the multi-layer feedforward network and the SVM composite algorithm is constructed; The API gateway processes the request according to the predicted result.

2. The API management method according to claim 1, characterized in that: The historical interface traffic data is trained through a regression model to obtain an API interface traffic anomaly prediction model, and the API interface traffic anomaly prediction model is used to predict in real time whether the requested API interface will have traffic anomalies; if the API interface is predicted to have traffic anomalies, the API gateway limits the number of requests for calling the API interface.

3. The API management method according to claim 1, characterized in that: The historical interface attack behavior data is trained through a supervised learning model to obtain an API interface attack anomaly prediction model, and the API interface attack anomaly prediction model is used to predict in real time whether the requested API interface will be attacked abnormally; if the API interface is predicted to be attacked abnormally, the API gateway will issue an early warning for the API interface.

4. The API management method according to claim 1, characterized in that: Deploying the API interface on a distributed server includes: The parameters of the API interface are modified and maintained on the distributed server.

5. An API management system, characterized in that: include: Deployment module, used to deploy API interfaces on distributed servers; Collection module, used to collect historical API interface data; A training module, used to train the historical API interface data to obtain an API interface anomaly prediction model; The prediction module is used to predict in real time whether an abnormality will occur on the server after the API interface is called through the API interface abnormality prediction model when requesting the API gateway to call the API interface; The API interface data includes historical interface traffic data and historical interface attack behavior data; The continuous time periods in the historical interface traffic data are used as independent variables, and the statistical traffic corresponding to each time period is used as the dependent variable to establish multiple regression models; By discovering the internal correlation between the dependent variable and the independent variable, a linear function of the dependent variable and the independent variable is constructed for fitting; Multiple regression models were screened according to the confidence and root mean square error of each regression model, and regression equations with a confidence greater than 0.7 and a root mean square error less than 0.04 were selected to predict future traffic data; First, the attack behavior features in the collected data are manually labeled, using a supervised learning method; The basic log information is used as input, the annotated key performance indicators are used as output, and the comprehensive impact factor is used as the classification standard. The SVM algorithm is used to train the samples with the comprehensive impact factor in the first 90% of its interval, and the multi-layer feedforward network optimized by the genetic algorithm is used to train the samples with the comprehensive impact factor in the last 10% of its interval. The API interface attack anomaly prediction model based on the multi-layer feedforward network and the SVM composite algorithm is constructed; The processing module is used for the API gateway to process the request according to the predicted result.

6. The API management system according to claim 5, characterized in that: Also includes: A maintenance module is used to modify and maintain the parameters of the API interface on the distributed server.

7. An API management device, comprising at least one processor; a memory coupled to the at least one processor, the memory storing executable instructions, characterized in that: The executable instructions, when executed by the at least one processor, enable the steps of the method according to any one of claims 1 to 4 to be implemented.

8. A chip, characterized in that: It comprises a processor, which is used to call and run a computer program from a memory, so that a device equipped with the chip executes the steps of the method as claimed in any one of claims 1 to 4.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images