Honey point generation method of Web API (Application Program Interface)

Abstract

The invention provides a honey point generation method of a Web API (Application Program Interface), and belongs to the field of network security. According to the specific technical scheme, after open source website source codes are obtained and preprocessed, a training set is constructed, and a word2vec model is trained based on the training set to obtain a parameter generation model; analyzing Web API information provided by a user to obtain a request parameter and a request mode corresponding to the request parameter, inputting the request parameter into a parameter generation model to obtain a deceptive parameter, and constructing a deceptive honey point based on the deceptive parameter and the request mode corresponding to the deceptive parameter; when an attack occurs, analyzing the traffic to obtain a request parameter of an attacker and a corresponding attack mode, updating the training set based on the request parameter of the attacker and the corresponding attack mode, updating a parameter generation model based on the updated training set, and updating the deceptive honey point; according to the invention, the Web API can be protected more comprehensively and effectively, and a more effective solution is provided in the field of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for generating a honey spot of a Web API. Background Art

[0002] Web Application Programming Interface (API) is an advanced technology that allows different software applications, especially web and mobile applications, to interact with each other through the Internet. Web API provides users with a convenient and efficient way to obtain and use various online services and resources, such as social media content, data storage services, online payment processing, etc.

[0003] With the widespread use of Web APIs in modern networks and applications, they have also become one of the main targets of network attacks. Attackers often look for and exploit vulnerabilities in Web APIs to perform unauthorized data access, service interference or other malicious behaviors. The most difficult and difficult to prevent attacks include Web API parameter tampering and Web API brute force discovery; Web API parameter tampering refers to an attacker accessing or leaking sensitive data by changing the parameters in the API request. For example, a user can only access his or her basic information, but by changing the request parameters, the attacker may access other users' information; Web API brute force discovery refers to an attacker enumerating through brute force methods to detect and find the real API interfaces and parameters.

[0004] In response to various attack methods in the current network environment, the commonly used defense strategy is rule-based detection. This defense mechanism mainly relies on a series of fixed and pre-defined rules or features to identify and intercept malicious behaviors. This method has certain limitations when dealing with Web API security. Since the rule-based detection system relies too much on preset rules when identifying malicious behaviors, it often lacks flexibility and accuracy when judging complex network behaviors. The usage scenarios of Web API are extensive and changeable. A static, rule-based defense system is difficult to adapt to these changing usage patterns; for example, some normal development and testing activities may trigger these preset rules and be mistakenly identified as attack attempts. Although rule-based detection can provide effective security protection in some cases, its limitations make it unable to provide comprehensive and effective protection when dealing with Web API security issues. Therefore, a solution is needed to improve the above problems. Summary of the invention

[0005] (one) Technical issues solved

[0006] In view of the deficiencies in the prior art, the present invention provides a method for generating honey spots for a Web API, which can generate corresponding honey spots based on a real Web API provided by a user. These honey spots can not only lure attackers to attack, thereby reducing the attack pressure on the real system, but also accurately track and capture the attacker's behavior by monitoring the status of parameters, and automatically update the honey spots based on the attacker's information, so that the honey spots can continuously learn and adapt to the latest attack patterns and techniques, and can provide more comprehensive and effective protection.

[0007] (two) Technical Solution

[0008] The purpose of the present invention is to provide a method for generating a honey spot of a Web API, which can improve the problem in the prior art that it is impossible to fully and effectively defend against attacks.

[0009] The present invention provides a method for generating a honey spot of a Web API, comprising:

[0010] Obtain the source code of the open source website and preprocess it to build a training set. Train the word2vec model based on the training set to obtain the parameter generation model.

[0011] Parsing the Web API information provided by the user to obtain request parameters and request methods corresponding to the request parameters, inputting the request parameters into a parameter generation model to obtain deceptive parameters, constructing deceptive honey spots based on the deceptive parameters and the request methods corresponding to the deceptive parameters, and deploying the deceptive honey spots to the user network;

[0012] A monitor is used to monitor user network traffic in real time. When an attack is detected, the traffic is parsed to obtain the attacker's request parameters and the corresponding attack method. The training set is updated based on the attacker's request parameters and the corresponding attack method. The parameter generation model is updated based on the updated training set, and the deceptive honey spots are updated.

[0013] Optionally, when obtaining the source code of an open source website, the source code is a Java language code. When constructing a training set after preprocessing the source code of the open source website, the training set is constructed after extracting the method name, method parameters, class constructor and parameters, class fields and variable names in the source code.

[0014] Optionally, when parsing the Web API information provided by the user, an interface file of the user's Web API is obtained and the interface file is parsed.

[0015] In addition, after obtaining the request parameters and the request method corresponding to the request parameters, the interface file, the request parameters and the request method are stored in a parameter database.

[0016] Optionally, when a monitor is used to monitor user network traffic in real time, the user network traffic is monitored in real time based on the Python scapy library.

[0017] In addition, when judging whether a deceptive honey spot has been attacked through traffic, if it is found that the traffic contains deceptive parameters or the user's request parameters have been tampered with, the attacker's request parameters and request method will be sent to the response system for processing, and an alert will be sent to the security team by email. The response system is a system based on the GPT agent that can generate reasonable response content for the attacker's request parameters and request method.

[0018] In addition, when it is sent to the response system for processing, the text similarity is calculated to determine whether there is data in the database that is similar to the attack request information. If so, the corresponding return information in the response database is returned, where the response database is used to store the attacker's request parameters, request method and return information given by ChatGPT; if not, the complete content is formed through the GPT agent and sent to ChatGPT for processing.

[0019] In addition, when sent to ChatGPT for processing, ChatGPT will give the corresponding return information and save the attack request parameters and the corresponding return information given by ChatGPT into the response database.

[0020] Optionally, when updating the parameter generation model based on the updated training set and updating the deceptive honey spots, after a fixed time interval, the word2vec model is retrained according to the newly collected data set, and new deceptive honey spots are obtained using the retrained word2vec model.

[0021] (three) Beneficial Effects

[0022] Compared with the prior art, the present invention provides a honey spot generation method for a Web API, which has the following beneficial effects: the present invention adopts advanced artificial intelligence technology, can customize personalized honey spots based on information provided by users, can meet users' specific security needs, and the automatic generation of honey spots significantly improves the flexibility and efficiency of honey spot generation. The automation capability of the core generation system also significantly reduces labor costs; based on the response system of ChatGPT, the system will record each request and its corresponding ChatGPT-generated response in a database. When the system encounters a similar request again, it can quickly retrieve the previous response from the database, which not only improves the response speed, but also ensures consistency and high fidelity. The system can also make simple modifications to the stored responses to adapt to the new request environment, ensuring the relevance and real-time nature of the responses; fixed time intervals are set, and the word2vec model will be retrained at these time points based on the newly collected data set. In this way, the honey spot system continuously learns and adapts to the latest attack patterns and techniques, thereby continuously improving its deceptiveness and effectiveness, providing a more economical and effective solution in the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is an overall flow chart of a honey spot generation method of a Web API;

[0024] Figure 2 It is a structural diagram of all systems of a honey spot generation method of Web API;

[0025] Figure 3 This is a structural diagram of the simulation training system;

[0026] Figure 4 Generate a structural diagram of the system for the core;

[0027] Figure 5 This is a structural diagram of the backend monitoring system and the backend response system. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with general skills in the field to which the present invention belongs.

[0029] refer to Figure 1, an example of the present invention provides a method for generating honey spots of a Web API.

[0030] Obtain the source code of the open source website and preprocess it to build a training set. Train the word2vec model based on the training set to obtain the parameter generation model.

[0031] Parsing the Web API information provided by the user to obtain request parameters and request methods corresponding to the request parameters, inputting the request parameters into a parameter generation model to obtain deceptive parameters, constructing deceptive honey spots based on the deceptive parameters and the request methods corresponding to the deceptive parameters, and deploying the deceptive honey spots to the user network;

[0032] A monitor is used to monitor user network traffic in real time. When an attack is detected, the traffic is parsed to obtain the attacker's request parameters and the corresponding attack method. The training set is updated based on the attacker's request parameters and the corresponding attack method. The parameter generation model is updated based on the updated training set, and the deceptive honey spots are updated.

[0033] refer to Figure 2 ,The honey spot generation system includes the following five main components: model training ,system, core generation system, back-end monitoring system, back-end response ,system and MySQL database system (a widely used open source relational ,data management system).

[0034] Specifically, the simulation training system crawls the source code of the open source website and performs data preprocessing, extracts key parameters from the source code as the initial training set and backs it up, and then uses this data to train the word2vac model and generate a model file, providing a basis for subsequent intelligent honey spot generation.

[0035] Specifically, the core generation system first parses the Web API input by the user, extracts parameter information and stores it in the parameter database, uses the word2vec model to heat-process these parameters, generates deceptive request parameters, and then saves this information into the honeyspot database; the system presets a back-end code framework based on Fl ask (a lightweight Web application framework written in Python), which can automatically fill in the code according to the deceptive request parameters, generate dockerfile (a text file that defines how to build a Docker image) and related Docker (an open source containerization technology) files, and then build a honeyspot.

[0036] Furthermore, the system also includes a honey spot update function. The core generation system will pass the attacker parameter information to the model training system, regularly use the updated data set to train a new word2vec model, and generate new honey spots based on the new model.

[0037] Specifically, the backend monitoring system uses a monitor to monitor the access of fraudulent request parameters and whether the user's WebAPI parameters have been modified. If any abnormality or tampering behavior is detected, the relevant information will be forwarded to the backend response system.

[0038] Specifically, the backend response system uses the GPT agent to combine the attacker's request with the predefined prompt word template to form a complete query content, which is sent to ChatGPT for processing. ChatGPT generates reasonable response content based on this information.

[0039] Specifically, the MySQL database system is used to store user Web API request parameters, generated deceptive request parameters, attacker's request parameters, and ChatGPT's response information. These data provide necessary information support for the operation of the system and help to continuously optimize system performance.

[0040] refer to Figure 3 ,The design details of the simulation training system include three parts: an open source website crawler system, a data preprocessing system and a core training system;

[0041] Specifically, the open source website crawler system uses the GHTorrent dataset on the Internet, which records the information of code submissions on GitHub (a code hosting and version control service platform based on Git). According to this dataset, all systems made in Java language on Github are screened out, and the systems whose names contain the keywords Android and mobile are deleted. The API provided by GitHub is used to download the codes of the remaining datasets.

[0042] Specifically, the data preprocessing system uses Python's java library (a Python library for parsing Java source code) to parse the codes, extract method names, method parameters, class constructors and parameters, class fields, and variable names, and saves them as text files and backs them up, which are used as the initial training set to train the word2vec model.

[0043] Specifically, the core training system uses Python's gens im library (a Python library specifically for natural language processing) to train the word2vec model using the parameters we set, and saves the model locally for subsequent use.

[0044] refer to Figure 4 ,The design details of the core generation system include three parts: the ,interface parsing system, the honey spot generation system and the ,honey spot update system;

[0045] Specifically, the interface parsing system requires users to provide their own Web API information, which must be an interface file that complies with the Swagger specification (which defines a set of standard, language-independent interfaces) and is in json format; the Python json library is used to parse the provided Web API json file, obtain the parameters required for requesting the user API and the corresponding request method, and save them to the parameter database in the MySQL database; then the Python gensim library is used to load the trained word2vec model, and the parameters required for requesting the user API are used as input. The model then returns five similar parameters and their similarities, and the first parameter with a similarity greater than 0.6 is retained, which is the deceptive API parameter.

[0046] Specifically, the honeyspot generation system presets a F l ask service template, which will automatically generate the F l ask service code after providing the request parameters and request method, and the return content in the code is completed by the back-end response system; the F l ask service module is used as the input of the dockerfile template, and can automatically generate the dockerfile according to the deceptive API parameters and its corresponding request method. Then, the Docker Python SDK in Python (the Python version SDK officially provided by Docker) can be used to build the Web API honeyspot docker.

[0047] Specifically, the honey spot update system uses the celery library (a distributed system for processing a large number of messages) to regularly run the core training system of the simulation training system to generate a new word2vec model, obtains the parameters required to request the user API from the parameter database as the input of the new model, generates new deceptive API parameters, destroys the existing Web API honey spot docker, re-runs the honey spot generation system, and generates a new Web API honey spot docker.

[0048] refer to Figure 5 ,Design details of the backend monitoring system and the backend response system.,The backend monitoring system consists of two parts: monitoring,forwarding system and alarm system; the backend response system consists of three parts:,traffic analysis system, intelligent return system and GPT agent;

[0049] Specifically, the monitoring and forwarding system uses Python's scapy library (a Python program for interactive packet operations) to monitor traffic in real time. If it is found that the traffic contains deceptive API parameters or the parameters required by the user API are tampered with, the traffic will be forwarded to the back-end response system, and the alarm system will send an alarm to the security team by email.

[0050] Specifically, the traffic analysis system extracts the request information of the traffic forwarded by the monitoring forwarding system, and determines whether there is data similar to the attack request information in the response database by calculating the text similarity in the intelligent return system; if there is, the corresponding return in the response database will be simply modified and returned; if not, the attacker's request is combined with the predefined prompt word template through the GPT agent to form a complete query content and send it to ChatGPT for processing. ChatGPT will give the content to be returned, and save the request information and the return given by ChatGPT to the response database; the intelligent return system will also parse the attacker's request information and save the request parameters in it to the response database.

[0051] The MySQL database system consists of three parts: parameter database, honey spot database, and response database;

[0052] Specifically, the parameter database stores the parameters required for requesting the user's Web AP I and the corresponding request method, as well as the specific content of the Web AP I json file; the honey spot database stores the parameters required for requesting the user's Web AP I, deceptive parameters and the corresponding request method, and the parameters required for requesting the user's Web AP I will be used as foreign keys in the parameter database; the response database stores the attacker's request information, request parameters and the return information given by ChatGPT.

[0053] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A method for generating a honey spot of a Web API, characterized in that: include: Obtain the source code of the open source website and preprocess it to build a training set. Train the word2vec model based on the training set to obtain the parameter generation model. Parsing the Web API information provided by the user to obtain request parameters and request methods corresponding to the request parameters, inputting the request parameters into a parameter generation model to obtain deceptive parameters, constructing deceptive honey spots based on the deceptive parameters and the request methods corresponding to the deceptive parameters, and deploying the deceptive honey spots to the user network; A monitor is used to monitor user network traffic in real time. When an attack is detected, the traffic is parsed to obtain the attacker's request parameters and the corresponding attack method. The training set is updated based on the attacker's request parameters and the corresponding attack method. The parameter generation model is updated based on the updated training set, and the deceptive honey spots are updated.

2. The method for generating a honey spot according to claim 1, characterized in that: When the source code of the open source website is obtained, the source code is a Java language code.

3. The method for generating a honey spot according to claim 1, characterized in that: When constructing a training set after obtaining the source code of the open source website and preprocessing it, the training set is constructed after extracting the method name, method parameters, class constructor and parameters, class fields and variable names in the source code.

4. The method for generating a honey spot according to claim 1, characterized in that: When parsing the Web API information provided by the user, the interface file of the user's Web API is obtained and the interface file is parsed.

5. The method for generating a honey spot according to claim 4, characterized in that: After obtaining the request parameters and the request method corresponding to the request parameters, the interface file, the request parameters and the request method are stored in a parameter database.

6. The dense point generation method according to claim 1, characterized in that: When a monitor is used to monitor user network traffic in real time, the user network traffic is monitored in real time based on the Python scapy library.

7. The method for generating a honey spot according to claim 6, characterized in that: When judging whether a deceptive honey spot has been attacked through traffic, if it is found that the traffic contains deceptive parameters or the user's request parameters have been tampered with, the attacker's request parameters and request method will be sent to the response system for processing, and an alert will be sent to the security team by email. The response system is a system based on the GPT agent that can generate reasonable response content for the attacker's request parameters and request method.

8. The method for generating a honey spot according to claim 7, characterized in that: When it is sent to the response system for processing, the text similarity is calculated to determine whether there is data in the database that is similar to the attack request information. If so, the corresponding return information in the response database is returned, where the response database is used to store the attacker's request parameters, request method and return information given by ChatGPT; if not, the complete content is formed through the GPT proxy and sent to ChatGPT for processing.

9. The method for generating a honey spot according to claim 8, characterized in that: When sent to ChatGPT for processing, ChatGPT will give the corresponding return information and save the attack request parameters and the corresponding return information given by ChatGPT into the response database.

10. The method for generating a honey spot according to claim 1, characterized in that: When the parameter generation model is updated based on the updated training set and the deceptive honey spots are updated, the word2vec model is retrained according to the newly collected data set after a fixed time interval, and new deceptive honey spots are obtained using the retrained word2vec model.

Images