A honeypot generation method for Web API

Abstract

The present invention provides a method for generating a honey spot for a Web API, which belongs to the field of network security. The specific technical solution is as follows: obtaining open source website source code, pre-processing it, and constructing a training set; training a word2vec model based on the training set to obtain a parameter generation model; parsing Web API information provided by the user to obtain request parameters and the request method corresponding to the request parameters; inputting the request parameters into the parameter generation model to obtain deceptive parameters; and constructing a deceptive honey spot based on the deceptive parameters and the request method corresponding to the deceptive parameters; when attacked, parsing traffic to obtain the attacker's request parameters and the corresponding attack method; updating the training set based on the attacker's request parameters and the corresponding attack method; updating the parameter generation model based on the updated training set, and updating the deceptive honey spot. The present invention can more comprehensively and effectively protect Web APIs, providing a more effective solution in the field of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for generating a honeypot for a Web API. Background Art

[0002] A Web Application Programming Interface (API) is an advanced technology that enables different software applications, particularly web and mobile applications, to interact with each other over the Internet. Web APIs provide users with a convenient and efficient way to access and use a variety of online services and resources, such as social media content, data storage services, and online payment processing.

[0003] With the widespread use of Web APIs in modern networks and applications, they have also become one of the main targets of network attacks. Attackers often look for and exploit vulnerabilities in Web APIs to conduct unauthorized data access, service disruption, or other malicious activities. The most difficult and difficult to prevent attacks include Web API parameter tampering and Web API brute force discovery. Web API parameter tampering refers to attackers changing the parameters in API requests to access or leak sensitive data. For example, a user can only access their basic information, but by changing the request parameters, an attacker may access other users' information. Web API brute force discovery refers to attackers using brute force enumeration methods to detect and find real API interfaces and parameters.

[0004] A common defense strategy against various attack methods in current network environments is rule-based detection. This defense mechanism relies primarily on a set of fixed, predefined rules or signatures to identify and intercept malicious behavior. However, this approach has certain limitations when addressing Web API security. Because rule-based detection systems rely too heavily on predefined rules to identify malicious behavior, they often lack flexibility and accuracy when assessing complex network behaviors. Web API usage scenarios are extensive and diverse, making it difficult for a static, rule-based defense system to adapt to these ever-changing usage patterns. For example, normal development and testing activities may trigger these predefined rules and be mistakenly identified as attack attempts. While rule-based detection can provide effective security protection in some cases, its limitations prevent it from providing comprehensive and effective protection against attacks when addressing Web API security issues. Therefore, a solution is needed to address these issues. Summary of the Invention

[0005] (one) Technical problems solved

[0006] In response to the shortcomings of the existing technology, the present invention provides a method for generating honey spots for Web APIs, which can generate corresponding honey spots based on the real Web APIs provided by users. These honey spots can not only lure attackers to attack, thereby reducing the attack pressure on the real system, but also accurately track and capture the attacker's behavior by monitoring the status of parameters, and automatically update the honey spots based on the attacker's information, so that the honey spots can continuously learn and adapt to the latest attack patterns and techniques, and can provide more comprehensive and effective protection.

[0007] (two) Technical Solution

[0008] The purpose of the present invention is to provide a method for generating a honeypot of a Web API, which can improve the problem in the prior art that it is unable to fully and effectively defend against attacks.

[0009] The present invention provides a method for generating a honeypot of a Web API, comprising:

[0010] Obtain the source code of the open source website and pre-process it to build a training set. Based on the training set, train the word2vec model to obtain the parameter generation model.

[0011] Parsing the Web API information provided by the user to obtain request parameters and the request method corresponding to the request parameters, inputting the request parameters into a parameter generation model to obtain deceptive parameters, constructing a deceptive honeyspot based on the deceptive parameters and the request method corresponding to the deceptive parameters, and deploying the deceptive honeyspot on the user's network;

[0012] A monitor is used to monitor user network traffic in real time. When an attack is detected, the traffic is parsed to obtain the attacker's request parameters and the corresponding attack method. The training set is updated based on the attacker's request parameters and the corresponding attack method. The parameter generation model is updated based on the updated training set, and the deceptive honey spots are updated.

[0013] Optionally, when obtaining the source code of an open source website, the source code is Java language code. When constructing a training set after preprocessing the source code of the open source website, the training set is constructed after extracting the method names, method parameters, class constructors and parameters, class fields and variable names in the source code.

[0014] Optionally, when parsing the Web API information provided by the user, an interface file of the user's Web API is obtained and the interface file is parsed.

[0015] In addition, after obtaining the request parameters and the request method corresponding to the request parameters, the interface file, the request parameters and the request method are stored in a parameter database.

[0016] Optionally, when using a monitor to monitor user network traffic in real time, the user network traffic is monitored in real time based on the Python scapy library.

[0017] In addition, when judging whether a deceptive honey spot has been attacked through traffic, if it is found that the traffic contains deceptive parameters or the user's request parameters have been tampered with, the attacker's request parameters and request method will be sent to the response system for processing, and an alert will be sent to the security team by email. The response system is a system based on the GPT agent that can generate reasonable response content for the attacker's request parameters and request method.

[0018] In addition, when sending it to the response system for processing, the text similarity is calculated to determine whether there is data in the database similar to the attack request information. If so, the corresponding return information in the response database is returned, where the response database is used to store the attacker's request parameters, request method and the return information given by ChatGPT; if not, the complete content is formed through the GPT agent and sent to ChatGPT for processing.

[0019] In addition, when sent to ChatGPT for processing, ChatGPT will give the corresponding return information and save the attack request parameters and the corresponding return information given by ChatGPT into the response database.

[0020] Optionally, when updating the parameter generation model based on the updated training set and updating the deceptive honeyspots, the word2vec model is retrained based on the newly collected dataset after a fixed time interval, and new deceptive honeyspots are obtained using the retrained word2vec model.

[0021] (three) Beneficial effects

[0022] Compared with the prior art, the present invention provides a honey spot generation method for a Web API, which has the following beneficial effects: the present invention adopts advanced artificial intelligence technology and can customize personalized honey spots based on user-provided information to meet the user's specific security needs. The automated generation of honey spots significantly improves the flexibility and efficiency of honey spot generation, and the automation capability of the core generation system also significantly reduces labor costs. The response system based on ChatGPT records each request and its corresponding ChatGPT-generated response in a database. When the system encounters a similar request again, it can quickly retrieve the previous response from the database, which not only improves the response speed but also ensures consistency and high fidelity. The system can also make simple modifications to the stored responses to adapt to the new request environment, ensuring the relevance and real-time nature of the responses. Fixed time intervals are set, and the word2vec model is retrained at these time points based on newly collected data sets. In this way, the honey spot system continuously learns and adapts to the latest attack patterns and techniques, thereby continuously improving its deceptiveness and effectiveness, providing a more economical and effective solution in the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is an overall flow chart of a honeypoint generation method for a Web API;

[0024] Figure 2 This is a structural diagram of all systems of a honeypoint generation method for Web AP I;

[0025] Figure 3 This is the structural diagram of the simulation training system;

[0026] Figure 4 Generate a structural diagram of the system for the core;

[0027] Figure 5 This is the structural diagram of the back-end monitoring system and the back-end response system. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the present invention belongs.

[0029] refer to Figure 1, an example of the present invention provides a method for generating honey spots of a Web AP I.

[0030] Obtain the source code of the open source website and pre-process it to build a training set. Based on the training set, train the word2vec model to obtain the parameter generation model.

[0031] Parsing the Web API information provided by the user to obtain request parameters and the request method corresponding to the request parameters, inputting the request parameters into a parameter generation model to obtain deceptive parameters, constructing a deceptive honeyspot based on the deceptive parameters and the request method corresponding to the deceptive parameters, and deploying the deceptive honeyspot on the user's network;

[0032] A monitor is used to monitor user network traffic in real time. When an attack is detected, the traffic is parsed to obtain the attacker's request parameters and the corresponding attack method. The training set is updated based on the attacker's request parameters and the corresponding attack method. The parameter generation model is updated based on the updated training set, and the deceptive honey spots are updated.

[0033] refer to Figure 2 ,The honey spot generation system includes the following five main components: model training ,system, core generation system, back-end monitoring system, back-end response ,system and MySQL database system (a widely used open source relational ,data management system).

[0034] Specifically, the simulation training system crawls the source code of open source websites and performs data preprocessing, extracts key parameters from the source code as the initial training set and backs it up, then uses this data to train the word2vac model and generate a model file, providing a basis for subsequent intelligent honeyspot generation.

[0035] Specifically, the core generation system first parses the Web API input by the user, extracts parameter information and stores it in a parameter database, uses the word2vec model to heat-process these parameters, generates deceptive request parameters, and then saves this information into a honeyspot database; the system presets a back-end code framework based on Fl ask (a lightweight Web application framework written in Python), which can automatically fill in the code according to the deceptive request parameters, generate dockerfile (a text file that defines how to build a Docker image) and related Docker (an open source containerization technology) files, and then build honeyspots.

[0036] Furthermore, the system also includes a honey spot update function. The core generation system will pass the attacker parameter information to the model training system, regularly use the updated data set to train a new word2vec model, and generate new honey spots based on the new model.

[0037] Specifically, the backend monitoring system uses monitors to monitor the access of fraudulent request parameters and whether the user's WebAP I parameters have been modified. If any abnormality or tampering behavior is detected, the relevant information will be forwarded to the backend response system.

[0038] Specifically, the backend response system uses the GPT proxy to combine the attacker's request with the predefined prompt word template to form a complete query content, which is sent to ChatGPT for processing. ChatGPT generates reasonable response content based on this information.

[0039] Specifically, the MySQL database system is used to store user Web API request parameters, generated deceptive request parameters, attacker request parameters, and ChatGPT response information. This data provides necessary information support for the operation of the system and helps to continuously optimize system performance.

[0040] refer to Figure 3 ,The design details of the simulation training system include three parts: an ,opensource website crawler system, a data preprocessing system, and a core ,training system;

[0041] Specifically, the open source website crawler system uses the GHTorrent dataset available on the Internet, which records information about code submissions on GitHub (a Git-based code hosting and version control service platform). Based on this dataset, all systems written in Java on Github are screened out, and systems with names containing the keywords "Android" and "mobile" are deleted. The code of the remaining datasets is downloaded using the API provided by GitHub.

[0042] Specifically, the data preprocessing system uses Python's java library (a Python library for parsing Java source code) to parse these codes, extract information such as method names, method parameters, class constructors and parameters, class fields, and variable names, save them as text files, and back them up, which are used as the initial training set to train the word2vec model.

[0043] Specifically, the core training system uses Python's gens im library (a Python library specifically for natural language processing) to train the word2vec model using the parameters we set and saves the model locally for subsequent use.

[0044] refer to Figure 4 ,The design details of the core generation system include three parts: the ,interface parsing system, the honey spot generation system and the ,honey spot update system;

[0045] Specifically, the interface parsing system requires users to provide their own Web API information. This information must be an interface file that complies with the Swagger specification (which defines a set of standard, language-independent interfaces) and is in JSON format. The provided Web API JSON file is parsed using Python's json library to obtain the parameters and corresponding request methods required for requesting the user API, and these parameters are saved in a parameter database in a MySQL database. The trained word2vec model is then loaded using Python's gensim library, and the parameters required for requesting the user API are used as input. The model then returns five similar parameters and their similarity scores. The first parameter with a similarity greater than 0.6 is retained, indicating that this parameter is a deceptive API parameter.

[0046] Specifically, the honeyspot generation system presets a Fl ask service template, which automatically generates the Fl ask service code after providing the request parameters and request method. The return content in the code is completed by the back-end response system; the Fl ask service module is used as the input of the dockerfile template, which can automatically generate the dockerfile according to the deceptive API parameters and its corresponding request method. The Fl ask service code and dockerfile file can then be generated. After that, the Docker Python SDK in Python (the Python version SDK officially provided by Docker) can be used to build the Web API honeyspot docker.

[0047] Specifically, the honey spot update system uses the celery library (a distributed system for processing large amounts of messages) to regularly run the core training system of the simulation training system to generate a new word2vec model, obtain the parameters required to request the user API from the parameter database as the input of the new model, generate new deceptive API parameters, destroy the existing Web API honey spot docker, re-run the honey spot generation system, and generate a new Web API honey spot docker.

[0048] refer to Figure 5 ,Design details of the back-end monitoring system and the back-end response system.,The back-end monitoring system consists of two parts: monitoring,forwarding system and alarm system; the back-end response system consists of three parts:,traffic analysis system, intelligent return system and GPT agent;

[0049] Specifically, the monitoring and forwarding system uses Python's scapy library (a Python program for interactive packet operations) to monitor traffic in real time. If it is found that the traffic contains fraudulent API parameters or the parameters required by the user API are tampered with, the traffic will be forwarded to the back-end response system, and the alarm system will send an alarm to the security team by email.

[0050] Specifically, the traffic analysis system extracts the request information of the traffic forwarded by the monitoring and forwarding system, and determines whether there is data similar to the attack request information in the response database by calculating the text similarity in the intelligent return system; if there is, the corresponding return in the response database will be simply modified and returned; if not, the attacker's request will be combined with the predefined prompt word template through the GPT agent to form a complete query content and send it to ChatGPT for processing. ChatGPT will give the content to be returned and save the request information and the return given by ChatGPT to the response database; the intelligent return system will also parse the attacker's request information and save the request parameters in it to the response database.

[0051] The MySQL database system consists of three parts: parameter database, honeypot database, and response database;

[0052] Specifically, the parameter database stores the parameters required for requesting the user's Web API, the corresponding request method, and the specific contents of the Web API json file; the honeypot database stores the parameters required for requesting the user's Web API, deceptive parameters, and the corresponding request method. The parameters required for requesting the user's Web API will serve as foreign keys in the parameter database; the response database stores the attacker's request information, request parameters, and the return information given by ChatGPT.

[0053] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A method for generating a honeypot for a Web API, characterized in that: include: Obtain the source code of the open source website and pre-process it to build a training set. Based on the training set, train the word2vec model to obtain the parameter generation model. Parsing the Web API information provided by the user to obtain request parameters and the request method corresponding to the request parameters, inputting the request parameters into a parameter generation model to obtain deceptive parameters, constructing a deceptive honey spot based on the deceptive parameters and the request method corresponding to the deceptive parameters, and deploying the deceptive honey spot on the user's network; Use a monitor to monitor user network traffic in real time, parse the traffic to obtain the attacker's request parameters and corresponding attack methods when an attack is detected, update the training set based on the attacker's request parameters and corresponding attack methods, update the parameter generation model based on the updated training set, and update the deceptive sweet spot; wherein, when judging whether the deceptive sweet spot has been attacked through traffic, if it is found that the traffic contains deceptive parameters or the user's request parameters have been tampered with, the attacker's request parameters and request method will be sent to the response system for processing, and an alert will be sent to the security team by email, wherein the response system is a system based on the GPT agent that can generate reasonable response content for the attacker's request parameters and request method; When sending it to the response system for processing, the text similarity is calculated to determine whether there is data similar to the attack request information in the response database. If so, the corresponding return information in the response database is returned, where the response database is used to store the attacker's request parameters, request method and the return information given by ChatGPT; if not, the complete content is formed through the GPT proxy and sent to ChatGPT for processing; When sent to ChatGPT for processing, ChatGPT will give the corresponding return information and save the attack request parameters, request method and the corresponding return information given by ChatGPT into the response database.

2. The honey spot generation method according to claim 1, characterized in that: When obtaining the source code of an open source website, the source code is Java language code.

3. The honey spot generation method according to claim 1, characterized in that: When constructing a training set after obtaining and pre-processing the source code of the open source website, the method names, method parameters, class constructors and parameters, class fields and variable names in the source code are extracted to construct the training set.

4. The honey spot generation method according to claim 1, wherein: When parsing the Web API information provided by the user, the interface file of the user's Web API is obtained and the interface file is parsed.

5. The honey spot generation method according to claim 4, characterized in that: After obtaining the request parameters and the request method corresponding to the request parameters, the interface file, the request parameters and the request method are stored in a parameter database.

6. The honey spot generation method according to claim 1, characterized in that: When a monitor is used to monitor user network traffic in real time, the user network traffic is monitored in real time based on the Python scapy library.

7. The honey spot generation method according to claim 1, characterized in that: When updating the parameter generation model based on the updated training set and updating the deceptive honey spots, the word2vec model is retrained based on the newly collected dataset after a fixed time interval, and new deceptive honey spots are obtained using the retrained word2vec model.

Images