An analysis method, device, equipment and storage medium for interface security protection
By extracting and matrixing the interface traffic data, identifying and locating abnormal interface traffic, the problems of inaccurate identification and difficulty in positioning in the existing technology are solved, and high-accurate identification and positioning of malicious traffic are achieved, which enhances the Network security.
Patent Information
- Application Number
- CN202411659514.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-20
- Publication Date
- 2025-02-14
- Estimated Expiration
- 2044-11-20
AI Technical Summary
In the prior art, malicious traffic identification is inaccurate and difficult to locate, especially in API-related traffic analysis.
Through interface traffic data acquisition and preprocessing, the characteristics of interface traffic data are extracted, and the interface traffic data feature matrix is constructed. Through feature reorganization and the construction of key factor sets, abnormal interface traffic is identified and located.
It improves the accuracy of malicious traffic recognition, realizes accurate analysis of API call characteristics and precise positioning of malicious traffic, and enhances network security.
Smart Images
Figure CN119182608B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a malicious traffic identification and positioning system and method based on an application programming interface. Background Art
[0002] In today's digital age, network security faces severe challenges. The existence of malicious traffic may lead to serious consequences such as network congestion, data leakage, and system paralysis. Traditional malicious traffic detection methods often lack targeted analysis of application program interface (API)-related traffic, making it difficult to accurately identify and locate the source of malicious traffic. With the widespread use of APIs, malicious attacks against APIs are also increasing. Therefore, developing an effective API-based malicious traffic identification and location method is of great practical significance. Summary of the invention
[0003] The purpose of the present invention is to provide a malicious traffic identification and positioning system and method based on an application program interface to solve the problems of inaccurate malicious traffic identification and difficult positioning in the prior art.
[0004] The present invention provides an analysis method for interface security protection, comprising the following steps:
[0005] Step 1: Interface traffic data collection and preprocessing: collect interface traffic data in real time through network monitoring equipment, and preprocess the collected interface traffic data, including data cleaning, format conversion and other operations, to remove noise and invalid data and improve data quality;
[0006] Step 2: Extract interface traffic data features, using deep interface testing technology to identify interface calls in interface traffic data and extract interface traffic data features, the interface traffic data features include interface name, parameters, request frequency, response time, signal length, traffic average, traffic peak, fluctuation factor, connection duration, connection bytes and other parameter information;
[0007] Establish an interface traffic data feature matrix based on the sample quantity and feature dimensions of multiple interface traffic data , and is expressed by the following formula:
[0008]
[0009] in, Indicates the number of samples of traffic data for multiple interfaces, Indicates the characteristic dimension of interface traffic data;
[0010] The interface traffic data feature matrix The interface traffic characteristic variables are reorganized and a new interface traffic characteristic variable set is constructed. ;
[0011] In constructing a new interface traffic characteristic variable set In the process, we first construct a new interface traffic characteristic variable set. The key factors in In this process, the key factor set is first determined The contribution of And the interface traffic data characteristic matrix The correlation coefficient matrix determines the key factor set , which is specifically expressed by the following formula:
[0012]
[0013] in, Represents the key factor set Middle A key factor, Represents the interface traffic data feature matrix The coefficient eigenvector in the correlation coefficient matrix of ;
[0014] In determining the key factor set In the process of calculating the contribution of key factors, the following formula is used to calculate the key factor set Middle Key Factors Contribution:
[0015]
[0016] in, express The corresponding eigenvalue is Indicates key factors The contribution of represents the identity matrix, Representing the interface traffic data feature matrix;
[0017] In getting the key factor set Key factors After the contribution of the first L key factors is calculated in descending order The sum of the contributions of The sum of the contributions :
[0018]
[0019]
[0020] In determining the first L key factors The sum of the contributions When the sum of the contributions is greater than or equal to the preset threshold value T, the final number of L is determined, and the new interface traffic feature variable set is further screened and determined by the following formula: ;
[0021] in, Indicates that in determining the Lth key factor After the contribution of Identified set of key factors , and determine the new interface traffic characteristic variable set , Represents the screening conditions. The new interface traffic feature variable set is determined through the above process. ;
[0022] Step 3: interface traffic data identification, performing feature identification on the new interface traffic feature variable set through the pre-trained interface traffic data analysis model, and classifying the interface traffic data;
[0023] Step 4: locating the abnormal interface traffic data. When the interface traffic data type is abnormal, for the abnormal interface call, the source and propagation path of the abnormal interface traffic data are determined by analyzing the flow direction of the network traffic; and the specific interface location of the abnormal interface traffic data in the network is determined by using the abnormal interface traffic data model;
[0024] Step 5: Early warning and response: When an abnormal interface and its location information are identified, an early warning message is issued in a timely manner to notify the network administrator. According to the type and severity of the abnormality of the interface, preset response measures are taken to block malicious traffic and isolate infected devices.
[0025] Specifically, in step 3, when determining a new interface traffic characteristic variable set After that, feature matching is performed through the interface traffic data analysis model to obtain the matching probability of the interface traffic data type. In this process, feature matching is performed through the following formula:
[0026]
[0027] in, The type feature vector representing the pre-stored interface traffic data, represents any value of the amount of pre-stored interface traffic data, represents the smoothing factor;
[0028] The matching probability of the interface traffic data type after feature matching is calculated using the following formula:
[0029]
[0030] in, Indicates the probability of the interface traffic data type, Indicates the dimension of the pre-stored interface traffic data type. represents the smoothing factor;
[0031] Determine the final interface traffic data type through probability density function ,Right now ; In this way, it can be determined whether the interface traffic data type is abnormal.
[0032] Specifically, in step 4, the specific location of the abnormal interface call needs to be determined in the process of determining the source and propagation path of the interface abnormal traffic data by analyzing the flow direction of the network traffic. In this process, the initial abnormal interface transfers and transmits data to the adjacent interface for different times, and calculates the average transfer distance from the abnormal interface to other transfer interfaces:
[0033]
[0034] in, and Represents any two transfer interfaces , The coordinates of Represents any two transfer interfaces , The average transfer distance, express , Minimum number of transfers between interfaces;
[0035] After obtaining the average transfer distance, the abnormal interface will transmit the information of the average transfer distance to the outside, and the received information will only be stored in the initial transfer distance. Therefore, the other transfer interfaces of the abnormal interface receive the sum of the average transfer distance multiplied by the minimum transfer number of the abnormal interface connected to it, that is, the actual distance between the abnormal interface and other transfer interfaces, and according to the transfer relationship between the abnormal interface and other known transfer interfaces and the actual distance between the abnormal interface and other transfer interfaces, Axis and The components on the axes give the coordinates of the anomaly interface.
[0036] Specifically, in step 4, the above positioning process is repeated in combination with the collection frequency of the interface traffic data to complete the analysis of the interface security protection.
[0037] The present invention also provides an analysis device for interface security protection, which includes the following modules:
[0038] The interface traffic data collection and preprocessing module is used to collect interface traffic data in real time through network monitoring equipment and preprocess the collected interface traffic data, including data cleaning, format conversion and other operations, to remove noise and invalid data and improve data quality;
[0039] The interface traffic data feature extraction module is used to use the deep interface testing technology to identify the interface calls in the interface traffic data and extract the interface traffic data features, wherein the interface traffic data features include parameter information such as interface name, parameters, request frequency, response time, signal length, traffic average, traffic peak, fluctuation factor, connection duration, connection bytes, etc.;
[0040] Establish an interface traffic data feature matrix based on the sample quantity and feature dimensions of multiple interface traffic data , and is expressed by the following formula:
[0041]
[0042] in, Indicates the number of samples of traffic data for multiple interfaces, Indicates the characteristic dimension of interface traffic data;
[0043] The interface traffic data feature matrix The interface traffic characteristic variables are reorganized and a new interface traffic characteristic variable set is constructed. ;
[0044] In constructing a new interface traffic characteristic variable set In the process, we first construct a new interface traffic characteristic variable set. The key factors in In this process, the key factor set is first determined The contribution of And the interface traffic data characteristic matrix The correlation coefficient matrix determines the key factor set , which is specifically expressed by the following formula:
[0045]
[0046] in, Represents the key factor set Middle A key factor, Represents the interface traffic data feature matrix The coefficient eigenvector in the correlation coefficient matrix of ;
[0047] In determining the key factor set In the process of calculating the contribution of key factors, the following formula is used to calculate the key factor set Middle Key Factors Contribution:
[0048]
[0049] in, express The corresponding eigenvalue is Indicates key factors The contribution of represents the identity matrix, Representing the interface traffic data feature matrix;
[0050] In getting the key factor set Key factors After the contribution of the first L key factors is calculated in descending order The sum of the contributions of The sum of the contributions :
[0051]
[0052]
[0053] In determining the first L key factors The sum of the contributions When the sum of the contributions is greater than or equal to the preset threshold value T, the final number of L is determined, and the new interface traffic feature variable set is further screened and determined by the following formula: ;
[0054] in, Indicates that in determining the Lth key factor After the contribution of Identified set of key factors , and determine the new interface traffic characteristic variable set , Represents the screening conditions. The new interface traffic feature variable set is determined through the above process. ;
[0055] An interface traffic data identification module, used to perform feature identification on the new interface traffic feature variable set through a pre-trained interface traffic data analysis model, and classify the interface traffic data;
[0056] The interface abnormal flow data positioning module is used to determine the source and propagation path of the interface abnormal flow data by analyzing the flow direction of network flow for abnormal interface calls when the interface flow data type is abnormal; and determine the specific interface position of the interface abnormal flow data in the network by using the interface abnormal flow data model;
[0057] The early warning and response module is used to issue early warning information in a timely manner when abnormal interfaces and their location information are identified, notify network administrators, and take preset response measures according to the type and severity of the abnormality of the interface to block malicious traffic and isolate infected devices.
[0058] Specifically, in the interface traffic data identification module, when determining a new interface traffic feature variable set After that, feature matching is performed through the interface traffic data analysis model to obtain the matching probability of the interface traffic data type. In this process, feature matching is performed through the following formula:
[0059]
[0060] in, The type feature vector representing the pre-stored interface traffic data, represents any value of the amount of pre-stored interface traffic data, represents the smoothing factor;
[0061] The matching probability of the interface traffic data type after feature matching is calculated using the following formula:
[0062]
[0063] in, Indicates the probability of the interface traffic data type, Indicates the dimension of the pre-stored interface traffic data type. represents the smoothing factor;
[0064] Determine the final interface traffic data type through probability density function ,Right now ; In this way, it can be determined whether the interface traffic data type is abnormal.
[0065] Specifically, in the interface abnormal traffic data location module, the specific location of the abnormal interface call needs to be determined in the process of determining the source and propagation path of the interface abnormal traffic data by analyzing the flow direction of the network traffic. In this process, the initial abnormal interface transfers and transmits data to the adjacent interface for different times, and calculates the average transfer distance from the abnormal interface to other transfer interfaces:
[0066]
[0067] in, and Represents any two transfer interfaces , The coordinates of Represents any two transfer interfaces , The average transfer distance, express , Minimum number of transfers between interfaces;
[0068] After obtaining the average transfer distance, the abnormal interface will transmit the information of the average transfer distance to the outside, and the received information will only be stored in the initial transfer distance. Therefore, the other transfer interfaces of the abnormal interface receive the sum of the average transfer distance multiplied by the minimum transfer number of the abnormal interface connected to it, that is, the actual distance between the abnormal interface and other transfer interfaces, and according to the transfer relationship between the abnormal interface and other known transfer interfaces and the actual distance between the abnormal interface and other transfer interfaces, Axis and The components on the axes give the coordinates of the anomaly interface.
[0069] Specifically, in the interface abnormal traffic data positioning module, the above positioning process is repeated in combination with the collection frequency of the interface traffic data to complete the analysis of the interface security protection.
[0070] The present invention also provides a device, which includes a processor and a memory: the memory is used to store program code and transmit the program code to the processor, and the processor is used to execute the above-mentioned interface security protection analysis method according to the instructions in the program code.
[0071] The present invention also provides a computer-readable storage medium, which is used to store program code and transmit the program code to a processor, and the processor is used to execute the above-mentioned interface security protection analysis method according to the instructions in the program code.
[0072] The present invention can improve the accuracy of malicious traffic identification. Furthermore, by extracting the features of API calls and comparing them with the malicious traffic feature library, malicious traffic can be identified more accurately. Accurate positioning of malicious traffic is achieved: At the same time, the present invention uses network topology and traffic analysis tools to quickly locate the specific location of malicious traffic in the network, providing strong support for timely response measures. In addition, the present invention enhances network security: timely discovery and positioning of malicious traffic can effectively prevent damage to the network caused by malicious attacks and improve network security. Finally, the present invention has strong adaptability and can adapt to different network environments and application scenarios, and has strong versatility and extensibility. BRIEF DESCRIPTION OF THE DRAWINGS
[0073] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0074] Figure 1 It is a flowchart of an analysis method for interface security protection;
[0075] Figure 2 The present invention is a module schematic diagram of an analysis device for interface security protection. DETAILED DESCRIPTION
[0076] like Figure 1 As shown, an analysis method for interface security protection, the specific steps are as follows:
[0077] Step 1: Interface traffic data collection and preprocessing: Interface traffic data is collected in real time through network monitoring equipment, and the collected interface traffic data is preprocessed, including data cleaning, format conversion and other operations, to remove noise and invalid data and improve data quality.
[0078] Step 2: Extract interface traffic data features. Use deep interface testing technology to identify interface calls in interface traffic data and extract interface traffic data features. The interface traffic data features include interface name, parameters, request frequency, response time, signal length, traffic average, traffic peak, fluctuation factor, connection duration, connection bytes and other parameter information.
[0079] Specifically, the interface traffic data feature matrix is established based on the sample quantity and feature dimension of multiple interface traffic data. , and is expressed by the following formula:
[0080]
[0081] in, Indicates the number of samples of traffic data for multiple interfaces, Indicates the characteristic dimension of interface traffic data;
[0082] Furthermore, the interface traffic data feature matrix The interface traffic characteristic variables are reorganized and a new interface traffic characteristic variable set is constructed. ;
[0083] Specifically, in constructing a new interface traffic characteristic variable set In the process, we first construct a new interface traffic characteristic variable set. The key factors in In this process, the key factor set is first determined The contribution of And the interface traffic data characteristic matrix The correlation coefficient matrix determines the key factor set , which is specifically expressed by the following formula:
[0084]
[0085] in, Represents the key factor set Middle A key factor, Represents the interface traffic data feature matrix The coefficient eigenvector in the correlation coefficient matrix of ;
[0086] Further, in determining the key factor set In the process of calculating the contribution of key factors, the following formula is used to calculate the key factor set Middle Key Factors Contribution:
[0087]
[0088] in, express The corresponding eigenvalue is Indicates key factors The contribution of represents the identity matrix, Representing the interface traffic data feature matrix;
[0089] Further, after obtaining the key factor set Key factors After the contribution of the first L key factors is calculated in descending order The sum of the contributions of The sum of the contributions :
[0090]
[0091]
[0092] Further, after determining the first L key factors The sum of the contributions When the sum of the contributions is greater than or equal to the preset threshold value T, the final number of L is determined, and the new interface traffic feature variable set is further screened and determined by the following formula: ;
[0093] in, Indicates that in determining the Lth key factor After the contribution of Identified set of key factors , and determine the new interface traffic characteristic variable set , Represents the screening conditions. The new interface traffic feature variable set is determined through the above process. .
[0094] Step 3: interface traffic data identification: feature identification is performed on the new interface traffic feature variable set through the pre-trained interface traffic data analysis model, and the interface traffic data is classified.
[0095] Specifically, when determining a new interface traffic characteristic variable set After that, feature matching is performed through the interface traffic data analysis model to obtain the matching probability of the interface traffic data type. In this process, feature matching is performed through the following formula:
[0096]
[0097] in, The type feature vector representing the pre-stored interface traffic data, Indicates any value of the amount of pre-stored interface traffic data, represents the smoothing factor;
[0098] Furthermore, the matching probability of the interface traffic data type after feature matching is calculated by the following formula:
[0099]
[0100] in, Indicates the probability of the interface traffic data type, Indicates the dimension of the pre-stored interface traffic data type. represents the smoothing factor;
[0101] Determine the final interface traffic data type through probability density function ,Right now ; In this way, it can be determined whether the interface traffic data type is abnormal.
[0102] Exemplarily, it can be understood that after obtaining the interface traffic data, the collected interface traffic data is preprocessed, including data cleaning, format conversion and other operations to remove noise and invalid data, improve data quality, establish an interface traffic data feature matrix from the interface traffic data features, and construct a key factor set from the characteristic factors in the interface traffic data feature matrix. Exemplarily, the key factor set includes request frequency, response time, signal length, traffic average value, and traffic peak value, and further use the above formula to calculate the contribution of each key factor in the key factor set, and sort according to the contribution of each key factor. And calculate the sum of contributions of a preset number of key factors from large to small, and determine the preset number of key factors when the sum of contributions is greater than or equal to a threshold of the preset sum of contributions, and further screen and determine a new interface traffic feature variable set. Exemplarily, the new interface traffic feature variable set includes request frequency, signal length, traffic average, and traffic peak. After determining the new interface traffic feature variable set, feature matching is further performed through an interface traffic data analysis model, and the matching probability of the interface traffic data type is determined through a probability density function, and finally the interface traffic data type is determined. Exemplarily, it can be obtained that the interface traffic data belongs to a transient anomaly.
[0103] Step 4, locating abnormal interface traffic data. When the interface traffic data type is abnormal, for abnormal interface calls, determine the source and propagation path of the abnormal interface traffic data by analyzing the flow direction of network traffic; use the abnormal interface traffic data model to determine the specific interface location of the abnormal interface traffic data in the network.
[0104] Specifically, in the process of determining the source and propagation path of the abnormal interface traffic data by analyzing the flow direction of network traffic, it is necessary to determine the specific location of the abnormal interface call. In this process, the initial abnormal interface transfers and transmits data to the adjacent interface for different times, and calculates the average transfer distance from the abnormal interface to other transfer interfaces:
[0105]
[0106] in, and Represents any two transfer interfaces , The coordinates of Represents any two transfer interfaces , The average transfer distance, express , Minimum number of transfers between interfaces;
[0107] Furthermore, since the abnormal interface will transmit the information of the average transfer distance to the outside after obtaining the average transfer distance, and the received information will only be stored in the initial transfer distance, the sum of the average transfer distances received by other transfer interfaces of the abnormal interface multiplied by the minimum transfer number of the abnormal interface connected to it, that is, the actual distance between the abnormal interface and other transfer interfaces, that is,
[0108]
[0109] in, Represents an exception interface and other transfer interfaces The actual distance Indicates abnormal interface other transfer interface The number of transfers, Indicates the average transfer distance from the abnormal interface to other transfer interfaces.
[0110] Further, according to the transfer relationship between the abnormal interface and other known transfer interfaces and the actual distance between the abnormal interface and other transfer interfaces, Axis and The components on the axis give the coordinates of the abnormal interface ,Right now
[0111]
[0112] Furthermore, the location information of the abnormal interface is obtained through the above formula, and combined with the collection frequency of the interface traffic data, the above intrusion source positioning process is repeated to complete the analysis of interface security protection.
[0113] Step 5: Early warning and response: When an abnormal interface and its location information are identified, an early warning message is issued in a timely manner to notify the network administrator. According to the type and severity of the abnormality of the interface, preset response measures are taken to block malicious traffic and isolate infected devices.
[0114] Example 2
[0115] As shown in FIG2 , an analysis device for interface security protection includes:
[0116] The interface traffic data collection and preprocessing module is used to collect interface traffic data in real time through network monitoring equipment, and preprocess the collected interface traffic data, including data cleaning, format conversion and other operations, to remove noise and invalid data and improve data quality.
[0117] The interface traffic data feature extraction module is used to use deep interface testing technology to identify interface calls in interface traffic data and extract interface traffic data features. The interface traffic data features include interface name, parameters, request frequency, response time, signal length, traffic average, traffic peak, fluctuation factor, connection duration, connection bytes and other parameter information.
[0118] Specifically, the interface traffic data feature matrix is established based on the sample quantity and feature dimension of multiple interface traffic data. , and is expressed by the following formula:
[0119]
[0120] in, Indicates the number of samples of traffic data for multiple interfaces, Indicates the characteristic dimension of interface traffic data;
[0121] Furthermore, the interface traffic data feature matrix The interface traffic characteristic variables are reorganized and a new interface traffic characteristic variable set is constructed. ;
[0122] Specifically, in constructing a new interface traffic characteristic variable set In the process, we first construct a new interface traffic characteristic variable set. The key factors in In this process, the key factor set is first determined The contribution of And the interface traffic data characteristic matrix The correlation coefficient matrix determines the key factor set , which is specifically expressed by the following formula:
[0123]
[0124] in, Represents the key factor set Middle A key factor, Represents the interface traffic data feature matrix The coefficient eigenvector in the correlation coefficient matrix of ;
[0125] Further, in determining the key factor set In the process of calculating the contribution of key factors, the following formula is used to calculate the key factor set Middle Key Factors Contribution:
[0126]
[0127] in, express The corresponding eigenvalue is Indicates key factors The contribution of represents the identity matrix, Representing the interface traffic data feature matrix;
[0128] Further, after obtaining the key factor set Key factors After the contribution of the first L key factors is calculated in descending order The sum of the contributions of The sum of the contributions :
[0129]
[0130]
[0131] Further, after determining the first L key factors The sum of the contributions When the sum of the contributions is greater than or equal to the preset threshold value T, the final number of L is determined, and the new interface traffic feature variable set is further screened and determined by the following formula: ;
[0132] in, Indicates that in determining the Lth key factor After the contribution of Identified set of key factors , and determine the new interface traffic characteristic variable set , Represents the screening conditions. The new interface traffic feature variable set is determined through the above process. .
[0133] The interface anomaly identification module is used to perform feature identification on the new interface traffic feature variable set through a pre-trained interface traffic data analysis model and classify the interface traffic data.
[0134] Specifically, when determining a new interface traffic characteristic variable set After that, feature matching is performed through the interface traffic data analysis model to obtain the matching probability of the interface traffic data type. In this process, feature matching is performed through the following formula:
[0135]
[0136] in, The type feature vector representing the pre-stored interface traffic data, Indicates any value of the amount of pre-stored interface traffic data, represents the smoothing factor;
[0137] Furthermore, the matching probability of the interface traffic data type after feature matching is calculated by the following formula:
[0138]
[0139] in, Indicates the probability of the interface traffic data type, Indicates the dimension of the pre-stored interface traffic data type. represents the smoothing factor;
[0140] Determine the final interface traffic data type through probability density function ,Right now ; In this way, it can be determined whether the interface traffic data type is abnormal.
[0141] Exemplarily, it can be understood that after obtaining the interface traffic data, the collected interface traffic data is preprocessed, including data cleaning, format conversion and other operations to remove noise and invalid data, improve data quality, establish an interface traffic data feature matrix from the interface traffic data features, and construct a key factor set from the characteristic factors in the interface traffic data feature matrix. Exemplarily, the key factor set includes request frequency, response time, signal length, traffic average value, and traffic peak value, and further use the above formula to calculate the contribution of each key factor in the key factor set, and sort according to the contribution of each key factor. And calculate the sum of contributions of a preset number of key factors from large to small, and determine the preset number of key factors when the sum of contributions is greater than or equal to a threshold of the preset sum of contributions, and further screen and determine a new interface traffic feature variable set. Exemplarily, the new interface traffic feature variable set includes request frequency, signal length, traffic average, and traffic peak. After determining the new interface traffic feature variable set, feature matching is further performed through an interface traffic data analysis model, and the matching probability of the interface traffic data type is determined through a probability density function, and finally the interface traffic data type is determined. Exemplarily, it can be obtained that the interface traffic data belongs to a transient anomaly.
[0142] The interface abnormal traffic data locating module is used to determine the source and propagation path of the interface abnormal traffic data by analyzing the flow direction of the network traffic for abnormal interface calls when the interface traffic data type is abnormal; and to determine the specific interface location of the interface abnormal traffic data in the network using the interface abnormal traffic data model.
[0143] Specifically, in the process of determining the source and propagation path of the abnormal interface traffic data by analyzing the flow direction of network traffic, it is necessary to determine the specific location of the abnormal interface call. In this process, the initial abnormal interface transfers and transmits data to the adjacent interface for different times, and calculates the average transfer distance from the abnormal interface to other transfer interfaces:
[0144]
[0145] in, and Represents any two transfer interfaces , The coordinates of Represents any two transfer interfaces , The average transfer distance, express , Minimum number of transfers between interfaces;
[0146] Furthermore, since the abnormal interface will transmit the information of the average transfer distance to the outside after obtaining the average transfer distance, and the received information will only be stored in the initial transfer distance, the sum of the average transfer distances received by other transfer interfaces of the abnormal interface multiplied by the minimum transfer number of the abnormal interface connected to it, that is, the actual distance between the abnormal interface and other transfer interfaces, that is,
[0147]
[0148] in, Represents an exception interface and other transfer interfaces The actual distance Indicates abnormal interface other transfer interface The number of transfers, Indicates the average transfer distance from the abnormal interface to other transfer interfaces.
[0149] Further, according to the transfer relationship between the abnormal interface and other known transfer interfaces and the actual distance between the abnormal interface and other transfer interfaces, Axis and The components on the axis give the coordinates of the abnormal interface ,Right now
[0150]
[0151] Furthermore, the location information of the abnormal interface is obtained through the above formula, and combined with the collection frequency of the interface traffic data, the above intrusion source positioning process is repeated to complete the analysis of interface security protection.
[0152] The early warning and response module is used to issue early warning information in a timely manner when abnormal interfaces and their location information are identified, notify network administrators, and take preset response measures according to the type and severity of the abnormality of the interface to block malicious traffic and isolate infected devices.
[0153] The present invention also relates to a device, comprising a processor and a memory: the memory is used to store program code and transmit the program code to the processor, and the processor is used to execute an interface security protection analysis method described in the above method embodiment according to instructions in the program code.
[0154] The present invention also relates to a computer-readable storage medium, which is used to store program code and transmit the program code to a processor, and the processor is used to execute an interface security protection analysis method described in the above method embodiment according to instructions in the program code.
[0155] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.
Claims
1. An analysis method for interface security protection, characterized in that The following steps are involved: Step 1: Interface traffic data collection and preprocessing: collect interface traffic data in real time through network monitoring equipment, and preprocess the collected interface traffic data, including data cleaning and format conversion operations, to remove noise and invalid data and improve data quality; Step 2: Extract interface traffic data features, using deep interface testing technology to identify interface calls in interface traffic data and extract interface traffic data features, the interface traffic data features include interface name, parameters, request frequency, response time, signal length, traffic average, traffic peak, fluctuation factor, connection duration, and connection bytes; Establish an interface traffic data feature matrix based on the sample quantity and feature dimensions of multiple interface traffic data , and is expressed by the following formula: in, Indicates the number of samples of traffic data for multiple interfaces, Indicates the characteristic dimension of interface traffic data; The interface traffic data feature matrix The interface traffic characteristic variables are reorganized and a new interface traffic characteristic variable set is constructed. ; In constructing a new interface traffic characteristic variable set In the process, we first construct a new interface traffic characteristic variable set. The key factors in In this process, the key factor set is first determined The contribution of And the interface traffic data characteristic matrix The correlation coefficient matrix determines the key factor set , which is specifically expressed by the following formula: in, Represents the key factor set Middle A key factor, Represents the interface traffic data feature matrix The coefficient eigenvector in the correlation coefficient matrix of ; In determining the key factor set In the process of calculating the contribution of key factors, the following formula is used to calculate the key factor set Middle Key Factors Contribution: in, express The corresponding eigenvalue is Indicates key factors The contribution of represents the identity matrix, Representing the interface traffic data feature matrix; In getting the key factor set Key factors After the contribution of the first L key factors is calculated in descending order The sum of the contributions of The sum of the contributions : In determining the first L key factors The sum of the contributions When the sum of the contributions is greater than or equal to the preset threshold value T, the final number of L is determined, and the new interface traffic feature variable set is further screened and determined by the following formula: ; in, Indicates that in determining the Lth key factor After the contribution of Identified set of key factors , and determine the new interface traffic characteristic variable set , Represents the screening conditions. The new interface traffic feature variable set is determined through the above process. ; Step 3: interface traffic data identification, performing feature identification on the new interface traffic feature variable set through the pre-trained interface traffic data analysis model, and classifying the interface traffic data; Step 4: locating the abnormal interface traffic data. When the interface traffic data type is abnormal, for the abnormal interface call, the source and propagation path of the abnormal interface traffic data are determined by analyzing the flow direction of the network traffic; the specific interface location of the abnormal interface traffic data in the network is determined by using the abnormal interface traffic data model; Step 5: Early warning and response: When an abnormal interface and its location information are identified, an early warning message is issued in a timely manner to notify the network administrator. According to the abnormal type and severity of the interface, the preset response measures are taken to block malicious traffic and isolate infected devices; Among them, in step 4, in the process of determining the source and propagation path of the interface abnormal traffic data by analyzing the flow direction of the network traffic, it is necessary to determine the specific location of the abnormal interface call. In this process, the initial abnormal interface transfers and transmits data to the adjacent interface for different times, and calculates the average transfer distance from the abnormal interface to other transfer interfaces: in, and Represents any two transfer interfaces , The coordinates of Represents any two transfer interfaces , The average transfer distance, express , Minimum number of transfers between interfaces; After obtaining the average transfer distance, the abnormal interface will transmit the information of the average transfer distance to the outside, and the received information will only be stored in the initial transfer distance. Therefore, the other transfer interfaces of the abnormal interface receive the sum of the average transfer distance multiplied by the minimum transfer number of the abnormal interface connected to it, that is, the actual distance between the abnormal interface and other transfer interfaces, and according to the transfer relationship between the abnormal interface and other known transfer interfaces and the actual distance between the abnormal interface and other transfer interfaces, Axis and The components on the axes give the coordinates of the anomaly interface.
2. The interface security protection analysis method according to claim 1, characterized in that: In step 3, specifically, when determining a new interface traffic characteristic variable set After that, feature matching is performed through the interface traffic data analysis model to obtain the matching probability of the interface traffic data type. In this process, feature matching is performed through the following formula: in, The type feature vector representing the pre-stored interface traffic data, Indicates any value of the amount of pre-stored interface traffic data, represents the smoothing factor; The matching probability of the interface traffic data type after feature matching is calculated using the following formula: in, Indicates the probability of the interface traffic data type, Indicates the dimension of the pre-stored interface traffic data type. represents the smoothing factor; Determine the final interface traffic data type through probability density function ,Right now ; In this way, it can be determined whether the interface traffic data type is abnormal.
3. The interface security protection analysis method according to claim 1, characterized in that: In step 4, the above positioning process is repeated in combination with the collection frequency of the interface traffic data to complete the analysis of the interface security protection.
4. An analysis device for interface security protection, characterized in that The device includes the following modules: The interface traffic data collection and preprocessing module is used to collect interface traffic data in real time through network monitoring equipment and preprocess the collected interface traffic data, including data cleaning and format conversion operations, to remove noise and invalid data and improve data quality; An interface traffic data feature extraction module is used to use deep interface testing technology to identify interface calls in interface traffic data and extract interface traffic data features, wherein the interface traffic data features include interface name, parameters, request frequency, response time, signal length, traffic average, traffic peak, fluctuation factor, connection duration, and connection bytes; Establish an interface traffic data feature matrix based on the sample quantity and feature dimensions of multiple interface traffic data , and is expressed by the following formula: in, Indicates the number of samples of traffic data for multiple interfaces, Indicates the characteristic dimension of interface traffic data; The interface traffic data feature matrix The interface traffic characteristic variables are reorganized and a new interface traffic characteristic variable set is constructed. ; In constructing a new interface traffic characteristic variable set In the process, we first construct a new interface traffic characteristic variable set. The key factors in In this process, the key factor set is first determined The contribution of And the interface traffic data characteristic matrix The correlation coefficient matrix determines the key factor set , which is specifically expressed by the following formula: in, Represents the key factor set Middle A key factor, Represents the interface traffic data feature matrix The coefficient eigenvector in the correlation coefficient matrix of ; In determining the key factor set In the process of calculating the contribution of key factors, the following formula is used to calculate the key factor set Middle Key Factors Contribution: in, express The corresponding eigenvalue is Indicates key factors The contribution of represents the identity matrix, Representing the interface traffic data feature matrix; In getting the key factor set Key factors After the contribution of the first L key factors is calculated in descending order The sum of the contributions of The sum of the contributions : In determining the first L key factors The sum of the contributions When the sum of the contributions is greater than or equal to the preset threshold value T, the final number of L is determined, and the new interface traffic feature variable set is further screened and determined by the following formula: ; in, Indicates that in determining the Lth key factor After the contribution of Identified set of key factors , and determine the new interface traffic characteristic variable set , Represents the screening conditions. The new interface traffic feature variable set is determined through the above process. ; An interface traffic data identification module, used to perform feature identification on the new interface traffic feature variable set through a pre-trained interface traffic data analysis model, and classify the interface traffic data; The interface abnormal flow data positioning module is used to determine the source and propagation path of the interface abnormal flow data by analyzing the flow direction of network flow for abnormal interface calls when the interface flow data type is abnormal; and to determine the specific interface location of the interface abnormal flow data in the network by using the interface abnormal flow data model; The early warning and response module is used to issue early warning information in a timely manner when abnormal interfaces and their location information are identified, notify network administrators, and take preset response measures according to the abnormal type and severity of the interface to block malicious traffic and isolate infected devices; Among them, in the interface abnormal traffic data positioning module, the specific location of the abnormal interface call needs to be determined in the process of determining the source and propagation path of the interface abnormal traffic data by analyzing the flow direction of the network traffic. In this process, the initial abnormal interface transfers and transmits data to the adjacent interface for different times, and calculates the average transfer distance from the abnormal interface to other transfer interfaces: in, and Represents any two transfer interfaces , The coordinates of Represents any two transfer interfaces , The average transfer distance, express , Minimum number of transfers between interfaces; After obtaining the average transfer distance, the abnormal interface will transmit the information of the average transfer distance to the outside, and the received information will only be stored in the initial transfer distance. Therefore, the other transfer interfaces of the abnormal interface receive the sum of the average transfer distance multiplied by the minimum transfer number of the abnormal interface connected to it, that is, the actual distance between the abnormal interface and other transfer interfaces, and according to the transfer relationship between the abnormal interface and other known transfer interfaces and the actual distance between the abnormal interface and other transfer interfaces, Axis and The components on the axes give the coordinates of the anomaly interface.
5. The interface security protection analysis device according to claim 4, characterized in that: In the interface traffic data identification module, a new interface traffic feature variable set is determined. After that, feature matching is performed through the interface traffic data analysis model to obtain the matching probability of the interface traffic data type. In this process, feature matching is performed through the following formula: in, The type feature vector representing the pre-stored interface traffic data, Indicates any value of the amount of pre-stored interface traffic data, represents the smoothing factor; The matching probability of the interface traffic data type after feature matching is calculated using the following formula: in, Indicates the probability of the interface traffic data type, Indicates the dimension of the pre-stored interface traffic data type. represents the smoothing factor; Determine the final interface traffic data type through probability density function ,Right now ; In this way, it can be determined whether the interface traffic data type is abnormal.
6. The interface security protection analysis device according to claim 4, characterized in that: In the interface abnormal traffic data positioning module, combined with the collection frequency of the interface traffic data, the above positioning process is repeated to complete the analysis of interface security protection.
7. A device, characterized in that: The device includes a processor and a memory: the memory is used to store program code and transmit the program code to the processor, and the processor is used to execute an interface security protection analysis method as described in any one of claims 1 to 3 according to instructions in the program code.
8. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program code and transmit the program code to a processor, and the processor is used to execute an interface security protection analysis method as described in any one of claims 1 to 3 according to instructions in the program code.
Citation Information
Patent Citations
Distributed evaluation of networking security rules
US11652848B1
Method and apparatus for dynamic anomaly-based updates to traffic selection policies in a switch
US20080163333A1