Link data generation method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a link data generation method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining interface calling behavior data of a normal user group, and generating interface calling time sequence link data based on the interface calling behavior data, obtaining interface basic data of each first interface in the interface calling time sequence link data, determining an interface association degree between the first interfaces based on the interface basic data, and screening out normal calling time sequence link data from the interface calling time sequence link data according to the interface association degree, the normal calling of the time sequence link data is used for performing abnormal behavior detection on the to-be-detected interface access flow data.

Description

Technical Field

[0001] The present specification relates to the field of computer technology, and in particular to a link data generation method, device, electronic device and storage medium. Background Art

[0002] In the past few decades, the rapid development and widespread popularity of the Internet has changed people's lifestyles and promoted the prosperity of global information sharing and business activities. With the continuous expansion of Internet applications, websites and network applications have become the main channels for many companies to interact with users. However, this has also made network security issues increasingly prominent, especially the existence of network security vulnerabilities has brought huge risks to the information security of enterprises and users.

[0003] Traditional web security vulnerability detection methods can already cover and detect a large number of known simple vulnerability patterns, thus significantly improving the security level of network applications. Nevertheless, due to the diversity of interactions between complex systems and the borderless nature of the open Internet, deeper and more difficult to find vulnerabilities are still lurking in various network platforms. Traditional automated tools cannot effectively identify them, so they are still used by hackers and the black and gray industry chain, posing a potential threat to the entire network ecosystem. Summary of the invention

[0004] The main purpose of this specification is to provide a link data generation method, device, electronic device and storage medium, aiming to save research and development time, reduce research and development costs, and improve analysis efficiency. The technical solution is as follows:

[0005] In a first aspect, an embodiment of this specification provides a link data generation method, including:

[0006] Obtain interface call behavior data of normal user groups;

[0007] Generate interface call timing link data based on the interface call behavior data;

[0008] Acquire interface basic data of each first interface in the interface call timing link data, and determine the interface association degree between the first interfaces based on the interface basic data;

[0009] Normal call timing link data is obtained by filtering the interface call timing link data according to the interface association degree, and the normal call timing link data is used to perform abnormal behavior detection on the interface access flow data to be detected.

[0010] In a second aspect, an embodiment of the present specification provides a link data generating device, including:

[0011] An acquisition unit, used to acquire interface call behavior data of a normal user group;

[0012] A generating unit, configured to generate interface call timing link data based on the interface call behavior data;

[0013] an association verification unit, configured to obtain basic interface data of each first interface in the interface call timing link data, and determine the degree of interface association between the first interfaces based on the basic interface data;

[0014] A screening unit is used to screen the interface call timing link data according to the interface association degree to obtain normal call timing link data, wherein the normal call timing link data is used to perform abnormal behavior detection on the interface access flow data to be detected.

[0015] In a third aspect, an embodiment of the present specification provides an electronic device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the above method when executed by the processor.

[0016] In a fourth aspect, an embodiment of the present specification provides a storage medium having a computer program stored thereon, and the computer program implements the steps of the above method when executed by a processor.

[0017] In a fifth aspect, an embodiment of this specification provides a computer program product, including: a computer program, when the computer program is executed by a processor of an electronic device, the processor can at least implement the method described in the first aspect.

[0018] In the embodiments of this specification, by obtaining the interface call behavior data of the normal user group, the interface call timing link data is generated based on the interface call behavior data, the interface basic data of each first interface in the interface call timing link data is obtained, the interface association degree between the first interfaces is determined based on the interface basic data, and the normal call timing link data is screened from the interface call timing link data according to the interface association degree. The normal call timing link data is used to detect abnormal behavior of the interface access traffic data to be detected. The interface call behavior sequence of normal user behavior is analyzed instead of a single API call, and the interface basic data is introduced to better capture the logical association and abnormal pattern between calls, and the normal call timing link data is established, which provides a method for examining application security from a macro perspective, so that the abnormal attacker behavior sequence can be perceived, and a more comprehensive, accurate and dynamic protection framework is provided for application security. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 This is an example schematic diagram of a link data generation method provided in an embodiment of this specification;

[0021] Figure 2 It is a flowchart of a link data generation method provided by an embodiment of this specification;

[0022] Figure 3 It is a flowchart of a link data generation method provided by an embodiment of this specification;

[0023] Figure 4 It is a flowchart of a link data generation method provided by an embodiment of this specification;

[0024] Figure 5 This is an example schematic diagram of a link data generation method provided in an embodiment of this specification;

[0025] Figure 6 It is a structural diagram of a link data generating device provided in an embodiment of this specification;

[0026] Figure 7 It is a structural schematic diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0028] In the related technology, vulnerability scanners (such as white box vulnerability scanners, black box vulnerability scanners and IAST) are usually used for security detection, but both white box (static analysis) and black box (dynamic analysis), as well as IAST (interactive application security testing), have their own limitations and shortcomings. Usually, they can only detect known patterns or defined vulnerability features, and may find it difficult to discover zero-day attacks or unconventional vulnerabilities. In addition, most traditional scanners focus on technical defects rather than transaction logic errors or attacks against specific transaction processes.

[0029] Based on the above problems, the embodiments of this specification provide a link data generation method. By constructing a call link based on the interface call behavior data of a normal user group, the relationship between multiple interface calls of multiple users is connected, and attention is paid to whether there is a correlation between the interfaces. Relying on the basic data of the interface, more actual execution environments and contexts of API calls are introduced to obtain more accurate call link information. This method can more widely cover third-party components and service calls in the application, reduce the number of vulnerabilities missed due to dependencies, and can more accurately identify which call sequences are abnormal or potential vulnerability exploitation attempts based on normal call timing link data, thereby reducing the false alarm rate and improving the accuracy of abnormal behavior detection.

[0030] The link data generation device provided in the embodiments of this specification can be a terminal device such as a mobile phone, a computer, a tablet computer, a smart watch or a vehicle-mounted device, or can be a module in the terminal device for implementing the link data generation method. Figure 1 , an example schematic diagram of a link data generation method is provided for an embodiment of this specification. The link data generation device can obtain interface call behavior data of a normal user group, generate interface call timing link data based on the interface call behavior data, and then obtain interface basic data of each first interface in the interface call timing link data, determine the interface association degree between the first interfaces based on the interface basic data, and filter out normal call timing link data from the interface call timing link data according to the interface association degree. The normal call timing link data is used to perform abnormal behavior detection on the interface access traffic data to be detected.

[0031] The link data generation method provided in this specification is described in detail below in conjunction with specific embodiments.

[0032] See also Figure 2 , is a flowchart of a link data generation method provided in an embodiment of this specification. Figure 2 As shown, the method of the embodiment of this specification may include the following steps S102-S108.

[0033] S102, obtaining interface calling behavior data of a normal user group;

[0034] In one embodiment of the present specification, the log data generated when the normal user group calls the interface to interact with the application is recorded, and all captured interface call data are integrated into a comprehensive access traffic log information library for in-depth mining. The interface call behavior data related to the first interface is obtained from the access traffic log information library. The first interface can be all interfaces called by the normal user group, or it can be a selected part of the focus interface.

[0035] Specifically, you can pre-set the required data types, such as call count, user ID, request time, and parameters. Then, integrate the logging function into the application to record the detailed information of each interface (API) request and response. For example, use Web server logs, application management tools, or APM tools to manage and collect these log data.

[0036] S104, generating interface call timing link data based on the interface call behavior data;

[0037] In one embodiment of the present specification, the interface call sequence link data is sorted out based on the interface call behavior data of the normal user group. Specifically, the interface call behavior data is sorted out according to the user, and the interface access sequence data when each user calls the interface is obtained, such as useridA[API1,API2,API3...], useridB[API1,API2,API4...], and the interface call sequence link data is obtained based on the interface access sequence data statistics of all users.

[0038] S106, acquiring interface basic data of each first interface in the interface call timing link data, and determining the interface association degree between the first interfaces based on the interface basic data;

[0039] In one embodiment of the present specification, the interface call sequence link data includes several first interfaces that are called. Since the interface call sequence link data only includes the call information of the first interface, in order to more accurately mine the behavioral characteristics of interface access, more context information can be introduced by acquiring interface basic data. The interface basic data may include API application information, API parameter model, API sample traffic, API access frequency, etc.

[0040] In a feasible implementation, the interface association degree between the first interfaces is determined based on the interface basic data of each first interface. It is understandable that there may be corresponding call sequences between the interfaces in the first interface, such as API1→API2, API2→API3, API3→API4, so it is necessary to verify whether there is an association between the two first interfaces with a call relationship, that is, the degree of association. If there is no association, the call relationship may be triggered by occasional, faulty or uncommon call behavior, that is, it does not belong to a normal call link. If there is an association, it means that the call relationship between the two first interfaces is triggered by the normal interface call behavior of the normal user group and needs to be retained.

[0041] S108, filtering the interface call timing link data to obtain normal call timing link data according to the interface association degree, wherein the normal call timing link data is used to perform abnormal behavior detection on the interface access traffic data to be detected.

[0042] In one embodiment of the present specification, after determining the degree of association of the first interface with a call relationship according to the interface basic data obtained above, the interface call timing link data is screened, and the call links between interfaces with low association are eliminated to obtain normal call timing link data. Exemplarily, when filtering interfaces based on the degree of interface association, a correlation degree threshold can be selected according to actual needs, and completely unrelated interfaces or interface call links with a degree of association lower than the correlation degree threshold can be filtered. The determined normal call timing link data includes call links between interfaces and interface basic data of each interface. Optionally, the normal call timing link data can be recorded in the form of a relationship graph, that is, with interfaces as nodes, edges between interfaces are established according to the call relationship between interfaces, and the basic data of the interfaces are used as node attribute data of each node.

[0043] In a feasible implementation, the normal call sequence link data is used to detect abnormal behavior of the interface access traffic data to be detected. It is understandable that the normal call sequence link data can be used as reference data. When the interface access traffic data to be detected is obtained, the user call sequence in the interface access traffic data to be detected is analyzed, and abnormal behaviors inconsistent with the normal user call sequence can be detected. In this way, more logical paths can be explored, especially those vulnerabilities that require specific orders or conditions to trigger, which reduces missed detections caused by unreachable paths in "black box" testing, and more accurately identifies which call sequences are abnormal or potential vulnerability exploitation attempts, thereby reducing the false alarm rate.

[0044] In another feasible implementation, the normal call timing link data can also be used for quick positioning. It is understandable that when a suspected security problem is located on a certain interface, in order to quickly locate the specific cause of the complex vulnerability, it is necessary to obtain the triggering precondition of the vulnerability. At this time, it is necessary to check the upstream dependencies of the interface and locate its behavior entry point. For example, the return packet of interface B, the source of the request parameters of interface A, can obtain the associated interface according to the normal call timing link data (interface call behavior sequence diagram), and then quickly obtain the vulnerability triggering precondition in combination with the traffic.

[0045] In another feasible implementation, the normal call sequence link data can also be used for interface query. According to the transaction that the R&D personnel are concerned about, the normal link corresponding to the transaction can be found, so as to obtain the interface therein, helping the R&D personnel to quickly understand the interfaces involved in different transaction scenarios and the interface call relationship. When the R&D personnel want to know how many APIs there are in a specific scenario, they can quickly evaluate the cost of changing the scenario. The meaning of the link using the machine learning API model, for example, a link is an order link, which is identified using machine learning. By analogy, the meaning of all links is identified, and then R&D can query the links of the specified scenario, so as to quickly and conveniently learn how to build API links in specific scenarios. Specifically, the API basic data such as the naming method of the API name and the parameter data of the API are input into the AI ​​model for learning (unlabeled training), automatically identified through the AI ​​large model, and manually involved in error correction, and the continuous iteration of the AI ​​large model.

[0046] In the embodiments of this specification, by obtaining the interface call behavior data of the normal user group, generating the interface call timing link data based on the interface call behavior data, obtaining the interface basic data of each first interface in the interface call timing link data, determining the interface association degree between the first interfaces based on the interface basic data, and filtering the interface call timing link data according to the interface association degree to obtain the normal call timing link data, the normal call timing link data is used to detect abnormal behavior of the interface access traffic data to be detected. By analyzing the interface call behavior sequence of normal user behavior rather than a single interface call, and introducing the interface basic data, the logical association and abnormal pattern between calls are better captured, and the normal call timing link data is established, which provides a method for examining application security from a macro perspective, so as to be able to perceive the abnormal attacker behavior sequence, and provide a more comprehensive, accurate and dynamic protection framework for application security.

[0047] See also Figure 3 , is a flowchart of a link data generation method provided in an embodiment of this specification. Figure 3 As shown, the method in the embodiment of this specification may include the following steps S202-S230.

[0048] S202, obtaining original access traffic data generated by a normal user group calling a second interface to access a target application;

[0049] In one embodiment of the present specification, the second interface is all interfaces called by the normal user group, and the target application is an application that needs to be detected for anomalies (vulnerability detection). Different applications have different interface calling behaviors, and the target application can be selected according to actual needs. The acquired raw access traffic data may include a timestamp: recording the exact time of the request, including date and time, for time series analysis and trend tracking. Request ID, user ID, IP address, request method, request URL, request parameters, response status code, response time, response size, error information, user agent, region information, and request duration, etc.

[0050] S204, filtering out a first interface from the second interface, and acquiring interface call behavior data associated with the first interface from the original access traffic data;

[0051] In one embodiment of the present specification, the first interface is obtained by filtering in the second interface. Usually, the first interface is an interface that R&D personnel are concerned about, or an interface for important transactions. The first interface can be filtered by a preset filtering policy. For example, the preset filtering policy can indicate filtering client APIs, APIs that do not affect transactions, and interfaces with an API access time interval of less than 1 minute as the first interface. The interface call behavior data associated with the first interface is obtained in the original access traffic data. Exemplarily, the time series relationship is aggregated by userid according to 1-minute partitions to obtain userid, [a, b, c], [timestamp 1, 2, 3], and then the interfaces are combined according to the user identifier to obtain userid: A [api1, api2, api3], userid: B [api2, api2, api3] and other interface call behavior data.

[0052] S206, obtaining a calling time when the target user calls the first interface from the interface calling behavior data;

[0053] S208, arranging according to the calling time to obtain the interface calling time sequence data of the target user calling the first interface;

[0054] In one embodiment of the present specification, the target user is any user in the normal user group. After obtaining the interface call behavior data associated with the first interface, the call time of the first interface is obtained therefrom. The interfaces called by the target user are sorted according to the order of the call time to obtain the interface call timing data of the first interface. Exemplarily, the call time of each interface is obtained, and the interfaces of the same user are sorted to obtain useridAAPI traffic: [api1, api2, api3, api4....][time1, time2, time3, time4....].

[0055] S210, generating interface call timing link data according to the interface call timing data of each target user;

[0056] In one embodiment of the present specification, the interface call sequence link data of each user in the normal user group is obtained, and the call times between each first interface are counted, for example, the interface call sequence link data such as API1->API2 (n times), API2->API4 (n times) can be obtained. The interface call sequence link data at least includes the call relationship between each first interface.

[0057] Optionally, the method also includes: determining the interface access frequency of each first interface based on the interface call timing data of each target user, filtering the first interfaces whose interface access frequency is less than a preset frequency threshold to obtain filtered first interfaces, and generating interface call timing link data between the filtered first interfaces based on the interface call timing data of the filtered first interfaces.

[0058] Specifically, before generating interface call timing link data based on the interface call timing data of the target user, the first interface can be filtered again, that is, the interface call timing data can be filtered. The first interface can be filtered by the interface access frequency of the first interface. For example, the interface with an access frequency less than a preset frequency threshold can be filtered, and the interface call timing link data is generated based on the interface timing data of the remaining interface call timing data of the first interface. For example, the useridAAPI traffic: [api1,api2,api3,api4....][time1,time2,time3,time4....] is filtered to useridA API traffic [api1,api2,api4....][time1,time2,time4..].

[0059] S212, obtaining interface request parameters of each first interface in the interface call timing link data;

[0060] In one embodiment of the present specification, interface request parameters refer to various information passed to the server during the API call process, which are usually used to specify the requested operation, provide necessary data, or control the response behavior. Interface request parameters can be passed in the following ways: URL path parameters, query parameters, request body parameters, header parameters, Cookie parameters, etc. For each first interface in the interface call timing link data, the corresponding interface request parameters are obtained as a basis for evaluating the degree of interface association. It can be understood that the interface request parameters may include parameters for requesting a certain API and parameters returned by the requested API.

[0061] S214, determining the meaning association degree between the interface request parameters to obtain the interface association degree between the first interfaces;

[0062] In one embodiment of the present specification, the meaning correlation degree between the interface request parameters is determined, and the meaning correlation degree is used to evaluate the interface correlation degree between the first interfaces. Specifically, the meaning correlation degree refers to the correlation or similarity of the meanings represented by the interface request parameters. For example, whether the meanings and similarities of API1 request parameter A and API2 return parameter B are consistent. The meaning correlation degree is positively correlated with the interface correlation degree, and the meaning correlation degree can also be directly determined as the interface correlation degree between the first interfaces. S216, obtaining the interface application information of each first interface in the interface call timing link data;

[0063] In one embodiment of the present specification, the interface application information corresponding to each first interface in the interface call timing link data is obtained as the interface basic data of the first interface. The interface application information can be used to describe the actual usage scenario and application of the interface. More specifically, the role and purpose of the interface in actual application is described. For example, an API interface may be used in different application scenarios such as user identity authentication, data retrieval, and payment processing. Typical use cases or transaction processes of the interface can also be described, which can help developers understand how the interface works in actual transactions. For example, typical use cases of a payment interface may include order creation, payment confirmation, and refund processing. Specific examples of the use of the interface in different applications may also be included. For example, a certain interface may be used in an order management system of an e-commerce website, and another interface may be used for data analysis of a social media platform.

[0064] S218, determining the source application association degree and the transaction association degree between the first interfaces based on the interface application information to obtain the interface association degree between the first interfaces;

[0065] In one embodiment of the present specification, the degree of association of the source application between the first interfaces and the degree of association of the transactions between the first interfaces are determined based on the interface application information obtained. The degree of association of the source application refers to whether the applications from which the interfaces come are the same or related. For example, API1 and API2 are from the same application and are related. The degree of association of the transactions refers to the degree of association between the transactions corresponding to the interfaces. For example, API2 and API3 are different analysis APIs, which respectively determine the transaction attributes of the application (e-commerce, takeaway), and determine the degree of association of the transactions based on the corresponding transaction attributes.

[0066] S220, obtaining the interface access frequency of each first interface in the interface call timing link data;

[0067] In one embodiment of the present specification, the interface access frequency of the first interface is obtained as a basis for evaluating the degree of association between the first interfaces. The interface access frequency refers to the number of times a certain API interface is accessed within a certain period of time. The interface access frequency of each first interface can be obtained by counting the interface call behavior data associated with the first interface.

[0068] S222: determining, based on the interface access frequencies, a degree of difference in access frequencies between the first interfaces to obtain a degree of interface association between the first interfaces;

[0069] In one embodiment of the present specification, the access frequencies of different first interfaces are compared to determine which interfaces have similar or different access patterns. Specifically, the degree of difference between the access frequencies of these interfaces can usually be calculated by statistical methods, such as difference percentage, correlation coefficient, etc. According to the degree of difference in access frequency, the degree of association between the interfaces is evaluated. Interfaces with smaller differences may be functionally related, while interfaces with larger differences may be less related. For example, API1 and API2 are accessed 10 million and 1,000 times daily, respectively, then API1 is accessed 9,999 times as many times as API2, indicating that the difference in access frequency between the two is very large, and therefore the degree of association between the two interfaces is low.

[0070] Optionally, the interface association degree between the first interfaces can be determined by obtaining one or more of the interface request parameters, interface application information, and interface access frequency of each first interface in the interface call timing link data, evaluating the meaning association degree of the corresponding first interface, the source application association degree and the transaction association degree between the first interfaces, and the access frequency difference degree between the first interfaces. The association between the first interfaces is verified based on a variety of basic data, thereby improving the accuracy of the verification of the association degree between the first interfaces.

[0071] S224, determining an associated interface in the first interface according to the interface association degree;

[0072] In one embodiment of the present specification, according to the determined interface association degree, an interface with a higher interface association degree is determined in the first interface as an associated interface. For example, illustratively, the interface call timing link data is API1→API2→API3→API4, and the first interfaces are API1, API2, API3, and API4. If the interface association degree between API1 and API2 is low, then API1 and API2 are not associated interfaces, and the link API1→API2 may not be a normal interface call behavior, but may be an occasional behavior. If the interface association degree between API2 and API3 is high, then API2 and API3 are associated interfaces, and the link API2→API3 is a normal interface call behavior. If the association degree between API3 and API4 is high, and API3 and API4 are associated interfaces, then the associated interfaces in the first interface are API2, API3, and API4. It can be understood that when verifying the association of the first interface, the interface association degree between the first interfaces with the calling relationship is mainly verified to determine whether the calling link between the first interfaces with the calling relationship is a regular calling behavior.

[0073] S226, filtering the interface call timing link data to obtain normal call timing link data corresponding to the associated interface;

[0074] In one embodiment of the present specification, after the associated interface is screened out, the normal call sequence link data corresponding to the associated interface is obtained from the interface call sequence link data. According to the example in the above step S224, the obtained normal call sequence link data is API2→API3→API4.

[0075] S228, determining the transaction type of each normal call timing link in the normal call timing link data based on the interface basic data;

[0076] In one embodiment of the present specification, the normal call timing link data includes multiple normal call timing links. After the normal call timing link data is obtained by screening from the interface call timing link data according to the interface association degree, the transaction type of the normal call timing link can also be determined according to the interface basic data of the first interface. Specifically, the API basic information includes the application information of the API, the simple description information of the API, and the API parameter model information. Using the AI ​​big model, it can be known whether the API is a sensitive API, such as a transfer API, or an API for obtaining personal information. Thereby, the interface call link of concern is determined according to the type of API. That is, the type of API and the transaction type of each normal call timing link can be confirmed according to the interface basic data. For example, the transaction type corresponding to the call link including the transfer API is a transfer type.

[0077] S230: Generate critical call timing link data based on the normal call timing link whose transaction type is a critical type.

[0078] Specifically, the normal call timing link with the transaction type of the associated type is determined as the associated call timing link, thereby obtaining the key call timing link data. It is understandable that the key type can be a transaction type that is prone to vulnerabilities and is automatically selected by the AI ​​model, or it can be a manually set transaction type. The key call timing link data obtained in this way can be used to detect threat traffic.

[0079] In an embodiment of the present specification, the original access traffic data generated by a normal user group calling a second interface to access a target application is obtained, the first interface is obtained from the second interface, and the interface call behavior data associated with the first interface is obtained from the original access traffic data. The first interface is obtained by filtering, thereby reducing the amount of data processing and focusing on the calling behavior with core and sensitive interfaces. Thereafter, the call time of the target user calling the first interface is obtained from the interface call behavior data, and the interface call timing data of the target user calling the first interface is obtained by arranging them according to the call time. The interface call timing link data is generated according to the interface call timing data of each target user, and the interface call timing link data corresponding to the normal user group is obtained by normalizing the data of multiple users. Then, the interface call timing link data is obtained. Use the interface request parameters of each first interface in the timing link data to determine the meaning association degree between the interface request parameters to obtain the interface association degree between the first interfaces, and / or obtain the interface application information of each first interface in the interface call timing link data, determine the source application association degree and the transaction association degree between the first interfaces based on the interface application information to obtain the interface association degree between the first interfaces, and / or obtain the interface access frequency of each first interface in the interface call timing link data, determine the degree of difference in access frequency between the first interfaces based on the interface access frequency to obtain the interface association degree between the first interfaces, determine the associated interface in the first interface according to the interface association degree, and filter out the normal call timing link data corresponding to the associated interface from the interface call timing link data. By introducing the interface basic data to verify the association between the interfaces, the interface call link in the normal mode can be found more accurately. Furthermore, based on the interface basic data, the transaction type of each normal call timing link in the normal call timing link data is determined, and based on the normal call timing link whose transaction type is a critical type, the critical call timing link data is generated, so that the timing links associated with the critical transactions can be screened out in the normal call timing link data, and then the critical transactions can be detected whether there are abnormalities according to the associated links.

[0080] See also Figure 4, is a flowchart of a link data generation method provided in an embodiment of this specification. Figure 4 As shown, the method of the embodiment of this specification may include the following steps S302-S308:

[0081] S302, obtaining access traffic data of the interface to be detected;

[0082] In one embodiment of the present specification, in order to realize abnormality perception, the interface access flow data generated by the unknown user calling the interface access application is obtained as the interface access flow data to be detected. Exemplarily, a real-time acquisition method can be adopted to ensure timely abnormality analysis.

[0083] S304, generating interface call link data to be detected based on the interface access traffic data;

[0084] In one embodiment of the present specification, the call link of the interface is extracted from the interface access traffic data to obtain the call link data of the interface to be detected.

[0085] S306, matching the interface call link data to be detected with the normal call sequence link data to obtain abnormal interface call link data that does not match the normal call sequence link data;

[0086] In one embodiment of the present specification, the interface call link data to be detected is matched with the normal call timing link data, and the abnormal interface call link data that does not match the normal call timing link data is determined from the interface call link data to be detected. For example, the normal call timing link data is API1→API2, API2→API4, and the interface call link data to be detected is API2→API3, then the interface call link data to be detected does not exist in the normal call timing link data, and the interface call link data to be detected is determined as abnormal interface call link data. Optionally, in addition to the call links between interfaces, the interface call link data to be detected may also include basic data of each interface and related data such as the number of interface calls.

[0087] S308: Generate an abnormal behavior detection result corresponding to the interface access traffic data based on the abnormal interface call link data.

[0088] In one embodiment of the present specification, after determining the abnormal interface call link data, an abnormal behavior detection result corresponding to the interface access traffic data is generated according to the abnormal interface call link data. Specifically, the abnormal interface call link data can be imported into the AI ​​model for intelligent pattern matching and evaluation, and the specific context of the vulnerability can be automatically determined to accelerate problem location.

[0089] For example, user A places an order first and can choose to pay or not. This solution focuses on whether there is abnormal behavior in the entire link. If a large number of users suddenly pay directly without placing an order, it is considered abnormal behavior.

[0090] See also Figure 5 , Figure 5 The following is a schematic diagram of an example of a link data generation method for this specification. Figure 5 As shown, the interface call behavior data of the normal user group is obtained, and the interface call timing link data is generated based on the interface call behavior data. Then, the interface basic data of each first interface in the interface call timing link data is obtained, and the interface correlation degree between the first interfaces is determined based on the interface basic data. According to the interface correlation degree, the normal call timing link data is screened from the interface call timing link data to obtain the interface access traffic data, and then the interface call link data generated by the unknown user calling the API to access the application is obtained in real time, and the interface call link data to be detected is extracted and matched with the normal call timing link data to obtain the abnormal behavior detection result for the unknown user.

[0091] In the embodiments of this specification, by obtaining the interface access traffic data to be detected, the interface call link data to be detected is generated based on the interface access traffic data, the interface call link data to be detected is matched with the normal call sequence link data to obtain abnormal interface call link data that does not match the normal call sequence link data, and the abnormal behavior detection result corresponding to the interface access traffic data is generated based on the abnormal interface call link data. The normal call sequence link data obtained by the construction can manage and automatically analyze abnormal traffic in real time, which is not limited to known vulnerability patterns, but can also identify potential and complex transaction logic vulnerabilities and new attacks, thereby improving the ability to respond to unknown security threats.

[0092] The following will be combined with the attached Figure 6 , the link data generating device provided in the embodiment of this specification is introduced in detail. It should be noted that the attached Figure 6 The link data generating device in the embodiment of the present invention is used to execute the link data generating device in the embodiment of the present invention. Figure 2-Figure 5 For the convenience of explanation, only the part related to the embodiment of this specification is shown. For the specific technical details not disclosed, please refer to this specification. Figure 2-Figure 5 The embodiment shown.

[0093] See also Figure 6 , which shows a schematic diagram of the structure of a link data generating device provided by an exemplary embodiment of this specification. The link data generating device can be implemented as all or part of the device through software, hardware or a combination of both. The device 1 includes an acquisition unit 11, a generation unit 12, an association verification unit 13 and a screening unit 14.

[0094] An acquisition unit 11 is used to acquire interface calling behavior data of a normal user group;

[0095] A generating unit 12, configured to generate interface call timing link data based on the interface call behavior data;

[0096] The association verification unit 13 is used to obtain the interface basic data of each first interface in the interface call timing link data, and determine the interface association degree between the first interfaces based on the interface basic data;

[0097] The screening unit 14 is used to screen the interface call timing link data to obtain normal call timing link data according to the interface association degree, and the normal call timing link data is used to perform abnormal behavior detection on the interface access traffic data to be detected.

[0098] Optionally, the acquisition unit 11 is specifically used to acquire original access traffic data generated by a normal user group calling the second interface to access the target application;

[0099] A first interface is obtained by filtering the second interface, and interface call behavior data associated with the first interface is obtained from the original access traffic data.

[0100] Optionally, the generating unit 12 is specifically configured to obtain a calling time when a target user calls the first interface from the interface calling behavior data; the target user is any user in the normal user group;

[0101] Arrange the interface call time series data of the target user calling the first interface according to the calling time;

[0102] Generate interface call timing link data according to the interface call timing data of each target user.

[0103] Optionally, the generating unit 12 is specifically configured to determine the interface access frequency of each of the first interfaces according to the interface call timing data of each of the target users;

[0104] Filtering the first interface whose access frequency of the interface is less than a preset frequency threshold to obtain a filtered first interface;

[0105] The interface call timing link data between the filtered first interfaces is generated based on the interface call timing data of the filtered first interfaces.

[0106] Optionally, the association verification unit 13 is specifically used to obtain the interface request parameters of each first interface in the interface call timing link data;

[0107] Determine the meaning association degree between the interface request parameters to obtain the interface association degree between the first interfaces.

[0108] Optionally, the association verification unit 13 is specifically used to obtain the interface application information of each first interface in the interface call timing link data;

[0109] The source application association degree and the transaction association degree between the first interfaces are determined based on the interface access frequency to obtain the interface association degree between the first interfaces.

[0110] Optionally, the association verification unit 13 is specifically used to obtain the interface access frequency of each first interface in the interface call timing link data;

[0111] The access frequency difference degree between the first interfaces is determined based on the interface application information to obtain the interface association degree between the first interfaces.

[0112] Optionally, the screening unit 14 is specifically configured to determine an associated interface in the first interface according to the interface association degree;

[0113] The normal calling timing link data corresponding to the associated interface is obtained by screening the interface calling timing link data.

[0114] Optionally, the screening unit 14 is further configured to determine the transaction type of each normal call timing link in the normal call timing link data based on the interface basic data;

[0115] Generate critical call timing link data based on a normal call timing link where the transaction type is a critical type.

[0116] Optionally, the device further comprises a detection unit 15, which is used to obtain the interface access flow data to be detected;

[0117] Generate the interface call link data to be detected based on the interface access traffic data;

[0118] Matching the interface call link data to be detected with the normal call sequence link data to obtain abnormal interface call link data that does not match the normal call sequence link data;

[0119] An abnormal behavior detection result corresponding to the interface access traffic data is generated based on the abnormal interface call link data.

[0120] It should be noted that the link data generation device provided in the above embodiment only uses the division of the above functional modules as an example when executing the link data generation method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the link data generation device provided in the above embodiment and the link data generation method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0121] The serial numbers of the embodiments of the present specification are for description only and do not represent the advantages and disadvantages of the embodiments. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0122] The present specification also provides a storage medium having a computer program stored thereon. When the computer program is executed by a processor, the above-mentioned Figure 2-Figure 5 The link data generation method of the embodiment shown in the figure can be found in the specific execution process. Figure 2-Figure 5 The specific description of the illustrated embodiment will not be repeated here.

[0123] Please refer to Figure 7 , which shows a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of this specification. The electronic device in this specification may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.

[0124] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions and processes data of the terminal 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user pages, and applications; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.

[0125] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable medium (Non-Transitory Computer-Readable Storage Medium). The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an IOS system developed by Apple, including a system deeply developed based on the IOS system or other systems.

[0126] The memory 120 can be divided into an operating system space and a user space. The operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good operating results, the operating system allocates corresponding system resources to different third-party applications. However, the requirements for system resources in different application scenarios in the same third-party application are also different. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and third-party applications are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0127] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0128] The input device 130 is used to receive input commands or data, and includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 140 is used to output commands or data, and includes but is not limited to a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are touch screen displays.

[0129] The touch display screen can be designed as a full screen, a curved screen or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in the embodiments of this specification.

[0130] In addition, those skilled in the art can understand that the structure of the electronic device shown in the above drawings does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the electronic device also includes components such as a radio frequency circuit, an input unit, a sensor, an audio circuit, a WiFi module, a power supply, and a Bluetooth module, which will not be described in detail here.

[0131] exist Figure 7 In the electronic device shown, the processor 110 may be used to call a computer application stored in the memory 120 and specifically perform the following operations:

[0132] Obtain interface call behavior data of normal user groups;

[0133] Generate interface call timing link data based on the interface call behavior data;

[0134] Acquire interface basic data of each first interface in the interface call timing link data, and determine the interface association degree between the first interfaces based on the interface basic data;

[0135] Normal call timing link data is obtained by filtering the interface call timing link data according to the interface association degree, and the normal call timing link data is used to perform abnormal behavior detection on the interface access flow data to be detected.

[0136] In one embodiment, the processor 110 specifically performs the following operations when acquiring the interface calling behavior data of a normal user group:

[0137] Obtaining original access traffic data generated by a normal user group calling the second interface to access the target application;

[0138] A first interface is obtained by filtering the second interface, and interface call behavior data associated with the first interface is obtained from the original access traffic data.

[0139] In one embodiment, when the processor 110 generates the interface call timing link data based on the interface call behavior data, the processor 110 specifically performs the following operations:

[0140] Acquire a calling time when a target user calls a first interface from the interface calling behavior data; the target user is any user in the normal user group;

[0141] Arrange the interface call time series data of the target user calling the first interface according to the calling time;

[0142] Generate interface call timing link data according to the interface call timing data of each target user.

[0143] In an embodiment, when the processor 110 generates the interface call timing link data according to the interface call timing data of each target user, the processor 110 specifically performs the following operations:

[0144] Determining the interface access frequency of each of the first interfaces according to the interface call timing data of each of the target users;

[0145] Filtering the first interface whose access frequency of the interface is less than a preset frequency threshold to obtain a filtered first interface;

[0146] The interface call timing link data between the filtered first interfaces is generated based on the interface call timing data of the filtered first interfaces.

[0147] In one embodiment, the interface basic data is an interface request parameter. When the processor 110 obtains the interface basic data of each first interface in the interface call timing link data and determines the interface association degree between the first interfaces based on the interface basic data, the processor 110 specifically performs the following operations:

[0148] Obtaining interface request parameters of each first interface in the interface call timing link data;

[0149] Determine the meaning association degree between the interface request parameters to obtain the interface association degree between the first interfaces.

[0150] In one embodiment, the interface basic data is interface application information. When the processor 110 obtains the interface basic data of each first interface in the interface call timing link data and determines the interface association degree between the first interfaces based on the interface basic data, the processor 110 specifically performs the following operations:

[0151] Obtaining interface application information of each first interface in the interface call timing link data;

[0152] The source application association degree and the transaction association degree between the first interfaces are determined based on the interface access frequency to obtain the interface association degree between the first interfaces.

[0153] In one embodiment, the interface basic data is the interface access frequency. When the processor 110 obtains the interface basic data of each first interface in the interface call timing link data and determines the interface association degree between the first interfaces based on the interface basic data, the processor 110 specifically performs the following operations:

[0154] Obtaining the interface access frequency of each first interface in the interface call timing link data;

[0155] The access frequency difference degree between the first interfaces is determined based on the interface application information to obtain the interface association degree between the first interfaces.

[0156] In one embodiment, when the processor 110 performs filtering to obtain normal call timing link data from the interface call timing link data according to the interface association degree, the processor 110 specifically performs the following operations:

[0157] Determining an associated interface in the first interface according to the interface association degree;

[0158] The normal calling timing link data corresponding to the associated interface is obtained by screening the interface calling timing link data.

[0159] In one embodiment, after filtering the interface call timing link data according to the interface association degree to obtain normal call timing link data, the processor 110 further performs the following operations:

[0160] Determine the transaction type of each normal call timing link in the normal call timing link data based on the interface basic data;

[0161] Generate critical call timing link data based on a normal call timing link where the transaction type is a critical type.

[0162] In one embodiment, the processor 110 is further configured to perform the following operations: obtaining access traffic data of the interface to be detected;

[0163] Generate the interface call link data to be detected based on the interface access traffic data;

[0164] Matching the interface call link data to be detected with the normal call sequence link data to obtain abnormal interface call link data that does not match the normal call sequence link data;

[0165] An abnormal behavior detection result corresponding to the interface access traffic data is generated based on the abnormal interface call link data.

[0166] In the embodiments of this specification, by obtaining the interface call behavior data of the normal user group, generating the interface call timing link data based on the interface call behavior data, obtaining the interface basic data of each first interface in the interface call timing link data, determining the interface association degree between the first interfaces based on the interface basic data, and filtering the interface call timing link data according to the interface association degree to obtain the normal call timing link data, the normal call timing link data is used to detect abnormal behavior of the interface access traffic data to be detected. By analyzing the interface call behavior sequence of normal user behavior rather than a single interface call, and introducing the interface basic data, the logical association and abnormal pattern between calls are better captured, and the normal call timing link data is established, which provides a method for examining application security from a macro perspective, so as to be able to perceive the abnormal attacker behavior sequence, and provide a more comprehensive, accurate and dynamic protection framework for application security.

[0167] Furthermore, by obtaining the original access traffic data generated by the normal user group calling the second interface to access the target application, the first interface is obtained from the second interface, and the interface call behavior data associated with the first interface is obtained from the original access traffic data. The first interface is obtained by screening, thereby reducing the amount of data processing and focusing on the calling behavior of the core and sensitive interfaces. Afterwards, the call time of the target user calling the first interface is obtained from the interface call behavior data, and the interface call timing data of the target user calling the first interface is obtained according to the call time. The interface call timing link data is generated according to the interface call timing data of each target user, and the interface call timing link data corresponding to the normal user group is obtained by normalizing the data of multiple users. The interface request parameters of each first interface in the interface call timing link data are determined to determine the meaning correlation between the interface request parameters to obtain the interface correlation between the first interfaces, and / or the interface application information of each first interface in the interface call timing link data is obtained, and the source application correlation and the transaction correlation between the first interfaces are determined based on the interface application information to obtain the interface correlation between the first interfaces, and / or the interface access frequency of each first interface in the interface call timing link data is obtained, and the degree of difference in the access frequency between the first interfaces is determined based on the interface access frequency to obtain the interface correlation between the first interfaces, and the associated interface is determined in the first interface according to the interface correlation degree, and the normal call timing link data corresponding to the associated interface is obtained from the interface call timing link data. The correlation between the interfaces is verified by introducing the interface basic data, so as to more accurately find the interface call link in the normal mode. Furthermore, based on the interface basic data, the transaction type of each normal call timing link in the normal call timing link data is determined, and based on the normal call timing link whose transaction type is a critical type, the critical call timing link data is generated, so that the timing links associated with the critical transactions can be screened out in the normal call timing link data, and then the critical transactions can be detected whether there are abnormalities according to the associated links.

[0168] Furthermore, by obtaining the interface access traffic data to be detected, the interface call link data to be detected is generated based on the interface access traffic data, and the interface call link data to be detected is matched with the normal call timing link data to obtain abnormal interface call link data that does not match the normal call timing link data, and the abnormal behavior detection result corresponding to the interface access traffic data is generated based on the abnormal interface call link data. The normal call timing link data obtained by construction can manage and automatically analyze abnormal traffic in real time, which is not limited to known vulnerability patterns, but can also identify potential and complex transaction logic vulnerabilities and new attacks, thereby improving the ability to respond to unknown security threats.

[0169] In addition, an embodiment of the present specification provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor of an electronic device, the processor can at least implement the above-mentioned Figures 1 to 5 The methods provided in the illustrated embodiments.

[0170] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0171] The above disclosure is only the preferred embodiment of this specification, which certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A link data generation method, the method comprising: Obtain interface call behavior data of normal user groups; Generate interface call timing link data based on the interface call behavior data; Acquire interface basic data of each first interface in the interface call timing link data, and determine the interface association degree between the first interfaces based on the interface basic data; Normal call timing link data is obtained by filtering the interface call timing link data according to the interface association degree, and the normal call timing link data is used to perform abnormal behavior detection on the interface access flow data to be detected.

2. The method according to claim 1, wherein obtaining the interface calling behavior data of the normal user group comprises: Obtaining original access traffic data generated by a normal user group calling the second interface to access the target application; A first interface is obtained by filtering the second interface, and interface call behavior data associated with the first interface is obtained from the original access traffic data.

3. The method according to claim 1, wherein generating interface call timing link data based on the interface call behavior data comprises: Acquire a calling time when a target user calls a first interface from the interface calling behavior data; The target user is any user in the normal user group; Arrange the interface call time series data of the target user calling the first interface according to the calling time; Generate interface call timing link data according to the interface call timing data of each target user.

4. The method according to claim 3, wherein generating the interface call timing link data according to the interface call timing data of each target user comprises: Determining the interface access frequency of each of the first interfaces according to the interface call timing data of each of the target users; Filtering the first interface whose access frequency of the interface is less than a preset frequency threshold to obtain a filtered first interface; The interface call timing link data between the filtered first interfaces is generated based on the interface call timing data of the filtered first interfaces.

5. The method according to claim 1, wherein the interface basic data is an interface request parameter; The acquiring interface basic data of each first interface in the interface call timing link data, and determining the interface association degree between the first interfaces based on the interface basic data, includes: Obtaining interface request parameters of each first interface in the interface call timing link data; Determine the meaning association degree between the interface request parameters to obtain the interface association degree between the first interfaces.

6. The method according to claim 1, wherein the interface basic data is interface application information; The acquiring interface basic data of each first interface in the interface call timing link data, and determining the interface association degree between the first interfaces based on the interface basic data, includes: Obtaining interface application information of each first interface in the interface call timing link data; The source application association degree and the transaction association degree between the first interfaces are determined based on the interface access frequency to obtain the interface association degree between the first interfaces.

7. The method according to claim 1, wherein the basic interface data is the interface access frequency; The acquiring interface basic data of each first interface in the interface call timing link data, and determining the interface association degree between the first interfaces based on the interface basic data, includes: Obtaining the interface access frequency of each first interface in the interface call timing link data; The access frequency difference degree between the first interfaces is determined based on the interface application information to obtain the interface association degree between the first interfaces.

8. The method according to claim 1, wherein the step of filtering the interface call timing link data to obtain normal call timing link data according to the interface association degree comprises: Determining an associated interface in the first interface according to the interface association degree; The normal calling timing link data corresponding to the associated interface is obtained by screening the interface calling timing link data.

9. The method according to claim 1, after filtering the interface call timing link data to obtain normal call timing link data according to the interface association degree, further comprising: Determine the transaction type of each normal call timing link in the normal call timing link data based on the interface basic data; Generate critical call timing link data based on a normal call timing link where the transaction type is a critical type.

10. The method of claim 1, further comprising: Obtain access traffic data of the interface to be detected; Generate the interface call link data to be detected based on the interface access traffic data; Matching the interface call link data to be detected with the normal call sequence link data to obtain abnormal interface call link data that does not match the normal call sequence link data; An abnormal behavior detection result corresponding to the interface access traffic data is generated based on the abnormal interface call link data.

11. A link data generating device, comprising: An acquisition unit, used to acquire interface call behavior data of a normal user group; A generating unit, configured to generate interface call timing link data based on the interface call behavior data; an association verification unit, configured to obtain basic interface data of each first interface in the interface call timing link data, and determine the degree of interface association between the first interfaces based on the basic interface data; A screening unit is used to screen the interface call timing link data according to the interface association degree to obtain normal call timing link data, wherein the normal call timing link data is used to perform abnormal behavior detection on the interface access flow data to be detected.

12. An electronic device comprising: Processor and memory; The memory stores a computer program, wherein the computer program is suitable for being loaded by the processor and executing the steps of the method according to any one of claims 1 to 10.

13. A storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 10.

14. A computer program product comprising: A computer program, when executed by a processor of an electronic device, causes the processor to perform the steps of the method according to any one of claims 1 to 10.

Images