API traversal threat detection method and device, storage medium and electronic equipment

Abstract

The invention provides an API traversal threat detection method and device, a storage medium and electronic equipment, and is applied to the technical field of network security. The method comprises the following steps: collecting a user flow request log generated in a process of using a specific application program by a user in a current time period; extracting and converting each user traffic request log, and identifying a keyword proportion of each user traffic request log; and when the keyword proportion of any user traffic request log is greater than a preset expert proportion threshold, identifying that the API interface corresponding to the user traffic request log has a parameter traversal risk. According to the method, the keyword proportion is used as a judgment standard, the high-risk API interface can be quickly screened out by setting a reasonable threshold value, and compared with a traditional method, the detection and recognition efficiency of API traversal threats is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an API traversal threat detection method, device, storage medium and electronic device. Background Art

[0002] API (Application Program Interface) is the link between the client and the server in modern software, improving the efficiency of data exchange.

[0003] However, as enterprises expand, the number of APIs surges, posing challenges to management. Unmanaged "shadow APIs" become potential attack targets, threatening enterprise security. Common parameter traversal attacks obtain sensitive data by enumerating parameters, leading to information leakage and resource consumption.

[0004] Therefore, how to efficiently identify whether there is a parameter traversal risk in the API interface becomes the key to improving network security. Summary of the invention

[0005] In view of the above problems, the present invention provides an API traversal threat detection method, device, storage medium and electronic device that overcome the above problems or at least partially solve the above problems. The technical solution is as follows:

[0006] An API traversal threat detection method, comprising:

[0007] Collect user traffic request logs generated when users use specific applications in the current period;

[0008] Extracting and converting each of the user traffic request logs respectively, and identifying the keyword ratio of each of the user traffic request logs;

[0009] When the keyword ratio of any of the user traffic request logs is greater than a preset expert ratio threshold, it is identified that the API interface corresponding to the user traffic request log has a parameter traversal risk.

[0010] Optionally, extracting and converting each of the user traffic request logs respectively to identify the keyword ratio of each of the user traffic request logs includes:

[0011] Extracting each of the user traffic request logs into a Hive database;

[0012] Clean each of the user traffic request logs in the Hive database, and extract the API interface of each of the user traffic request logs and its corresponding path parameter;

[0013] Performing word segmentation processing on the path parameter according to a word segmentation algorithm to generate a word segmentation list, wherein the word segmentation list includes at least one word;

[0014] Calculate the inverse document frequency value of each word in the word segmentation list;

[0015] The word with the largest inverse document frequency value in the word segmentation list is used as the keyword of the corresponding user traffic request log;

[0016] Based on the keywords in each of the user traffic request logs, a keyword ratio in each of the user traffic request logs is calculated.

[0017] Optionally, calculating the inverse document frequency value of each word in the word segmentation list includes:

[0018] For any word: using the number of the word lists containing the word and the total number of word lists in the current time period, calculate the inverse document frequency value of the word.

[0019] Optionally, the calculating, based on the keywords in the traffic request logs of each user, a keyword ratio of each user traffic request log includes:

[0020] The number of logs in which the keyword is identified in each of the user traffic request logs is counted, and the ratio of the number of logs to the total number of logs in the current time period is calculated, and the ratio is used as the keyword ratio of the user traffic request log that identifies the keyword.

[0021] Optionally, after identifying that the API interface corresponding to the user traffic request log has a parameter traversal risk, the method further includes:

[0022] The interface information of the API interface with parameter traversal risk is written into the MySQL database.

[0023] Optionally, after identifying that the API interface corresponding to the user traffic request log has a parameter traversal risk, the method further includes:

[0024] At least one specified security control measure is applied to the API interface that has the risk of parameter traversal.

[0025] Optionally, the specified security control measures are parameter verification, rate limiting, authentication authorization, or signing and encryption.

[0026] An API traversal threat detection device includes: a user traffic request log collection unit, a keyword ratio identification unit and an API interface risk identification unit.

[0027] The user flow request log collection unit is used to collect the user flow request log generated by the user in the process of using the specific application program in the current period;

[0028] The keyword ratio identification unit is used to extract and convert each of the user traffic request logs respectively, and identify the keyword ratio of each of the user traffic request logs;

[0029] The API interface risk identification unit is used to identify that the API interface corresponding to the user traffic request log has a parameter traversal risk when the keyword ratio of any of the user traffic request logs is greater than a preset expert ratio threshold.

[0030] A computer-readable storage medium stores a program thereon, wherein when the program is executed by a processor, the method for detecting API traversal threats described in any one of the above is implemented.

[0031] An electronic device comprises at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute any of the above-mentioned API traversal threat detection methods.

[0032] Through the above technical solution, the API traversal threat detection method, device, storage medium and electronic device provided by the present invention collect user traffic request logs generated by users using specific applications in the current period; extract and convert each user traffic request log respectively, and identify the keyword ratio of each user traffic request log; when the keyword ratio of any user traffic request log is greater than the preset expert ratio threshold, identify the API interface corresponding to the user traffic request log as having parameter traversal risk. The present invention uses the keyword ratio as a judgment criterion, and by setting a reasonable threshold, it can quickly screen out high-risk API interfaces, which significantly improves the detection and identification efficiency of API traversal threats compared to traditional methods.

[0033] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0035] Figure 1 A flowchart of an implementation of an API traversal threat detection method provided by an embodiment of the present invention is shown;

[0036] Figure 2 A flow chart showing another implementation of the API traversal threat detection method provided by an embodiment of the present invention is shown;

[0037] Figure 3 A flow chart showing another implementation of the API traversal threat detection method provided by an embodiment of the present invention is shown;

[0038] Figure 4 A schematic diagram of the architecture of an API traversal threat detection system provided by an embodiment of the present invention is shown;

[0039] Figure 5 A schematic diagram of the structure of an API traversal threat detection device provided by an embodiment of the present invention is shown;

[0040] Figure 6 A schematic structural diagram of an electronic device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0041] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0042] Application Program Interface (API) plays a vital role in modern software architecture. It acts as a bridge between the client and the server, enabling personal devices to easily connect to the Internet. This bridge greatly improves the efficiency of information communication and exchange of software. However, with the continuous expansion of the business scope of enterprises, the number of APIs is also growing rapidly, which poses a huge challenge to the management of APIs. The limitation of management costs has led to many APIs being left unmanaged after multiple rounds of business iterations. These improperly managed APIs, often referred to as "shadow APIs", may become potential targets of attack, posing serious risks to the network security and data security of enterprises.

[0043] Among these security risks, parameter traversal attacks are a common method. Attackers enumerate parameters in the API interface to obtain sensitive data under the interface. This may not only lead to information leakage, but also consume server resources and affect the normal operation of the enterprise. In order to deal with these security risks, network security managers usually sort out the API list and manually check whether the API is at risk of being attacked one by one. The advantage of this method is accurate identification, but it also has the disadvantage of low efficiency and is difficult to cope with the rapidly changing technical environment and the increasing number of APIs.

[0044] Based on this, in an embodiment of the present invention, an API traversal threat detection method is provided. First, a user traffic request log generated by a user in the process of using a mobile APP (Application) is collected through a big data log collection tool (such as Logstash), and these logs are saved in a Hive database. Secondly, after the user traffic request log is connected to the Hive database, an ETL (Extract, Transform, Load) operation is performed, and preliminary data cleaning and processing are performed according to data requirements, with special attention to the path parameter in the API interface request, and the API interface name and its corresponding path parameter are extracted from the requested URL (Uniform Resource Locator). It can be seen that by calculating the TF-IDF (Term Frequency–Inverse Document Frequency) value of the path parameter, keywords are screened out, and the API interface with parameter traversal risk is identified and written into the MySQL database. At the same time, the downstream API analysis service pushes the detected abnormal data to the network security operator for processing. This process is conducive to improving the accuracy and efficiency of parameter traversal risk detection and identification of the API interface, and enhancing network security.

[0045] like Figure 1 As shown, a flowchart of an implementation of an API traversal threat detection method provided by an embodiment of the present invention is provided. The method may include:

[0046] S100: Collect user traffic request logs generated when a user uses a specific application program in a current period.

[0047] Among them, the user traffic request log is a log file that records all network requests and data transmission activities generated by users when using specific applications. The user traffic request log can include request timestamp, user identifier, request source and target, request type, URL or resource path, status code, data volume, and user agent information.

[0048] Specifically, the embodiment of the present invention can use a big data log collection tool (such as Logstash) to collect user traffic request logs generated by users using specific applications in the current period. By using a big data log collection tool, the embodiment of the present invention can effectively collect and manage user traffic request logs, providing basic data support for subsequent analysis and detection of parameter traversal risks of API interfaces.

[0049] S110 , extracting and converting the traffic request logs of each user respectively, and identifying the keyword ratio of the traffic request logs of each user.

[0050] The keyword ratio is used to determine the ratio of logs with the same keyword in multiple logs to the total number of logs. For example, suppose there are N logs, each with a keyword. If a keyword (for example, "login") appears in M ​​different logs, then the ratio of the keyword "login" is M / N.

[0051] Specifically, the embodiment of the present invention can perform data cleaning and data processing on the user traffic request log, extract the API interface name and its corresponding path parameter from the URL, and focus on processing the path parameter in the API interface request. The TF-IDF value of the extracted path parameter is calculated to screen out key parameters, so as to identify the keyword ratio of the user traffic request log by analyzing these key parameters.

[0052] Optionally, data cleaning may include unifying field formats, converting time fields, and maintaining consistent positions of processed field values.

[0053] S120: When the keyword ratio of any user traffic request log is greater than a preset expert ratio threshold, it is identified that the API interface corresponding to the user traffic request log has a parameter traversal risk.

[0054] The keyword ratio measures the prevalence of a particular keyword in all logs. If the keyword ratio is close to 1, it means that most logs contain the same keyword, which may indicate that these API interface requests have similar structures and parameter patterns. When many API interface requests have the same keyword, it may indicate that these API interfaces have some parameter traversal risks.

[0055] The preset expert ratio threshold is a value used as a judgment standard when identifying parameter traversal risks in user traffic request logs. Specifically, this threshold is set by domain experts based on experience and historical data to measure the frequency of specific keywords appearing in request logs.

[0056] When the proportion of a keyword in the user traffic request log exceeds this preset threshold, it can be considered that the keyword appears abnormally frequently in the API interface. This abnormally frequent appearance may indicate the risk of parameter traversal attacks, that is, attackers try to access different data or functions by constantly changing parameters in API requests. Therefore, API request logs that exceed this threshold will be marked as potentially risky and require further investigation and processing.

[0057] The API traversal threat detection method provided by the present invention comprises: collecting user traffic request logs generated by users using a specific application program in the current period; extracting and converting each user traffic request log respectively, identifying the keyword ratio of each user traffic request log; and identifying the API interface corresponding to the user traffic request log as having parameter traversal risk when the keyword ratio of any user traffic request log is greater than a preset expert ratio threshold. The present invention uses the keyword ratio as a judgment criterion, and by setting a reasonable threshold, it can quickly screen out high-risk API interfaces, significantly improving the detection and identification efficiency of API traversal threats compared to traditional methods.

[0058] Optional, based on Figure 1 The method shown, such as Figure 2 As shown, a flowchart of another implementation of the API traversal threat detection method provided by an embodiment of the present invention is shown, and step S110 may specifically include:

[0059] S200. Extract each user's traffic request log to the Hive database.

[0060] Among them, the Hive database is a data warehouse tool used to process and query data stored in a distributed file system.

[0061] Specifically, the embodiment of the present invention can extract each user traffic request log from each data source and import it into a Hive table of a Hive database, thereby ensuring that all original log data are centrally stored for subsequent processing.

[0062] S210: Clean each user traffic request log in the Hive database, and extract the API interface of each user traffic request log and its corresponding path parameter.

[0063] Specifically, the embodiment of the present invention can use HiveQL to parse the request URL in the user traffic request log and extract the API interface and path parameter. For example, assuming that there is a column in the user traffic request log containing a complete request URL, it can be parsed using a regular expression or a built-in string function. If the log contains the method and path information of the request, this information can be extracted through a string processing function (such as split, regexp_extract, etc.). For example, in the URL "api.example.com / login / 238", the " / login / 238" part is called the path, which specifies the location of the resource on the server. Among them, "238" is a variable parameter, which is usually used to identify a specific resource or a specific context of a request. Then, unnecessary fields and noise data can be removed, such as invalid requests or incomplete log records. The cleaning step can include deleting records containing errors or abnormal data. The cleaned and extracted data is stored in a new Hive table to facilitate subsequent analysis and processing. The embodiment of the present invention can define a new Hive table structure to store the extracted API interface and corresponding parameters.

[0064] S220. Segment the path parameter according to a segmentation algorithm to generate a segmentation list, wherein the segmentation list includes at least one word.

[0065] S230, calculating the inverse document frequency value of each word in the word segmentation list.

[0066] S240: Use the word with the largest inverse document frequency value in the word segmentation list as the keyword of the corresponding user traffic request log.

[0067] S250 . Calculate the keyword ratio of each user's traffic request log based on the keyword of each user's traffic request log.

[0068] In natural language processing, TF-IDF (term frequency-inverse document frequency) is a commonly used statistical method to evaluate the importance of a word in a document. Specifically, if a word appears frequently in a document (i.e., high term frequency TF) but appears less frequently in other documents, then the word can be considered an important keyword in the document.

[0069] Based on this concept, the embodiment of the present invention can regard all URL requests sent by the client to the server in the current period as a group of documents. Then, in order to identify the keywords of a single URL request, the URL needs to be segmented first, and it is divided into a list such as ['login', '238']. In this solution, in order to simplify the calculation, the embodiment of the present invention can assume that the term frequency (TF) of each word is 1.

[0070] Next, all N request documents of the corresponding API interface are segmented to obtain N word lists. Then, the IDF value of each word is calculated according to the IDF (Inverse Document Frequency) algorithm. In each segmentation list, the word with the highest IDF value is regarded as the keyword of the corresponding document.

[0071] Generally, if a document has a large number of keywords, it means that the request for the interface contains a large number of different variable parameters. If the keyword ratio exceeds the preset threshold, it can be considered that the API interface has the risk of parameter traversal.

[0072] The embodiment of the present invention adopts a keyword calculation algorithm, combined with natural language processing technology, to quickly calculate the keyword ratio of user traffic request logs, thereby helping to efficiently identify parameter traversal threats in massive API interfaces.

[0073] Optional, in the above Figure 2 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, calculating the inverse document frequency value of each word in the word segmentation list may specifically include:

[0074] For any word: use the number of word lists containing the word and the total number of word lists in the current time period to calculate the inverse document frequency value of the word.

[0075] Specifically, the embodiment of the present invention can input the number of word segmentation lists containing the word and the total number of word segmentation lists in the current time period into the following formula:

[0076]

[0077] Calculate the inverse document frequency value of the word, where IDF is the inverse document frequency value, DF is the number of word lists containing the word, and N is the total number of word lists in the current period. Adding 1 to the denominator can avoid system errors caused by the denominator being 0 in actual applications.

[0078] By calculating the IDF value, the embodiment of the present invention can identify words that are relatively uncommon in a large number of URL requests but particularly prominent in certain requests. These words often represent unique parameters of specific requests. By automatically analyzing and identifying keywords, the efficiency of identifying abnormal parameter usage patterns is improved, thereby helping to prevent potential parameter traversal attacks and enhancing the security of the system.

[0079] Optional, in the above Figure 2 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, based on the keywords of each user traffic request log, calculating the keyword ratio of each user traffic request log may specifically include:

[0080] The number of logs identifying the keyword in each user traffic request log is counted, and the ratio of the number of logs to the total number of logs in the current period is calculated, and the ratio is used as the keyword ratio of the user traffic request log that identifies the keyword.

[0081] To make it easier to understand, here is an example: suppose you have 1,000 user request logs in a certain period of time. When analyzing these logs, you identify the keyword "login". If 100 logs contain the keyword "login", then the keyword ratio of "login" is: 100 / 1000=0.1, which means that in this period of time, 10% of the request logs contain the keyword "login".

[0082] By calculating the keyword ratio, the embodiment of the present invention can quickly identify whether certain keywords are abnormally frequent in user requests. If the ratio of a certain keyword suddenly increases, it may indicate a new or abnormal behavior pattern, such as concentrated calls or attack attempts against a certain API. By dynamically analyzing the keyword ratio of user request logs, the embodiment of the present invention can more effectively monitor and identify potential abnormal behaviors, thereby improving the security and stability of the system.

[0083] Optional, based on Figure 1 The method shown, such as Figure 3 As shown, a flow chart of another implementation of the API traversal threat detection method provided by an embodiment of the present invention is provided. After identifying that the API interface corresponding to the user traffic request log has a parameter traversal risk, the method may further include:

[0084] S300: Write the interface information of the API interface with parameter traversal risk into the MySQL database.

[0085] Specifically, the embodiment of the present invention can load the interface information of the API interface with parameter traversal risks into a MySQL database to provide support for downstream analysis services, thereby helping the network security operation team to respond in a timely manner.

[0086] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, after identifying that the API interface corresponding to the user traffic request log has a parameter traversal risk, the method may further include:

[0087] Apply at least one specified security control measure to API interfaces that are at risk of parameter traversal.

[0088] Optionally, specify security control measures such as parameter verification, rate limiting, authentication and authorization, or signing and encryption.

[0089] Optionally, embodiments of the present invention may perform parameter verification on API interfaces that are at risk of parameter traversal, verify each input parameter, including the data type, length, format, and range, use a whitelist approach to accept only expected input, and may also use regular expressions to verify string format inputs, such as email addresses or phone numbers. It may also be mandatory that all parameters must be verified and the verification logic may not be skipped.

[0090] Optionally, embodiments of the present invention may perform rate limits on API interfaces that present a risk of parameter traversal, limit the number of requests that a single IP address or user can issue within a certain period of time, prevent brute force attacks, temporarily or permanently block the source of requests after the rate limit is exceeded, and may also dynamically adjust the rate limit based on user behavior, such as providing a higher rate limit for authenticated users.

[0091] Optionally, embodiments of the present invention may perform authentication and authorization on API interfaces that present a risk of parameter traversal, and through a strong authentication mechanism, ensure that only verified users can access the API interfaces, or control the resources and operations that the users can access based on their roles and permissions.

[0092] Optionally, an embodiment of the present invention can sign and encrypt API interfaces that have the risk of parameter traversal, digitally sign each request, verify the integrity and source of the request, and use TLS / SSL encryption to transmit data to ensure that the data is not eavesdropped or tampered with during transmission.

[0093] The embodiments of the present invention can effectively reduce the parameter traversal risks faced by API interfaces and improve overall security by applying security control measures to API interfaces that have parameter traversal risks.

[0094] Although operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order.Multitasking and parallel processing may be advantageous under certain circumstances.

[0095] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0096] The embodiment of the present invention also provides an API traversal threat detection system, whose architecture is as follows: Figure 4 As shown, it can include: APP, Web application firewall, Kafka module, Hive database, Path scenario detection module, MySQL database and API analysis service module.

[0097] APP is used for users to perform various operations on mobile applications (APP), which generate user traffic request logs. APP is the data source of the entire system, and the generated logs contain call information for different API interfaces.

[0098] Web application firewall is used to protect APP backend services from malicious traffic and attacks. Web application firewall can filter out some obvious attack requests at the initial stage and pass legitimate request logs to the subsequent Kafka module.

[0099] The Kafka module is used to provide a high-throughput distributed message queue system for processing real-time data streams. The Kafka module transfers the traffic request logs received from the Web Application Firewall to the Hive database for storage and processing.

[0100] Hive database is used to store data from the Kafka module. Hive database allows SQL-style query languages ​​to be used to process stored data. After the data enters Hive, ETL (extraction, transformation, loading) processing is required to convert the raw log data into the format required for analysis.

[0101] The Path scenario detection module is used to extract the API interface name and path parameters from the URL request during the ETL process. This step is to clarify the analysis target, that is, the analysis of the API path parameters. Then, by calculating the TF-IDF value of these parameters, high-risk keywords and potential parameter traversal threats are identified.

[0102] MySQL database is used to store the analyzed and detected abnormal API interface information. As a relational database, MySQL facilitates structured storage and fast retrieval of analysis results for use by downstream services.

[0103] The API analysis service module is used to obtain the identified abnormal data from the MySQL database and push this data to the network security operations personnel. The analysis service is responsible for further processing and analyzing the abnormal situation, and may trigger an alarm or generate a report so that security measures can be taken in a timely manner.

[0104] The embodiment of the present invention realizes the complete process from data collection, storage, analysis and alarm through the collaborative work of various modules in the API traversal threat detection system. This architecture enables network managers to identify and respond to potential API security threats in real time and efficiently, improving the overall security and stability of the system. At the same time, through automated log analysis and data processing, the burden of manual monitoring and analysis is greatly reduced.

[0105] Corresponding to the above method embodiment, the embodiment of the present invention also provides an API traversal threat detection device, whose structure is as follows: Figure 5 As shown, it may include: a user traffic request log collection unit 10, a keyword ratio identification unit 20 and an API interface risk identification unit 30.

[0106] The user flow request log collection unit 10 is used to collect the user flow request logs generated when the user uses a specific application program in the current period.

[0107] The keyword ratio identification unit 20 is used to extract and convert each user traffic request log respectively, and identify the keyword ratio of each user traffic request log.

[0108] The API interface risk identification unit 30 is used to identify that the API interface corresponding to the user traffic request log has parameter traversal risk when the keyword ratio of any user traffic request log is greater than a preset expert ratio threshold.

[0109] Optionally, the keyword ratio identification unit 20 may include: a log extraction subunit, a data extraction subunit, a word segmentation processing subunit, a document frequency value calculation subunit, a keyword identification subunit and a keyword ratio calculation subunit.

[0110] The log extraction subunit is used to extract each user's traffic request log into the Hive database.

[0111] The data extraction subunit is used to clean each user traffic request log in the Hive database and extract the API interface of each user traffic request log and its corresponding path parameter.

[0112] The word segmentation processing subunit is used to perform word segmentation processing on the path parameter according to the word segmentation algorithm to generate a word segmentation list, wherein the word segmentation list includes at least one word.

[0113] The document frequency value calculation subunit is used to calculate the inverse document frequency value of each word in the word segmentation list.

[0114] The keyword identification subunit is used to use the word with the largest inverse document frequency value in the word segmentation list as the keyword of the corresponding user traffic request log.

[0115] The keyword ratio calculation subunit is used to calculate the keyword ratio of each user traffic request log based on the keywords of each user traffic request log.

[0116] Optionally, the document frequency value calculation subunit is specifically used to calculate the inverse document frequency value of any word by using the number of word segmentation lists containing the word and the total number of word segmentation lists in the current time period.

[0117] Optionally, a keyword ratio calculation subunit is specifically used to count the number of logs that identify the keyword in each user traffic request log, calculate the ratio of the number of logs to the total number of logs in the current time period, and use the ratio as the keyword ratio of the user traffic request log that identifies the keyword.

[0118] Optionally, the API traversal threat detection device may further include: an interface risk information writing unit.

[0119] The interface risk information writing unit is used to write the interface information of the API interface with parameter traversal risk into the MySQL database after the API interface risk identification unit 30 identifies that the API interface corresponding to the user traffic request log has parameter traversal risk.

[0120] Optionally, the API traversal threat detection device may further include: a security control measure application unit.

[0121] The security control measure application unit is used to apply at least one specified security control measure to the API interface with parameter traversal risk after the API interface risk identification unit 30 identifies that the API interface corresponding to the user traffic request log has parameter traversal risk.

[0122] Optionally, the specified security control measures may be parameter verification, rate limiting, authentication and authorization, or signing and encryption.

[0123] The API traversal threat detection device provided by the present invention is used to: collect user traffic request logs generated by users in the process of using specific applications in the current period; extract and convert each user traffic request log respectively, and identify the keyword ratio of each user traffic request log; when the keyword ratio of any user traffic request log is greater than a preset expert ratio threshold, identify that the API interface corresponding to the user traffic request log has parameter traversal risks. The present invention uses the keyword ratio as a judgment criterion, and by setting a reasonable threshold, it can quickly screen out high-risk API interfaces, which significantly improves the detection and identification efficiency of API traversal threats compared to traditional methods.

[0124] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0125] The API traversal threat detection device includes a processor and a memory. The user traffic request log collection unit 10, the keyword ratio identification unit 20 and the API interface risk identification unit 30 are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions.

[0126] The processor contains a kernel, which calls the corresponding program unit from the memory. The kernel can be set to one or more, and by adjusting the kernel parameters to use the keyword ratio as the judgment standard and setting a reasonable threshold, high-risk API interfaces can be quickly screened out, which significantly improves the detection and identification efficiency of API traversal threats compared to traditional methods.

[0127] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the API traversal threat detection method is implemented.

[0128] An embodiment of the present invention provides a processor, which is used to run a program, wherein the API traversal threat detection method is executed when the program is running.

[0129] like Figure 6 As shown, an embodiment of the present invention provides an electronic device 1000, which includes at least one processor 1001, at least one memory 1002 connected to the processor 1001, and a bus 1003; wherein the processor 1001 and the memory 1002 communicate with each other through the bus 1003; the processor 1001 is used to call the program instructions in the memory 1002 to execute the above-mentioned API traversal threat detection method. The electronic device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0130] The present invention also provides a computer program product, which, when executed on an electronic device, is suitable for executing a program that initializes the steps of the API traversal threat detection method.

[0131] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatuses, electronic devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the instructions executed by the processor of the computer or other programmable device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0132] In a typical configuration, an electronic device includes one or more processors (CPU), a memory, and a bus. The electronic device may also include an input / output interface, a network interface, and the like.

[0133] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0134] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0136] In the description of the present invention, it should be understood that the terms "up", "down", "front", "back", "left" and "right" etc. indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description. They do not indicate or imply that the positions or elements referred to must have specific directions, be constructed and operate in specific directions. Therefore, they should not be understood as limitations of the present invention.

[0137] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should also be noted that the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0138] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0139] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for detecting API traversal threats, characterized in that: include: Collect user traffic request logs generated when users use specific applications in the current period; Extracting and converting each of the user traffic request logs respectively, and identifying the keyword ratio of each of the user traffic request logs; When the keyword ratio of any of the user traffic request logs is greater than a preset expert ratio threshold, it is identified that the API interface corresponding to the user traffic request log has a parameter traversal risk.

2. The method according to claim 1, characterized in that The extracting and converting the user traffic request logs respectively to identify the keyword ratio of the user traffic request logs includes: Extracting each of the user traffic request logs into a Hive database; Clean each of the user traffic request logs in the Hive database, and extract the API interface of each of the user traffic request logs and its corresponding path parameter; Performing word segmentation processing on the path parameter according to a word segmentation algorithm to generate a word segmentation list, wherein the word segmentation list includes at least one word; Calculate the inverse document frequency value of each word in the word segmentation list; The word with the largest inverse document frequency value in the word segmentation list is used as the keyword of the corresponding user traffic request log; Based on the keywords in each of the user traffic request logs, a keyword ratio in each of the user traffic request logs is calculated.

3. The method according to claim 2, characterized in that The step of calculating the inverse document frequency value of each word in the word segmentation list includes: For any word: using the number of the word lists containing the word and the total number of word lists in the current time period, calculate the inverse document frequency value of the word.

4. The method according to claim 2, characterized in that: The calculating the keyword ratio of each of the user traffic request logs based on the keyword of each of the user traffic request logs includes: The number of logs in which the keyword is identified in each of the user traffic request logs is counted, and the ratio of the number of logs to the total number of logs in the current time period is calculated, and the ratio is used as the keyword ratio of the user traffic request log that identifies the keyword.

5. The method according to claim 1, characterized in that After identifying that the API interface corresponding to the user traffic request log has a parameter traversal risk, the method further includes: The interface information of the API interface with parameter traversal risk is written into the MySQL database.

6. The method according to any one of claims 1 to 5, characterized in that After identifying that the API interface corresponding to the user traffic request log has a parameter traversal risk, the method further includes: At least one specified security control measure is applied to the API interface that has the risk of parameter traversal.

7. The method according to claim 6, characterized in that The specified security control measures include parameter verification, rate limiting, authentication authorization, or signature and encryption.

8. An API traversal threat detection device, characterized in that: include: User traffic request log collection unit, keyword ratio identification unit and API interface risk identification unit, The user flow request log collection unit is used to collect the user flow request log generated by the user in the process of using the specific application program in the current period; The keyword ratio identification unit is used to extract and convert each of the user traffic request logs respectively, and identify the keyword ratio of each of the user traffic request logs; The API interface risk identification unit is used to identify that the API interface corresponding to the user traffic request log has a parameter traversal risk when the keyword ratio of any of the user traffic request logs is greater than a preset expert ratio threshold.

9. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the API traversal threat detection method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The electronic device includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the API traversal threat detection method as described in any one of claims 1 to 7.

Images