Implementation method and device for protecting CSRF attack by API gateway

Abstract

The invention discloses an implementation method and device for an API gateway to protect CSRF attacks, and the method comprises the steps: S01, adding an API flag bit on the API gateway, marking whether the API relates to sensitive information, and configuring a threshold value of API request frequency, an IP blacklist, a Referer blacklist and a CORS strategy; s02, receiving an API request message, and intercepting an abnormal API request according to the configuration information of the API gateway; and S03, sending the API requests which are not intercepted to the big data platform, and further analyzing the API requests according to the detection model trained by the big data platform. According to the implementation method and device for protecting the CSRF attack by the API gateway, the current API request is detected, and the historical API request message is also combined, so that the detection conditions used for detecting the CSRF attack are more comprehensive; according to the method, the API request message of the user can be analyzed from different dimensions, data errors possibly occurring in the detection process are reduced, and therefore the accuracy of CSRF attack detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of gateway protection, and in particular to a method and device for implementing API gateway protection against CSRF attacks. Background Art

[0002] API (Application Programming Interface) is the development interface of an application. If any application system needs to be called by other systems, it needs to expose API. Exposing API directly on the public Internet will cause security risks, so an API gateway is needed as the unified entrance of API. All user requests will pass through the API gateway, which can perform a comprehensive security check on API requests before they reach the backend service.

[0003] CSRF (Cross-site request forgery) attack is an attack method that uses user authentication vulnerabilities to send malicious requests. The attacker can make the user accidentally perform an operation without the user's knowledge, resulting in the theft of the user's account or other losses.

[0004] Implementing a unified security policy through the API gateway is the key to preventing CSRF. The existing API gateway's protection against CSRF attacks is relatively simple, mainly token and double cookie verification, which is inefficient and only recognizes the current API request without combining historical API request messages, and cannot defend against complex attack scenarios. Summary of the invention

[0005] In order to solve the problems existing in the prior art, the present invention provides an implementation method and device for API gateway protection against CSRF attacks. While detecting the current API request, it also combines the historical API request message, so that the detection conditions used when detecting CSRF attacks are more comprehensive; the present invention can analyze the user's API request message from different dimensions, reduce the data errors that may occur during the detection process, and thus improve the accuracy of CSRF attack detection.

[0006] To achieve the above object, the present invention adopts the following technical solutions:

[0007] In one embodiment of the present invention, a method for implementing API gateway protection against CSRF attacks is proposed, the method comprising:

[0008] S01. Add an API flag on the API gateway to mark whether the API involves sensitive information, and configure the API request frequency threshold, IP blacklist, Referer blacklist, and CORS policy;

[0009] Further, the S01 includes:

[0010] S011. Configure the API on the API gateway and set flags for sensitive APIs;

[0011] S012. For sensitive APIs, configure the threshold of API request frequency on the API gateway;

[0012] Configure rules in the API gateway to disable unsafe HTTP methods for sensitive operations, such as GET, HEAD, and OPTIONS. Usually, only POST, PUT, and DELETE methods should be allowed to modify data.

[0013] Furthermore, the threshold in S012 is: the maximum number of requests allowed per minute for a certain API for the same IP address or user ID.

[0014] S013. Set IP blacklist, Referer blacklist and CORS policy;

[0015] Configure CORS policy in the API gateway, Cross-Origin Resource Sharing, to limit which sources can access the API across domains. By only allowing requests from trusted sources, you can reduce the risk of CSRF attacks.

[0016] Furthermore, the request source information restricted by the CORS policy in S013 includes: HTTP method, HTTP request header, and domain name.

[0017] S02. Receive an API request message, and intercept abnormal API requests according to the configuration information of the API gateway;

[0018] Further, the S02 includes:

[0019] S021. After receiving an API request, the API gateway intercepts requests that exceed the threshold, Referer blacklist, and CORS policy restrictions;

[0020] S022, PI gateway determines whether the client IP of the API request is in the IP blacklist. If it is in the IP blacklist, the request will be blocked, and the cookie in the request will be deleted, and the client will be re-authenticated;

[0021] When the client IP of the API request is on the IP blacklist, the API deletes the request cookie to prevent attackers from using cookies to hijack sessions and modify request headers to bypass other security measures;

[0022] S03. Send the unintercepted API requests to the big data platform, and further analyze the API requests based on the detection model trained by the big data platform;

[0023] Further, the S03 includes:

[0024] S031, data collection and preprocessing,

[0025] Data collection: The API gateway captures and records all HTTP request data, including the requested URL, method, header information, request body, source IP, and timestamp;

[0026] Data preprocessing: Clean and transform the collected data, remove noise and outliers, and convert the raw data into a format suitable for pattern recognition algorithm processing;

[0027] Furthermore, the data preprocessing in S031 includes: data standardization, normalization, and encoding conversion.

[0028] S032. Extract feature information of API requests, extract key features that contribute to identifying malicious request sequences from request data; construct feature vectors, combine the extracted key features into feature vectors, each feature vector represents an instruction of a request or request sequence;

[0029] Furthermore, the characteristic information in S032 includes: request frequency, request interval time, entropy value of request source IP, similarity of request parameters, and structure of request body.

[0030] S033. Use known normal and malicious API request sequence data to train a pattern recognition model. During the training process, the model learns the characteristic distribution of normal request sequences and the abnormal patterns of malicious request sequences;

[0031] S034, inputting the API requests that were not intercepted in S02 into the trained pattern recognition model for further analysis;

[0032] If there is an abnormality in the current API request, the API gateway intercepts the current API request;

[0033] If the current API request is a normal request, the API gateway releases the current API request.

[0034] In one embodiment of the present invention, a device for implementing API gateway protection against CSRF attacks is also proposed, the device comprising:

[0035] API marking module, which adds an API flag on the API gateway to mark whether the API involves sensitive information, and configures the API request frequency threshold, IP blacklist, Referer blacklist, and CORS policy;

[0036] An abnormal request interception module receives an API request message and intercepts abnormal API requests according to the configuration information of the API gateway;

[0037] The model training module sends the unintercepted API requests to the big data platform and conducts further analysis on the API requests based on the detection model trained by the big data platform.

[0038] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned method for implementing the API gateway protection against CSRF attacks is implemented.

[0039] In one embodiment of the present invention, a computer-readable storage medium is further proposed, wherein the computer-readable storage medium stores a computer program for executing an implementation method for protecting an API gateway from CSRF attacks.

[0040] Beneficial effects:

[0041] The present invention provides an implementation method and device for API gateway protection against CSRF attacks. While detecting the current API request, it also combines the historical API request message, so that the detection conditions used when detecting the CSRF attack are more comprehensive.

[0042] The present invention can analyze the user's API request message from two different dimensions: one is real-time API request and historical API request; the other is combining the request frequency, request interval, entropy value of request source IP, similarity of request parameters, and structure of request body for analysis, effectively reducing the data errors that may occur during the detection process, thereby improving the accuracy of CSRF attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flowchart of a method for implementing the API gateway protection against CSRF attacks of the present invention;

[0044] Figure 2 It is a schematic diagram of the structure of the implementation device of the API gateway of the present invention for protecting against CSRF attacks;

[0045] Figure 3 It is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0047] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0048] According to the implementation mode of the present invention, a method and device for implementing API gateway protection against CSRF attacks are proposed. While detecting the current API request, historical API request messages are also combined, so that the detection conditions used when detecting CSRF attacks are more comprehensive. The present invention can analyze the user's API request message from different dimensions, reduce the data errors that may occur during the detection process, and thus improve the accuracy of CSRF attack detection.

[0049] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0050] like Figure 1 As shown, the present invention relates to a method for implementing an API gateway to protect against CSRF attacks, the method comprising:

[0051] S01. Add an API flag on the API gateway to mark whether the API involves sensitive information, and configure the API request frequency threshold, IP blacklist, Referer blacklist, and CORS policy;

[0052] The S01 includes:

[0053] S011. Configure the API on the API gateway and set flags for sensitive APIs;

[0054] S012. For sensitive APIs, configure the threshold of API request frequency on the API gateway;

[0055] Configure rules in the API gateway to disable unsafe HTTP methods for sensitive operations, such as GET, HEAD, and OPTIONS. Usually, only POST, PUT, and DELETE methods should be allowed to modify data.

[0056] The threshold in S012 is: the maximum number of requests allowed per minute for a certain API for the same IP address or user ID.

[0057] S013. Set IP blacklist, Referer blacklist and CORS policy;

[0058] Configure CORS policy in the API gateway, Cross-Origin Resource Sharing, to limit which sources can access the API across domains. By only allowing requests from trusted sources, you can reduce the risk of CSRF attacks.

[0059] The request source information restricted by the CORS policy in S013 includes: HTTP method, HTTP request header, and domain name.

[0060] S02. Receive an API request message, and intercept abnormal API requests according to the configuration information of the API gateway;

[0061] The S02 includes:

[0062] S021. After receiving an API request, the API gateway intercepts requests that exceed the threshold, Referer blacklist, and CORS policy restrictions;

[0063] S022, PI gateway determines whether the client IP of the API request is in the IP blacklist. If it is in the IP blacklist, the request will be blocked, and the cookie in the request will be deleted, and the client will be re-authenticated;

[0064] When the client IP of the API request is on the IP blacklist, the API deletes the request cookie to prevent attackers from using cookies to hijack sessions and modify request headers to bypass other security measures;

[0065] S03. Send the unintercepted API requests to the big data platform, and further analyze the API requests based on the detection model trained by the big data platform;

[0066] The S03 includes:

[0067] S031, data collection and preprocessing,

[0068] Data collection: The API gateway captures and records all HTTP request data, including the requested URL, method, header information, request body, source IP, and timestamp;

[0069] Data preprocessing: Clean and transform the collected data, remove noise and outliers, and convert the raw data into a format suitable for pattern recognition algorithm processing;

[0070] The data preprocessing in S031 includes: data standardization, normalization, and encoding conversion.

[0071] S032. Extract feature information of API requests, extract key features that contribute to identifying malicious request sequences from request data; construct feature vectors, combine the extracted key features into feature vectors, each feature vector represents an instruction of a request or request sequence;

[0072] The characteristic information in S032 includes: request frequency, request interval time, entropy value of request source IP, similarity of request parameters, and structure of request body.

[0073] S033. Use known normal and malicious API request sequence data to train a pattern recognition model. During the training process, the model learns the characteristic distribution of normal request sequences and the abnormal patterns of malicious request sequences;

[0074] S034, inputting the API requests that were not intercepted in S02 into the trained pattern recognition model for further analysis;

[0075] If there is an abnormality in the current API request, the API gateway intercepts the current API request;

[0076] If the current API request is a normal request, the API gateway releases the current API request.

[0077] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0078] In order to explain more clearly the implementation method of the above-mentioned API gateway to protect against CSRF attacks, it is described below in conjunction with a specific embodiment. However, it is worth noting that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0079] S01. Add an API flag on the API gateway to mark whether the API involves sensitive information, and configure the API request frequency threshold, IP blacklist, Referer blacklist, and CORS policy;

[0080] The S01 includes:

[0081] S011. Configure the API on the API gateway and set flags for sensitive APIs;

[0082] S012. For sensitive APIs, configure the threshold of API request frequency on the API gateway;

[0083] Configure rules in the API gateway to disable unsafe HTTP methods for sensitive operations, such as GET, HEAD, and OPTIONS. Usually, only POST, PUT, and DELETE methods should be allowed to modify data.

[0084] The threshold in S012 is: the maximum number of requests allowed per minute for a certain API for the same IP address or user ID.

[0085] In specific implementation, it can be set that within 1 minute, the number of requests to a sensitive API from the same IP address or user ID (such as Token) shall not exceed 100 times. If this threshold is exceeded, it will be regarded as an abnormal request.

[0086] S013. Set IP blacklist, Referer blacklist and CORS policy;

[0087] Configure CORS policy in the API gateway, Cross-Origin Resource Sharing, to limit which sources can access the API across domains. By only allowing requests from trusted sources, you can reduce the risk of CSRF attacks.

[0088] The request source information restricted by the CORS policy in S013 includes: HTTP method, HTTP request header, and domain name.

[0089] In specific implementation, for some third-party API interfaces, you can specify the partner's domain name as the allowed source to ensure that only the partner's clients can access these resources. For example, API-A is used by a third party, and the third-party domain name is: https: / / example.com, you can configure a CORS policy for API-A to restrict only requests with the domain name https: / / example.com to access API-A.

[0090] S02. Receive an API request message, and intercept abnormal API requests according to the configuration information of the API gateway;

[0091] The S02 includes:

[0092] S021. After receiving an API request, the API gateway intercepts requests that exceed the threshold, Referer blacklist, and CORS policy restrictions;

[0093] S022, PI gateway determines whether the client IP of the API request is in the IP blacklist. If it is in the IP blacklist, the request will be blocked, and the cookie in the request will be deleted, and the client will be re-authenticated;

[0094] When the client IP of the API request is on the IP blacklist, the API deletes the request cookie to prevent attackers from using cookies to hijack sessions and modify request headers to bypass other security measures;

[0095] In specific implementation, the request methods are GET / HEAD / OPTIONS, non-logged-in and non-sensitive messages, and the token information in the API request header is still verified. Requests that pass the token verification are released;

[0096] Add IP addresses that have CSRF attacks or are suspected of CSRF attacks to the blacklist. If the IP address is on the blacklist, delete the cookie in the request to make the client re-authenticate.

[0097] By checking the Referer field in the HTTP request header, verify whether the Referer of the API request is in the Referer blacklist. If the Referer of the message is in the blacklist, the request will be blocked.

[0098] S03. Send the unintercepted API requests to the big data platform, and further analyze the API requests based on the detection model trained by the big data platform;

[0099] The S03 includes:

[0100] S031, data collection and preprocessing,

[0101] Data collection: The API gateway captures and records all HTTP request data, including the requested URL, method, header information, request body, source IP, and timestamp;

[0102] Data preprocessing: Clean and transform the collected data, remove noise and outliers, and convert the raw data into a format suitable for pattern recognition algorithm processing;

[0103] The data preprocessing in S031 includes: data standardization, normalization, and encoding conversion.

[0104] S032. Extract feature information of API requests, extract key features that contribute to identifying malicious request sequences from request data; construct feature vectors, combine the extracted key features into feature vectors, each feature vector represents an instruction of a request or request sequence;

[0105] The characteristic information in S032 includes: request frequency, request interval time, entropy value of request source IP, similarity of request parameters, and structure of request body.

[0106] S033. Use known normal and malicious API request sequence data to train a pattern recognition model. During the training process, the model learns the characteristic distribution of normal request sequences and the abnormal patterns of malicious request sequences;

[0107] S034, inputting the API requests that were not intercepted in S02 into the trained pattern recognition model for further analysis;

[0108] If there is an abnormality in the current API request, the API gateway intercepts the current API request;

[0109] If the current API request is a normal request, the API gateway releases the current API request.

[0110] In specific implementation, most users' API requests are regular, such as: most users' client IPs are fixed, and most users' active stages are also fixed; for example, 20:00-23:00 every night is the peak period for most users' API requests;

[0111] The following situations indicate that the current API request may be vulnerable to CSRF attacks:

[0112] Submitting a large number of requests in a short period of time: If a user submits a large number of seemingly legitimate but actually forged API requests (such as batch transfers, password changes, etc.) in a very short period of time, this is a sign of a CSRF attack. Because it is unlikely that a normal user will perform so many operations in such a short period of time.

[0113] Requests coming from unusual IP addresses: If API requests are suddenly coming from an address that doesn’t match the IP address range they normally use, this could be a sign that their account is being taken over by a third party and used for malicious activity such as CSRF attacks.

[0114] Abnormal request frequency and pattern: If a user is usually active only during the day, but suddenly makes a large number of API requests late at night, or the request pattern does not match the user's regular behavior, such as frequently visiting unrelated pages or performing uncommon operations, this may indicate that the account has been taken over by an attacker.

[0115] Missing or invalid CSRF token in the request: If a valid CSRF token is missing in the API request, it means that the API request is vulnerable to CSRF attack.

[0116] Based on the same inventive concept, the present invention also proposes an implementation device for API gateway protection against CSRF attacks. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0117] Figure 2 It is a schematic diagram of the structure of the implementation device of the API gateway of the present invention for protecting against CSRF attacks.

[0118] like Figure 2 As shown, the device comprises:

[0119] The API marking module 110 adds a flag bit to the API on the API gateway to mark whether the API involves sensitive information, and configures the threshold of the API request frequency, IP blacklist, Referer blacklist and CORS policy;

[0120] The abnormal request interception module 120 receives the API request message and intercepts the abnormal API request according to the configuration information of the API gateway;

[0121] The model training module 130 sends the unintercepted API requests to the big data platform, and further analyzes the API requests based on the detection model trained by the big data platform.

[0122] It should be noted that although several modules of the implementation device for protecting the API gateway from CSRF attacks are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be concretized.

[0123] Based on the above invention concept, Figure 3 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned method for implementing the API gateway protection against CSRF attacks is implemented.

[0124] Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned method for implementing the API gateway protection against CSRF attacks.

[0125] The present invention provides an implementation method and device for API gateway protection against CSRF attacks. While detecting the current API request, it also combines the historical API request message, so that the detection conditions used when detecting the CSRF attack are more comprehensive.

[0126] The present invention can analyze the user's API request message from two different dimensions: one is real-time API request and historical API request; the other is combining the request frequency, request interval, entropy value of request source IP, similarity of request parameters, and structure of request body for analysis, effectively reducing the data errors that may occur during the detection process, thereby improving the accuracy of CSRF attack detection.

[0127] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0128] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0129] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0130] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0132] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0133] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0134] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0135] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0136] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for implementing API gateway protection against CSRF attacks, characterized in that: The method includes: S01. Add an API flag on the API gateway to mark whether the API involves sensitive information, and configure the API request frequency threshold, IP blacklist, Referer blacklist, and CORS policy; S02. Receive an API request message, and intercept abnormal API requests according to the configuration information of the API gateway; S03. Send the unintercepted API requests to the big data platform, and further analyze the API requests based on the detection model trained by the big data platform.

2. According to the method for implementing API gateway protection against CSRF attacks according to claim 1, it is characterized in that: The S01 includes: S011. Configure the API on the API gateway and set flags for sensitive APIs; S012. For sensitive APIs, configure the threshold of API request frequency on the API gateway; S013. Set IP blacklist, Referer blacklist and CORS policy.

3. The method for implementing API gateway protection against CSRF attacks according to claim 2, characterized in that: The threshold in S012 is: the maximum number of requests allowed per minute for a certain API for the same IP address or user ID.

4. The method for implementing API gateway protection against CSRF attacks according to claim 2, characterized in that: The request source information restricted by the CORS policy in S013 includes: HTTP method, HTTP request header, and domain name.

5. The method for implementing API gateway protection against CSRF attacks according to claim 1, characterized in that: The S02 includes: S021. After receiving an API request, the API gateway intercepts requests that exceed the threshold, Referer blacklist, and CORS policy restrictions; S022. PI Gateway determines whether the client IP of the API request is in the IP blacklist. If it is in the IP blacklist, the request will be blocked, and the cookie in the request will be deleted, and the client will be re-authenticated.

6. The method for implementing API gateway protection against CSRF attacks according to claim 1, characterized in that: The S03 includes: S031, data collection and preprocessing, Data collection: The API gateway captures and records all HTTP request data, including the requested URL, method, header information, request body, source IP, and timestamp; Data preprocessing: Clean and transform the collected data, remove noise and outliers, and convert the raw data into a format suitable for pattern recognition algorithm processing; S032. Extract feature information of API requests, extract key features that contribute to identifying malicious request sequences from request data; construct feature vectors, combine the extracted key features into feature vectors, each feature vector represents an instruction of a request or request sequence; S033. Use known API request sequence data to train a pattern recognition model, where the model learns the characteristic distribution of normal request sequences and the abnormal patterns of malicious request sequences; S034, inputting the API requests that were not intercepted in S02 into the trained pattern recognition model for further analysis; If there is an abnormality in the current API request, the API gateway intercepts the current API request; If the current API request is a normal request, the API gateway releases the current API request.

7. The method for implementing API gateway protection against CSRF attacks according to claim 6, characterized in that: The data preprocessing in S031 includes: data standardization, normalization, and encoding conversion.

8. The method for implementing API gateway protection against CSRF attacks according to claim 6, characterized in that: The characteristic information in S032 includes: request frequency, request interval time, entropy value of request source IP, similarity of request parameters, and structure of request body.

9. An implementation device for protecting an API gateway from CSRF attacks, characterized in that: The device includes: API marking module, which adds an API flag on the API gateway to mark whether the API involves sensitive information, and configures the API request frequency threshold, IP blacklist, Referer blacklist, and CORS policy; An abnormal request interception module receives an API request message and intercepts abnormal API requests according to the configuration information of the API gateway; The model training module sends the unintercepted API requests to the big data platform and conducts further analysis on the API requests based on the detection model trained by the big data platform.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 8.

Images