Implementation method and device for protecting API gateway from CSRF attack

Abstract

The application discloses an API gateway CSRF attack prevention implementation method and device, wherein the method comprises the following steps: S01, adding a flag bit of an API on the API gateway to mark whether the API involves sensitive information, and configuring a threshold of API request frequency, an IP blacklist, a Referer blacklist and a CORS strategy; S02, receiving an API request message, and intercepting abnormal API requests according to configuration information of the API gateway; and S03, sending the API requests that are not intercepted to a big data platform, and further analyzing the API requests according to a detection model trained by the big data platform. The API gateway CSRF attack prevention implementation method and device can detect current API requests and combine historical API request messages, so that detection conditions used when detecting CSRF attacks are more comprehensive. The application can analyze API request messages of users from different dimensions, reduces possible data errors in the detection process, and thus improves the accuracy of CSRF attack detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of gateway protection, and in particular to an API gateway CSRF attack prevention implementation method and device. BACKGROUND

[0002] API (Application Programming Interface) is the development interface of an application program. If an application system needs to be called by other systems, it needs to expose API. API is directly exposed on the public network, which has security risks, so API gateway is used as a unified entrance of API here, and all user requests will pass through the API gateway, and the API gateway can perform comprehensive security checks on API requests before reaching the backend service.

[0003] CSRF (Cross-site request forgery) attack is an attack method that uses user authentication vulnerabilities to send malicious requests. Attackers can cause users to unknowingly perform certain operations, resulting in user account theft or other losses.

[0004] Implementing a unified security policy through an API gateway is the key to preventing CSRF. The existing API gateway CSRF attack prevention method is relatively simple, mainly using token and double cookie verification, which is not efficient and only identifies the current API request without combining historical API request messages, so it cannot defend against complex attack scenarios. SUMMARY

[0005] To solve the problems in the prior art, the present application provides an API gateway CSRF attack prevention implementation method and device, which combines historical API request messages when detecting current API requests, making the detection conditions used when detecting CSRF attacks more comprehensive. The present application can analyze API request messages from different dimensions, reducing the possibility of data errors in the detection process, thereby improving the accuracy of CSRF attack detection.

[0006] To achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0007] In an embodiment of the present application, an API gateway CSRF attack prevention implementation method is provided, which comprises:

[0008] S01, adding a flag bit of API on the API gateway to mark whether the API involves sensitive information, and configuring the threshold of API request frequency, IP blacklist, Referer blacklist and CORS policy;

[0009] Further, the S01 comprises:

[0010] S011, configuring API on API gateway, setting flag for sensitive API;

[0011] S012, configuring threshold value of API request frequency on API gateway for sensitive API;

[0012] Configure rules in API gateway to disable unsafe HTTP methods for sensitive operations, for example: GET, HEAD, OPTIONS, usually only POST, PUT, DELETE methods should be allowed to modify data.

[0013] Further, the threshold value in S012 is: the maximum number of requests allowed per minute for a certain API for the same IP address or user identifier.

[0014] S013, setting IP blacklist, Referer blacklist and CORS policy;

[0015] Configure CORS policy in API gateway, Cross-Origin Resource Sharing, limit which sources can access API cross-domain, by allowing only requests from trusted sources, can reduce the risk of CSRF attack;

[0016] Further, the request source information limited by the CORS policy in S013 includes: HTTP method, HTTP request header, domain name.

[0017] S02, receiving API request message, intercepting abnormal API request according to the configuration information of the API gateway;

[0018] Further, the S02 comprises:

[0019] S021, after the API gateway receives the API request, intercept the request exceeding the threshold value, Referer blacklist and CORS policy limit request;

[0020] S022, the API gateway judges whether the client IP of the API request is in the IP blacklist, if it is in the IP blacklist, the request will be intercepted, and the cookie in the request is deleted, the client re-authentication;

[0021] When the client IP of the API request is in the IP blacklist, the API deletes the cookie of the request, which can prevent attackers from using cookies for session hijacking and modifying request headers to bypass other security measures;

[0022] S03, send the unintercepted API request to the big data platform, and further analyze the API request according to the detection model trained by the big data platform;

[0023] Further, the S03 comprises:

[0024] S031, data collection and preprocessing,

[0025] Data collection: the API gateway captures and records all passing HTTP request data, including the requested URL, method, header information, request body, source IP, and timestamp;

[0026] Data preprocessing: the collected data is cleaned and converted, noise and outliers are removed, and the original data is converted into a format suitable for pattern recognition algorithm processing;

[0027] Further, the data preprocessing in the S031 comprises: data standardization, normalization, and encoding conversion.

[0028] S032, extracting feature information of API request, extracting key features contributing to identifying malicious request sequence from request data; constructing a feature vector, combining the extracted key features into a feature vector, and each feature vector representing a request or request sequence instruction;

[0029] Further, the feature information in the S032 comprises: request frequency, request interval time, entropy value of request source IP, similarity of request parameters, and structure of request body.

[0030] S033, training a pattern recognition model using known normal and malicious API request sequence data. In the training process, the model learns the feature distribution of normal request sequence and the abnormal pattern of malicious request sequence;

[0031] S034, inputting the unintercepted API request of S02 into the trained pattern recognition model for further analysis;

[0032] If the current API request has an abnormal situation, the API gateway intercepts the current API request;

[0033] If the current API request is a normal request, the API gateway releases the current API request.

[0034] In an embodiment of the present application, an API gateway protection device for CSRF attack is also provided, which comprises:

[0035] An API marking module is configured to mark an API on an API gateway with a flag bit to indicate whether the API involves sensitive information, and to configure a threshold of API request frequency, an IP blacklist, a Referer blacklist, and a CORS policy;

[0036] An abnormal request interception module is configured to receive an API request message, and to intercept an abnormal API request according to configuration information of the API gateway.

[0037] A model training module is configured to send an unintercepted API request to a big data platform, and to further analyze the API request according to a detection model trained by the big data platform.

[0038] In an embodiment of the present application, a computer device is also provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned method for protecting an API gateway from CSRF attacks when executing the computer program.

[0039] In an embodiment of the present application, a computer readable storage medium is also provided, which stores a computer program for implementing the above-mentioned method for protecting an API gateway from CSRF attacks.

[0040] Advantages:

[0041] The present application provides a method and device for protecting an API gateway from CSRF attacks, which combines current API requests with historical API request messages, so that the detection conditions used for detecting CSRF attacks are more comprehensive.

[0042] The present application can analyze API request messages from two different dimensions, one being real-time API requests and historical API requests, and the other being analysis of request frequency, request interval time, entropy value of request source IP, similarity of request parameters, and structure of request body, which effectively reduces data errors in the detection process and improves the accuracy of CSRF attack detection. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 is a flowchart of the method for protecting an API gateway from CSRF attacks according to the present application;

[0044] Figure 2 is a structural diagram of the device for protecting an API gateway from CSRF attacks according to the present application;

[0045] Figure 3 is a structural diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] The principles and spirits of the present application will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are given only to enable those skilled in the art to better understand and implement the present application, and in no way limit the scope of the present application. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0047] Those skilled in the art know that the embodiments of the present application can be implemented as a system, a device, an apparatus, a method or a computer program product. Therefore, the present disclosure can be embodied in the form of entire hardware, entire software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0048] According to the embodiments of the present application, an implementation method and device of API gateway protecting CSRF attack are provided. The current API request is detected, and the historical API request message is combined, so that the detection condition used when detecting CSRF attack is more comprehensive. The API request message of the user is analyzed from different dimensions, the data error that may occur in the detection process is reduced, and the accuracy of CSRF attack detection is improved.

[0049] The principles and spirits of the present application will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are given only to enable those skilled in the art to better understand and implement the present application, and in no way limit the scope of the present application. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0050] As shown in Figure 1 The present application relates to an implementation method of API gateway protecting CSRF attack, which comprises:

[0051] S01, adding a flag bit of API on the API gateway to mark whether the API involves sensitive information, and configuring a threshold of API request frequency, an IP blacklist, a Referer blacklist and a CORS strategy;

[0052] The S01 comprises:

[0053] S011, configuring the API to the API gateway, and setting the flag bit for the sensitive API;

[0054] S012, configuring the threshold of API request frequency on the API gateway for the sensitive API;

[0055] Configure rules in the API gateway to disable unsafe HTTP methods for sensitive operations, for example: GET, HEAD, OPTIONS, usually only POST, PUT, DELETE methods should be allowed to modify data.

[0056] The threshold in S012 is: the maximum number of requests allowed per minute for the same IP address or user identifier.

[0057] S013, set IP blacklist, Referer blacklist and CORS policy;

[0058] Configure CORS policy in API gateway, Cross-Origin Resource Sharing, limit which source can access API cross domain, by only allowing requests from trusted sources, can reduce the risk of CSRF attack;

[0059] The request source information limited by the CORS policy in S013 includes: HTTP method, HTTP request header, domain name.

[0060] S02, receive API request message, according to the configuration information of the API gateway, intercept abnormal API request;

[0061] The S02 includes:

[0062] S021, after the API gateway receives the API request, intercept the request exceeding the threshold, Referer blacklist and CORS policy limit request;

[0063] S022, the API gateway judges whether the client IP of the API request is in the IP blacklist, if it is in the IP blacklist, the request will be intercepted, and the cookie in the request will be deleted, the client will be re authenticated;

[0064] When the client IP of the API request is in the IP blacklist, the API deletes the cookie of the request, which can prevent attackers from using cookies to perform session hijacking and modify request headers to bypass other security measures;

[0065] S03, send the API request that is not intercepted to the big data platform, and further analyze the API request according to the detection model trained by the big data platform;

[0066] The S03 includes:

[0067] S031, data collection and preprocessing,

[0068] Data collection: API gateway captures and records all passed HTTP request data, including request URL, method, header information, request body, source IP, timestamp;

[0069] Data preprocessing: clean and convert the collected data, remove noise and outliers, and convert the original data into a format suitable for pattern recognition algorithm processing;

[0070] The data preprocessing in S031 includes data standardization, normalization, and encoding conversion.

[0071] S032, extracting feature information of API requests, extracting key features contributing to identifying malicious request sequences from request data; constructing a feature vector, combining the extracted key features into a feature vector, each feature vector representing a request or a request sequence instruction;

[0072] The feature information in S032 includes request frequency, request interval time, entropy value of request source IP, similarity of request parameters, and structure of request body.

[0073] S033, training a pattern recognition model using known normal and malicious API request sequence data. During the training process, the model learns the feature distribution of normal request sequences and the abnormal patterns of malicious request sequences;

[0074] S034, inputting the API requests not intercepted in S02 into the trained pattern recognition model for further analysis;

[0075] If the current API request has an abnormal situation, the API gateway intercepts the current API request;

[0076] If the current API request is a normal request, the API gateway releases the current API request.

[0077] It should be noted that although the operations of the method of the present application are described in a specific order in the above embodiments and drawings, this does not require or imply that the operations must be performed in that specific order, or that all the shown operations must be performed to achieve the desired results. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, and / or one step can be divided into multiple steps.

[0078] In order to more clearly explain the implementation method of the above API gateway protection against CSRF attacks, specific embodiments will be described below, however, it should be noted that the embodiments are only for better illustration of the present application and do not constitute undue limitation on the present application.

[0079] S01, adding a flag bit of API on the API gateway to mark whether the API involves sensitive information, and configuring the threshold of API request frequency, IP blacklist, Referer blacklist and CORS policy;

[0080] The S01 includes:

[0081] S011, configuring the API on the API gateway, and setting a flag bit for sensitive API;

[0082] S012, for sensitive APIs, configure the threshold of API request frequency on the API gateway;

[0083] Configure rules in the API gateway to disable unsafe HTTP methods for sensitive operations, such as: GET, HEAD, OPTIONS, usually only POST, PUT, DELETE methods should be allowed to modify data.

[0084] The threshold in S012 is: the maximum number of requests per minute allowed for a certain API for the same IP address or user identifier.

[0085] In specific implementation, the number of requests for a certain sensitive API by the same IP address or user identifier (such as Token) within 1 minute should not exceed 100 times. Exceeding this threshold is considered an abnormal request.

[0086] S013, set up IP blacklists, Referer blacklists and CORS policies;

[0087] Configure CORS policy in API gateway, Cross-Origin Resource Sharing, limit which sources can access API across domains, by allowing only requests from trusted sources, can reduce the risk of CSRF attacks;

[0088] The request source information limited by the CORS policy in S013 includes: HTTP method, HTTP request header, domain name.

[0089] In specific implementation, for some third-party cooperative API interfaces, you can specify the domain name of the partner as the allowed source to ensure that only the client of the partner can access these resources. For example, API-A is for third-party use, and the third-party domain name is: https: / / example.com, you can configure CORS policy for API-A to limit only requests with domain name https: / / example.com can access API-A.

[0090] S02, receive API request message, according to the configuration information of the API gateway, intercept abnormal API requests;

[0091] S02 includes:

[0092] S021, after the API gateway receives the API request, intercepts requests exceeding the threshold, Referer blacklist and CORS policy restrictions;

[0093] S022, the PI gateway judges whether the client IP of the API request is in the IP blacklist, if it is in the IP blacklist, the request will be intercepted, and the cookie in the request is deleted, and the client re-authenticates;

[0094] When the client IP of the API request is in the IP blacklist, the API deletes the cookie of the request, which can prevent attackers from using cookies for session hijacking and modifying request headers to bypass other security measures;

[0095] In specific implementation, the pass request method is GET / HEAD / OPTIONS, no login and no sensitive message, continue to check the token information of the API request header, and pass the request of the token verification;

[0096] The IP address existing CSRF attack or suspected CSRF attack is added to the blacklist, if it is in the IP blacklist, the cookie in the request is deleted, so that the client re-authenticates;

[0097] By checking the Referer field in the HTTP request header, it is verified whether the Referer of the API request is in the Referer blacklist. If the Referer of the message is in the blacklist, the request will be intercepted.

[0098] S03, the API request not intercepted is sent to the big data platform, and according to the detection model trained by the big data platform, the API request is further analyzed;

[0099] The S03 includes:

[0100] S031, data collection and pretreatment,

[0101] Data collection: the API gateway captures and records all passed HTTP request data, including request URL, method, header information, request body, source IP, timestamp;

[0102] Data preprocessing: the collected data is cleaned and converted, noise and outliers are removed, and the original data is converted into a format suitable for pattern recognition algorithm processing;

[0103] The data preprocessing in the S031 includes: data standardization, normalization, and encoding conversion.

[0104] S032, extracting feature information of API request, extracting key features contributing to identifying malicious request sequence from request data; constructing a feature vector, combining the extracted key features into a feature vector, and each feature vector represents a request or request sequence instruction;

[0105] The feature information in S032 includes: request frequency, request interval time, entropy value of request source IP, similarity of request parameters, structure of request body.

[0106] S033, training the pattern recognition model using known normal and malicious API request sequence data. During the training process, the model learns the feature distribution of normal request sequences and the abnormal patterns of malicious request sequences;

[0107] S034, inputting the API requests not intercepted in S02 into the trained pattern recognition model for further analysis;

[0108] If the current API request has abnormal conditions, the API gateway intercepts the current API request;

[0109] If the current API request is a normal request, the API gateway releases the current API request.

[0110] In specific implementation, most of the API requests of users are regular, such as: most of the client IPs of users are fixed, and most of the active stages of users are also fixed; for example, 20-23 o'clock every night is the peak period of API requests of most users;

[0111] The following situations indicate that the current API request may be subject to CSRF attack:

[0112] A large number of requests submitted in a short time: if a user submits a large number of seemingly legitimate but actually possibly fake API requests (such as batch transfer, password modification, etc.) in a very short time, it is a sign of CSRF attack. Because normal users are unlikely to perform so many operations in such a short time.

[0113] The request comes from an unusual IP address: if the API request suddenly comes from an address that does not match the IP address range they usually use, it may indicate that their account has been controlled by a third party and used for malicious activities to initiate CSRF attacks.

[0114] Abnormal request frequency and pattern: if a user is usually active only during the day, but suddenly there are a large number of API requests at night, or the pattern of the request does not match the user's regular behavior, such as frequent access to unrelated pages or execution of unusual operations, it may indicate that the account has been controlled by an attacker.

[0115] CSRF token missing or invalid in request: if there is no valid CSRF token in the API request, it indicates that the API request is subject to CSRF attack.

[0116] Based on the same inventive concept, the present application further provides an API gateway protection device against CSRF attack. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be described here. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware or a combination of software and hardware is also possible and contemplated.

[0117] Figure 2 is a structural schematic diagram of the API gateway protection device against CSRF attack of the present application.

[0118] As shown in Figure 2 , the device comprises:

[0119] An API marking module 110 is configured to add a flag bit of an API on an API gateway, mark whether the API involves sensitive information, and configure a threshold of API request frequency, an IP blacklist, a Referer blacklist and a CORS policy.

[0120] An abnormal request interception module 120 is configured to receive an API request message, and intercept an abnormal API request according to configuration information of the API gateway.

[0121] A model training module 130 is configured to send an unintercepted API request to a big data platform, and further analyze the API request according to a detection model trained by the big data platform.

[0122] It should be noted that although several modules of the API gateway protection device against CSRF attack are mentioned in the above detailed description, such division is only exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided into several modules.

[0123] Based on the foregoing inventive concept, as shown in Figure 3 , the present application further provides a computer device 200, comprising a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220, wherein the processor 220 implements the foregoing API gateway protection method against CSRF attack when executing the computer program 230.

[0124] Based on the foregoing inventive concept, the present application further provides a computer readable storage medium, which stores a computer program for executing the foregoing API gateway protection method against CSRF attack.

[0125] The application discloses an API gateway CSRF attack prevention implementation method and device.

[0126] The application can analyze API request messages of a user from two different dimensions, one being real-time API requests and historical API requests, and the other being analysis in combination with API request frequency, request interval time, entropy value of a request source IP, request parameter similarity, and request body structure, effectively reducing possible data errors in the detection process, thereby improving the accuracy of CSRF attack detection.

[0127] While the principles and teachings of the present application have been primarily described in relation to certain embodiments, it is to be understood that the present application is not limited to the disclosed embodiments, and that various modifications and changes can be made without departing from the spirit and scope of the application. It is further understood that the use of relational terms such as first and second, and the like, are used solely to distinguish one from another entity without necessarily implying a required or chronological order.

[0128] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0129] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / operations specified in the flowchart and / or block diagram block or blocks. The program code can be retrieved from storage and / or memory and / or a remote storage or memory and executed by a processor or controller. The program code can execute entirely on a machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

[0130] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0132] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0133] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0134] It should be understood that the various forms of flow shown above can be used to reorder, add or delete steps. For example, the steps described in the present disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions of the present disclosure can be achieved, which are not limited herein.

[0135] The above detailed description does not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

[0136] Those skilled in the art should understand that various modifications or changes made on the basis of the technical solutions of the present disclosure without creative labor are still within the protection scope of the present disclosure.

Claims

1. A method for protecting an API gateway from CSRF attacks, characterized in that, The method includes: S01. Add an API flag to the API gateway to mark whether the API involves sensitive information, and configure the API request frequency threshold, IP blacklist, Referer blacklist and CORS policy. S02. Receive API request messages and intercept abnormal API requests according to the configuration information of the API gateway; S03. Send the uninterrupted API requests to the big data platform, and further analyze the API requests based on the detection model trained by the big data platform. S031, Data Collection and Preprocessing Data collection: The API gateway captures and records all HTTP request data that passes through, including the request URL, method, header information, request body, source IP, and timestamp; Data preprocessing: Cleaning and transforming the collected data to remove noise and outliers, and converting the raw data into a format suitable for pattern recognition algorithms; S032. Extract the feature information of API requests, extract key features from the request data that contribute to the identification of malicious request sequences; construct feature vectors, combine the extracted key features into feature vectors, and each feature vector represents the instruction of a request or request sequence. S033. Train a pattern recognition model using known API request sequence data. The model learns the feature distribution of normal request sequences and the abnormal patterns of malicious request sequences. S034. Input the API requests that were not intercepted in S02 into the trained pattern recognition model for further analysis; If there is an exception in the current API request, the API gateway will intercept the current API request. If the current API request is a normal request, the API gateway will allow the current API request.

2. The method for protecting an API gateway from CSRF attacks according to claim 1, characterized in that, S01 includes: S011. Configure the API on the API gateway and set flags for sensitive APIs; S012. For sensitive APIs, configure a threshold for API request frequency on the API gateway; S013. Configure IP blacklist, Referer blacklist and CORS policy.

3. The method for protecting an API gateway from CSRF attacks according to claim 2, characterized in that, The threshold in S012 is the maximum number of requests allowed per minute for a certain API for the same IP address or user identifier.

4. The method for protecting an API gateway from CSRF attacks according to claim 2, characterized in that, The request source information restricted by the CORS policy in S013 includes: HTTP method, HTTP request header, and domain name.

5. The method for protecting an API gateway from CSRF attacks according to claim 1, characterized in that, S02 includes: S021. After receiving an API request, the API gateway will block requests that exceed the threshold, referer blacklist, and CORS policy restrictions. S022. The PI gateway determines whether the client IP of the API request is in the IP blacklist. If it is in the IP blacklist, the request will be blocked, the cookie in the request will be deleted, and the client will need to re-authenticate.

6. The method for protecting an API gateway from CSRF attacks according to claim 1, characterized in that, The data preprocessing in S031 includes data standardization, normalization, and encoding conversion.

7. The method for protecting an API gateway from CSRF attacks according to claim 1, characterized in that, The feature information in S032 includes: request frequency, request interval time, entropy value of the request source IP, similarity of request parameters, and structure of the request body.

8. An implementation device for protecting an API gateway from CSRF attacks, characterized in that, The device includes: The API tagging module adds a flag to the API gateway to mark whether the API involves sensitive information, and configures the API request frequency threshold, IP blacklist, Referer blacklist and CORS policy. The abnormal request interception module receives API request messages and intercepts abnormal API requests according to the configuration information of the API gateway. The model training module sends uninterrupted API requests to the big data platform, where the API requests are further analyzed based on the detection model trained on the big data platform. The model training module includes: Data collection and preprocessing, Data collection: The API gateway captures and records all HTTP request data that passes through, including the request URL, method, header information, request body, source IP, and timestamp; Data preprocessing: Cleaning and transforming the collected data to remove noise and outliers, and converting the raw data into a format suitable for pattern recognition algorithms; Extract feature information from API requests, extract key features from request data that contribute to identifying malicious request sequences; construct feature vectors, combining the extracted key features into feature vectors, with each feature vector representing the instruction of a request or request sequence. A pattern recognition model is trained using known API request sequence data. The model learns the feature distribution of normal request sequences and the abnormal patterns of malicious request sequences. API requests that were not intercepted by the abnormal request interception module are input into the trained pattern recognition model for further analysis; If there is an exception in the current API request, the API gateway will intercept the current API request. If the current API request is a normal request, the API gateway will allow the current API request.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the method according to any one of claims 1-7.

Images