Method and system for analyzing calling risk based on service interface calling log

Abstract

The invention relates to the technical field of computer system security, in particular to a method and system for analyzing calling risks based on service interface calling logs, and the method comprises the following steps: collecting logs, monitoring the calling activity of a service interface in real time, and dynamically capturing all related interaction data; an efficient log collection tool is adopted, a service interface calling log is output into a log file, and the log file is read in real time, so that the influence on service performance is reduced; the method and the system for analyzing the calling risk based on the service interface calling log have the beneficial effects that the difference between normal business calling and malicious calling can be more accurately identified by comprehensively analyzing the service interface calling log; the service interface calling behavior is monitored and evaluated in real time, potential security threats are found in time, and the risks of data leakage and unauthorized access are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer system security, and in particular to a method and system for analyzing call risks based on service interface call logs. Background Art

[0002] As government data sharing continues to deepen, government services increasingly rely on data sharing and exchange platforms to achieve rapid information circulation and efficient business operations. As the hub of information exchange, the data sharing and exchange platform allows data integration and interaction between different systems and applications, thereby improving the automation level of business processes and the quality of decision-making.

[0003] In a shared exchange platform, service interfaces play a vital role. Service interfaces define a set of operations and protocols that enable different systems to communicate and exchange data in a standardized way. Service provision methods based on service interfaces include RESTful APIs, SOAP services, etc.

[0004] However, while service interfaces facilitate interoperability between systems, they also bring a series of security and stability challenges. Service interfaces may be subject to malicious attacks, such as denial of service (DoS), data leakage, or unauthorized access, which may seriously affect the availability of services and the integrity of data. In addition, improper use or misconfiguration of service interfaces may also lead to service interruption or performance degradation. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for analyzing call risks based on service interface call logs to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a method for analyzing call risks based on service interface call logs, the method comprising the following steps:

[0007] Log collection, real-time monitoring of service interface call activities, and dynamic capture of all relevant interaction data;

[0008] Use efficient log collection tools to output service interface call logs to log files and read log files in real time to reduce the impact on service performance;

[0009] The collected log data is temporarily stored in the message queue to ensure the integrity and order of the data and provide support for log processing in a high-concurrency environment.

[0010] Preferably, log cleaning and filtering are also included: applying predefined rules and algorithms to identify and remove invalid, erroneous or irrelevant log entries; performing deduplication, supplementing business data and aggregation operations to improve data quality and analysis efficiency; retaining cleaning logs to facilitate problem tracking and system tuning.

[0011] Preferably, log analysis storage is also included: storing the service interface call log in Elasticsearch for analysis and storage, generating index data, and providing a query interface to the outside world; implementing data archiving and backup mechanisms to ensure the security and traceability of analysis data to support long-term risk management and decision support.

[0012] Preferably, a configuration management step is also included, specifically including:

[0013] Abnormal situation configuration: Adopt the abnormal situation configuration method based on the deduction system, set the initial full score of 100 risk scores for service interface calls, and define a series of deduction rules according to the different characteristics and behaviors of service interface calls. When the service interface call behavior triggers the preset deduction rules, the risk score is deducted in real time according to the rules;

[0014] Alarm rule setting: Set three alarm levels: emergency, suspicious, and reminder. When the score is lower than a certain threshold, the system will issue a risk warning of the corresponding level and take corresponding preventive or response measures.

[0015] Preferably, the method further includes risk assessment and result feedback processing steps:

[0016] Risk assessment: The system reads the service interface log and evaluates the potential risks of service interface calls according to the configured risk analysis rules and alarm rules, and performs analysis by monitoring changes in risk scores;

[0017] Result feedback processing: The service interface call risk analysis results are displayed in a visual way to intuitively present the risk warning status and details of the service interface call, and support the retrieval of call risk warnings and feedback of processing results.

[0018] A system for analyzing call risks based on service interface call logs, applied to a method for analyzing call risks based on service interface call logs, the system comprising:

[0019] The log collection module is used to monitor the calling activities of the service interface in real time, dynamically capture all relevant interaction data, and read the service interface call log output by the service gateway in real time and temporarily store it in the message queue through efficient log collection tools and mechanisms to ensure the integrity and sequence of the data, and provide support for log processing in a high-concurrency environment;

[0020] The cleaning and filtering module is used to apply a series of predefined rules and algorithms to identify and remove invalid, erroneous or irrelevant log entries, perform data deduplication, supplement business data and aggregation operations to improve data quality and analysis efficiency, and retain cleaning logs for problem tracking and system tuning;

[0021] The analysis and storage module is used to store the cleaned and filtered service interface call logs in Elasticsearch for analysis and storage, generate index data, and provide a query interface to the outside world. At the same time, it implements data archiving and backup mechanisms to ensure the security and traceability of analysis data.

[0022] Preferably, a configuration management module is also included, which includes:

[0023] The abnormal situation configuration submodule is used to adopt an abnormal situation configuration method based on a deduction system, set an initial risk score of 100 points for the service interface call, and define a series of deduction rules according to the different characteristics and behaviors of the service interface call. When the service interface call behavior triggers the preset deduction rules, the risk score is deducted in real time according to the rules;

[0024] The alarm rule submodule is used to set three alarm levels: emergency, suspicious, and reminder. When the score is lower than a certain threshold, the system will issue a risk warning of the corresponding level and take corresponding preventive or response measures.

[0025] Preferably, it also includes a risk assessment module, which is used to read the service interface log at a certain period, and evaluate the potential risks of the service interface call according to the configured risk analysis rules and alarm rules, and analyze the potential risks of the service interface call by monitoring the changes in the risk score. When the score is lower than a certain threshold, the system issues a risk warning and takes corresponding preventive or response measures.

[0026] Preferably, a result feedback and processing module is also included, which includes:

[0027] The call risk analysis result display submodule is used to display the service interface call risk analysis results in a visual way, and intuitively present the risk warning and details of the service interface call;

[0028] The result feedback processing submodule is used to support the retrieval and invocation of risk alerts and feedback of processing results.

[0029] Preferably, the log collection module, cleaning and filtering module, analysis and storage module, configuration management module, risk assessment module, and result feedback and processing module are all implemented through software programming and integrated in the same server or distributed server cluster to realize real-time collection, cleaning and filtering, analysis and storage, configuration management, risk assessment, and result feedback and processing functions of the service interface call log.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] The method and system for analyzing call risks based on service interface call logs proposed in the present invention can more accurately identify the difference between normal business calls and malicious calls by comprehensively analyzing service interface call logs; monitor and evaluate service interface call behaviors in real time, promptly discover potential security threats, and reduce the risks of data leakage and unauthorized access; through a rapid response mechanism, the present invention can take timely measures to prevent or mitigate the impact of service interruptions or performance degradation; ensure that the data sharing and exchange platform can still operate stably in the face of various attacks and abnormal situations; the automated risk assessment and alarm mechanism reduces manual intervention and improves the efficiency of risk management; displays risk alarms and details through visual means, allowing users to quickly understand and respond to risks; and provides system administrators with real-time risk assessment results to help them make more informed business and technical decisions. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] For example, see Figure 1 The present invention provides a technical solution: a method for analyzing call risks based on service interface call logs, the method comprising the following steps:

[0035] 1. Log collection:

[0036] (1) Log Collection

[0037] Log collection involves real-time monitoring of service interface call activities and dynamically capturing all relevant interaction data. The system will use efficient log collection tools and mechanisms. The service gateway will output the service interface call log to the log file, and the log collection tool will read it in real time to reduce the impact on service performance. The collected log data will be temporarily stored in the message queue to ensure the integrity and sequence of the data, while providing support for log processing in a high-concurrency environment.

[0038] (2) Cleaning and filtration

[0039] In the cleaning and filtering step, the system will apply a series of predefined rules and algorithms to identify and remove invalid, erroneous or irrelevant log entries. The cleaning process also includes deduplication, supplementation of business data and aggregation operations to improve data quality and analysis efficiency. In addition, the system will retain the cleaning log for problem tracking and system tuning.

[0040] (3) Analysis and storage

[0041] The analysis and storage step is the core of the entire log processing process. The service interface call log is stored in Elasticsearch for analysis and storage, index data is generated, and a query interface is provided to the outside world. In order to support long-term risk management and decision support, the system will also implement data archiving and backup mechanisms to ensure the security and traceability of analysis data.

[0042] 2. Configuration Management

[0043] (1) Abnormal situation configuration

[0044] Abnormal situation configuration is an abnormal situation configuration method based on the deduction system, which is used to analyze the potential risks of service interface calls. Initial setting: Set a risk score of 100 points for the service interface call. Multi-dimensional deduction rules: Define a series of deduction rules based on the different characteristics and behaviors of the service interface call. These rules cover multiple dimensions, such as call frequency, request parameter abnormalities, extended response time, identity authentication failure, etc. Real-time deduction: When the call behavior of the service interface triggers the preset deduction rules, the system will deduct the risk score in real time according to the rules.

[0045] (2) Alarm rules

[0046] The alarm level is set to three levels: emergency, suspicious, and reminder. When the score is lower than a certain threshold, the system will issue a risk warning of the corresponding level and take corresponding preventive or response measures.

[0047] 3. Risk Assessment

[0048] Risk assessment is the core function of service interface call risk analysis. The system reads the service interface logs at a certain period and evaluates the potential risks of service interface calls according to the configured risk analysis rules and alarm rules. By monitoring the changes in risk scores, the potential risks of service interface calls are analyzed. When the score is lower than a certain threshold, the system will issue a risk warning and take corresponding preventive or countermeasures.

[0049] 4. Result feedback and processing

[0050] (1) Call risk analysis results: The service interface call risk analysis results are displayed in a visual manner to intuitively present the risk warnings and details of the service interface calls.

[0051] (2) Result feedback processing: supports retrieval and invocation of risk alerts and feedback of processing results.

[0052] Embodiment 2, based on Embodiment 1, proposes a system for analyzing call risks based on service interface call logs, which is applied to the method for analyzing call risks based on service interface call logs. The system includes:

[0053] The log collection module is used to monitor the calling activities of the service interface in real time, dynamically capture all relevant interaction data, and read the service interface call log output by the service gateway in real time and temporarily store it in the message queue through efficient log collection tools and mechanisms to ensure the integrity and sequence of the data, and provide support for log processing in a high-concurrency environment;

[0054] The cleaning and filtering module is used to apply a series of predefined rules and algorithms to identify and remove invalid, erroneous or irrelevant log entries, perform data deduplication, supplement business data and aggregation operations to improve data quality and analysis efficiency, and retain cleaning logs for problem tracking and system tuning;

[0055] The analysis and storage module is used to store the cleaned and filtered service interface call logs in Elasticsearch for analysis and storage, generate index data, and provide a query interface to the outside world. At the same time, it implements data archiving and backup mechanisms to ensure the security and traceability of analysis data.

[0056] It also includes a configuration management module, which includes:

[0057] The abnormal situation configuration submodule is used to adopt an abnormal situation configuration method based on a deduction system to set an initial risk score of 100 points for service interface calls, and define a series of deduction rules based on the different characteristics and behaviors of the service interface calls. When the service interface call behavior triggers the preset deduction rules, the risk score is deducted in real time according to the rules; the alarm rule submodule is used to set three alarm levels: emergency, suspicious, and reminder. When the score is lower than a certain threshold, the system issues a risk warning of the corresponding level and takes corresponding preventive or response measures.

[0058] It also includes a risk assessment module, which is used to read the service interface log at a certain period, and evaluate the potential risks of the service interface call according to the configured risk analysis rules and alarm rules. The potential risks of the service interface call are analyzed by monitoring the changes in the risk score. When the score is lower than a certain threshold, the system issues a risk warning and takes corresponding preventive or response measures.

[0059] It also includes a result feedback and processing module, which includes: a call risk analysis result display sub-module, which is used to display the service interface call risk analysis results in a visual manner, and intuitively present the risk warning situation and details of the service interface call; a result feedback processing sub-module, which is used to support the retrieval of call risk warnings and feedback of processing results.

[0060] The log collection module, cleaning and filtering module, analysis and storage module, configuration management module, risk assessment module, and result feedback and processing module are all implemented through software programming and integrated in the same server or distributed server cluster to realize the real-time collection, cleaning and filtering, analysis and storage, configuration management, risk assessment, and result feedback and processing functions of the service interface call log.

[0061] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for analyzing call risks based on service interface call logs, characterized in that: The method comprises the following steps: Log collection, real-time monitoring of service interface call activities, and dynamic capture of all relevant interaction data; Use efficient log collection tools to output service interface call logs to log files and read log files in real time to reduce the impact on service performance; The collected log data is temporarily stored in the message queue to ensure the integrity and order of the data and provide support for log processing in a high-concurrency environment.

2. A method for analyzing call risks based on service interface call logs according to claim 1, characterized in that: Also includes log cleaning filters: Apply predefined rules and algorithms to identify and remove invalid, erroneous or irrelevant log entries; perform deduplication, supplement business data and aggregation operations to improve data quality and analysis efficiency; Keep cleaning logs to facilitate problem tracking and system tuning.

3. A method for analyzing call risks based on service interface call logs according to claim 2, characterized in that: Also includes log analysis storage: Store service interface call logs in Elasticsearch for analysis and storage, generate index data, and provide external query interfaces; Implement data archiving and backup mechanisms to ensure the security and traceability of analytical data to support long-term risk management and decision support.

4. A method for analyzing call risks based on service interface call logs according to claim 1, characterized in that: It also includes configuration management steps, including: Abnormal situation configuration: Adopt the abnormal situation configuration method based on the deduction system, set the initial full score of 100 risk scores for service interface calls, and define a series of deduction rules according to the different characteristics and behaviors of service interface calls. When the service interface call behavior triggers the preset deduction rules, the risk score is deducted in real time according to the rules; Alarm rule setting: Set three alarm levels: emergency, suspicious, and reminder. When the score is lower than a certain threshold, the system will issue a risk warning of the corresponding level and take corresponding preventive or response measures.

5. A method for analyzing call risks based on service interface call logs according to claim 4, characterized in that: It also includes risk assessment and result feedback processing steps: Risk assessment: The system reads the service interface log and evaluates the potential risks of service interface calls according to the configured risk analysis rules and alarm rules, and performs analysis by monitoring changes in risk scores; Result feedback processing: The service interface call risk analysis results are displayed in a visual way to intuitively present the risk warning status and details of the service interface call, and support the retrieval of call risk warnings and feedback of processing results.

6. A system for analyzing call risks based on service interface call logs, applied to the method for analyzing call risks based on service interface call logs according to any one of claims 1 to 5, characterized in that: The system comprises: The log collection module is used to monitor the calling activities of the service interface in real time, dynamically capture all relevant interaction data, and read the service interface call log output by the service gateway in real time and temporarily store it in the message queue through efficient log collection tools and mechanisms to ensure the integrity and sequence of the data, and provide support for log processing in a high-concurrency environment; The cleaning and filtering module is used to apply a series of predefined rules and algorithms to identify and remove invalid, erroneous or irrelevant log entries, perform data deduplication, supplement business data and aggregation operations to improve data quality and analysis efficiency, and retain cleaning logs for problem tracking and system tuning; The analysis and storage module is used to store the cleaned and filtered service interface call logs in Elasticsearch for analysis and storage, generate index data, and provide a query interface to the outside world. At the same time, it implements data archiving and backup mechanisms to ensure the security and traceability of analysis data.

7. A system for analyzing call risks based on service interface call logs according to claim 6, characterized in that: It also includes a configuration management module, which includes: The abnormal situation configuration submodule is used to adopt an abnormal situation configuration method based on a deduction system, set an initial risk score of 100 points for the service interface call, and define a series of deduction rules according to the different characteristics and behaviors of the service interface call. When the service interface call behavior triggers the preset deduction rules, the risk score is deducted in real time according to the rules; The alarm rule submodule is used to set three alarm levels: emergency, suspicious, and reminder. When the score is lower than a certain threshold, the system will issue a risk warning of the corresponding level and take corresponding preventive or response measures.

8. A system for analyzing call risks based on service interface call logs according to claim 7, characterized in that: It also includes a risk assessment module, which is used to read the service interface log at a certain period, and evaluate the potential risks of the service interface call according to the configured risk analysis rules and alarm rules. The potential risks of the service interface call are analyzed by monitoring the changes in the risk score. When the score is lower than a certain threshold, the system issues a risk warning and takes corresponding preventive or response measures.

9. A system for analyzing call risks based on service interface call logs according to claim 6, characterized in that: It also includes a result feedback and processing module, which includes: The call risk analysis result display submodule is used to display the service interface call risk analysis results in a visual way, and intuitively present the risk warning and details of the service interface call; The result feedback processing submodule is used to support the retrieval and invocation of risk alerts and feedback of processing results.

10. A system for analyzing call risks based on service interface call logs according to claim 9, characterized in that: The log collection module, cleaning and filtering module, analysis and storage module, configuration management module, risk assessment module, and result feedback and processing module are all implemented through software programming and integrated in the same server or distributed server cluster to realize the real-time collection, cleaning and filtering, analysis and storage, configuration management, risk assessment, and result feedback and processing functions of the service interface call log.

Images