Network flow API risk analysis method and system based on Siddhi, medium and equipment

Abstract

The invention provides a network flow API risk analysis method and system based on Siddhi, a medium and equipment, and relates to the technical field of network flow risk analysis, and the method comprises the steps: obtaining all request flow and response flow data in network flow; combining each acquired request flow and the corresponding response flow data into one piece of API flow data according to a rule, and preprocessing the API flow data; and based on a Siddhi flow analysis engine, constructing a risk identification model according to a set risk judgment rule, inputting the preprocessed API flow data into the risk identification model, carrying out mapping receiving through a statistical implementation algorithm, converting into an engine recognizable format, and carrying out risk identification. And calculating the sum of the lengths of the request data per second, per minute, per hour, each day and each month and the sum of the corresponding data by using an aggregation algorithm, outputting the sum of the lengths of the request data and the sum of the corresponding data to a database table for recording, and generating a piece of risk data when the sum of the request data exceeds a set threshold value to complete risk identification.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network traffic risk analysis, and in particular to a Siddhi-based network traffic API risk analysis method, system, medium, and device. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] In order to identify the risks caused by customers' illegal operations in the complex network traffic, it is necessary to develop a system for risk analysis of network traffic. The network traffic that needs to be analyzed has the following characteristic data: source IP, source port, destination IP, destination port, request URL, request data length, request data size, response data length, response data size, etc. Common API risks are divided into baseline risks, such as an application accessing an interface more than twice the historical number of times; threshold risks, such as an interface being accessed more than 2,000 times within 15 minutes.

[0004] Among the existing methods for risk analysis of network traffic API, a homologous API risk analysis method is proposed, that is, to match homologous API assets with preset risk event data to determine the risk data of each homologous API asset, and to determine the risk analysis results of the target API asset based on the risk data of each homologous API asset and homology data. The advantage of this method is that it can realize early discovery and avoidance of risks, but this solution strongly relies on the risk analysis results of homologous APIs and has certain limitations; a proactive risk API inspection method is also proposed, that is, the collected API data is used as the first API information, reconstructed into the second API information through certain rules, and the second API information is periodically actively accessed. If the access is successful, it is judged that the API information has been leaked to the network, and there is a risk that needs to be handled safely. This method requires periodic active access to customers, but the inspection method of periodic active access is not applicable in some sensitive customer environments, and the risk identification system has no authority to actively request the customer environment, and there are certain difficulties in the implementation process. Summary of the invention

[0005] In order to solve the above problems, the present disclosure proposes a network traffic API risk analysis method, system, medium and device based on Siddhi, introduces a Siddhi flow analysis engine in network traffic API risk identification, completes data reception, risk identification and result storage after the engine is started, and can flexibly manage the start and stop of risk identification tasks to reduce the overall impact on the risk identification module.

[0006] According to some embodiments, the present disclosure adopts the following technical solutions:

[0007] The network traffic API risk analysis method based on Siddhi includes:

[0008] Get all request and response traffic data in network traffic;

[0009] Combine each acquired request flow and its corresponding response flow data into one piece of API flow data according to the rules, and pre-process the API flow data;

[0010] Based on the Siddhi stream analysis engine, a risk identification model is built according to the set risk judgment rules. The pre-processed API traffic data is input into the risk identification model, mapped and received through the statistical implementation algorithm, and converted into a format recognizable by the engine. The aggregation algorithm is used to calculate the total length of the request data per second, minute, hour, day, and month, as well as the total sum of the corresponding data, and output them to the database table record. When the total amount of request data exceeds the set threshold, a risk data is generated to complete the risk identification.

[0011] According to some embodiments, the present disclosure adopts the following technical solutions:

[0012] The network traffic API risk analysis system based on Siddhi includes:

[0013] A data acquisition module is used to obtain all request traffic and response traffic data in network traffic;

[0014] The preprocessing module is used to merge each acquired request flow and its corresponding response flow data into one piece of API flow data according to the rules, and preprocess the API flow data;

[0015] The risk identification module is used to build a risk identification model based on the Siddhi stream analysis engine according to the set risk judgment rules, input the pre-processed API traffic data into the risk identification model, map and receive it through the statistical implementation algorithm, convert it into a format that the engine can recognize, and use the aggregation algorithm to calculate the total length of the request data per second, minute, hour, day, and month, as well as the total sum of the corresponding data, and output it to the database table record. When the total amount of request data exceeds the set threshold, a risk data is generated to complete the risk identification.

[0016] According to some embodiments, the present disclosure adopts the following technical solutions:

[0017] A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the Siddhi-based network traffic API risk analysis method is implemented.

[0018] According to some embodiments, the present disclosure adopts the following technical solutions:

[0019] An electronic device includes: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the Siddhi-based network traffic API risk analysis method.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] The disclosed Siddhi-based network traffic API risk analysis method can be applied to API audit monitoring and early warning scenarios. Its main data source is the traffic data generated by accessing the API in the network. The survey found that the traffic data in the production environment can reach 100 million per day, averaging 1,100 per second. In such a high-concurrency data scenario, general statistics and baseline algorithms are difficult to implement. This disclosure introduces a lightweight real-time stream computing engine Siddhi. When 300,000 traffic data are accumulated in the Kafka message, the engine can complete the consumption and complete the statistical output results within 1 minute. In addition, after using this engine, under the multi-dimensional data statistical baseline requirements, the workload required for development is relatively small, and only additional configuration is required, which greatly reduces the development workload.

[0022] The disclosed Siddhi-based network traffic API risk analysis method introduces a Siddhi flow analysis engine into the risk identification module, and adds an editable risk identification script to the engine, so as to complete the data reception, risk identification and result storage after the engine is started. This method can flexibly manage the start and stop of risk identification tasks and reduce the overall impact on the risk identification module.

[0023] The Siddhi-based network traffic API risk analysis method disclosed in the present invention builds a risk identification model according to the set risk judgment rules. It only needs to complete business function development and debugging on the siddhi-tooling visual development tool, generate the corresponding script file (.siddhi), and then deploy and run it in the siddhi-running operating environment to realize the above-mentioned data generation function. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0025] Figure 1 This is a risk identification principle diagram of an embodiment of the present disclosure;

[0026] Figure 2 This is a data flow diagram for risk identification in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0028] It should be noted that the following detailed descriptions are all illustrative and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0029] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0030] Example 1

[0031] In one embodiment of the present disclosure, a network traffic API risk analysis method based on Siddhi is provided, including:

[0032] Step 1: Obtain all request traffic and response traffic data in the network traffic;

[0033] Step 2: Combine each acquired request flow and its corresponding response flow data into one piece of API flow data according to the rules, and pre-process the API flow data;

[0034] Step 2: Based on the Siddhi stream analysis engine, a risk identification model is constructed according to the set risk judgment rules, and the pre-processed API traffic data is input into the risk identification model. The Siddhi stream analysis engine is introduced in the risk identification module, and an editable risk identification script is added to the engine to complete the data reception, risk identification and result storage after the engine is started. The mapping reception is performed through the statistical implementation algorithm and converted into a format recognizable by the engine. The aggregation algorithm is used to calculate the total length of the request data per second, minute, hour, day, and month, as well as the total sum of the corresponding data, and output them to the database table record. When the total amount of request data exceeds the set threshold, a risk data is generated to complete the risk identification.

[0035] As an embodiment, the specific implementation process of a Siddhi-based network traffic API risk analysis method disclosed in the present invention includes:

[0036] Step 1: Obtain all request traffic and response traffic data in the network traffic;

[0037] Deploy the probe application to the target detection server, obtain the request flow and response flow data in the network flow, and report them;

[0038] Step 2: Combine each acquired request flow and its corresponding response flow data into one piece of API flow data according to the rules, and pre-process the API flow data;

[0039] The same request traffic and response traffic reported are merged into one piece of API traffic data according to certain rules, and the data contains request-related information and response-related information.

[0040] Furthermore, the API traffic data is pre-processed and analyzed, mainly involving the identification of asset data, the analysis of network links, the parsing of data items in request data and response data, and the analysis of content sensitivity levels. The analysis results will be synchronously supplemented to the API traffic data;

[0041] Specifically, there are two types of asset data identification: one is application assets: a unique application asset is identified based on the source IP and source port combination in the traffic log; the other is API assets: a unique API asset is identified based on the destination IP, destination port, and URL path combination in the traffic log.

[0042] Network link analysis refers to identifying the relationship between previous and subsequent calls in traffic logs. For example, if application A requests API-B, and API-B requests API-C, the result of network link analysis is that application A to API-B and API-Bd to API-C are on the same request link.

[0043] Data item parsing refers to the response body data in the traffic log, which is usually in JSON format. Each key value in the JSON data is identified and recorded in the database as data item parsing.

[0044] Content sensitivity level analysis refers to the JSON data mentioned above, which performs regular matching on the value content corresponding to the key, and the matching result is the sensitivity level.

[0045] Step 3: Based on the Siddhi flow analysis engine, a risk identification model is constructed according to the set risk judgment rules. The pre-processed API traffic data is input into the risk identification model, and the mapping and reception are performed through the statistical implementation algorithm, and converted into a format that the engine can recognize. The aggregation algorithm is used to calculate the sum of the request data length and the corresponding data sum per second, minute, hour, day, and month, and output to the database table record. When the sum of the request data exceeds the set threshold, a risk data is generated to complete the risk identification;

[0046] Specifically, based on the analysis of the API traffic data after preprocessing, the traditional method finds the possible API risks according to the given risk judgment rules, such as the baseline risk of the application access interface exceeding the historical value by 2 times, or the threshold risk of the API interface content request error exceeding 1000 times in 15 minutes. The present disclosure uses the risk identification function of the Siddhi flow analysis engine, and can edit the risk identification model according to the given risk judgment rules, and can be directly deployed and used after completion.

[0047] Specifically, different risks have different judgment rules. For example, if the API interface has more than 1,000 content request errors within 15 minutes, the judgment rule is that in the traffic log within 15 minutes, group statistics are performed based on api_id. If the number of records with status_code not equal to 200 is greater than 1,000, it is a risk and an alarm is issued.

[0048] To build a risk identification model using the Siddhi engine, you only need to complete business function development and debugging on the siddhi-tooling visual development tool, build the risk identification model script, generate the corresponding script file (.siddhi), and then deploy and run it in the siddhi-running runtime environment to achieve the above data generation function. Usually, the risk identification model (script) needs to include the following functions:

[0049] (1) Data receiving function: This function is used to receive API traffic data after the data preprocessing module and can convert it into a custom data format. The receiving function can support different data sources such as kafka, redis, DB, gRPC, and support common data types such as json and xml;

[0050] The received data is mapped and received through the receiving function, and the received data is the network traffic quintuple, the basic information of the network traffic and the preprocessed API data. The network traffic quintuple is dest_ip, dest_port, source_ip, source_port, url, and the basic information of the network traffic includes: request header, request data, response data, request data length, request data size, response data length and response data size.

[0051] (2) Data processing function: This function can use statistics, grouping, comparison and other functions on the above-mentioned custom data format to implement the risk rules, and map the calculation results to the custom result data;

[0052] The aggregation algorithm is used to calculate the sum of the request data length and response data length in the API traffic data. The statistics are grouped according to api_id and app_id. The sum of the request data length and the corresponding data length per second, minute, hour, day, and month are calculated in an aggregated manner. The aggregation results are automatically recorded and stored in the database. The storage target is the configured database information.

[0053] The results calculated by the aggregation algorithm will be output according to the configured target database. The data output format is a database table record, including api_id, app_id, sum_request_data_size, sum_respones_data_size, statistical time and statistical frequency.

[0054] Specifically, the request data length and response data length in the API traffic are summed up and counted, where:

[0055] define stream HttpLogStream(api_id long,app_id long,request_data_sizedouble,respones_data_size double,request_date long);

[0056] Define data algorithm input, api_id and app_id can uniquely identify the API interface;

[0057] define aggregation HttpLogDataSizeAgg

[0058] from HttpLogStream

[0059] select api_id,app_id,sum(request_data_size)as sum_request_data_size,sum(respones_data_size)as sum_respones_data_size

[0060] group by api_id,app_id

[0061] aggregate every sec,min,hour,day,month;

[0062] Define the calculation logic of the algorithm, group and count by api_id, app_id, and aggregate and calculate the total length of request data and the total sum of corresponding data per second, minute, hour, day, and month;

[0063] @store(type="rdbms",jdbc.url="jdbc:mysql: / / localhost:3306 / api_db",

[0064] username="root",password="root",

[0065] jdbc.driver.name="com.mysql.jdbc.Driver")

[0066] The aggregation algorithm defined can automatically complete the storage of aggregation results, and the storage target is the configured database information.

[0067] Finally, after editing and debugging, a script file with the suffix .siddhi will be generated, which can be deployed to the Siddhi stream analysis engine for use.

[0068] (2) Data output function: This function receives the custom result data and matches it one-to-one with the data type you want to output, completing the output of the risk identification results. It supports output to databases, Redis, and Kafka.

[0069] The steps for risk identification are as follows:

[0070]

[0071]

[0072] The script management module is used to manage risky scripts, usually with functions such as script upload, deletion, update, start, and stop.

[0073] As an embodiment, the present disclosure implements the risk that the total amount of data requested by the interface within one hour exceeds the threshold of 10,000. The specific process is as follows:

[0074] First, the data input of the risk identification model is the result of data preprocessing, which is transmitted through Kafka. The content includes the network traffic 5-tuple (dest_ip, dest_port, source_ip, source_port, url), basic network traffic information (request header, request data, response data, request data length, request data size, response data length, response data size), and preprocessing results (api_id, app_id); then the above data will be mapped and received through the receiving function and converted into a data format that the engine can recognize; then the result calculated by the aggregation algorithm will be output according to the configured target database. The data output format is a database table record, including api_id, app_id, sum_request_data_size, sum_respones_data_size, statistical time, statistical frequency and other information; when there is data that meets the condition of exceeding the threshold of 10,000, a risk data is generated and recorded in the corresponding database to complete the final risk identification function.

[0075] Example 2

[0076] In one embodiment of the present disclosure, a network traffic API risk analysis system based on Siddhi is provided, including:

[0077] A data acquisition module is used to obtain all request traffic and response traffic data in network traffic;

[0078] The preprocessing module is used to merge each acquired request flow and its corresponding response flow data into one piece of API flow data according to the rules, and preprocess the API flow data; specifically, the preprocessing analysis of the API flow data mainly involves the identification of asset data, the analysis of network links, the parsing of data items in the request data and response data, and the analysis of the content sensitivity level. The analysis results will be synchronously supplemented to the API flow data;

[0079] The risk identification module is used to build a risk identification model based on the Siddhi stream analysis engine according to the set risk judgment rules, input the pre-processed API traffic data into the risk identification model, map and receive it through the statistical implementation algorithm, convert it into a format that the engine can recognize, and use the aggregation algorithm to calculate the total length of the request data per second, minute, hour, day, and month, as well as the total sum of the corresponding data, and output it to the database table record. When the total amount of request data exceeds the set threshold, a risk data is generated to complete the risk identification.

[0080] It also includes a data cleaning module, which combines the request traffic and response traffic reported by the collection module into one piece of API traffic data according to the same identification value. The traffic contains both request-related information and response-related information.

[0081] The risk analysis script function of the Siddhi engine is relatively simple. You only need to complete the business function development and debugging on the siddhi-tooling visual development tool, generate the corresponding script file (.siddhi), and then deploy and run it in the siddhi-running running environment to achieve the above data generation function. Usually, the risk identification script implementation needs to include the following functions:

[0082] (1) Data receiving algorithm: This algorithm is used to receive API traffic data after the data preprocessing module and can convert it into a custom data format. This receiving function can support different data sources such as kafka, redis, DB, gRPC, and supports common data types such as json and xml;

[0083] (2) Data processing algorithm: This algorithm can use statistics, grouping, comparison and other functions on the above-mentioned custom data format to implement the risk rules, and map the calculation results to the custom result data;

[0084] (3) Data output algorithm: This algorithm receives the customized result data and matches it one-to-one with the data type you want to output, completes the output of the risk identification results, and supports output to databases, Redis, and Kafka.

[0085] As an example, a risk of "the total amount of data requested by the VIP interface within one hour exceeds the threshold of 10,000" is implemented. At this time, the data flow in the risk script is as follows: Figure 2 As shown:

[0086] First, the data input of the risk identification script is the result of the upstream data preprocessing module, which is transmitted through Kafka. The content includes network traffic 5-tuples, basic network traffic information, and preprocessing results. Then the above data will be mapped and received through the access and conversion algorithm and converted into a data format that the engine can recognize. VipApi information is a set of data configured in the business system, which is usually saved in the form of Redis memory. When used in the script, the access and conversion algorithm is also required.

[0087] Then, the aggregation algorithm can be configured to calculate the sum of the request data volume, and the calculated result data will be converted into a stream, which will be recorded in the database on the one hand, and used as input for risk identification and judgment on the other hand. The calculated result will be output according to the configured target database, and the data output format is a database table record, including api_id, app_id, sum_request_data_size, sum_respones_data_size, statistical time, statistical frequency and other information;

[0088] In addition, there is a risk identification and judgment algorithm. When the current API is VipApi and the sum of the requested data exceeds the threshold, a risk data is generated to meet the conditions and recorded in the corresponding database to complete the risk identification function. The storage algorithm needs to complete the design and creation of the database table in advance. The data flow that needs to be stored must correspond to the fields of the table. The necessary information of the database is configured through the @store annotation, such as database type, jdbc address, user name, password, driver class name, etc.

[0089] Example 3

[0090] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the Siddhi-based network traffic API risk analysis method is implemented.

[0091] Example 4

[0092] An embodiment of the present disclosure provides an electronic device, comprising: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the Siddhi-based network traffic API risk analysis method.

[0093] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0094] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0095] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A network traffic API risk analysis method based on Siddhi, characterized in that: include: Get all request and response traffic data in network traffic; Combine each acquired request flow and its corresponding response flow data into one piece of API flow data according to the rules, and pre-process the API flow data; Based on the Siddhi stream analysis engine, a risk identification model is built according to the set risk judgment rules. The pre-processed API traffic data is input into the risk identification model, mapped and received through the statistical implementation algorithm, and converted into a format recognizable by the engine. The aggregation algorithm is used to calculate the total length of the request data per second, minute, hour, day, and month, as well as the total sum of the corresponding data, and output them to the database table record. When the total amount of request data exceeds the set threshold, a risk data is generated to complete the risk identification.

2. The Siddhi-based network traffic API risk analysis method according to claim 1, characterized in that: Preprocess the API traffic data, including: identifying asset data, analyzing network links, parsing data items in the response data of the request data, and analyzing the content sensitivity level, and synchronously supplement the analysis results to the API traffic data.

3. The Siddhi-based network traffic API risk analysis method according to claim 1, characterized in that: Based on the Siddhi stream analysis engine, a risk identification model is built according to the set risk judgment rules, including: using the Siddhi engine, editing the risk analysis script, completing business development and debugging on the siddhi-tooling visual development tool, generating the corresponding script file .siddhi, and then deploying and running it in the siddhi-running operating environment.

4. The Siddhi-based network traffic API risk analysis method according to claim 1, characterized in that: The preprocessed API traffic data is input into the risk identification model, including: first, the statistical implementation algorithm includes a receiving function, which receives the preprocessed API traffic data and converts the API traffic data into a custom data format. The receiving function supports different data sources such as kafka, redis, DB and gRPC, and supports common json and xml types in terms of data types.

5. The Siddhi-based network traffic API risk analysis method according to claim 1, characterized in that: The aggregation algorithm is used to calculate the sum of the request data length and response data length in the API traffic data. The statistics are grouped according to api_id and app_id. The sum of the request data length and the corresponding data length per second, minute, hour, day, and month are calculated in an aggregated manner. The aggregation results are automatically recorded and stored in the database. The storage target is the configured database information.

6. The Siddhi-based network traffic API risk analysis method according to claim 1, characterized in that: The mapping and reception are performed through a statistical implementation algorithm, and the received data are a five-tuple of network traffic, basic information of network traffic, and preprocessed API data. The five-tuple of network traffic is dest_ip, dest_port, source_ip, source_port, and url. The basic information of network traffic includes: request header, request data, response data, request data length, request data size, response data length, and response data size.

7. The Siddhi-based network traffic API risk analysis method according to claim 1, characterized in that: The results calculated by the aggregation algorithm will be output according to the configured target database. The data output format is a database table record, including api_id, app_id, sum_request_data_size, sum_respones_data_size, statistical time and statistical frequency.

8. The network traffic API risk analysis system based on Siddhi is characterized by: include: A data acquisition module is used to obtain all request traffic and response traffic data in network traffic; The preprocessing module is used to merge each acquired request flow and its corresponding response flow data into one piece of API flow data according to the rules, and preprocess the API flow data; The risk identification module is used to build a risk identification model based on the Siddhi stream analysis engine according to the set risk judgment rules, input the pre-processed API traffic data into the risk identification model, map and receive it through the statistical implementation algorithm, convert it into a format that the engine can recognize, and use the aggregation algorithm to calculate the total length of the request data per second, minute, hour, day, and month, as well as the total sum of the corresponding data, and output it to the database table record. When the total amount of request data exceeds the set threshold, a risk data is generated to complete the risk identification.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by the processor, the Siddhi-based network traffic API risk analysis method as described in any one of claims 1-7 is implemented.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes the Siddhi-based network traffic API risk analysis method as described in any one of claims 1-7.

Images