Cloud API abnormal flow detection method and system based on multi-feature fusion

Abstract

The invention provides a cloud API abnormal traffic detection method and system based on multi-feature fusion, and belongs to the field of cloud API security. The detection method comprises the following steps: based on flow data of API endpoints acquired by a user, establishing a call graph and generating an adjacent matrix of the call graph, calculating API endpoint features and extracting flow statistical features; a cloud API abnormal traffic detection model comprising a GCN model and a feature fusion model is constructed based on the GCN, the GCN model obtains graph-level vector representation according to the adjacency matrix of the calling graph and the API endpoint feature matrix, and the feature fusion model fuses the graph-level vector representation and the traffic statistical features to obtain fusion features; and after the detection model is trained, collecting traffic data of a current user, and inputting the traffic data into the cloud API abnormal traffic detection model which is trained, so as to detect the abnormal traffic. According to the method, the abstraction level, the expression ability and the model generalization ability of API endpoint expression are improved, the misjudgment rate is reduced, and the detection effect is improved.

Description

Technical Field

[0001] The present invention belongs to the field of cloud API security, and specifically relates to a cloud API abnormal traffic detection method and system based on multi-feature fusion. Background Art

[0002] With the rapid development of cloud computing, cloud application programming interfaces (APIs) have become a key hub connecting different services and applications, and concerns about cloud API security are increasing. Malicious attackers exploit vulnerabilities and weaknesses in cloud APIs to launch various forms of attacks, including but not limited to SQL injection, cross-site scripting (XSS), authentication bypass, etc. These attacks are not only huge in number, but also increasingly diverse and covert in methods and techniques. Traditional rule-based matching and machine learning algorithms have certain limitations in detecting cloud API attacks. Rule-based matching methods require a large number of rules to be defined in advance, and cannot cover all possible forms of attacks, which is prone to missed reports and false positives; machine learning algorithms only use the traffic statistics of cloud APIs for modeling, ignoring the relationship between API endpoints and the call semantics generated by users calling API endpoints, resulting in the inability of machine learning algorithms to detect disguised malicious traffic.

[0003] In the prior art, cloud-based traffic features are generally used to build machine learning models to better identify abnormal traffic in cloud APIs.

[0004] For example, the Chinese patent with publication number CN116781431A discloses a method for monitoring abnormal behavior of API endpoints based on traffic features. It detects abnormal traffic of API endpoints based on cluster analysis of unsupervised learning algorithms and verifies and adjusts the abnormal traffic of API endpoints through modeling analysis and verification of supervised machine learning algorithms. It performs cluster analysis on the calling behaviors of different accounts to obtain the baseline of account calling API endpoints and calling frequency to realize the monitoring of abnormal behavior of accounts. It obtains the standard baseline of request parameters for the transmission of calling parameters of API endpoints to realize the monitoring of abnormal parameter transmission behavior. However, the above method has the following shortcomings: (1) The unsupervised learning results are unstable, which may lead to the unstable results of unsupervised machine learning algorithms, especially for algorithms such as K-Means that require a predetermined number of clusters. Improper selection may lead to inaccurate or unstable clustering results; (2) Insufficient feature extraction. In actual network environments, some malicious behaviors may take multiple steps to disguise their behavior patterns, but this disguise often leaves obvious traces in the call graph, such as abnormal call sequence, frequently changing call path, etc. Therefore, the above detection algorithm cannot detect these abnormal behaviors in time, resulting in the possibility of missing some disguised malicious traffic in the abnormal traffic detection process.

[0005] For example, the Chinese patent with publication number CN117574127A discloses a method for establishing a behavior baseline based on traffic data to identify whether there are abnormal calls in the application API endpoint. The method extracts the call data of all API endpoints through features, analyzes the call traffic of all API endpoints, calculates the call probability of the call data within a period of time to form a baseline, and compares it with the daily call behavior probability curve to identify whether there are abnormal call behaviors in the application API endpoint. However, the above scheme has the following shortcomings: (1) It does not consider the relationship between API endpoints. The scheme focuses on the analysis and anomaly detection of the call behavior of a single API endpoint, but does not involve the relationship between API endpoints, which leads to the inability to capture the propagation path and impact range of abnormal behavior, and the inability to identify some abnormal behaviors; (2) The method of establishing a baseline is too simple. The method of establishing a call baseline by counting the call frequency is too simple. Although this method can identify some abnormal call behaviors, it may not be effective against some advanced malicious attacks. Simple baselines may not be able to capture new attack patterns or variants because these attacks may be different from the normal behavior patterns described by simple baselines.

[0006] In summary, the cloud API abnormal traffic detection method in the prior art does not pay attention to the calling relationship between API endpoints, but only uses the calling behavior of a single API endpoint to establish a calling baseline for abnormal behavior detection, which makes it impossible to fully capture the complex relationship and interaction mode between API endpoints in the system, affecting the detection performance and generalization ability; in addition, the existing method only pays attention to the traffic statistical characteristics of users calling API endpoints, and is unable to detect some malicious behaviors disguised by multiple steps, resulting in the inability to accurately and timely identify disguised malicious behaviors, and the detection efficiency is low. Summary of the invention

[0007] In view of the above-mentioned defects or deficiencies in the prior art, the present invention aims to provide a cloud API abnormal traffic detection method and system based on multi-feature fusion, which is based on the multi-feature fusion of cloud API call graph features and traffic statistical features, focuses on the calling relationship between API endpoints, and identifies abnormal API endpoint calling patterns through in-depth analysis of the cloud API call graph, more comprehensively understands the complex relationship semantics between API endpoints, and improves the detection precision and accuracy of abnormal behaviors; by extracting the call graph of users calling cloud APIs, and using graph representation learning to capture the structure and relationship semantics in the cloud API call graph, fully mines user call features, discovers abnormal cloud API call patterns, identifies disguised malicious behaviors, and improves detection accuracy.

[0008] In order to achieve the above purpose, the embodiment of the present invention adopts the following technical solution:

[0009] In a first aspect, an embodiment of the present invention provides a cloud API abnormal traffic detection method based on multi-feature fusion, the method comprising the following steps:

[0010] Step S1, collecting traffic data of all API endpoints within a predetermined time period based on the user;

[0011] Step S2, taking the traffic data of each user as a sample, establishing a call graph and generating a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call paths from one API endpoint to another API endpoint;

[0012] Step S3, calculating API endpoint features based on the call graph and generating an API endpoint feature matrix; the API endpoint features reflect the number of users of each API endpoint, the traffic of each user, and the importance of the endpoint formed thereby;

[0013] Step S4, extracting traffic statistical features based on the call graph and generating a traffic statistical feature matrix;

[0014] Step S5, cleaning the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix, and normalizing the cleaned data, using the normalized data as a model training data set, and dividing it into training data and test data;

[0015] Step S6, constructing a cloud API abnormal traffic detection model based on the graph convolutional neural network GCN, wherein the cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model; wherein the GCN model obtains a graph-level vector representation according to the adjacency matrix of the call graph and the API endpoint feature matrix, and the feature fusion model fuses the graph-level vector representation and the traffic statistical features to obtain a fusion feature;

[0016] Step S7, using the training data in the model training data set to train the cloud API abnormal traffic detection model to obtain a trained cloud API abnormal traffic detection model;

[0017] Step S8, using test data to test the cloud API abnormal traffic detection model, and using accuracy Acc, recall Rec and F1 score to evaluate the cloud API abnormal traffic detection model;

[0018] Step S9, based on the cloud API traffic to be detected collected by the user and preprocessed, the trained cloud API abnormal traffic detection model is used to detect the current cloud API abnormal traffic.

[0019] As a preferred embodiment of the present invention, the API endpoint features in step S3 include: the degree of the API endpoint, the total number of times the API endpoint appears in all call graphs, and the total number of times the API endpoint is called.

[0020] As a preferred embodiment of the present invention, the API endpoint features calculated based on the call graph are used as initial features, and an initial feature matrix X0 is generated as initial input data for a subsequent GCN model.

[0021] As a preferred embodiment of the present invention, the traffic statistical characteristics in step S4 include: the average call duration of each API endpoint, the ratio of the number of API endpoints called by users to the total number of calls to all API endpoints, and the maximum number of calls to all API endpoints.

[0022] As a preferred embodiment of the present invention, the GCN model in step S6 includes: a data input interface, three graph convolution layers, a pooling layer, and a hidden layer; wherein the hidden layer uses dropout regularization to prevent the model from overfitting, uses an Adam optimizer with a learning rate of 0.01 to participate in the gradient descent process, and the loss function is the cross entropy of the input data X and the reconstructed data y, and uses the random forest rule for classification;

[0023] The GCN model effectively propagates and aggregates information on the call graph through convolution operations based on the call graph adjacency matrix and the API endpoint feature matrix, obtaining a graph embedding with graph structure and node relationship information.

[0024] As a preferred embodiment of the present invention, the hyperparameters of the GCN model include the number of neurons in three graph convolutional layers and a dropout parameter value.

[0025] As a preferred embodiment of the present invention, the feature fusion model classifies the fused features through the random forest algorithm; takes the graph-level vector representation and the traffic statistical feature matrix as input, classifies them through the random forest algorithm, fuses the graph-level vector representation and the traffic statistical features, and mines the multi-dimensional semantics on the cloud API call graph; wherein the graph-level vector representation has the relationship between the nodes in the cloud API call graph and the structural information of the graph, and the traffic statistical features provide intuitive and comprehensive traffic statistical information; through feature fusion, the behavioral characteristics of users calling the cloud API are described and analyzed, and the ability to detect malicious traffic is improved.

[0026] As a preferred embodiment of the present invention, the training process in step S7 includes:

[0027] Initialize all model parameters and obtain the node embedding Z through the GCN model, as shown in formula (1):

[0028]

[0029] In formula (1), X is the API endpoint feature matrix, the initial input X is the API endpoint feature matrix calculated based on the call graph; σ is the activation function; A is the adjacency matrix of the call graph; A+I, where I is the unit matrix, used to consider the case of self-connection; for The degree matrix of the GCN model is the degree of each node on the diagonal.

[0030] Expand the node embedding Z to {z i}, i = 1, 2, ..., n, n represents the total number of nodes in a call graph, z i represents the feature vector of the i-th node; perform graph-level average pooling on the node embedding Z to obtain a graph-level vector representation h with graph structure and node relationship information GAP :

[0031]

[0032] After N rounds of training, the graph convolutional layer learns the correlation and global features between nodes. By aggregating and transmitting information to the node's neighbor nodes, the GCN model continuously updates the node's feature representation while considering the context of the entire call graph, and obtains the final graph-level vector representation to complete the model training.

[0033] As a preferred embodiment of the present invention, the calculation process of the accuracy Acc, recall Rec and F1 score in step S8 is shown in formulas (3)-(5):

[0034]

[0035] In formulas (3)-(5), TP is the number of samples where malicious traffic is detected as malicious traffic, TN is the number of samples where normal traffic is detected as normal traffic, FP is the number of samples where normal traffic is detected as malicious traffic, and FN is the number of samples where malicious traffic is detected as normal traffic; Pre represents the accuracy, and Recall represents the recall rate.

[0036] In a second aspect, an embodiment of the present invention further provides a cloud API abnormal traffic detection system based on multi-feature fusion, the system comprising: a traffic data acquisition module, a call graph construction module, an API endpoint feature matrix generation module, a traffic statistical feature generation module, a training data integration module, a model construction module, a model training and testing module and a detection result output module; wherein,

[0037] The flow data collection module is used to collect flow data of all API endpoints within a predetermined time period based on the user; and is also used to collect flow data to be detected;

[0038] The call graph building module is used to take the traffic data of each user as a sample, build a call graph and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another API endpoint;

[0039] The API endpoint feature matrix generation module is used to calculate API endpoint features based on the call graph and generate an API endpoint feature matrix; the API endpoint features reflect the number of users of each API endpoint, the traffic of each user, and the importance of the endpoint formed thereby;

[0040] The traffic statistics feature generation module is used to extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix;

[0041] The training data integration module is used to clean the call graph adjacency matrix, the API endpoint feature matrix and the traffic statistics feature matrix, and normalize the cleaned data, use the normalized data as the model training data set, and divide it into training data and test data;

[0042] The model building module is used to build a cloud API abnormal traffic detection model based on a graph convolutional neural network (GCN); the cloud API abnormal traffic detection model includes a GCN model and a feature fusion model; the GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix, and the feature fusion model fuses the graph-level vector representation and traffic statistical features to obtain a fusion feature;

[0043] The model training and testing module is used to train the cloud API abnormal traffic detection model using the training data in the model training data set to obtain a trained cloud API abnormal traffic detection model; it is also used to test the cloud API abnormal traffic detection model using the test data, and evaluate the cloud API abnormal traffic detection model using the accuracy Acc, recall Rec and F1 score;

[0044] The detection result output module is used to clean and normalize the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix generated based on the traffic data to be detected, generate the data to be detected, and input it into the trained cloud API abnormal traffic detection model to detect the current cloud API abnormal traffic and output the detection results.

[0045] The technical solution provided by the embodiment of the present invention has the following beneficial effects:

[0046] The cloud API abnormal traffic detection method and system based on multi-feature fusion provided by the embodiment of the present invention proposes a new feature of API endpoints based on cloud API call graphs: the total number of times the API endpoint appears in different call graphs, the degree of the API endpoint, and the total number of times the API endpoint is called are used as features of the API endpoints in the cloud API call graph. These features can provide information about the importance and influence of the API endpoint in the entire call graph, and comprehensively consider the position, importance and connection of the API endpoint in the entire call graph, which helps to more comprehensively describe the characteristics of the API endpoint, so that GCN can more fully learn the representation of the node. The present invention detects abnormal cloud API traffic by integrating the call graph of the cloud API with traffic statistical features, processes the cloud API call graph through a GCN model with three layers of graph convolution layers, and uses multi-layer graph convolution layers to aggregate and propagate more information layer by layer, thereby improving the abstract level and expression ability of the node representation, better learning the features of the graph data, and improving the performance and generalization ability of the model; the cloud API call graph is converted into an effective feature representation and combined with statistical features, thereby adding the traffic statistical features of the call graph, so that the random forest model has a better classification performance, improves the accuracy of the classification system, reduces the misjudgment rate, thereby improving the credibility and reliability of the system, and improving the detection effect.

[0047] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 It is a schematic diagram of a cloud API abnormal traffic detection method based on multi-feature fusion according to an embodiment of the present invention;

[0050] Figure 2 It is a flow chart of a cloud API abnormal traffic detection method based on multi-feature fusion according to an embodiment of the present invention;

[0051] Figure 3 It is a schematic diagram of the training process of the cloud API abnormal traffic detection model described in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations. It should be noted that the embodiments of the present invention and the features in the embodiments can also be combined with each other without conflict.

[0053] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. In the description of the present invention, the terms "first", "second", "third", "fourth", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0054] In response to the malicious attack problems currently faced by cloud APIs, especially when attackers may disguise their malicious behaviors through various means to make them look like normal cloud API calling behaviors, how to detect malicious behaviors, the present invention proposes a cloud API abnormal traffic detection method and system based on multi-feature fusion, by establishing a call graph of users calling cloud APIs, using feature engineering means to obtain the features of API endpoints, using a graph neural network model to mine the semantics of the call graph of users calling cloud APIs, learning the semantic features of the cloud API call graph, mining deeper calling behaviors, modeling the behaviors of users calling cloud APIs, learning the normal and abnormal calling behaviors of users, combining the learned cloud API endpoint features with traffic statistical features, and finally inputting the cloud API endpoint features and traffic statistical features into a random forest algorithm to classify normal traffic and abnormal traffic, thereby improving the detection effect of cloud API abnormal traffic.

[0055] like Figure 1 and Figure 2 As shown, the cloud API abnormal traffic detection method based on multi-feature fusion according to an embodiment of the present invention includes the following steps:

[0056] Step S1, collecting traffic data of all API endpoints within a predetermined time period based on the user.

[0057] In this step, the predetermined time period is specifically selected according to the specific situation, for example, it can be one hour, one day, etc., or it can be 5s, 10s, etc.

[0058] In the cloud computing environment, the microservice architecture used to provide services to enterprises splits a large service into multiple small, autonomous services. Each service focuses on a specific business function and interacts on the cloud platform through lightweight communication mechanisms. With the support of the elasticity and scalability of cloud computing, microservices can be deployed and managed more flexibly, allowing enterprises to respond to market demands more quickly and provide more competitive products and services. Each service is an API endpoint.

[0059] In this step, a distributed tracing system is used in the environment to track the user's request call chain for calling the cloud API, and obtain the call path of the request from one API endpoint to another. Specifically, after selecting the starting sample, the distributed tracing system is used to collect the traffic in the subsequent call chain generated by a single call, and finally the traffic of the entire call process is obtained. All traffic generated by the current user calling the cloud API within a predetermined time period is collected as the original sample data.

[0060] Step S2, taking the traffic data of each user as a sample, establishing a call graph and generating a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call paths from one API endpoint to another API endpoint.

[0061] In this step, after obtaining the traffic data, a call graph is created for each sample. For each sample, all call traffic generated by users using the service is tracked through the distributed system trace tracking tool, and an abstract cloud API call graph containing nodes and edges is generated. The nodes and edges in the call graph are processed to obtain the adjacency matrix A of the graph, which is used as the input of the subsequent graph convolutional network (GCN) model.

[0062] Specifically, the call graph is established, the API endpoints are abstracted as nodes, and the traffic paths between the API endpoints are abstracted as edges, which clearly presents all the API endpoints and traffic paths that the user request passes through. By analyzing and detecting these traffic paths, potential malicious behaviors can be better discovered and identified, and the accuracy and timeliness of malicious traffic detection can be improved, thereby effectively protecting the security and stability of the system. Correspondingly, the call graph includes nodes and edges, wherein the nodes of the call graph represent API endpoints, which are different types of services provided by the cloud API to users, and the edges of the call graph represent service call paths. For example, the map service provided by the enterprise is deployed using a microservice architecture, and multiple small services communicate through the network. Taking the request of user A as an example, user A wants to reach a certain destination, so he calls the route planning API endpoint. Subsequently, the route planning API endpoint requests the authentication API endpoint to verify the identity information of the caller, and the authentication API endpoint calls the user data API endpoint to obtain the user data and verify it. After completing the verification, the route planning API endpoint requests the geocoding API endpoint to obtain the user code of the user's location and destination. After completion, the navigation service API endpoint is called to provide navigation information to the user, and the service request is archived through the log service API endpoint. The existing technology only focuses on the north-south traffic of users directly calling API endpoints, ignoring the east-west traffic between API endpoints within the service, and the behavior of users making multiple calls to different API endpoints. This may be exploited by attackers to sniff vulnerabilities by making calls between multiple different API endpoints. This kind of hidden attack behavior can circumvent traditional north-south traffic detection, but will leave call traces. Therefore, this embodiment uses an API call graph to describe all the traffic generated by the user's calls over a period of time and build a map by identifying and tracking the calling behavior of a user over a period of time and whether the subsequent API endpoint call chain caused by it is normal.

[0063] Step S3, calculating API endpoint features based on the call graph and generating an API endpoint feature matrix; the API endpoint features reflect the number of users of each API endpoint, the traffic of each user, and the importance of the endpoint formed thereby.

[0064] In this step, a cloud computing service provides multiple API endpoints that can be called by users. Different users may use different API endpoints when using the service; in addition, some API endpoints may be called simultaneously by different users, that is, in different usage scenarios, and different call traffic will be generated at the same API endpoint, thereby generating different cloud API call graphs. Therefore, each API endpoint has different importance and characteristics due to the different call traffic used by different users and whether two or more users use it at the same time. This embodiment describes this difference through API endpoint characteristics.

[0065] Specifically, after obtaining the cloud API call graph, the API endpoint features are obtained by calculation. The API endpoint features include: the degree of the API endpoint, the total number of times the API endpoint appears in all call graphs, and the total number of times the API endpoint is called. The above features are used to reflect the characteristics of the API endpoints corresponding to the nodes in the call graph in actual applications. The API endpoint features calculated based on the call graph are used as the initial features, and the initial feature matrix X0 is generated as the initial input data for the subsequent GCN model.

[0066] Step S4, extracting traffic statistical features based on the call graph and generating a traffic statistical feature matrix.

[0067] In this step, firstly, sample information is extracted based on the call graph, and the sample information includes: client IP address, call duration, time interval between adjacent data packets, and number of data packets in the sample; based on the sample information, the traffic statistics characteristics of the cloud API are calculated. The traffic statistics characteristics include: the average call duration of each API endpoint, the ratio of the number of API endpoints called by the user to the total number of calls to all API endpoints, and the maximum number of calls to all API endpoints.

[0068] Step S5, clean the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix, normalize the cleaned data, use the normalized data as the model training data set, and divide it into training data and test data.

[0069] In this step, for the call graph, due to network reasons, only the call data for a single API endpoint may be captured. Such samples cannot be used as call graphs and are outliers. For traffic data, there may be incomplete capture of network sessions or other network reasons, which may cause individual traffic after feature extraction to contain outliers such as non-digits and infinite numbers, which will affect subsequent data processing. Because this part of the traffic accounts for no more than 1%, the traffic containing outliers is removed as "dirty data".

[0070] The cleaned dataset for model training includes the adjacency matrix of the call graph with invalid data removed, the API endpoint feature matrix, and the statistical feature matrix.

[0071] Step S6, building a cloud API abnormal traffic detection model based on the graph convolutional neural network GCN, the cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model; wherein the GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix, and the feature fusion model fuses the graph-level vector representation and the traffic statistical features to obtain a fused feature.

[0072] In this step, the model is built based on GCN. GCN is a type of deep learning model specifically designed to process graph-structured data. It updates the representation of nodes through local information transmission and aggregation between nodes, and combines global information for comprehensive learning. The structural functions of the GCN model include two parts: message passing and node updating. In the message passing stage, each node collects information about its neighboring nodes, aggregates and transmits this information; in the node updating stage, the node updates its own representation based on the collected information. This iterative process can continuously improve the representation of the node, so that the node representation can better reflect the characteristics of the graph structure. The feature representations of all nodes are then aggregated through graph pooling to obtain a graph-level vector representation.

[0073] The cloud API abnormal traffic detection model is constructed, including two parts: a GCN model and a feature fusion model.

[0074] In the GCN model part, a GCN model with three graph convolution layers is used to process the cloud API call graph. Specifically, the GCN model includes: a data input interface, three graph convolution layers, a pooling layer, and a hidden layer; wherein, the hidden layer uses dropout regularization to prevent the model from overfitting, and uses the Adam optimizer with a learning rate of 0.01 to participate in the gradient descent process. The loss function is the cross entropy of the input data X and the reconstructed data y, and the random forest rule is used for classification. The GCN-based abnormal traffic detection model effectively propagates and aggregates information on the call graph through convolution operations based on the call graph adjacency matrix and the API endpoint feature matrix, and obtains a graph embedding with graph structure and node relationship information, that is, a graph-level vector representation. The hyperparameters of the GCN model include the number of neurons in the three graph convolution layers and the dropout parameter value.

[0075] In the feature fusion model part, the graph-level vector representation and the statistical features in the traffic are fused by means of ensemble learning to obtain fused features, and abnormal traffic detection is performed based on the fused features. When detecting abnormal traffic, the fused features are classified by the random forest algorithm. Random forest is an ensemble learning algorithm that improves the performance and stability of the model by building multiple decision trees and integrating the fused features together. In this embodiment, the graph-level vector representation and statistical features are fused as input, classified by the random forest algorithm, and the graph-level vector representation and traffic statistical features are fused to fully explore the multi-dimensional semantics on the cloud API call graph. The graph-level vector representation has the relationship between the nodes in the cloud API call graph and the structural information of the graph, while the traffic statistical features can provide more intuitive and comprehensive traffic statistical information. Through feature fusion, the behavioral characteristics of users calling cloud APIs can be more accurately described and analyzed, and the ability to detect malicious traffic can be improved.

[0076] Table 1 GCN model hyperparameter settings

[0077] Model composition Setting Hyperparameters GraphConv1 hidden_num=128 GraphConv2 hidden_num=64 GraphConv3 hidden_num=32 Dropout 0.2

[0078] Step S7, using the training data in the model training data set to train the cloud API abnormal traffic detection model to obtain a trained cloud API abnormal traffic detection model.

[0079] In this step, the GCN model is trained on the training set, such as Figure 3 As shown, the training process includes:

[0080] Initialize all model parameters and obtain the node embedding Z through the GCN model, as shown in formula (1):

[0081] In formula (1), X is the API endpoint feature matrix, the initial input X is the API endpoint feature matrix calculated based on the call graph; σ is the activation function; A is the adjacency matrix of the call graph; A+I, where I is the unit matrix, used to consider the case of self-connection; for The degree matrix of the GCN model is represented by the diagonal elements, where the diagonal elements are the degrees of each node. W is the weight matrix of the GCN model. Preferably, softmax regression is used here to classify the call graph, and the parameters of the graph convolution layer are adjusted by back propagation. The ReLU function is used as the activation function.

[0082] Expand the node embedding Z to {z i}, i = 1, 2, ..., n, n represents the total number of nodes in a call graph, z i represents the feature vector of the i-th node; perform graph-level average pooling on the node embedding Z to obtain a graph-level vector representation h with graph structure and node relationship information GAP :

[0083]

[0084] After N rounds of training, the graph convolutional layer learns the correlation and global features between nodes. By aggregating and transmitting information to the node's neighbor nodes, the GCN model continuously updates the node's feature representation while considering the context of the entire call graph, and obtains the final graph-level vector representation to complete the model training.

[0085] In the feature fusion model, the graph-level vector representation is fused with the traffic statistical features corresponding to the graph, and the fused vector is used to train the random forest model to classify the fused features.

[0086] Step S8, using test data to test the cloud API abnormal traffic detection model, and using accuracy Acc, recall Rec and F1 score to evaluate the cloud API abnormal traffic detection model.

[0087] In this step, in order to verify the advantages of GCN in detecting abnormal cloud API traffic, a comparative experiment was conducted with other models on the API Security: Access behavior anomaly dataset open source dataset. The dataset contains normal and abnormal cloud API call traffic data, 10,051 positive samples and 26,050 negative samples. The training set and test set are divided by the train_test_split function of sklearn, with a ratio of 7:3.

[0088] The experimental performance indicators include accuracy Acc, recall Rec and F1 score. The calculation process is shown in formulas (3)-(5):

[0089]

[0090]

[0091] In formulas (3)-(5), TP is the number of samples where malicious traffic is detected as malicious traffic, TN is the number of samples where normal traffic is detected as normal traffic, FP is the number of samples where normal traffic is detected as malicious traffic, and FN is the number of samples where malicious traffic is detected as normal traffic; Pre represents the accuracy, and Recall represents the recall rate.

[0092] The experimental results are shown in Table 2. Compared with using only statistical features, the combined features of the representation features and statistical features learned by the GCN model achieved better classification results. This is because the GCN model effectively captures the relationship and information transfer between nodes, learns the structural characteristics of the cloud API call graph, and improves the application effect of the classifier in real-world scenarios.

[0093] The classification effect of using GCN+softmax classifier is worse than that of GCN+RF classifier because of the difference in feature space of data and applicability of the model. Random forest usually performs well when processing data with complex nonlinear features because it can partition feature space more flexibly and has strong generalization ability.

[0094] Table 2 Comparison results of experimental performance indicators

[0095] feature Model Acc(%) Rec(%) F1(％) Graph Embedding GCN+softmax 81.03 81.03 78.43 Graph Embedding GCN+RF 84.22 84.22 84.19 Traffic statistics characteristics Logistic regression 84.48 84.15 84.48 Traffic statistics characteristics RF 92.91 92.91 92.85 Graph embedding + traffic statistics features GCN+RF 95.21 95.21 95.18

[0096] Step S9, based on the cloud API traffic to be detected collected by the user and preprocessed, the trained cloud API abnormal traffic detection model is used to detect the current cloud API abnormal traffic.

[0097] In this step, the cloud API traffic to be detected is collected based on the user and preprocessed, including: taking a user's cloud API traffic as a sample, constructing a call graph, and generating a call graph adjacency matrix; then calculating the API end ignition feature and generating an API endpoint feature matrix; extracting traffic statistical features based on the call graph and generating a traffic statistical feature matrix; after data cleaning the call graph adjacency matrix, API endpoint feature matrix and traffic statistical matrix, inputting the trained cloud API abnormal traffic detection model, the detection result can be obtained. At this time, if y_pred = 1, it is normal traffic, and if y_pred = 0, it is malicious traffic.

[0098] Based on the same idea, the embodiment of the present invention also provides a cloud API abnormal traffic detection system based on multi-feature fusion. The system includes: a traffic data acquisition module, a call graph construction module, an API endpoint feature matrix generation module, a traffic statistical feature generation module, a training data integration module, a model construction module, a model training and testing module and a detection result output module; wherein,

[0099] The flow data collection module is used to collect flow data of all API endpoints within a predetermined time period based on the user; and is also used to collect flow data to be detected;

[0100] The call graph building module is used to take the traffic data of each user as a sample, build a call graph and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another API endpoint;

[0101] The API endpoint feature matrix generation module is used to calculate API endpoint features based on the call graph and generate an API endpoint feature matrix; the API endpoint features reflect the number of users of each API endpoint, the traffic of each user, and the importance of the endpoint formed thereby;

[0102] The traffic statistics feature generation module is used to extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix;

[0103] The training data integration module is used to clean the call graph adjacency matrix, the API endpoint feature matrix and the traffic statistics feature matrix, and normalize the cleaned data, use the normalized data as the model training data set, and divide it into training data and test data;

[0104] The model building module is used to build a cloud API abnormal traffic detection model based on a graph convolutional neural network (GCN); the cloud API abnormal traffic detection model includes a GCN model and a feature fusion model; the GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix, and the feature fusion model fuses the graph-level vector representation and traffic statistical features to obtain a fusion feature;

[0105] The model training and testing module is used to train the cloud API abnormal traffic detection model using the training data in the model training data set to obtain a trained cloud API abnormal traffic detection model; it is also used to test the cloud API abnormal traffic detection model using the test data, and evaluate the cloud API abnormal traffic detection model using the accuracy Acc, recall Rec and F1 score;

[0106] The detection result output module is used to clean and normalize the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix generated based on the traffic data to be detected, generate the data to be detected, and input it into the trained cloud API abnormal traffic detection model to detect the current cloud API abnormal traffic and output the detection results.

[0107] In this embodiment, each module is implemented by a processor, and a memory is appropriately added when storage is required. Among them, the processor can be but is not limited to a microprocessor MPU, a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components, etc. The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0108] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0109] It should also be noted that the cloud API abnormal traffic detection system based on multi-feature fusion described in this embodiment corresponds to the cloud API abnormal traffic detection method based on multi-feature fusion. The description and limitation of the method are also applicable to the system and will not be repeated here.

[0110] It can be seen from the above technical solutions that the cloud API abnormal traffic detection method and system based on multi-feature fusion provided in the embodiments of the present invention propose new features of API endpoints based on API call graphs: the total number of times the API endpoint appears in different call graphs, the degree of the API endpoint, and the total number of times the API endpoint is called are used as features of the API endpoint in the cloud API call graph. These features can provide information about the importance and influence of the API endpoint in the entire call graph, and comprehensively consider the position, importance and connection status of the API endpoint in the entire call graph, which helps to more comprehensively describe the characteristics of the API endpoint, so that GCN can more fully learn the representation of nodes. The present invention detects abnormal cloud API traffic by integrating the call graph of the cloud API with traffic statistical features, processes the cloud API call graph through a GCN model with three graph convolution layers, and utilizes multiple graph convolution layers to aggregate and propagate more information layer by layer, thereby improving the abstraction level and expression ability of node representation, better learning the features of graph data, and improving the performance and generalization ability of the model; the cloud API call graph is converted into an effective feature representation and combined with statistical features, thereby adding the traffic statistical features of the call graph, so that the random forest model has better classification performance, improves the accuracy of the classification system, and reduces the misjudgment rate, thereby improving the credibility and reliability of the system and improving the detection effect.

[0111] The above description is only a preferred embodiment of the present invention and an explanation of the technical principles used. It is not intended to limit the scope of the invention claimed for protection, but only represents the preferred embodiment of the present invention. Those skilled in the art should understand that the scope of the invention involved in the present invention is not limited to the technical solution formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the inventive concept. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.

Claims

1. A cloud API abnormal traffic detection method based on multi-feature fusion, characterized in that: The method comprises the following steps: Step S1, collecting traffic data of all API endpoints within a predetermined time period based on the user; Step S2, taking the traffic data of each user as a sample, establishing a call graph and generating a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call paths from one API endpoint to another API endpoint; Step S3, calculating API endpoint features based on the call graph and generating an API endpoint feature matrix; The API endpoint characteristics reflect the number of users of each API endpoint, the traffic of each user, and the importance of the endpoint formed thereby; Step S4, extracting traffic statistical features based on the call graph and generating a traffic statistical feature matrix; Step S5, cleaning the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix, and normalizing the cleaned data, using the normalized data as a model training data set, and dividing it into training data and test data; Step S6, constructing a cloud API abnormal traffic detection model based on the graph convolutional neural network GCN, wherein the cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model; wherein the GCN model obtains a graph-level vector representation according to the adjacency matrix of the call graph and the API endpoint feature matrix, and the feature fusion model fuses the graph-level vector representation and the traffic statistical features to obtain a fusion feature; Step S7, using the training data in the model training data set to train the cloud API abnormal traffic detection model to obtain a trained cloud API abnormal traffic detection model; Step S8, using test data to test the cloud API abnormal traffic detection model, and using accuracy Acc, recall Rec and F1 score to evaluate the cloud API abnormal traffic detection model; Step S9, based on the cloud API traffic to be detected collected by the user and preprocessed, the trained cloud API abnormal traffic detection model is used to detect the current cloud API abnormal traffic.

2. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 1 is characterized in that: The API endpoint features in step S3 include: the degree of the API endpoint, the total number of times the API endpoint appears in all call graphs, and the total number of times the API endpoint is called.

3. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 2 is characterized in that: The API endpoint features calculated based on the call graph are used as the initial features, and the initial feature matrix X0 is generated as the initial input data for the subsequent GCN model.

4. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 1 is characterized in that: The traffic statistics features in step S4 include: the average call duration of each API endpoint, the ratio of the number of API endpoints called by users to the total number of calls to all API endpoints, and the maximum number of calls to all API endpoints.

5. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 1 is characterized in that: The GCN model in step S6 includes: a data input interface, three graph convolutional layers, a pooling layer, and a hidden layer; the hidden layer uses dropout regularization to prevent the model from overfitting, uses the Adam optimizer with a learning rate of 0.01 to participate in the gradient descent process, and the loss function is the cross entropy of the input data X and the reconstructed data y, and uses the random forest rule for classification; The GCN model effectively propagates and aggregates information on the call graph through convolution operations based on the call graph adjacency matrix and the API endpoint feature matrix, obtaining a graph embedding with graph structure and node relationship information.

6. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 5 is characterized in that: The hyperparameters of the GCN model include the number of neurons in the three graph convolutional layers and the dropout parameter value.

7. The cloud API abnormal traffic detection method based on multi-feature fusion according to any one of claims 1 to 6 is characterized in that: The feature fusion model classifies the fused features through the random forest algorithm; takes the graph-level vector representation and the traffic statistical feature matrix as input, classifies them through the random forest algorithm, fuses the graph-level vector representation and the traffic statistical features, and mines the multi-dimensional semantics on the cloud API call graph; wherein the graph-level vector representation has the relationship between the nodes in the cloud API call graph and the structural information of the graph, and the traffic statistical features provide intuitive and comprehensive traffic statistical information; through feature fusion, the behavioral characteristics of users calling the cloud API are described and analyzed, and the detection capability of malicious traffic is improved.

8. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 7 is characterized in that: The training process in step S7 includes: Initialize all model parameters and obtain the node embedding Z through the GCN model, as shown in formula (1): In formula (1), X is the API endpoint feature matrix, the initial input X is the API endpoint feature matrix calculated based on the call graph; σ is the activation function; A is the adjacency matrix of the call graph; A+I, where I is the unit matrix, used to consider the case of self-connection; for The degree matrix of the GCN model is the degree of each node on the diagonal. Expand the node embedding Z to {z i }, i = 1, 2, ..., n, n represents the total number of nodes in a call graph, z i represents the feature vector of the i-th node; perform graph-level average pooling on the node embedding Z to obtain a graph-level vector representation h with graph structure and node relationship information GAP : After N rounds of training, the graph convolutional layer learns the correlation and global features between nodes. By aggregating and transmitting information to the node's neighbor nodes, the GCN model continuously updates the node's feature representation while considering the context of the entire call graph, and obtains the final graph-level vector representation to complete the model training.

9. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 1 is characterized in that: The calculation process of accuracy Acc, recall Rec and F1 score in step S8 is shown in formulas (3)-(5): In formulas (3)-(5), TP is the number of samples where malicious traffic is detected as malicious traffic, TN is the number of samples where normal traffic is detected as normal traffic, FP is the number of samples where normal traffic is detected as malicious traffic, and FN is the number of samples where malicious traffic is detected as normal traffic; Pre represents the accuracy, and Recall represents the recall rate.

10. A cloud API abnormal traffic detection system based on multi-feature fusion, characterized in that: The system includes: a traffic data acquisition module, a call graph construction module, an API endpoint feature matrix generation module, a traffic statistics feature generation module, a training data integration module, a model construction module, a model training and testing module and a detection result output module; wherein, The flow data collection module is used to collect flow data of all API endpoints within a predetermined time period based on the user; and is also used to collect flow data to be detected; The call graph building module is used to take the traffic data of each user as a sample, build a call graph and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another API endpoint; The API endpoint feature matrix generation module is used to calculate API endpoint features based on the call graph and generate an API endpoint feature matrix; the API endpoint features reflect the number of users of each API endpoint, the traffic of each user, and the importance of the endpoint formed thereby; The traffic statistics feature generation module is used to extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix; The training data integration module is used to clean the call graph adjacency matrix, the API endpoint feature matrix and the traffic statistics feature matrix, and normalize the cleaned data, use the normalized data as the model training data set, and divide it into training data and test data; The model building module is used to build a cloud API abnormal traffic detection model based on a graph convolutional neural network (GCN); the cloud API abnormal traffic detection model includes a GCN model and a feature fusion model; the GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix, and the feature fusion model fuses the graph-level vector representation and traffic statistical features to obtain a fusion feature; The model training and testing module is used to train the cloud API abnormal traffic detection model using the training data in the model training data set to obtain a trained cloud API abnormal traffic detection model; it is also used to test the cloud API abnormal traffic detection model using the test data, and evaluate the cloud API abnormal traffic detection model using the accuracy Acc, recall Rec and F1 score; The detection result output module is used to clean and normalize the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix generated based on the traffic data to be detected, generate the data to be detected, and input it into the trained cloud API abnormal traffic detection model to detect the current cloud API abnormal traffic and output the detection results.

Images