A method and system for detecting abnormal traffic in cloud APIs based on multi-feature fusion

Abstract

This invention provides a method and system for detecting abnormal traffic in cloud APIs based on multi-feature fusion, within the field of cloud API security. The detection method includes: establishing a call graph and generating an adjacency matrix based on user-collected API endpoint traffic data; calculating API endpoint features and extracting traffic statistical features; constructing a cloud API abnormal traffic detection model based on Gaussian Cloud Network (GCN) model and a feature fusion model. The GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix. The feature fusion model fuses the graph-level vector representation and traffic statistical features to obtain fused features. After training the detection model, current user traffic data is collected and input into the trained cloud API abnormal traffic detection model to detect abnormal traffic. This invention improves the abstraction level and expressive power of API endpoint representation, enhances model generalization ability, reduces the false positive rate, and improves detection performance.

Description

Technical Field

[0001] This invention belongs to the field of cloud API security, specifically relating to a method and system for detecting abnormal cloud API traffic based on multi-feature fusion. Background Technology

[0002] With the rapid development of cloud computing, cloud application programming interfaces (APIs) have become a crucial hub connecting different services and applications, leading to increasing attention on cloud API security. Malicious attackers exploit vulnerabilities and weaknesses in cloud APIs to launch various forms of attacks, including but not limited to SQL injection, cross-site scripting (XSS), and authentication bypass. These attacks are not only numerous but also increasingly diverse and sophisticated in their methods and techniques. Traditional rule-based matching and machine learning algorithms have limitations in detecting cloud API attacks. Rule-based matching methods require pre-defining a large number of rules and cannot cover all possible attack forms, making them prone to false negatives and false negatives. Machine learning algorithms only use the traffic statistics of cloud APIs for modeling, ignoring the relationships between API endpoints and the call semantics generated by users calling API endpoints, resulting in machine learning algorithms being unable to detect disguised malicious traffic.

[0003] In existing technologies, cloud-based traffic characteristics are generally used to build machine learning models to better identify abnormal traffic in cloud APIs.

[0004] For example, Chinese patent CN116781431A discloses a method for detecting abnormal behavior of API endpoints based on traffic characteristics. It detects abnormal traffic of API endpoints by clustering analysis based on unsupervised learning algorithms and modeling, analysis and verification by supervised machine learning algorithms. It obtains the API endpoint call frequency baseline by clustering analysis of the call behavior of different accounts to realize abnormal behavior monitoring of accounts, and obtains the request parameter standard baseline by transmitting call parameters of API endpoints to realize abnormal parameter transmission behavior monitoring. However, the above method has the following shortcomings: (1) The results of unsupervised learning are unstable, which may lead to unstable results of unsupervised machine learning algorithms. Especially for algorithms such as K-Means that require the number of clusters to be determined in advance, improper selection may lead to inaccurate or unstable clustering results; (2) The feature extraction is insufficient. In the actual network environment, some malicious behaviors may take multi-step operations to disguise their behavior patterns. However, such disguise often leaves obvious traces in the call graph, such as abnormal call order and frequently changing call path. Therefore, the above detection algorithm cannot detect these abnormal behaviors in time, which may lead to some disguised malicious traffic being missed in the abnormal traffic detection process.

[0005] For example, Chinese patent CN117574127A discloses a method for identifying whether an application API endpoint has abnormal calls by establishing a behavioral baseline based on traffic data. The method extracts call data from all API endpoints by feature extraction, analyzes the call traffic of all API endpoints, calculates the call probability of the call data over a period of time to form a baseline, and compares it with the daily call behavior probability curve to identify whether the application API endpoint has abnormal call behavior. However, the above scheme has the following shortcomings: (1) It does not consider the relationship between API endpoints. The scheme focuses on the analysis and anomaly detection of call behavior of a single API endpoint, but does not involve the relationship between API endpoints, which leads to the inability to capture the propagation path and scope of impact of abnormal behavior, and thus cannot identify some abnormal behaviors; (2) The method of establishing the baseline is too simple. The method of establishing the call baseline by statistically analyzing the call frequency is too simple. Although the method can identify some abnormal call behaviors, it may not be effective in dealing with some advanced malicious attacks. The simple baseline may not be able to capture new attack patterns or variants, because these attacks may be different from the normal behavior patterns described by the simple baseline.

[0006] In summary, existing cloud API abnormal traffic detection methods do not focus on the call relationships between API endpoints. They only establish a call baseline based on the call behavior of a single API endpoint for abnormal behavior detection. This results in an inability to fully capture the complex relationships and interaction patterns between API endpoints in the system, affecting detection performance and generalization ability. In addition, existing methods only focus on the traffic statistics of user calls to API endpoints and cannot detect malicious behaviors that are disguised through multi-step operations. This leads to an inability to accurately and timely identify disguised malicious behaviors, resulting in low detection efficiency. Summary of the Invention

[0007] In view of the above-mentioned defects or deficiencies in the prior art, the present invention aims to provide a method and system for detecting abnormal cloud API traffic based on multi-feature fusion. This method focuses on the call relationships between API endpoints by fusing cloud API call graph features and traffic statistics features. Through in-depth analysis of the cloud API call graph, it identifies abnormal API endpoint call patterns, provides a more comprehensive understanding of the complex semantic relationships between API endpoints, and improves the accuracy and precision of detecting abnormal behavior. By extracting the call graph of user calls to cloud APIs and using graph representation learning to capture the structure and semantic relationships within the cloud API call graph, it fully mines user call features, discovers abnormal cloud API call patterns, identifies disguised malicious behavior, and improves the accuracy of detection.

[0008] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0009] In a first aspect, embodiments of the present invention provide a method for detecting abnormal traffic in cloud APIs based on multi-feature fusion, the method comprising the following steps:

[0010] Step S1: Based on the user's collection of traffic data for all API endpoints within a predetermined time period;

[0011] Step S2: Take each user's traffic data as a sample, build a call graph and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another.

[0012] Step S3: Calculate API endpoint features based on the call graph and generate an API endpoint feature matrix; the API endpoint features reflect the number of users for each API endpoint, the traffic of each user, and the resulting endpoint importance.

[0013] Step S4: Extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix;

[0014] Step S5: Clean the adjacency matrix of the call graph, the feature matrix of API endpoints, and the feature matrix of traffic statistics, and normalize the cleaned data. Use the normalized data as the model training dataset and divide it into training data and test data.

[0015] Step S6: Construct a cloud API abnormal traffic detection model based on graph convolutional neural network (GCN). The cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model. The GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix. The feature fusion model fuses the graph-level vector representation and traffic statistics features to obtain fused features.

[0016] Step S7: Use the training data in the model training dataset to train the cloud API abnormal traffic detection model to obtain the trained cloud API abnormal traffic detection model.

[0017] Step S8: Test the cloud API abnormal traffic detection model using test data, and evaluate the cloud API abnormal traffic detection model using accuracy (Acc), recall (Rec), and F1 score.

[0018] Step S9: Based on the cloud API traffic collected by the user and preprocessed, the trained cloud API abnormal traffic detection model is used to detect the current cloud API abnormal traffic.

[0019] As a preferred embodiment of the present invention, the API endpoint features in step S3 include: the degree of the API endpoint, the total number of times the API endpoint appears in all call graphs, and the total number of times the API endpoint is called.

[0020] In a preferred embodiment of the present invention, the API endpoint features calculated based on the call graph are used as initial features, and an initial feature matrix X0 is generated as the initial input data for the subsequent GCN model.

[0021] As a preferred embodiment of the present invention, the traffic statistics features in step S4 include: the average call duration of each API endpoint, the ratio of the number of API endpoints called by the user to the total number of API endpoint calls, and the maximum value among all API endpoint calls.

[0022] As a preferred embodiment of the present invention, the GCN model in step S6 includes: a data input interface, three graph convolutional layers, a pooling layer, and a hidden layer; wherein, the hidden layer uses dropout regularization to prevent model overfitting, uses an Adam optimizer with a learning rate of 0.01 to participate in the gradient descent process, the loss function is the cross-entropy between the input data X and the reconstructed data y, and uses the random forest rule for classification;

[0023] The GCN model effectively propagates and aggregates information on the call graph through convolution operations based on the adjacency matrix of the call graph and the feature matrix of the API endpoint, resulting in a graph embedding with graph structure and node relationship information.

[0024] In a preferred embodiment of the present invention, the hyperparameters of the GCN model include the number of neurons in the three graph convolutional layers and the dropout parameter value.

[0025] In a preferred embodiment of the present invention, the feature fusion model classifies the fused features using a random forest algorithm. It takes graph-level vector representations and traffic statistics feature matrices as input, classifies them using a random forest algorithm, and fuses the graph-level vector representations and traffic statistics features to mine multi-dimensional semantics on the cloud API call graph. The graph-level vector representations contain the relationships between nodes in the cloud API call graph and the graph's structural information, while the traffic statistics features provide intuitive and comprehensive traffic statistics information. Through feature fusion, the model describes and analyzes the behavioral characteristics of users calling cloud APIs, improving the ability to detect malicious traffic.

[0026] In a preferred embodiment of the present invention, the training process in step S7 includes:

[0027] Initialize all model parameters and obtain the node embedding Z through the GCN model, as shown in formula (1):

[0028]

[0029] In equation (1), X is the API endpoint feature matrix, and the initial input X is the API endpoint feature matrix calculated based on the call graph; σ is the activation function; and A is the adjacency matrix of the call graph. Let A+I be the identity matrix, used to account for the case of self-connection; for The degree matrix is ​​denoted by , with the diagonal elements representing the degree of each node; W is the weight matrix of the GCN model.

[0030] Expand the node embedding Z into {z} i}, i = 1, 2, ..., n, where n represents the total number of nodes in a call graph, z i The feature vector of the i-th node is represented by Z; graph-level average pooling is performed on the node embedding Z to obtain a graph-level vector representation h that contains graph structure and node relationship information. GAP :

[0031]

[0032] After N rounds of training, the graph convolutional layer learns the relationships between nodes and global features. By aggregating and passing information between the neighboring nodes of a node, the GCN model continuously updates the feature representation of the node while considering the context of the entire call graph, and obtains the final graph-level vector representation, thus completing the model training.

[0033] In a preferred embodiment of the present invention, the accuracy (Acc), recall (Rec), and F1 score in step S8 are calculated as shown in formulas (3)-(5):

[0034]

[0035] In equations (3)-(5), TP is the number of samples that are detected as malicious traffic, TN is the number of samples that are detected as normal traffic, FP is the number of samples that are detected as malicious traffic, and FN is the number of samples that are detected as normal traffic; Pre represents the accuracy rate, and Recall represents the recall rate.

[0036] Secondly, embodiments of the present invention also provide a cloud API abnormal traffic detection system based on multi-feature fusion. The system includes: a traffic data acquisition module, a call graph construction module, an API endpoint feature matrix generation module, a traffic statistical feature generation module, a training data integration module, a model construction module, a model training and testing module, and a detection result output module; wherein,

[0037] The traffic data acquisition module is used to collect traffic data from all API endpoints within a predetermined time period based on user data collection; it is also used to collect traffic data to be detected.

[0038] The call graph construction module is used to take each user's traffic data as a sample, build a call graph, and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another.

[0039] The API endpoint feature matrix generation module is used to calculate API endpoint features based on the call graph and generate an API endpoint feature matrix; the API endpoint features reflect the number of users for each API endpoint, the traffic of each user, and the resulting endpoint importance.

[0040] The traffic statistics feature generation module is used to extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix;

[0041] The training data integration module is used to clean the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix, and normalize the cleaned data. The normalized data is used as the model training dataset and divided into training data and test data.

[0042] The model building module is used to build a cloud API abnormal traffic detection model based on graph convolutional neural network (GCN). The cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model. The GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix. The feature fusion model fuses the graph-level vector representation and traffic statistics features to obtain fused features.

[0043] The model training and testing module is used to train the cloud API abnormal traffic detection model using training data in the model training dataset to obtain the trained cloud API abnormal traffic detection model; it is also used to test the cloud API abnormal traffic detection model using test data, and to evaluate the cloud API abnormal traffic detection model using accuracy (Acc), recall (Rec), and F1 score.

[0044] The detection result output module is used to clean and normalize the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix generated based on the traffic data to be detected, generate the data to be detected, and input it into the trained cloud API abnormal traffic detection model to detect the current cloud API abnormal traffic and output the detection result.

[0045] The technical solutions provided in the embodiments of the present invention have the following beneficial effects:

[0046] The cloud API abnormal traffic detection method and system based on multi-feature fusion provided in this invention proposes new API endpoint features based on the cloud API call graph: the total number of times an API endpoint appears in different call graphs, the degree of the API endpoint, and the total number of times the API endpoint is called are used as features of the API endpoint in the cloud API call graph. These features can provide information about the importance and influence of the API endpoint in the entire call graph. By comprehensively considering the position, importance, and connectivity of the API endpoint in the entire call graph, it helps to more comprehensively describe the characteristics of the API endpoint, enabling GCN to learn the node representation more fully. This invention detects abnormal cloud API traffic by fusing cloud API call graphs with traffic statistics features. The cloud API call graph is processed by a GCN model with three layers of graph convolutional layers. By using multiple layers of graph convolutional layers to aggregate and propagate more information layer by layer, the abstraction level and expressive power of node representation are improved, the features of graph data are learned better, and the performance and generalization ability of the model are improved. The cloud API call graph is converted into an effective feature representation and combined with statistical features, thus incorporating traffic statistics features of the call graph. This gives the random forest model better classification performance, improves the accuracy of the classification system, reduces the false positive rate, and thus improves the credibility and reliability of the system, and improves the detection effect.

[0047] Of course, implementing any product or method of the present invention does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a schematic diagram of the cloud API abnormal traffic detection method based on multi-feature fusion as described in the embodiments of the present invention;

[0050] Figure 2 This is a flowchart of the cloud API abnormal traffic detection method based on multi-feature fusion as described in an embodiment of the present invention;

[0051] Figure 3 This is a schematic diagram of the training process of the cloud API abnormal traffic detection model described in this embodiment of the invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. It should be noted that, without conflict, the embodiments and features in the embodiments of the present invention can also be combined with each other.

[0053] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In the description of this invention, the terms "first," "second," "third," "fourth," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0054] This invention addresses the problem of malicious attacks on current cloud APIs, particularly the issue of attackers disguising their malicious behavior as normal cloud API calls through various means. To improve the detection of malicious behavior, this invention proposes a method and system for detecting abnormal cloud API traffic based on multi-feature fusion. The method involves establishing a call graph of user calls to cloud APIs, using feature engineering to obtain API endpoint features, and employing a graph neural network model to mine the semantics of the call graph. This learns the semantic features of the cloud API call graph, uncovering deeper levels of call behavior, and modeling user call behavior. The method learns both normal and abnormal call behaviors, combines the learned cloud API endpoint features with traffic statistics features, and finally inputs these features into a random forest algorithm to classify normal and abnormal traffic, thereby improving the detection effectiveness of abnormal cloud API traffic.

[0055] like Figure 1 and Figure 2 As shown in the embodiment of the present invention, the cloud API abnormal traffic detection method based on multi-feature fusion includes the following steps:

[0056] Step S1: Collect traffic data for all API endpoints within a predetermined time period based on user data collection.

[0057] In this step, the predetermined time period can be selected according to the specific situation. For example, it can be one hour, one day, or 5 seconds, 10 seconds, etc.

[0058] In a cloud computing environment, a microservices architecture, used to provide services to enterprises, breaks down a large service into multiple small, autonomous services. Each service focuses on a specific business function and interacts on the cloud platform through lightweight communication mechanisms. Supported by the elasticity and scalability of cloud computing, microservices can be deployed and managed more flexibly, enabling enterprises to respond more quickly to market demands and provide more competitive products and services. Each service is essentially an API endpoint.

[0059] In this step, a distributed tracing system is used in the environment to trace the user's request call chain to the cloud API, obtaining the call path from one API endpoint to another. Specifically, after selecting the initial sample, the distributed tracing system collects the traffic in the subsequent call chain generated by a single call, ultimately obtaining the traffic of the entire call process. All traffic generated by the current user's calls to the cloud API within a predetermined time period is collected as the raw sample data.

[0060] Step S2: Take the traffic data of each user as a sample, establish a call graph and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another API endpoint.

[0061] In this step, after obtaining the traffic data, a call graph is built for each sample. For each sample, a distributed system tracing tool is used to track all call traffic generated by the user's use of the service, and an abstract cloud API call graph containing nodes and edges is generated. The nodes and edges in the call graph are processed to obtain the adjacency matrix A of the graph, which is used as input for the subsequent Graph Convolutional Network (GCN) model.

[0062] Specifically, the establishment of the call graph abstracts API endpoints as nodes and traffic paths between API endpoints as edges, clearly presenting all API endpoints and traffic paths traversed by a user request. By analyzing and detecting these traffic paths, potential malicious behaviors can be better discovered and identified, improving the accuracy and timeliness of malicious traffic detection, thereby effectively protecting the security and stability of the system. Accordingly, the call graph includes nodes and edges. The nodes of the call graph represent API endpoints, which are different types of services provided by the cloud API to the user, and the edges represent service call paths. For example, a map service provided by an enterprise is deployed using a microservice architecture, with multiple small services communicating over a network. Taking user A's request as an example, user A wants to reach a certain destination and therefore calls the route planning API endpoint. Subsequently, the route planning API endpoint requests the authentication API endpoint to verify the caller's identity information. The authentication API endpoint calls the user data API endpoint to obtain user data and performs verification. After verification, the route planning API endpoint requests the geocoding API endpoint to obtain the user's location and destination's user code. Finally, it calls the navigation service API endpoint to provide navigation information to the user and archives this service request through the log service API endpoint. Existing technologies only focus on north-south traffic from direct user calls to API endpoints, ignoring east-west traffic between API endpoints within the service, as well as user actions involving multiple calls to different API endpoints. This can be exploited by attackers who can sniff out vulnerabilities by making calls between multiple different API endpoints. Such covert attacks can evade traditional north-south traffic detection but leave call traces. Therefore, this embodiment identifies and tracks a user's call behavior over a period of time and whether the subsequent API endpoint call chain it causes is normal, using an API call graph to describe and construct a graph of all traffic generated by the user's calls over a period of time.

[0063] Step S3: Calculate API endpoint features based on the call graph and generate an API endpoint feature matrix; the API endpoint features reflect the number of users for each API endpoint, the traffic of each user, and the resulting endpoint importance.

[0064] In this step, a cloud computing service provides multiple API endpoints that can be invoked by users. Different users may use different API endpoints when using the service; in addition, some API endpoints may be invoked simultaneously by different users, i.e., in different usage scenarios, resulting in different call traffic at the same API endpoint, thus generating different cloud API call graphs. Therefore, each API endpoint has different importance and characteristics due to the different call traffic used by different users and whether two or more users use it simultaneously. This embodiment describes these differences through API endpoint characteristics.

[0065] Specifically, after obtaining the cloud API call graph, API endpoint features are calculated. These features include: the degree of the API endpoint, the total number of times the API endpoint appears in all call graphs, and the total number of times the API endpoint is called. These features reflect the characteristics of the API endpoints corresponding to nodes in the call graph in practical applications. The API endpoint features calculated based on the call graph are used as initial features to generate an initial feature matrix X0, which serves as the initial input data for the subsequent GCN model.

[0066] Step S4: Extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix.

[0067] In this step, sample information is first extracted based on the call graph. This sample information includes: client IP addresses, call duration, time intervals between adjacent data packets, and the number of data packets. Based on this sample information, the traffic statistics characteristics of the cloud API are calculated. These traffic statistics characteristics include: the average call duration for each API endpoint, the ratio of the number of API endpoints called by the user to the total number of API endpoint calls, and the maximum value among all API endpoint calls.

[0068] Step S5 involves cleaning the adjacency matrix of the call graph, the API endpoint feature matrix, and the traffic statistics feature matrix, and then normalizing the cleaned data. The normalized data is used as the model training dataset and divided into training data and test data.

[0069] In this step, for the call graph, network issues may result in only capturing call data to a single API endpoint. Such samples cannot be used as a call graph and are considered outliers. For traffic data, incomplete network session captures or other network issues may lead to some traffic containing non-numeric, infinitely large numbers, or other outliers after feature extraction. This will affect subsequent data processing. Since this portion of traffic accounts for less than 1%, traffic containing outliers will be discarded as "dirty data."

[0070] The cleaned dataset used for model training includes the adjacency matrix of the call graph after invalid data has been removed, the API endpoint feature matrix, and the statistical feature matrix.

[0071] Step S6: Construct a cloud API abnormal traffic detection model based on graph convolutional neural network (GCN). The cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model. The GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix. The feature fusion model fuses the graph-level vector representation and traffic statistics features to obtain fused features.

[0072] In this step, a model is built based on Graph Convergence Neural Networks (GCNs). GCNs are a class of deep learning models specifically designed for processing graph-structured data. They update node representations through the exchange and aggregation of local information between nodes, and combine this with global information for comprehensive learning. The structure and functionality of a GCN model consist of two parts: message passing and node updating. In the message passing phase, each node collects information from its neighbors and aggregates and passes this information. In the node updating phase, each node updates its own representation based on the collected information. This iterative process continuously improves the node representations, enabling them to better reflect the characteristics of the graph structure. Finally, graph pooling aggregates the feature representations of all nodes to obtain a graph-level vector representation.

[0073] The cloud API abnormal traffic detection model consists of two parts: a GCN model and a feature fusion model.

[0074] In the GCN model section, a three-layer graph convolutional GCN model is used to process the cloud API call graph. Specifically, the GCN model includes: a data input interface, three graph convolutional layers, a pooling layer, and a hidden layer. The hidden layer uses dropout regularization to prevent overfitting, employs an Adam optimizer with a learning rate of 0.01 in the gradient descent process, uses the cross-entropy of the input data X and the reconstructed data y as the loss function, and uses the random forest rule for classification. The GCN-based abnormal traffic detection model effectively propagates and aggregates information on the call graph through convolution operations based on the adjacency matrix and API endpoint feature matrix, obtaining a graph embedding with graph structure and node relationship information, i.e., a graph-level vector representation. The hyperparameters of the GCN model include the number of neurons in the three graph convolutional layers and the dropout parameter value.

[0075] In the feature fusion model, ensemble learning is used to fuse graph-level vector representations and statistical features from traffic to obtain fused features, which are then used for abnormal traffic detection. During abnormal traffic detection, the fused features are classified using a random forest algorithm. Random forest is an ensemble learning algorithm that improves model performance and stability by constructing multiple decision trees and integrating the fused features. In this embodiment, the fusion of graph-level vector representations and statistical features is used as input, and the random forest algorithm is used for classification. This fusion of graph-level vector representations and traffic statistical features fully exploits the multi-dimensional semantics of the cloud API call graph. The graph-level vector representations contain the relationships between nodes and the graph's structure, while traffic statistical features provide more intuitive and comprehensive traffic statistics. Through feature fusion, the behavioral characteristics of users calling cloud APIs can be more accurately described and analyzed, improving the ability to detect malicious traffic.

[0076] Table 1. Hyperparameter settings for the GCN model

[0077] Model Composition Set hyperparameters GraphConv1 hidden_num = 128 GraphConv2 hidden_num = 64 GraphConv3 hidden_num = 32 Dropout 0.2

[0078] Step S7: Use the training data in the model training dataset to train the cloud API abnormal traffic detection model to obtain the trained cloud API abnormal traffic detection model.

[0079] In this step, the GCN model is trained on the training set, such as... Figure 3 As shown, the training process includes:

[0080] Initialize all model parameters and obtain the node embedding Z through the GCN model, as shown in formula (1):

[0081] In equation (1), X is the API endpoint feature matrix, and the initial input X is the API endpoint feature matrix calculated based on the call graph; σ is the activation function; and A is the adjacency matrix of the call graph. Let A+I be the identity matrix, used to account for the case of self-connection; for The degree matrix is ​​denoted by , with the diagonal elements representing the degree of each node; W is the weight matrix of the GCN model; preferably, softmax regression is used to classify the call graph, and the parameters of the graph convolutional layers are adjusted through backpropagation; the ReLU function is used as the activation function.

[0082] Expand the node embedding Z into {z} i}, i = 1, 2, ..., n, where n represents the total number of nodes in a call graph, z i The feature vector of the i-th node is represented by Z; graph-level average pooling is performed on the node embedding Z to obtain a graph-level vector representation h that contains graph structure and node relationship information. GAP :

[0083]

[0084] After N rounds of training, the graph convolutional layer learns the relationships between nodes and global features. By aggregating and passing information between the neighboring nodes of a node, the GCN model continuously updates the feature representation of the node while considering the context of the entire call graph, and obtains the final graph-level vector representation, thus completing the model training.

[0085] In the feature fusion model, the graph-level vector representation is fused with the traffic statistics features corresponding to the graph. The fused vector is then used to train a random forest model to classify the fused features.

[0086] Step S8: Test the cloud API abnormal traffic detection model using test data, and evaluate the cloud API abnormal traffic detection model using accuracy (Acc), recall (Rec), and F1 score.

[0087] In this step, to verify GCN's advantages in detecting abnormal cloud API traffic, a comparative experiment was conducted with other models on the open-source API Security: Access behavior anomaly dataset. This dataset contains both normal and abnormal cloud API call traffic data, with 10,051 positive samples and 26,050 negative samples. The training and test sets were split using the `train_test_split` function of sklearn in a 7:3 ratio.

[0088] Experimental performance metrics include accuracy (Acc), recall (Rec), and F1 score, and the calculation process is shown in formulas (3)-(5):

[0089]

[0090]

[0091] In equations (3)-(5), TP is the number of samples that are detected as malicious traffic, TN is the number of samples that are detected as normal traffic, FP is the number of samples that are detected as malicious traffic, and FN is the number of samples that are detected as normal traffic; Pre represents the accuracy rate, and Recall represents the recall rate.

[0092] The experimental results are shown in Table 2. Compared with using only statistical features, the combined features learned by the GCN model, which combine representational features and statistical features, achieved better classification results. This is because the GCN model effectively captures the relationships and information transmission between nodes, learns the structural features of the cloud API call graph, and improves the classifier's application performance in real-world scenarios.

[0093] The classification performance of the GCN+softmax classifier is worse than that of the GCN+RF classifier because of differences in the feature space of the data and the applicability of the model. Random forests generally perform well when dealing with data with complex nonlinear features because they can more flexibly partition the feature space and have strong generalization ability.

[0094] Table 2 Comparison of Experimental Performance Indicators

[0095] feature Model Acc(%) Rec(%) F1(％) Image Embedding GCN+softmax 81.03 81.03 78.43 Image Embedding GCN+RF 84.22 84.22 84.19 Traffic Statistical Characteristics Logistic regression 84.48 84.15 84.48 Traffic Statistical Characteristics RF 92.91 92.91 92.85 Graph embedding + traffic statistics features GCN+RF 95.21 95.21 95.18

[0096] Step S9: Based on the cloud API traffic collected by the user and preprocessed, the trained cloud API abnormal traffic detection model is used to detect the current cloud API abnormal traffic.

[0097] In this step, the preprocessing of user-collected cloud API traffic to be detected includes: using a user's cloud API traffic as a sample, constructing a call graph and generating a call graph adjacency matrix; calculating API endpoint features and generating an API endpoint feature matrix; extracting traffic statistical features based on the call graph and generating a traffic statistical feature matrix; and after cleaning the call graph adjacency matrix, API endpoint feature matrix, and traffic statistical matrix, inputting them into the trained cloud API abnormal traffic detection model to obtain the detection result. If y_pred = 1, it is normal traffic; if y_pred = 0, it is malicious traffic.

[0098] Based on the same idea, this invention also provides a cloud API abnormal traffic detection system based on multi-feature fusion. The system includes: a traffic data acquisition module, a call graph construction module, an API endpoint feature matrix generation module, a traffic statistical feature generation module, a training data integration module, a model construction module, a model training and testing module, and a detection result output module; wherein,

[0099] The traffic data acquisition module is used to collect traffic data from all API endpoints within a predetermined time period based on user data collection; it is also used to collect traffic data to be detected.

[0100] The call graph construction module is used to take each user's traffic data as a sample, build a call graph, and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another.

[0101] The API endpoint feature matrix generation module is used to calculate API endpoint features based on the call graph and generate an API endpoint feature matrix; the API endpoint features reflect the number of users for each API endpoint, the traffic of each user, and the resulting endpoint importance.

[0102] The traffic statistics feature generation module is used to extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix;

[0103] The training data integration module is used to clean the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix, and normalize the cleaned data. The normalized data is used as the model training dataset and divided into training data and test data.

[0104] The model building module is used to build a cloud API abnormal traffic detection model based on graph convolutional neural network (GCN). The cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model. The GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix. The feature fusion model fuses the graph-level vector representation and traffic statistics features to obtain fused features.

[0105] The model training and testing module is used to train the cloud API abnormal traffic detection model using training data in the model training dataset to obtain the trained cloud API abnormal traffic detection model; it is also used to test the cloud API abnormal traffic detection model using test data, and to evaluate the cloud API abnormal traffic detection model using accuracy (Acc), recall (Rec), and F1 score.

[0106] The detection result output module is used to clean and normalize the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix generated based on the traffic data to be detected, generate the data to be detected, and input it into the trained cloud API abnormal traffic detection model to detect the current cloud API abnormal traffic and output the detection result.

[0107] In this embodiment, each module is implemented using a processor, with additional memory added as needed for storage. The processor can be, but is not limited to, a microprocessor (MPU), a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components, etc. The memory can include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0108] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0109] It should also be noted that the cloud API abnormal traffic detection system based on multi-feature fusion described in this embodiment corresponds to the cloud API abnormal traffic detection method based on multi-feature fusion. The description and limitations of the method also apply to the system, and will not be repeated here.

[0110] As can be seen from the above technical solutions, the cloud API abnormal traffic detection method and system based on multi-feature fusion provided by the embodiments of the present invention proposes new API endpoint features based on API call graphs: the total number of times the API endpoint appears in different call graphs, the degree of the API endpoint, and the total number of times the API endpoint is called are used as features of the API endpoint in the cloud API call graph. These features can provide information about the importance and influence of the API endpoint in the entire call graph. By comprehensively considering the position, importance, and connection of the API endpoint in the entire call graph, it helps to describe the characteristics of the API endpoint more comprehensively, enabling GCN to learn the representation of nodes more fully. This invention detects abnormal traffic from cloud APIs by fusing cloud API call graphs with traffic statistics. It processes the cloud API call graph using a three-layer graph convolutional GCN model, leveraging multi-layer convolutional layers to aggregate and propagate more information layer by layer. This improves the abstraction level and expressive power of node representations, enabling better learning of graph data features and enhancing model performance and generalization ability. By converting the cloud API call graph into an effective feature representation and combining it with statistical features, the invention incorporates traffic statistics from the call graph, resulting in superior classification performance for the random forest model. This improves the accuracy of the classification system, reduces the false positive rate, and ultimately enhances the system's credibility and reliability, thus improving detection effectiveness.

[0111] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed, and is not intended to limit the scope of the claimed invention, but merely to illustrate preferred embodiments of the invention. Those skilled in the art should understand that the scope of the invention is not limited to the specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal traffic in cloud APIs based on multi-feature fusion, characterized in that, The method includes the following steps: Step S1: Based on the user's collection of traffic data for all API endpoints within a predetermined time period; Step S2: Take each user's traffic data as a sample, build a call graph and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another. Step S3: Calculate API endpoint features based on the call graph and generate an API endpoint feature matrix; The API endpoint characteristics reflect the number of users for each API endpoint, the traffic of each user, the different call traffic used by different users, and the importance of the endpoint formed by whether two or more users use it at the same time. Step S4: Extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix; Step S5: Clean the adjacency matrix of the call graph, the feature matrix of API endpoints, and the feature matrix of traffic statistics, and normalize the cleaned data. Use the normalized data as the model training dataset and divide it into training data and test data. Step S6: Construct a cloud API abnormal traffic detection model based on graph convolutional neural network (GCN). The cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model. The GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix. The feature fusion model fuses the graph-level vector representation and traffic statistics features to obtain fused features. Step S7: Use the training data in the model training dataset to train the cloud API abnormal traffic detection model to obtain the trained cloud API abnormal traffic detection model. Step S8: Test the cloud API abnormal traffic detection model using test data, and evaluate the cloud API abnormal traffic detection model using accuracy (Acc), recall (Rec), and F1 score. Step S9: Based on the cloud API traffic collected by the user and preprocessed, the trained cloud API abnormal traffic detection model is used to detect the current cloud API abnormal traffic.

2. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 1, characterized in that, The API endpoint characteristics mentioned in step S3 include: the degree of the API endpoint, the total number of times the API endpoint appears in all call graphs, and the total number of times the API endpoint is called.

3. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 2, characterized in that, The API endpoint features calculated based on the call graph are used as initial features, and an initial feature matrix X0 is generated as the initial input data for the subsequent GCN model.

4. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 1, characterized in that, The traffic statistics features mentioned in step S4 include: the average call duration of each API endpoint, the ratio of the number of API endpoints called by the user to the total number of API endpoint calls, and the maximum value among all API endpoint calls.

5. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 1, characterized in that, The GCN model in step S6 includes: a data input interface, three graph convolutional layers, a pooling layer, and a hidden layer; the hidden layer uses dropout regularization to prevent overfitting, uses an Adam optimizer with a learning rate of 0.01 to participate in the gradient descent process, the loss function is the cross-entropy between the input data X and the reconstructed data y, and uses the random forest rule for classification; The GCN model effectively propagates and aggregates information on the call graph through convolution operations based on the adjacency matrix of the call graph and the feature matrix of the API endpoint, resulting in a graph embedding with graph structure and node relationship information.

6. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 5, characterized in that, The hyperparameters of the GCN model include the number of neurons in the three graph convolutional layers and the dropout parameter value.

7. The cloud API abnormal traffic detection method based on multi-feature fusion according to any one of claims 1-6, characterized in that, The feature fusion model classifies fused features using a random forest algorithm. It takes graph-level vector representations and traffic statistics feature matrices as input, classifies them using the random forest algorithm, and then fuses the graph-level vector representations and traffic statistics features to mine multi-dimensional semantics on the cloud API call graph. The graph-level vector representations contain the relationships between nodes and the graph's structure, while the traffic statistics features provide intuitive and comprehensive traffic statistics. Through feature fusion, the model describes and analyzes the behavioral characteristics of users calling cloud APIs, improving the ability to detect malicious traffic.

8. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 7, characterized in that, The training process in step S7 includes: Initialize all model parameters and obtain the node embedding Z through the GCN model, as shown in formula (1): In equation (1), X is the API endpoint feature matrix, and the initial input X is the API endpoint feature matrix calculated based on the call graph; σ is the activation function; and A is the adjacency matrix of the call graph. Let A+I be the identity matrix, used to account for the case of self-connection; for The degree matrix is ​​denoted by , with the diagonal elements representing the degree of each node; W is the weight matrix of the GCN model. Expand the node embedding Z into {z} i }, i = 1, 2, ..., n, where n represents the total number of nodes in a call graph, z i The feature vector of the i-th node is represented by Z; graph-level average pooling is performed on the node embedding Z to obtain a graph-level vector representation h that contains graph structure and node relationship information. GAP : After N rounds of training, the graph convolutional layer learns the relationships between nodes and global features. By aggregating and passing information between the neighboring nodes of a node, the GCN model continuously updates the feature representation of the node while considering the context of the entire call graph, and obtains the final graph-level vector representation, thus completing the model training.

9. The cloud API abnormal traffic detection method based on multi-feature fusion according to claim 1, characterized in that, In step S8, the accuracy (Acc), recall (Rec), and F1 score are calculated as shown in formulas (3)-(5): In equations (3)-(5), TP is the number of samples that are detected as malicious traffic, TN is the number of samples that are detected as normal traffic, FP is the number of samples that are detected as malicious traffic, and FN is the number of samples that are detected as normal traffic; Pre represents the accuracy rate, and Recall represents the recall rate.

10. A cloud API abnormal traffic detection system based on multi-feature fusion, characterized in that, The system includes: a traffic data acquisition module, a call graph construction module, an API endpoint feature matrix generation module, a traffic statistics feature generation module, a training data integration module, a model construction module, a model training and testing module, and a detection result output module; wherein, The traffic data acquisition module is used to collect traffic data from all API endpoints within a predetermined time period based on user data collection; it is also used to collect traffic data to be detected. The call graph construction module is used to take each user's traffic data as a sample, build a call graph, and generate a call graph adjacency matrix; the nodes of the call graph correspond to API endpoints, and the edges of the call graph correspond to the call path from one API endpoint to another. The API endpoint feature matrix generation module is used to calculate API endpoint features based on the call graph and generate an API endpoint feature matrix. The API endpoint features reflect the number of users for each API endpoint, the traffic of each user, the different call traffic used by different users, and the importance of the endpoint formed by whether two or more users use it at the same time. The traffic statistics feature generation module is used to extract traffic statistics features based on the call graph and generate a traffic statistics feature matrix; The training data integration module is used to clean the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix, and normalize the cleaned data. The normalized data is used as the model training dataset and divided into training data and test data. The model building module is used to build a cloud API abnormal traffic detection model based on graph convolutional neural network (GCN). The cloud API abnormal traffic detection model includes two parts: a GCN model and a feature fusion model. The GCN model obtains a graph-level vector representation based on the adjacency matrix of the call graph and the API endpoint feature matrix. The feature fusion model fuses the graph-level vector representation and traffic statistics features to obtain fused features. The model training and testing module is used to train the cloud API abnormal traffic detection model using training data in the model training dataset to obtain the trained cloud API abnormal traffic detection model; it is also used to test the cloud API abnormal traffic detection model using test data, and to evaluate the cloud API abnormal traffic detection model using accuracy (Acc), recall (Rec), and F1 score. The detection result output module is used to clean and normalize the call graph adjacency matrix, API endpoint feature matrix and traffic statistics feature matrix generated based on the traffic data to be detected, generate the data to be detected, and input it into the trained cloud API abnormal traffic detection model to detect the current cloud API abnormal traffic and output the detection result.

Images