Application Programming Interface (API) security assessment method and system
By analyzing the API traffic data and policy trigger frequency, calculating the comprehensive score of the API subject and dividing the security level, the problem of inaccurate API security evaluation results in the existing technology is solved, and a more accurate and comprehensive API security evaluation is achieved.
Patent Information
- Application Number
- CN202411824417.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-12
- Publication Date
- 2025-04-08
AI Technical Summary
In the prior art, when evaluating API security, single-point detection methods are usually used, which cannot guarantee the accuracy and comprehensiveness of API evaluation results, especially in complex industry environments.
By obtaining the API's traffic data, sensitive/risk policy collection and initial weight, analyzing the number of visits and policy triggering frequency, calculating the target weight of the policy and the comprehensive score of the API subject, and dividing the security level. And optimize the target weight set through a gradient optimization algorithm to improve the accuracy of the score.
Ensure the accuracy and comprehensiveness of API evaluation results, identify long-term inactive or no longer used APIs, reduce unnecessary exposure to risk, and reduce the impact of manual weight setting on scoring results.
Smart Images
Figure CN119783110A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of security assessment, and in particular relates to an application programming interface (API) security assessment method and system. Background Art
[0002] When evaluating the security of an API, existing technologies usually perform single-point detection based on a single detection rule and conduct security assessments for specific types of security issues. However, in industries with complex business logic such as finance and taxation, there are extremely complex environmental requirements for access to API interfaces, such as multi-level access control and permission management, high concurrency and load pressure, and multi-platform cross-domain data interaction, which lead to extremely high requirements for the data security of API requests. Using a one-sided single-point detection method cannot guarantee that the final API evaluation results are accurate enough for the scenario. Summary of the invention
[0003] The main problem solved by the present invention is how to make the evaluation result of API accurate and comprehensive, and provides an application programming interface (API) security evaluation method and system.
[0004] In order to solve the above technical problems, the technical solutions adopted are: An application programming interface (API) security assessment method comprises the following steps: Step 1: Obtain the traffic data received and responded by the application, the set of sensitive / risk policies contained in the API body, and the initial weight of each policy; Step 2: Analyze the traffic data to extract the number of visits to the API subject, and count the frequency of the API subject being triggered under each policy, where the frequency is 0 if it is not triggered; Step 3: Calculate the target weight of each strategy based on the initial weight of each strategy in the sensitive / risk strategy set; Step 4: Calculate the comprehensive score of the API subject according to the target weight of each policy, and classify the API subject into a security level based on the result of the comprehensive score.
[0005] Furthermore, the method for calculating the target weight of each strategy in the sensitive / risk strategy set is: (1) in For the The initial weight value of each sensitive / risky strategy. The number of policies in the sensitive / risk policy set contained in the current API subject. For the current The target weight of each sensitive / risky strategy.
[0006] Furthermore, the method for calculating the comprehensive score of the API subject according to the target weights of each policy is: Step 4.1: Calculate the initial score of the API subject’s sensitivity / risk strategy, ; (2) in For the The frequency with which sensitive / risky strategies are triggered. The total number of requests for this API entity. is the preset parameter, is the initial score, n is the total number of sensitive / risky strategies; Step 4.2: Calculate the final score for the API principal’s sensitive / risky policy: (3) (4) in is a magnitude parameter, which is used to adjust the change trend of the initial score and measure the impact of the frequency magnitude of the strategy being triggered on the change trend of the initial score. is a set of positive integers; Step 4.3: Get the inactivity days of the API subject and calculate the inactivity score of the API subject. (5) Where t is the number of days of inactivation; Step 4.4: Calculate the comprehensive score of the API subject: (6) in Score weight values for pre-set risk strategy behaviors. The weight value of the pre-set sensitive strategy score, , , is the score of risk strategy behavior, The score of the sensitive strategy, The comprehensive score of the API entity.
[0007] Furthermore, the method for dividing the security level of the API subject based on the result of the comprehensive score is: pre-setting different levels and the comprehensive score intervals corresponding to each level, judging the interval in which the API subject is located according to the comprehensive score value of the API subject, and giving the level of the API subject.
[0008] Furthermore, after obtaining the target weights of each strategy in step 3 to form a target weight set for all strategies, a gradient optimization algorithm is used to optimize the target weight set to obtain an optimal weight set, and the optimal weights corresponding to each strategy in the optimal weight set are used to calculate the comprehensive score of the API subject.
[0009] Furthermore, the training set used in the training of the gradient optimization algorithm is to generate labels of the remaining unlabeled samples through a semi-supervised learning method.
[0010] The present invention also provides an application programming interface (API) security assessment system, which is implemented using the steps of the aforementioned application programming interface (API) security assessment method.
[0011] By adopting the above technical solution, the present invention has the following beneficial effects: The present invention provides an application programming interface (API) security assessment method and system, which ensures the comprehensive security of API subject access by performing security scoring from multiple angles, including static sensitive data, access risk, and inactivation status. Scoring from the perspective of API inactivation status helps to identify APIs that have been inactive for a long time or are no longer used. These APIs may have security vulnerabilities due to lack of timely updates, and ensure that these APIs are properly managed, updated, or disabled, which can reduce unnecessary risk exposure. The API subject security score based on static data and dynamic risk behavior data ensures that the final API assessment result has accuracy that meets the scenario. By optimizing the target weight set to obtain the optimal weight set, and using the optimal weight set to calculate the comprehensive score, the influence of the manually set initial weight on the scoring result is reduced, and the influence of the policy caused by the manual setting is avoided, which causes a large deviation in the final comprehensive score. BRIEF DESCRIPTION OF THE DRAWINGS
[0012] Figure 1 It is a flow chart of the system of the present invention. DETAILED DESCRIPTION
[0013] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0014] Figure 1 A specific embodiment of a method for evaluating the security of an application programming interface (API) of the present invention is shown, comprising the following steps: Step 1: Obtain the traffic data received and responded by the application, the set of sensitive / risky policies contained in the API body, and the initial weight of each policy.
[0015] Step 2: Analyze the traffic data to extract the number of visits to the API subject, and count the frequency of the API subject being triggered under each policy, which is 0 when not triggered.
[0016] Step 3: Calculate the target weight of each strategy based on the initial weight of each strategy in the sensitive / risky strategy set.
[0017] In this embodiment, the method for calculating the target weight of each strategy in the sensitive / risk strategy set is: (1) in For the The initial weight value of each sensitive / risky strategy. The number of policies in the sensitive / risk policy set contained in the current API subject. For the current The target weight of each sensitive / risky strategy.
[0018] Step 4: Calculate the comprehensive score of the API subject according to the target weight of each policy, and classify the API subject into a security level based on the result of the comprehensive score.
[0019] In this embodiment, the method for calculating the comprehensive score of the API subject according to the target weight of each policy is: Step 4.1: Calculate the initial score of the API subject’s sensitivity / risk strategy, ; (2) in For the The frequency with which sensitive / risky strategies are triggered. The total number of requests for this API entity. is the preset parameter, is the initial score, n is the total number of sensitive / risky strategies; Step 4.2: Calculate the final score for the API principal’s sensitive / risky policy: (3) (4) in is a magnitude parameter, which is used to adjust the change trend of the initial score and measure the impact of the frequency magnitude of the strategy being triggered on the change trend of the initial score. is a set of positive integers, is the score of risk strategy behavior, The score value of the sensitive strategy; Step 4.3: Get the inactivity days of the API subject and calculate the inactivity score of the API subject , (5) Where t is the number of days of inactivation; Step 4.4: Calculate the comprehensive score of the API subject: (6) in Score weight values for pre-set risk strategy behaviors. The weight value of the pre-set sensitive strategy score, , , The comprehensive score of the API entity.
[0020] However, since the initial weight values of each sensitive / risky strategy are manually set, it is easy to cause the influence of the strategy to be biased, resulting in a large deviation in the final comprehensive score. In this embodiment, after the target weights of each strategy are obtained in step 3 to form a target weight set for all strategies, a gradient optimization algorithm is used to optimize the target weight set to obtain an optimal weight set, and the optimal weights corresponding to each strategy in the optimal weight set are used to calculate the comprehensive score of the API subject.
[0021] In this embodiment, the training set used in the training of the gradient optimization algorithm is to generate labels for the remaining unlabeled samples by a semi-supervised learning method. The data of the training set comes from historical data, and the specific method for constructing the training set is: S1. Under the premise of ensuring the same time range, select n time windows, obtain the number of visits to the API subject and the frequency set of policy triggering in the n time windows, and horizontally splice the feature values on the n time windows to construct a high-dimensional feature vector X of the API subject.
[0022] S2. Calculate the score values on these n time windows respectively and take the average value as the sample label of the API subject;
[0023] Where n is the number of time windows, is the score value of the risk / sensitive strategy in the i-th time window, The label value of the API body.
[0024] In order to obtain the sample labels of the initial training data set R, the sample labels have a high acquisition cost, so a semi-supervised learning method is used to learn and generate all the sample labels in the R set. Self-training requires a small number of labels as basic labels, so it is necessary to specify the generation scheme of the basic labels: Get the regression values under different time windows (use the score value calculated by the initial weight as the regression value, and select different calculation formulas according to the Nt threshold during calculation), take the average regression value as the basic label, and take Sample generation Basic tags ( ).
[0025] S3. Select API bodies ( ), repeat the above S1, S2, and get The label of the API body.
[0026] S4. The labels are combined with G high-dimensional features X as a training set for self-training. Self-training generates labels for the remaining unlabeled samples, and the high-confidence prediction results are added to the training set as pseudo labels for iterative training until the self-training model converges to obtain a complete training data set.
[0027] The stochastic gradient descent algorithm (SGD) is used to optimize the target weight set (the target weights of all strategies form the target weight set) for the complete training data set to obtain the optimal weight set.
[0028] The loss function L(MSE) defined in the stochastic gradient descent algorithm is
[0029] Calculate predicted values
[0030] Calculate the gradient for the set of weight values, using only one sample per iteration
[0031] Iteratively update the target weight set
[0032] Where α is the learning rate, and the target weight set is iteratively updated until the loss function L converges (the convergence threshold parameter is set to ), and obtain the optimal weight set of all strategies, denoted as , based on the optimal weight set Substitute into formula (2) in step 4.1 to calculate the initial score of all sensitive / risk strategies of the API entity, ; Calculate the final score of the API subject’s sensitivity / risk strategy based on the initial score and , combined with the inactivation score of the API subject Formula (6) is used to calculate the comprehensive score of the API subject, and then the security level of the API subject is divided based on the comprehensive score.
[0033] In this embodiment, the method for dividing the security level of the API subject based on the result of the comprehensive score is: pre-setting different levels and the comprehensive score intervals corresponding to each level, judging the interval in which the API subject is located according to the comprehensive score value of the API subject, and giving the level of the API subject.
[0034] In this embodiment, the security score is determined as the security level of the API subject, which can be mapped to 6 levels:
[0035] 1 is the lowest security level and 6 is the highest security level. The corresponding security level is given according to the interval of the calculated total security score of the API subject. The security level serves as an important criterion for whether to protect the API subject in the future. At the same time, API subjects that are at a high security level for a long period of time can be used as a criterion for whether to be included in the API whitelist.
[0036] The comprehensive security of API subject access is ensured by performing security scoring from multiple perspectives, including static sensitive data, access risk, and inactive status. Scoring from the perspective of API inactive status helps identify APIs that have been inactive for a long time or are no longer used. These APIs may have security vulnerabilities due to lack of timely updates. Ensuring that these APIs are properly managed, updated, or disabled can reduce unnecessary risk exposure. API subject security scoring based on static data and dynamic risk behavior data ensures that the final API evaluation results are accurate and consistent with the scenario.
[0037] Since the network model is based on historical data, it learns the weight patterns of different strategies on a large amount of valid data in the past, and obtains an optimal set on the training data. The reason why the manually set weights are not completely removed is that it is necessary to give the correlation between the impact of security strategies on security scores, but scoring based on this given correlation is often not accurate enough. At the same time, different quantitative values set by different people subjectively lead to different scoring results (even if different people ensure the consistency of the correlation when setting the initial weights, direct scoring will also have a large deviation). At this time, the optimization algorithm introduced solves this problem very well, because only the correlation is set, and the relative relationship is guaranteed to be consistent, the internal distribution pattern of the data in the same scenario is consistent (for homogeneous data, the consistency of the data will be guaranteed). The distribution pattern based on data learning and mining will eventually be reflected in the learning of weights. At this time, the weight set parameters obtained will be the optimal fitting parameters of the security scoring method.
[0038] The present invention provides a policy-based dynamic weight update method to ensure that the relative size of the policy remains unchanged during the dynamic update process, that is, the relative impact on the score does not change during the dynamic update process, making the security score based on the API subject more robust.
[0039] The present invention also provides an application programming interface (API) security assessment system, which is implemented using the steps of the aforementioned application programming interface (API) security assessment method.
[0040] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for evaluating the security of an application programming interface (API), characterized in that: The following steps are involved: Step 1: Obtain the traffic data received and responded by the application, the set of sensitive / risk policies contained in the API body, and the initial weight of each policy; Step 2: Analyze the traffic data to extract the number of visits to the API subject, and count the frequency of the API subject being triggered under each policy, where the frequency is 0 if it is not triggered; Step 3: Calculate the weight transformation value of each strategy based on the initial weight of each strategy in the sensitive / risk strategy set, and record it as the target weight; Step 4: Calculate the comprehensive score of the API subject according to the target weight of each policy, and classify the API subject into a security level based on the result of the comprehensive score.
2. The method for evaluating the security of an application programming interface (API) according to claim 1, characterized in that: The method for calculating the target weight of each strategy based on the initial weight of each strategy in the sensitive / risk strategy set is: (1) in For the The initial weight value of each sensitive / risky strategy. The number of policies in the sensitive / risk policy set contained in the current API subject. For the current The target weight of each sensitive / risky strategy.
3. The method for evaluating the security of an application programming interface (API) according to claim 1, characterized in that: The method to calculate the comprehensive score of the API subject based on the target weights of each policy is: Step 4.1: Calculate the initial score of the API subject’s sensitivity / risk strategy, ； (2) in For the The frequency with which sensitive / risky strategies are triggered. The total number of requests for this API entity. is the preset parameter, is the initial score, n is the total number of sensitive / risky strategies; Step 4.2: Calculate the final score for the API principal’s sensitive / risky policy: (3) (4) in is a magnitude parameter, which is used to adjust the change trend of the initial score and measure the impact of the frequency magnitude of the strategy being triggered on the change trend of the initial score. is a set of positive integers; Step 4.3: Get the inactivity days of the API subject and calculate the inactivity score of the API subject. (5) Where t is the number of days of inactivation; Step 4.4: Calculate the comprehensive score of the API subject: (6) in Score weight values for pre-set risk strategy behaviors. The weight value of the pre-set sensitive strategy score, , , is the score of risk strategy behavior, The score of the sensitive strategy, The comprehensive score of the API entity.
4. The method for evaluating the security of an application programming interface (API) according to claim 3, characterized in that: The method for classifying the security level of the API subject based on the result of the comprehensive score is: pre-setting different levels and the comprehensive score intervals corresponding to each level, judging the interval in which the API subject is located according to the comprehensive score value of the API subject, and giving the level of the API subject.
5. The method for evaluating the security of an application programming interface (API) according to claim 4, characterized in that: After obtaining the target weights of each strategy in step 3 to form the target weight set of all strategies, the target weight set is optimized using a gradient optimization algorithm to obtain the optimal weight set, and the optimal weights corresponding to each strategy in the optimal weight set are used to calculate the comprehensive score of the API subject.
6. The method for evaluating the security of an application programming interface (API) according to claim 5, characterized in that: The training set used in the training by the gradient optimization algorithm is optimized by generating labels of the remaining unlabeled samples through a semi-supervised learning method.
7. An application programming interface API security assessment system, characterized in that: The steps of the method for evaluating the security of an application programming interface (API) are implemented using any one of claims 1 to 6.