An API-based information security risk assessment method and system

Abstract

This invention discloses an API-based information security risk assessment method, which includes: using traffic analysis to acquire API assets within an enterprise; using a sensitive data identification model to identify and locate sensitive data in log files or files; integrating a vulnerability rule set to detect vulnerabilities in APIs through an API vulnerability detection model; setting up an automatic behavioral risk monitoring engine to monitor and issue early warnings in real time for abnormal API calls to obtain data; constructing a network attack monitoring model; using a risk monitoring model trained based on historical monitoring data to draw API risk chain relationships, and combining clue association ranking analysis to infer suspicious data leakage paths; comprehensively recording API data usage behavior; and using a matrix method to calculate risks and generate an API information security risk assessment report. This method can establish a comprehensive API security risk assessment system, effectively identifying and managing API security risks and protecting enterprise data security.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to an API-based information security risk assessment method and system. Background Technology

[0002] As a crucial channel for data transmission, APIs are directly linked to data security, including the protection of sensitive information such as user personal data and transaction data. APIs are typically vulnerable to malicious attacks such as DDoS attacks and SQL injection, which can lead to severe consequences such as system crashes and data tampering. These API security issues can cause business interruptions; therefore, ensuring API security is crucial for maintaining business continuity.

[0003] Due to a general lack of awareness among enterprises regarding the importance and unique nature of API security, API security protection measures vary widely, and systemic security construction is severely lagging behind. Security vendors are still in the exploratory stage of developing comprehensive and effective API protection technologies, requiring guidance and encouragement for enterprises and security vendors to accelerate research and practice of new API security technologies and methods. Many enterprises have a large number of legacy applications that use APIs that are often unauthenticated, allowing attackers to easily access and exploit them. Furthermore, the lack of effective data anonymization strategies for these APIs means that sensitive data may be illegally accessed during transmission. These APIs may contain vulnerabilities and vulnerabilities, leading to unauthorized data acquisition and making them prime targets for external cyberattacks.

[0004] Therefore, there is an urgent need for an API-based information security risk assessment method to monitor and assess enterprise API risks and protect the security of information data. Summary of the Invention

[0005] The purpose of this invention is to provide an API-based information security risk assessment method to solve one or more of the technical problems mentioned above:

[0006] The objective of this invention can be achieved through the following technical solutions:

[0007] In a first aspect, the present invention provides an information security risk assessment method based on APIs, comprising: using traffic analysis to acquire API assets within an enterprise, and classifying and marking the API assets; using a sensitive data identification model to identify and locate sensitive data in log files or files, and encrypting the sensitive data; integrating a vulnerability rule set, detecting vulnerabilities existing on APIs through an API vulnerability detection model, and verifying and analyzing the characteristics of the vulnerabilities; wherein the rule dimensions of the vulnerability rule set include coverage of data exposure, data permissions, security specifications, high-risk interfaces, and password authentication; setting up an automatic behavioral risk monitoring engine to monitor and warn of abnormal API calls for data acquisition in real time, thereby identifying behavioral risks; constructing a network attack monitoring model to monitor network attack risks of all APIs, and drawing attack routes and assessing the impact of events; using a risk monitoring model trained based on historical monitoring data to draw API risk link relationships, and combining clue association ranking analysis to infer suspicious data leakage paths; and performing API... I. Data usage behavior is fully traced to enable rapid location of the leakage source after a leakage incident; and the matrix method is used to calculate risks, combining probability and impact to assess the severity of risks and generate an AP I information security risk assessment report.

[0008] In a second aspect, the present invention provides an API-based information security risk assessment system, comprising: an API asset acquisition and management module: used to acquire API assets within an enterprise using traffic analysis, and to classify and label the API assets; a sensitive data identification and protection module: used to identify and locate sensitive data in log files or files using sensitive data identification technology, and to encrypt the sensitive data; an API vulnerability assessment module: used to integrate a vulnerability rule set, detect vulnerabilities existing on APIs through an API vulnerability detection model, and to verify and analyze the characteristics of the vulnerabilities; wherein, the rule dimensions of the vulnerability rule set include coverage of data exposure, data permissions, security specifications, high-risk interfaces, and password authentication; a behavioral risk monitoring and abnormal event control module: used to set up an automatic behavioral risk monitoring engine, to monitor and warn of abnormal API calls for data acquisition in real time, in order to identify behavioral risks; an API attack monitoring module: used to build a network attack monitoring model to monitor network attack risks of all APIs, and to draw attack routes and assess the impact of events; and a risk monitoring model construction module: used to train a risk monitoring model based on historical monitoring data, and to draw API... The I-risk link relationship module, combined with clue association ranking analysis, infers suspicious data leakage paths; the risk event tracing analysis module is used to comprehensively record AP I data usage behavior to quickly locate the leakage source after a leakage event occurs; the risk assessment report module is used to calculate risks using the matrix method, combine probability and impact to assess the severity of risks, and generate an AP I information security risk assessment report.

[0009] By employing the API-based information security risk assessment method described above, embodiments of this invention provide a comprehensive API security protection assessment system through automated API asset analysis, real-time monitoring of API vulnerabilities, behavioral risks, and network attack risks, combined with risk link characterization and data leakage path prediction. This solution effectively reduces data leakage risks, improves response speed to API attacks, and quickly locates the source of leakage when a data leakage event occurs. Through this integrated technical approach, enterprises can promptly detect and respond to potential data leakage risks, protect their data assets, and ensure business continuity and security. Attached Figure Description

[0010] The invention will now be further described with reference to the accompanying drawings.

[0011] Figure 1 An exemplary flowchart of an API-based information security risk assessment method according to some embodiments of the present invention is shown;

[0012] Figure 2An exemplary structural block diagram of an API-based information security risk assessment system according to an embodiment of the present invention is shown. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] Figure 1 An exemplary flowchart of an API-based information security risk assessment method 100 according to some embodiments of the present invention is shown;

[0015] like Figure 1 As shown, method 100 includes step 101: using traffic analysis to acquire API assets within the enterprise, and classifying and tagging these API assets. All API assets within the enterprise include public, private, partner-oriented APIs, as well as shadow APIs and zombie APIs. The discovered APIs are classified and graded to form a complete API list, and sensitive data exposed in API requests and response content is automatically identified and graded based on exposure levels. Measures are taken to update the details of sensitive data exposure in a timely manner.

[0016] In one embodiment, using traffic analytics to acquire API assets within an enterprise may include the following steps:

[0017] Collect API traffic data, which includes HTTP request and response headers, request methods, URL paths, and request bodies. Specifically, this data collection can utilize web crawlers, proxy servers, and other technologies to perform a comprehensive scan of the enterprise's internal network to identify existing API interfaces. Then, based on statistical algorithms, the APIs in the communication traffic are initially categorized, typically by the same business system.

[0018] The collected data is cleaned to remove invalid or redundant information and key features are extracted, including API endpoints, request parameters, and response status codes.

[0019] In-depth analysis of discovered API interfaces can yield information such as their functions, parameters, and return values ​​through techniques like static code analysis and dynamic debugging.

[0020] An improved trie structure algorithm is used to aggregate and classify API URL paths. Traditional trie structures are suitable for fast string retrieval, but they need improvement for API URL path aggregation and classification to meet risk assessment needs. First, the API URL portion is transformed into a tree structure using a trie algorithm, with ' / ' as the node delimiter. Relevant dimensions for determining the API aggregation range are statistically analyzed, such as the distance from the tail node to the root node (URL length), tree structures with identical nodes (URLs with the same path), and the variability of nodes at the same depth. Second, an improved trie node structure can be defined, containing additional information such as node depth and path frequency.

[0021] Furthermore, in one embodiment, the improved trie structure algorithm is used to aggregate and classify the URL paths of the API, including: defining an improved trie node structure, wherein the trie node structure includes node depth and path frequency.

[0022] Then, the URL paths of the API are aggregated to group URL paths with the same prefix into one category; the aggregation degree DP formula includes:

[0023] Where n is the number of URL paths with the same prefix, f i It is the frequency of the i-th path.

[0024] Then, edit distance is used to calculate the similarity between paths, and aggregation is performed based on the similarity. The similarity SM formula includes:

[0025] Here, p1 and p2 are two API paths, and Levenshtein(p1, p2) is the edit distance, which represents the minimum number of operations required to transform path p1 into path p2.

[0026] Furthermore, features are extracted from the aggregation results. These features may include node depth, path frequency, path similarity, and path length. Then, a classification algorithm is used to categorize the APIs. Specific API classification can be based on features such as API function and call frequency, allowing for the categorization and management of identified APIs to facilitate subsequent security control and optimization. Common classification methods include business APIs, management APIs, data APIs, and third-party APIs.

[0027] For API categorization, the following steps can be used:

[0028] First, a random forest model is trained using the extracted features; second, features are extracted for each API path and input into the model; finally, the model outputs classification results, assigning the API path to the corresponding category.

[0029] In one embodiment, classifying and tagging API assets includes:

[0030] Using machine learning models, such as random forests, identified APIs are classified and labeled based on multidimensional factors, including functionality, usage scenarios, and sensitivity factors. The labeling of API assets includes the system, environment type, business type, and whether the API is internal or external. This labeling process prepares for subsequent API asset classification management and security level assessment.

[0031] Furthermore, a machine learning model is trained based on the preprocessed feature data to construct an asset recognition model.

[0032] To help those skilled in the art better understand, this invention provides an embodiment scenario for enterprises to quickly identify and classify a large number of API assets. For example, in an e-commerce platform, API paths may include different categories such as product search, order management, and user information. Using the method described above, these API assets can be automatically discovered and classified, thereby improving the efficiency of API management and security protection.

[0033] The technical means provided by this invention improve the accuracy of API asset discovery and enhance the ability to classify and manage API assets. This method can be effectively applied to large enterprises with complex API structures, improving their ability to manage and protect their API assets.

[0034] Furthermore, in step 102, a sensitive data identification model is used to identify and locate sensitive data in log files or other files, and then encrypts the sensitive data. A predetermined number of sensitive data tags can be set, such as 100. Customizable sensitive detection rules are supported through a built-in data classification and grading template to prevent the leakage of sensitive information. During the encryption of sensitive data, whether during transmission or storage in the database, industry-standard encryption algorithms, such as AES, can be used.

[0035] It intelligently identifies 19 types of sensitive parameter information, such as ID cards and mobile phone numbers, using built-in rules. For example, it matches sensitive fields like mobile phone numbers and ID card numbers using regular expressions, and identifies sensitive information in documents using NLP technology. These rules cover information types such as personal identity information, property information, internet access information, and location information, and support custom sensitive detection rules to prevent the leakage of sensitive information and ensure data security.

[0036] Sensitive data can be located by real-time analysis of API access logs, identifying requests and responses containing sensitive data. Regular expression matching techniques can be used to identify patterns of sensitive information in the logs. During transmission, HTTPS can be used to ensure that sensitive data (such as personal identification information, financial data, medical records, etc.) is always stored in encrypted form. Using HTTPS also ensures end-to-end encryption of the API communication link, preventing man-in-the-middle attacks.

[0037] By effectively identifying, locating, and encrypting sensitive data in APIs, the risk of data leakage can be reduced, and the information security protection capabilities of APIs can be improved.

[0038] Furthermore, in step 103, a vulnerability rule set is integrated, and the vulnerability detection model is used to detect vulnerabilities existing on the API, and the characteristics of the vulnerability are verified and analyzed; wherein, the rule dimensions of the vulnerability rule set include coverage of data exposure, data permissions, security specifications, high-risk interfaces, and password authentication.

[0039] Integrates with OWASP API to publish a security risk list, including a predetermined number of vulnerability rules, such as 50+, covering rule dimensions such as data exposure, data permissions, security specifications, high-risk interfaces, and password authentication. Performs real-time, automatic vulnerability assessments on APIs, and monitors authentication and anonymization compliance issues in real time.

[0040] In one embodiment, the weakness rule set R contains rules across multiple dimensions:

[0041] R = {r1, r2, ..., r} n}, where r i This represents the i-th rule, where each rule r i It can include the following parameter: data exposure rule d i1 Data permission rule d i2 Safety regulations and rules d i3 High-risk interface rule d i4 Password authentication rule d i5 .

[0042] In one embodiment, the API vulnerability detection model includes:

[0043] Use historical data to train machine learning models to identify anomalous patterns and potential vulnerabilities in API traffic.

[0044] API traffic is scanned using rule-based matching algorithms and machine learning models (such as recurrent neural networks (RNNs) to process time-series data of API call sequences and extract features) to match vulnerability patterns defined in a vulnerability rule set. These rules can be regular expressions, code patterns, or security checklists. Machine learning models learn common attack behaviors of API interfaces to identify API attack behaviors and abnormal access behaviors, supporting attribution and tracing back to the entity responsible for the data breach.

[0045] The detected potential vulnerabilities are analyzed in depth, and sensitive data is classified using clustering algorithms and word vector techniques to identify high-risk inputs.

[0046] Threats are categorized based on their severity and potential impact, and corresponding response measures are automatically triggered. A logistic regression model L can be used to score threats.

[0047] L(X) = σ(WX + b), where σ is the sigmoid function, W and b are model parameters, and X is the feature vector.

[0048] After the API vulnerability is fixed, the model verifies the fix through continuous traffic monitoring to ensure that the vulnerability is effectively resolved and provides feedback to optimize the detection algorithm.

[0049] In one embodiment, the vulnerability rule set verification and analysis described above uses a rule matching algorithm, such as regular expression matching, to check for the existence of vulnerability patterns defined in the vulnerability rule set for each API request and response. Statistical analysis methods, such as the TF-IDF algorithm, are employed to mine potential sensitive keywords, expanding the rule base and compensating for missed detections due to incomplete keyword coverage. Clustering algorithms, such as k-means, are used to classify sensitive data, filtering out potentially risky input threat grading models, and implementing tiered operations based on different levels.

[0050] In vulnerability signature analysis, word vectors are trained using a word2vec model and used as feature input in a k-means clustering algorithm for filtering, identifying potentially risky inputs into a threat grading model. Based on different grading levels, API activities are monitored and analyzed in real time to identify abnormal and malicious behaviors.

[0051] Through the embodiments provided by this invention, vulnerabilities in APIs are discovered, and the characteristics of these vulnerabilities are verified and analyzed, ultimately achieving continuous improvement and vulnerability remediation of API information security.

[0052] The process then proceeds to step 104: Set up an automatic behavior risk monitoring engine to monitor and issue early warnings in real time for abnormal API calls to obtain data, in order to identify behavioral risks.

[0053] Through a built-in automatic behavioral risk monitoring engine, it provides real-time monitoring and early warnings for abnormal user API calls to retrieve data, identifying risks such as excessive data fetching and data crawling. Rate limiting measures are implemented to help prevent API abuse or crashes. By continuously detecting various security risks associated with APIs, covering types of risk events such as abnormal permissions, abnormal accounts, resource abuse, business anomalies, sensitive information anomalies, and web attacks, it helps enterprises classify and handle risks, achieving a closed-loop management system for abnormal events.

[0054] In one embodiment, an automatic behavioral risk monitoring engine is set up to monitor and issue early warnings in real time for abnormal API calls to obtain data, in order to identify behavioral risks, including:

[0055] Monitoring API access behavior based on application traffic analysis is used to detect risks associated with sensitive data flow within API interfaces. Based on historical and real-time user behavior data, as well as the context information of API calls, a behavioral baseline model based on user behavior analysis and machine learning can be established. The formula includes:

[0056] B(t)=α·H(t)+β·R(t)+γ·C(t),

[0057] Here, B(t) represents the behavioral baseline at time t, H(t) represents historical behavioral patterns established by analyzing past user behavior data, such as request frequency, request path, and request time. R(t) represents real-time behavioral data, including real-time monitored request frequency and request type data. Behavioral data allows for the acquisition of the latest changes in user behavior, enabling timely adjustments to the behavioral baseline. C(t) represents contextual information, including the business scenario of the API, data sensitivity, and risk level, which can accurately identify abnormal behavior. α, β, and γ are weighting coefficients representing the degree of influence of different factors on the behavioral baseline.

[0058] Furthermore, an unsupervised learning algorithm is used to learn attacks on the API interface in order to identify API attack risks.

[0059] Then, based on application traffic parsing and graph modeling techniques, the requests in the API traffic logs are path-escaping and categorized to identify sensitive data in the API interfaces and perform inventory and classification. Furthermore, by constructing a behavioral analysis model and combining it with actual interface traffic, the model baseline is adjusted to provide early warnings for risky behaviors. For different risk behavior scenarios such as unauthorized access, unauthorized crawling, data exposure, and interface exposure, a behavioral analysis model is constructed, and the model baseline is flexibly adjusted based on actual interface traffic conditions. The formulas include:

[0060] R = h(A,L,H), where R represents the behavioral risk score, A represents account behavior, such as the account's API call behavior, L represents abnormal login behavior, such as frequent failed login attempts, and H represents historical behavior patterns, which are used to compare with current behavior to identify anomalies.

[0061] In real-world scenarios, an automated risk monitoring engine can be deployed in an API gateway or WAF (Web Application Firewall) to monitor and analyze API call behavior in real time. Through machine learning algorithms, the weighting coefficients α, β, and γ are automatically adjusted to adapt to constantly changing business environments and user behaviors. When detected API call behavior deviates significantly from the established behavioral baseline B(t), the system triggers an alert, indicating potential security risks. The method provided in this embodiment can promptly detect and respond to abnormal API call behavior, improving API security.

[0062] The automatic behavior risk monitoring engine provided by this invention can perform real-time monitoring and early warning of abnormal API calls for data acquisition to identify behavioral risks.

[0063] Furthermore, in step 105, a network attack monitoring model is constructed to monitor network attack risks across all APIs, and to map attack routes and assess the impact of events.

[0064] In one embodiment, a network attack monitoring model is constructed to monitor network attack risks across the entire API, map attack paths, and assess the impact of events, including:

[0065] The monitoring formula for the network attack risk model is:

[0066]

[0067] Where R(t) represents the overall network attack risk score at time t, r t (t) represents the score of the i-th risk indicator at time t, which can be the frequency of abnormal API access, data leakage risk, web attack risk, etc. Each indicator is calculated by monitoring API activity in real time. ω i This represents the weight of the i-th risk indicator, indicating its influence on the overall risk score. It can be optimized based on historical data and reflects the importance of different risk indicators.

[0068] In mapping attack paths, one embodiment can employ an attack graph-based approach to describe the propagation relationships between nodes of an intrusion and map the highest probability of an attack originating from a particular host or vulnerability. This embodiment can represent attack paths in the network by constructing a directed graph, where nodes represent network assets and edges represent vulnerabilities or attack methods that an attacker might exploit.

[0069] The formula for drawing the attack route is:

[0070] P = argmax p∈Π (∑ (i,j)∈p ω ij ),

[0071] Where P represents the predicted attack path, Π is the set of all possible paths, and ω ij It is the weight of the edge from node i to node j, representing the probability that the path can be exploited by an attacker; the weight can be determined by a combination of factors such as the severity of the vulnerability, the difficulty of exploitation, and historical attack data.

[0072] In assessing the impact of an event, one approach combines graph theory algorithms and machine learning models. First, graph theory algorithms are used to determine the attack paths, and then machine learning models are used to evaluate the impact on each affected node.

[0073] The formulas for assessing the impact of specific events include:

[0074]

[0075] Where I represents the overall impact of the event, K is the number of affected nodes, and α k It represents the influence weight of the k-th node, which can be determined by factors such as the node's business importance and data sensitivity. k It is the influence score of the kth node, which can be predicted by a machine learning model based on historical data.

[0076] The following is a specific embodiment scenario example to help those skilled in the art better understand the present invention.

[0077] Suppose we have an enterprise network environment that includes multiple API services and network assets. We need to monitor the network attack risks of these APIs and assess the impact of attack incidents. Specifically, we can take the following steps:

[0078] 1. Data collection: Deploy a network monitoring system to collect network traffic and log data.

[0079] 2. Attack Graph Construction: Based on the collected data, an attack graph is constructed, which includes network assets and possible attack paths.

[0080] 3. Attack Path Prediction: Using an improved attack path drawing algorithm, possible attack paths are predicted, and the weight of each path is calculated.

[0081] 4. Impact Assessment: For each affected node, an impact score is assessed using a machine learning model, and the overall impact of the event is calculated.

[0082] Using the methods described above, network attack risks across all APIs can be automatically monitored, attack routes can be mapped, and the impact of incidents can be quickly assessed, thereby improving the efficiency and response speed of API security management.

[0083] Further, the process moves to step 106: Based on the risk monitoring model trained with historical monitoring data, the AP I risk link relationship is plotted, and combined with clue association ranking analysis, the suspicious data leakage path is inferred.

[0084] In response to abnormal risk events in AP I, sensitive data is extracted and traced, data access behavior is recorded, and correlation retrieval analysis of related events is proactively conducted to perform precise audit and backtracking of data behavior.

[0085] In one embodiment, a risk monitoring model trained based on historical monitoring data plots the API risk chain relationship, and combines clue association ranking analysis to infer suspicious data leakage paths, including:

[0086] The formula for plotting risk link relationships using the risk monitoring model is as follows:

[0087]

[0088] Where R represents the strength of the risk link relationship, W is a weight vector that can be trained using machine learning algorithms (such as random forests or neural networks) and reflects the degree of influence of different features on the strength of the risk link relationship. F is a feature vector that includes API call frequency, data sensitivity, user permission level, and abnormal behavior patterns, and b is a bias term used to adjust the risk baseline.

[0089] Clue association ranking analysis is an algorithm that assesses the importance of nodes (APIs or data streams). The formula is:

[0090]

[0091] Where PR(v) is the PageRank value of node v, representing the node's importance in the risky link; d is the damping coefficient, used to simulate the user's random hopping behavior; N is the total number of nodes in the graph, reflecting the system's scale. B v L(u) is the set of nodes pointing to node v, representing the direction of data flow. L(u) is the number of outgoing edges of node u, representing the number of data flows from node u outwards.

[0092] Based on the risk link relationship model and clue association ranking analysis, suspicious data leakage paths are inferred.

[0093] In practical applications, these models can be deployed in API gateways or data security platforms to monitor API call behavior and data flow in real time. Using these models, an API risk chain diagram can be automatically generated, assessing the risk intensity of each node. Combined with clue correlation ranking analysis, the most likely data leakage path can be inferred. When a high-risk leakage path is detected, the system can automatically trigger an early warning mechanism, notifying the security team for further investigation and response. This approach helps enterprises promptly identify and respond to potential data leakage risks, protecting their data assets.

[0094] Further, the process proceeds to step 107: to fully record the usage of API data in order to quickly locate the source of the leak after a leak event occurs.

[0095] In one embodiment, comprehensive logging of API data usage behavior is implemented to enable rapid location of the source of a leak after an incident, including:

[0096] By extracting and recording sensitive data and data access behavior, the system can proactively perform correlation analysis of related events after a data breach occurs, enabling precise auditing and backtracking of data behavior.

[0097] By setting up audit tables and event logs, detailed information about each data operation is recorded, including the operator, the time of the operation, and the data status before and after the modification. This method provides a comprehensive record of data behavior and forms the basis for audit backtracking.

[0098] In one embodiment, by utilizing an optimized Local Anomaly Factor (LOF) algorithm and machine learning techniques such as random forests to analyze user behavior and identify anomalous patterns that may indicate an attack, the accuracy of alerts can be improved and illegal operations can be detected in real time.

[0099] The above approach, through sensitive data identification and automatic logging, meticulously records data access behavior and utilizes machine learning algorithms for correlation analysis of related events, enabling precise auditing and backtracking of data behavior. This solution can quickly locate the source of a data breach after it occurs, accurately reconstructing the historical state of data changes through timestamps, audit tables, event logs, and other technical means, providing strong technical support for the investigation and response to data security incidents. This method not only improves data security protection capabilities but also enhances enterprises' ability to respond to and trace the source of data breaches.

[0100] Step 108: Use the matrix method to calculate the risk, combine probability and impact to assess the severity of the risk, and generate an AP I information security risk assessment report.

[0101] Construct a two-dimensional matrix, using the frequency of threat occurrence and the severity of vulnerability as two dimensions, and determine the probability of a security incident occurring using the matrix method principle.

[0102] In one embodiment, the formula can be used:

[0103] Z(ij) = a·X(i) + b·Y(j), where X(i) represents the frequency of threat occurrence, Y(j) represents the severity of vulnerability, and a and b are coefficients determined according to the specific situation and the increasing nature of the function.

[0104] The risk value is calculated using a matrix method, combining the levels of likelihood and impact. For example, if the likelihood of a security incident is level 1 and the impact is level 2, then the risk value is determined to be level 3 based on the risk matrix.

[0105] A risk assessment report should include a risk analysis model, risk calculation methods, risk analysis and evaluation, etc. The report should describe in detail the current risk status, safety hazards, and areas requiring rectification.

[0106] By combining the two key factors of probability and impact using a matrix approach, this invention provides a structured risk assessment framework. The solution offered by this invention can not only assess the risk of individual APIs but also identify and compare the risk levels of different APIs across the entire information system, generating detailed risk assessment reports that provide decision-makers with a basis for risk management and mitigation measures. This approach improves the accuracy and efficiency of risk assessment, helping enterprises better understand and manage the security of their API assets.

[0107] In summary, the technical solution of the API-based information security risk assessment method provided by some embodiments of this invention offers a comprehensive API security protection system by automatically sorting out API assets, monitoring API vulnerabilities, behavioral risks, and network attack risks in real time, and combining risk link characterization and data leakage path prediction. This solution can effectively reduce data leakage risks, improve response speed to API attacks, and quickly locate the source of leakage when a data leakage event occurs. Through this comprehensive technical approach, enterprises can promptly discover and respond to potential data leakage risks and assess information security risks, thereby protecting their data assets and ensuring business continuity and security.

[0108] Figure 2 An exemplary structural block diagram of an API-based information security risk assessment system 200 according to an embodiment of the present invention is shown.

[0109] like Figure 2 As shown, system 200 includes:

[0110] API Asset Acquisition and Management Module 201: Used to acquire API assets within the enterprise using traffic analysis, and to classify and tag API assets.

[0111] Sensitive data identification and protection module 202: Used to identify and locate sensitive data in log files or files using sensitive data identification technology, and encrypt the sensitive data.

[0112] API Vulnerability Assessment Module 203: This module integrates a set of vulnerability rules to detect vulnerabilities in APIs using an API vulnerability detection model, and performs verification and analysis based on the characteristics of the vulnerabilities. The rule dimensions of the vulnerability rule set include coverage of data exposure, data permissions, security specifications, high-risk interfaces, and password authentication.

[0113] Behavioral Risk Monitoring and Abnormal Event Management Module 204: This module is used to set up an automatic behavioral risk monitoring engine to monitor and issue early warnings in real time for abnormal API calls to obtain data, in order to identify behavioral risks.

[0114] API Attack Monitoring Module 205: Used to build a network attack monitoring model to monitor network attack risks across all APIs, map attack routes, and assess the impact of events.

[0115] Risk monitoring model building module 206: Used to train a risk monitoring model based on historical monitoring data, draw API risk link relationships, and combine clue association ranking analysis to infer suspicious data leakage paths.

[0116] Risk Event Source Analysis Module 207: Used to comprehensively record the usage behavior of API data in order to quickly locate the source of leakage after a leakage event occurs.

[0117] Risk Assessment Report Module 208: Used to calculate risks using a matrix method, combining probability and impact to assess the severity of risks, in order to generate an API information security risk assessment report.

[0118] It is understandable that the information security risk assessment system based on API is the aforementioned Figure 1 This is a specific implementation of the method, therefore, in conjunction with the preceding text... Figure 1 The described features can be similarly applied here. Further details will not be elaborated upon here.

[0119] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. An API-based information security risk assessment method, characterized by, The method comprises the following steps: acquiring API assets in an enterprise using traffic analysis, and classifying and labeling the API assets; identifying and locating sensitive data in log files or files using a sensitive data identification model, and encrypting the sensitive data; integrating a vulnerability rule set to detect vulnerability flaws existing on the API through an API vulnerability detection model, and checking and analyzing the vulnerability flaw features; wherein the rule dimensions of the vulnerability rule set include data exposure, data authority, security specifications, high-risk interfaces, and password authentication; setting up a behavior risk automatic monitoring engine to monitor and warn in real time about abnormal API data acquisition behaviors, so as to obtain behavior risks; constructing a network attack monitoring model to monitor network attack risks of all APIs, and drawing attack routes and evaluating the influence of events; training a risk monitoring model based on historical monitoring data, drawing API risk link relationships, combining clue correlation ranking analysis, and inferring suspicious data leakage paths; comprehensively leaving traces of API data usage behaviors, so as to quickly locate the leakage source after a leakage event occurs; and using a matrix method to calculate risks, combining likelihood and impact to evaluate the severity of the risks, and generating an API information security risk assessment report.

2. The method of claim 1, wherein, The step of acquiring API assets in an enterprise using traffic analysis comprises the following steps: collecting API traffic data, wherein the traffic data includes HTTP request and response headers, request methods, URL paths, and request bodies; cleaning the collected data to remove invalid or redundant information, and extracting key features, wherein the key features include API endpoints, request parameters, and response status codes; aggregating and classifying the URL paths of the API using an improved trie structure algorithm; training a machine learning model based on the preprocessed feature data to construct an asset identification model.

3. The method of claim 2, wherein, The step of aggregating and classifying the URL paths of the API using an improved trie structure algorithm comprises the following steps: defining an improved trie node structure, wherein the trie node structure includes node depth and path frequency; aggregating the URL paths of the API to classify URL paths with the same prefix into one category; the aggregation degree DP formula comprises: where n is the number of URL paths with the same prefix, f i is the frequency of the i-th path; using the edit distance to calculate the similarity between paths, and aggregating according to the similarity; the similarity SM formula comprises: where p1 and p2 are two API paths, and Levenshtein(p1, p2) is the edit distance, representing the minimum number of operations required to transform path p1 into path p2. extracting features from the aggregation results, and then classifying the API using a classification algorithm; training a random forest model using the extracted features; extracting features for each API path and inputting them into the model; the model outputs a classification result, and assigns the API path to a corresponding category.

4. The method of claim 1, wherein, The step of classifying and labeling the API assets comprises the following steps: using a machine learning model to classify and label the identified API according to multi-dimensional factor features of the API assets, wherein the multi-dimensional factor features include functionality, usage scenarios, and sensitivity factors; the API asset labeling includes the system to which the API belongs, the environment type, the business type, and internal or external API.

5. The method of claim 1, wherein, The API vulnerability detection model comprises: Train machine learning models using historical data to identify abnormal patterns and potential vulnerabilities in API traffic; Scan API traffic for matching vulnerability patterns defined in a set of weakness rules using rule matching algorithms and machine learning models; Perform in-depth analysis on detected potential vulnerabilities, classify sensitive data using clustering algorithms and word vector techniques to identify high-risk inputs; Classify threats based on the severity and potential impact of vulnerabilities and automatically trigger corresponding response measures; and After API weakness fixes, the model verifies the effectiveness of the fixes through continuous traffic monitoring, ensuring that vulnerabilities are effectively addressed and providing feedback to optimize detection algorithms.

6. The method of claim 1, wherein, The setting behavior risk automatic monitoring engine monitors and warns in real time about abnormal API data access behaviors to obtain behavior risks, including: Monitoring interface access behaviors based on application traffic analysis to monitor sensitive data flow risks in API interfaces, including: B(t) = α·H(t) + β·R(t) + γ·C(t), where B(t) represents the behavior baseline at time t, H(t) represents historical behavior patterns established by analyzing the user's past behavior data, R(t) represents real-time behavior data including request frequency, request type data monitored in real time, C(t) represents context information including API business scenarios, data sensitivity, risk level, and α, β, and γ are weight coefficients representing the influence degree of different factors on the behavior baseline; Attack learning on API interfaces through unsupervised learning algorithms to identify API attack risks; Based on application traffic analysis and graph model technology, the request in API traffic log is path-escaped and classified to identify sensitive data in API interfaces and conduct inventory classification; and Through the constructed behavior analysis model, combined with actual interface traffic, adjust the model baseline to prewarn risk behaviors, including: R = h(A, L, H), where R represents the behavior risk score, A represents account behavior, L represents login anomalies, and H represents historical behavior patterns.

7. The method of claim 1, wherein, The network attack monitoring model is constructed to monitor the network attack risks of all API, and the attack route and the impact of the event are drawn, including: The monitoring formula of the network attack risk model is: wherein R(t) represents the overall cyber-attack risk score at time t, r t (t) represents the score of the i-th risk indicator at time t, ω i is the weight of the i-th risk indicator, representing the degree of influence of the indicator on the overall risk score; The formula for drawing the attack route is: P = argmax p∈Π (Σ (i,j)∈p ω ij ), where P denotes the predicted attack path, Π is the set of all possible paths, ω ij is the weight of the edge from node i to node j, and represents the likelihood of the path being exploited by an attacker; The event impact evaluation formula is: where I denotes the overall event impact surface, K is the number of affected nodes, a k is the influence weight of the kth node, I k is the influence score of the kth node.

8. The method of claim 1, wherein, The risk monitoring model trained based on historical monitoring data draws API risk link relationships, combines clue correlation ranking analysis, and infers suspicious data leakage paths, including: The formula for the risk monitoring model to draw risk link relationships is: where R represents the strength of the risk link relationship, W is the weight vector, F is the feature vector including API call frequency, data sensitivity, user permission level, abnormal behavior patterns, and b is the bias term for adjusting the risk baseline; The formula for clue correlation ranking analysis is: wherein PR(v) is the PageRank value of node v, indicating the importance of the node in the risk link, d is the damping coefficient, N is the total number of nodes in the graph, B v is the node set pointing to node v, indicating the data flow, L(u) is the out-degree of node u, indicating the number of data flows out of node u; According to the risk link relationship model and clue correlation ranking analysis, the suspicious data leakage path is inferred.

9. The method of claim 1, wherein, The API data usage behavior is comprehensively left traces to quickly locate the leakage source after the leakage event occurs, including: By extracting and leaving traces of sensitive data, record data access behavior, after the leakage event occurs, actively conduct correlation analysis of related events to accurately audit and trace data behavior.

10. An API-based information security risk assessment system, characterized by, Including: API asset acquisition and management module: used for acquiring API assets in the enterprise using traffic analysis, and classifying and labeling API assets; Sensitive data identification and protection module: used for identifying and locating sensitive data in log files or files using sensitive data identification technology, and encrypting sensitive data; API vulnerability assessment module: used for integrating a weakness rule set, detecting existing vulnerability vulnerabilities on the API through an API vulnerability detection model, and checking and analyzing vulnerability vulnerability features; wherein the rule dimensions of the weakness rule set include covering data exposure, data authority, security specification, high-risk interface, password authentication; Behavior risk monitoring and abnormal event control module: used for setting up a behavior risk automatic monitoring engine to monitor and warn in real time the abnormal API data acquisition behavior to obtain behavior risk; API attack monitoring module: used for constructing a network attack monitoring model to monitor the network attack risk of all API and draw attack routes and evaluate the impact of events; Risk monitoring model construction module: used for a risk monitoring model trained based on historical monitoring data to draw API risk link relationships and combine clue correlation ranking analysis to infer suspicious data leakage paths; Risk event traceability analysis module: used for comprehensively leaving traces of API data usage behavior to quickly locate the leakage source after the leakage event occurs; Risk assessment report module: used for calculating risk using matrix method, combining possibility and impact to evaluate the severity of risk, to generate API information security risk assessment report.

Images