A WebAPI protection method, system, device and storage medium

Abstract

An embodiment of the present specification provides a WebAPI protection method, which is executed by a processor-controlled protection component, which includes a front-end calling component and a back-end security component. The method includes: receiving an interface call request issued by a client through the front-end calling component, where the interface call request corresponds to an interface request parameter; controlling the front-end calling component to determine a call request instruction that matches the interface call request based on the interface request parameter, so as to receive the interface request metadata issued by the client, encrypt the data, and then send it to the back-end security component for decryption to obtain the interface request metadata again; in response to meeting the preset call conditions, sending the interface request metadata to the back-end service component through the back-end security component to obtain feedback data, and sending it to the back-end security component; and the back-end security component encrypts the feedback data and sends it to the front-end calling component, which is then decrypted by the front-end calling component and sent to the client.

Description

Technical Field

[0001] This specification relates to the field of WebAPI protection, and in particular to a WebAPI protection method, system, device and storage medium. Background Art

[0002] In the traditional WebAPI interface call request process, the front-end directly accesses the back-end service component through HTTP requests. Attackers can intercept interface call requests through tools such as Burp Suite and Fiddler, modify the parameters of interface call requests, and perform attacks such as SQL injection, file upload bypass, interface brute force cracking, and unauthorized traversal of open interface lists.

[0003] This specification provides a WebAPI protection method, system, device and storage medium, which takes over the WebAPI calling process through the protection component, making existing attack tools on the market ineffective, increasing the attack cost and difficulty of the attacker. Summary of the Invention

[0004] One or more embodiments of the present specification provide a WebAPI protection method, which is executed by a processor-controlled protection component, the protection component including a front-end call component and a back-end security component. The WebAPI protection method includes: receiving an interface call request issued by a client through the front-end call component, the interface call request corresponding to an interface request parameter; controlling the front-end call component to determine a call request instruction that matches the interface call request according to the interface request parameter; controlling the front-end call component to receive interface request metadata issued by the client according to the call request instruction, and encrypting the interface request metadata to generate a first ciphertext; receiving the first ciphertext through the back-end security component, decrypting the first ciphertext to regenerate the interface request metadata; in response to meeting a preset call condition, sending the interface request metadata to the back-end service component through the back-end security component; receiving feedback data from the back-end service component through the back-end security component, and encrypting the feedback data to generate a second ciphertext; receiving the second ciphertext through the front-end call component and decrypting it to regenerate the feedback data; and sending the feedback data to the client through the front-end call component.

[0005] One or more embodiments of the present specification provide a WebAPI protection system. The system includes a processor and a protection component, the processor and the protection component being electrically connected, the protection component including a front-end call component and a back-end security component; the processor is configured to: receive an interface call request issued by a client through the front-end call component, the interface call request corresponding to an interface request parameter; control the front-end call component to determine a call request instruction matching the interface call request based on the interface request parameter; control the front-end call component to receive interface request metadata issued by the client based on the call request instruction, and encrypt the interface request metadata to generate a first ciphertext; receive the first ciphertext through the back-end security component, decrypt the first ciphertext to regenerate the interface request metadata; in response to meeting a preset call condition, send the interface request metadata to the back-end service component through the back-end security component; receive feedback data from the back-end service component through the back-end security component, encrypt the feedback data to generate a second ciphertext; receive the second ciphertext through the front-end call component and decrypt it to regenerate the feedback data; and send the feedback data to the client through the front-end call component.

[0006] One or more embodiments of this specification provide a WebAPI protection device, at least one processor and at least one memory; the at least one memory is used to store computer instructions; the at least one processor is used to execute at least part of the computer instructions to implement a WebAPI protection method.

[0007] One or more embodiments of this specification provide a computer-readable storage medium that stores computer instructions. When a computer reads the computer instructions in the storage medium, the computer executes the WebAPI protection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] This specification will be further described in the form of exemplary embodiments, which will be described in detail with reference to the accompanying drawings. These embodiments are not limiting, and in these embodiments, like numbers represent like structures, wherein:

[0009] Figure 1 This is a module diagram of a WebAPI protection system according to some embodiments of this specification;

[0010] Figure 2 is an exemplary flow chart of a WebAPI protection method according to some embodiments of this specification;

[0011] Figure 3is an exemplary flow chart of determining whether to enable a backend security component according to some embodiments of this specification;

[0012] Figure 4 This is another exemplary flowchart of determining whether to enable the backend security component according to some embodiments of this specification. DETAILED DESCRIPTION

[0013] To more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly describes the drawings required for describing the embodiments. Obviously, the drawings described below are merely examples or embodiments of this specification. Those skilled in the art can apply this specification to other similar scenarios based on these drawings without inventive effort. Unless otherwise apparent from the context or otherwise noted, the same reference numerals in the figures represent the same structure or operation.

[0014] It should be understood that the terms "system," "device," "unit," and / or "module" used herein are a method for distinguishing different components, elements, parts, portions, or assemblies at different levels. However, if other terms can achieve the same purpose, the terms may be replaced by other expressions.

[0015] As used in this specification and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" do not refer to the singular but also include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0016] Flowcharts are used throughout this specification to illustrate the operations performed by systems according to embodiments of this specification. It should be understood that preceding or following operations do not necessarily need to be performed in exact order. Instead, the steps may be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0017] Figure 1 This is a module diagram of the WebAPI protection system shown in some embodiments of this specification.

[0018] In some embodiments, the WebAPI protection system 100 may include a processor 110 and a protection component 120, and the processor 110 and the protection component 120 are electrically connected.

[0019] The protection component 120 refers to a pre-set WebAPI interface protection framework, such as a program package.

[0020] In some embodiments, the protection component 120 includes a front-end calling component 121 and a back-end security component 122 .

[0021] The front-end retrieval component 121 is part of the protection component. The front-end retrieval component 121 can be used to receive interface call requests issued by users through the client. The client can include a mobile phone, computer, etc. The front-end retrieval component 121 can be located on the server.

[0022] Backend security component 122 is another part of the protection component. Backend security component 122 is configured to automatically perform security protection related tasks for interface call requests. Backend security component 122 can be set on a server, virtual machine, cloud service platform, etc.

[0023] In some embodiments, the processor is configured to: receive an interface call request issued by a client through a front-end calling component, where the interface call request corresponds to an interface request parameter; control the front-end calling component to determine a call request instruction that matches the interface call request based on the interface request parameter; control the front-end calling component to receive the interface request metadata issued by the client based on the call request instruction, and encrypt the interface request metadata to generate a first ciphertext; receive the first ciphertext through a back-end security component, decrypt the first ciphertext to regenerate the interface request metadata; in response to meeting a preset call condition, send the interface request metadata to the back-end service component through the back-end security component; receive feedback data from the back-end service component through the back-end security component, and encrypt the feedback data to generate a second ciphertext; receive the second ciphertext through the front-end calling component and decrypt it to regenerate the feedback data; and send the feedback data to the client through the front-end calling component.

[0024] In some embodiments, the front-end calling component also includes a cache component, which is configured to cache call request instructions corresponding to high-frequency requests and / or high-frequency users' interface call requests; the processor is further configured to: in response to identifying high-frequency requests or high-frequency users, control the front-end calling component to determine the call request instructions corresponding to the high-frequency requests and / or high-frequency users' interface call requests through the cache component based on the interface request parameters.

[0025] In some embodiments, the processor is further configured to: determine the security value corresponding to the interface call request based on the interface request parameters and interface request metadata corresponding to the interface call request; and determine whether to enable the back-end security component based on the security value and the security value threshold, and the back-end security component is configured to perform protection processing for subsequent interface call requests.

[0026] In some embodiments, the processor is further configured to: estimate the waiting time corresponding to executing the protection process based on the interface call request, the waiting time includes the waiting time corresponding to executing the call request instruction, encryption processing and decryption processing; after receiving the interface call request issued by the client, obtain the number and interval time of the target interface call request from the client, the target interface call request is an interface call request that meets the preset conditions; based on the number and interval time, evaluate the impact of the waiting time on the user; and based on the impact level, determine whether to enable the back-end security component.

[0027] For more information about the processor 110 and the protection component 120, see Figure 2-Figure 4 See the relevant instructions in .

[0028] It should be noted that the above description of the WebAPI protection system and its modules is for convenience only and does not limit this specification to the scope of the embodiments. It is understandable that those skilled in the art, after understanding the principles of the system, may arbitrarily combine the modules or form subsystems connected with other modules without deviating from the principles. In some embodiments, Figure 1 The processor and protection component disclosed herein can be different modules within a system, or a single module can implement the functions of two or more of the aforementioned modules. For example, the modules can share a single storage module, or each module can have its own storage module. Such variations are within the scope of protection of this specification.

[0029] Figure 2 This is an exemplary flow chart of the WebAPI protection method shown in some embodiments of this specification. Figure 2 As shown, the process 200 includes the following steps 210 to 280. In some embodiments, the process 200 can be executed by the protection component 120 controlled by the processor 110.

[0030] Step 210: Receive the interface call request sent by the client through the front-end calling component.

[0031] Interface call requests refer to information related to user requests. User requests can include user login requests, file upload requests, data call requests, data analysis requests, etc.

[0032] In some embodiments, the interface call request corresponds to an interface request parameter.

[0033] Interface request parameters refer to the characteristic parameters corresponding to the interface call request issued by the client.

[0034] In some embodiments, the interface request parameters include at least one of a request type code, a request time point, a user login identifier, a virtual address, and a geographic location.

[0035] The request type code refers to the code corresponding to the type of interface call request. Interface call request types may include one of the following request types: new user creation, user login, information query, data collection, data analysis, etc. The code corresponding to each interface call request type can be preset by those skilled in the art based on experience.

[0036] The request time point refers to the time point recorded by the client when the user issues an interface call request.

[0037] The user login identifier may include the user's account number and password for logging into the client.

[0038] The virtual address may include the IP address of the user's login client, etc.

[0039] Geographic location refers to the geographical area corresponding to the client, such as Beijing, Chengdu, etc.

[0040] In some embodiments, the processor may parse the interface call request through the user end to obtain the interface request parameters.

[0041] In some embodiments, the processor may generate an interface call request based on the relevant information sent by the user through the interactive interface of the client.

[0042] Step 220: Control the front-end calling component to determine a call request instruction that matches the interface call request based on the interface request parameters.

[0043] A call request instruction is a set of codes generated within the front-end component related to the interface call request. Different interface call requests can correspond to different call request instructions.

[0044] In some embodiments, the processor can control the front-end call component to determine, based on the interface request parameters, a call request instruction that matches the interface call request through a first preset comparison table. In some embodiments, the first preset comparison table includes a correspondence between multiple different reference interface request parameters and reference call request instructions that match the reference interface call request. In some embodiments, the first preset comparison table can be constructed based on prior knowledge or historical data.

[0045] In some embodiments, the front-end calling component also includes a cache component, which is configured to cache call request instructions corresponding to high-frequency requests and / or high-frequency users' interface call requests; in response to identifying high-frequency requests or high-frequency users, the processor controls the front-end calling component to determine the call request instructions corresponding to the high-frequency requests and / or high-frequency users' interface call requests through the cache component based on the interface request parameters.

[0046] A cache component is a component used to cache data. A cache component can be a combination of hardware and software, such as a cache database.

[0047] High-frequency requests refer to interface call requests in one or more interface call request types that meet specific requirements. Interface call request types can be divided into at least one of the request types such as newly established users, user logins, information queries, data collection, and data analysis. One or more interface call request types that meet specific requirements can be understood as: within a preset time period, classifying the interface call request types of all interface call requests sent by one or more clients, and counting the number of interface call requests within each interface call request type; and determining one or more interface call request types whose number of interface call requests is greater than a preset request threshold as one or more interface call request types that meet specific requirements.

[0048] In some embodiments, when the processor counts the number of requests for a certain type of interface call request, interface call requests of the same interface call request type may come from different clients.

[0049] A high-frequency user refers to a client that sends interface call requests more than the preset number of times within a preset time period.

[0050] The preset time period, preset request threshold and preset number of transmission times can be preset by those skilled in the art based on experience.

[0051] In some embodiments, the processor may generate interface request statistics based on historical interface request parameters; and determine high-frequency requests and / or high-frequency users based on the interface request statistics.

[0052] Historical interface request parameters refer to the interface request parameters corresponding to multiple historical interface call requests issued by the client within a preset period of time. Historical interface call requests refer to the interface call requests that have been sent by the client in the past.

[0053] One historical interface call request corresponds to one request record information. The request record information includes historical interface request parameters, the cumulative number of historical interface call requests for each request type in different request types, or the number of historical interface call requests corresponding to each client in different clients, etc. Interface request statistical information refers to the information obtained by aggregating a large amount of request record information. Interface request statistical information may include the cumulative number of historical interface call requests for each request type in different request types or the number of historical interface call requests corresponding to each client in different clients within a preset time period, the occurrence time distribution of different historical interface call requests, etc.

[0054] In some embodiments, the processor may perform statistics on request record information corresponding to historical interface call requests to obtain interface request statistics information.

[0055] In some embodiments, the processor may also divide the preset time period into multiple sub-periods; for each sub-period, based on the interface request statistical information, the total number of historical interface call requests corresponding to each request type is counted; the total number of historical interface call requests corresponding to each request type is compared with the preset request threshold; and in response to the total number of historical interface call requests corresponding to a certain request type being greater than the preset request threshold, the historical interface call request corresponding to the request type is determined to be a high-frequency request of the corresponding sub-period. Similarly, in different sub-periods, clients that send historical interface call requests greater than the preset number of times in different clients are determined to be high-frequency users of the corresponding sub-period. Multiple sub-periods may include sub-periods corresponding to weekdays, holidays, working hours, off-duty hours, etc. In different sub-periods, the call request instructions temporarily stored in the cache component may be different.

[0056] In some embodiments, the processor may also determine the type of historical interface call requests at different time points, the client to which the historical interface call requests belong, and the number of historical interface call requests based on the interface request statistical information; perform clustering based on the type of historical interface call requests at different time points, the client to which the historical interface call requests belong, and the number of historical interface call requests, and determine the time period corresponding to high-frequency requests and / or the time period corresponding to high-frequency users; and determine whether the interface call request is a high-frequency request and / or a high-frequency user based on the time point corresponding to the interface call request and the time period corresponding to the high-frequency request and / or high-frequency user. The time period corresponding to the high-frequency user refers to the time interval between the maximum time point and the minimum time point corresponding to the historical interface call request in the specific cluster obtained by clustering. A specific cluster refers to a cluster obtained by clustering specific clients into one category. A specific client refers to a client that has sent historical interface call requests more than a preset number of times.

[0057] In some embodiments, the processor can cluster historical interface call requests of the same type and historical interface call requests whose corresponding time points are within a preset time interval; among the clusters obtained by clustering, determine the cluster in which the number of historical interface call requests is greater than a preset request threshold, and determine the time interval between the maximum time point and the minimum time point corresponding to the historical interface call requests in the cluster as the time period corresponding to the high-frequency request; and in response to the time point corresponding to the interface call request being within the time period corresponding to the high-frequency request, the interface call request is a high-frequency request. The preset time interval can be preset by those skilled in the art based on experience. The number of historical interface call requests in a cluster can be equivalent to the number of historical interface call requests obtained by clustering in a cluster.

[0058] In some embodiments, the processor may determine high-frequency users in a similar manner to determining high-frequency requests.

[0059] In some embodiments, the cache component includes a cache database, and the processor can also control the front-end calling component to determine the call request instruction that matches the interface call request by querying the cache database according to the interface request parameters.

[0060] The cache database includes a plurality of corresponding relationships between different reference interface request parameters and reference call request instructions. In some embodiments, the cache database can be constructed based on prior knowledge or historical data.

[0061] In some embodiments of the present specification, by setting a cache component, the operation speed can be improved by retrieving the call request instructions that may be frequently used and correspond to the interface request parameters at the current time point from the cache database in advance.

[0062] Step 230 , controlling the front-end calling component to receive the interface request metadata sent by the client according to the call request instruction, and encrypting the interface request metadata to generate a first ciphertext.

[0063] Interface request metadata refers to information that records the specific content of a user's request. For example, interface request metadata may include the specific content of a user's login request.

[0064] In some embodiments, the processor may control the front-end calling component to receive the interface request metadata issued by the client according to the call request instruction.

[0065] The first ciphertext refers to the encrypted interface request metadata.

[0066] In some embodiments, the processor may control the front-end call component to obtain interface request metadata from the interface call request issued by the client according to the call request instruction; and encrypt the interface request metadata to generate a first ciphertext. The encryption method may include Base64 encryption and decryption method, DES encryption and decryption method, etc.

[0067] In some embodiments, the processor can determine whether to enable the backend security component. In response to enabling the backend security component, the processor can control the front-end calling component to connect through WebSocket, send the first ciphertext generated after encrypting the interface request metadata to the backend security component, and execute the following steps 240-280; and in response to not enabling the backend security component, the interface request metadata without encryption processing is directly sent to the backend service component.

[0068] The backend service component can be used to provide feedback on services related to the interface call request. The backend service component can be set in the server.

[0069] For example, the backend service component can be used to provide feedback on services related to user login, services related to user query data, etc.

[0070] For instructions on how to determine whether to enable backend security components, see the following text. Figure 3-Figure 4 Instructions in .

[0071] Step 240: Receive the first ciphertext through the backend security component, and decrypt the first ciphertext to regenerate the interface request metadata.

[0072] The decryption processing method may include Base64 encryption and decryption method, DES encryption and decryption method, etc.

[0073] Step 250: In response to the preset calling condition being met, the interface request metadata is sent to the backend service component through the backend security component.

[0074] The preset call conditions can be preset by those skilled in the art based on their experience. For example, the preset call conditions may include the user login identifier being valid and the interface request parameters being normal. The user login identifier being valid may include the user login account and password being consistent and having no abnormal behavior. The interface request parameters being normal may include the virtual address in the interface request parameters not being an illegal address.

[0075] Step 260: Receive feedback data from the backend service component through the backend security component, and encrypt the feedback data to generate a second ciphertext.

[0076] Feedback data refers to data fed back to users in response to an interface call request. For example, feedback data may include results of login, data query, and data analysis.

[0077] The second ciphertext refers to the feedback data after encryption. The processor can generate the second ciphertext using a method similar to that used to generate the first ciphertext.

[0078] Step 270: Receive the second ciphertext through the front-end calling component and perform decryption processing to regenerate feedback data.

[0079] The processor may use a method similar to the decryption of the first ciphertext to decrypt the second ciphertext to generate feedback data.

[0080] Step 280: Send the feedback data to the client through the front-end calling component.

[0081] In some embodiments, the processor can call the component through the front end and send the feedback data to the client through websocket communication.

[0082] In some embodiments, the processor may update the client's interactive interface based on the feedback data, for example, updating the client's interactive interface to indicate a successful login, display data query results, etc.

[0083] In some embodiments of the present specification, the interface call request sent by the user through the client must first be processed by the protection component before reaching the back-end service component for data interaction, thereby hiding all the original API interfaces behind the back-end security component of the protection component, so that only one websocket communication interface is exposed to the threat attacker. The attacker cannot directly access the back-end service component, and cannot use existing attack tools to attack the back-end service component, which greatly increases the attack cost of the threat attacker and improves the security of the back-end service component.

[0084] Figure 3 This is an exemplary flow chart of determining whether to enable backend security components according to some embodiments of this specification. Figure 3 As shown, the process 300 includes the following steps 310 to 320. In some embodiments, the process 300 can be executed by the protection component 120 controlled by the processor 110.

[0085] Step 310 : Determine a security value 313 corresponding to the interface call request based on the interface request parameters 311 and the interface request metadata 312 corresponding to the interface call request.

[0086] For a description of interface request parameters and interface request metadata, see Figure 2 See the relevant instructions in .

[0087] The security value is a numerical value that reflects the security level of the interface call request. The security value can be expressed as a number between 0 and 1. The larger the value, the more secure the interface call request is, and the lower the possibility or risk of attacking the server.

[0088] In some embodiments, the processor can determine the security value corresponding to the interface call request through the security table based on the interface request parameters and interface request metadata corresponding to the interface call request. In some embodiments, the security table includes a correspondence between multiple different reference interface request parameters and reference interface request metadata and reference security values. A reference interface call request corresponds to a reference interface request parameter, a reference interface request metadata, and a reference security value. In some embodiments, the security table can be constructed based on historical server interception data, attack data, and blacklist data of other platforms on the Internet.

[0089] For example, the processor can classify historical server interface request parameters corresponding to the request type, request time, virtual address, and geographic location as different security values ​​based on the severity of the attack. Therefore, if a virtual address or geographic location frequently sends phishing messages, but requests from these virtual addresses or geographic locations cannot be completely blocked, a security value can be evaluated to determine whether to enable the backend security component.

[0090] In some embodiments, the processor may further determine a security value corresponding to the interface call request based on the interface request parameters and interface request metadata corresponding to the interface call request through a protection model.

[0091] In some embodiments, the protection model is a machine learning model. In some embodiments, the protection model can be a neural network (NN) model or a deep neural network (DNN) model.

[0092] In some embodiments, the input of the protection model includes interface request parameters and interface request metadata corresponding to the interface call request, and the output includes a security value corresponding to the interface call request.

[0093] In some embodiments, the input of the protection model also includes the number of interface call requests issued by the same client.

[0094] In some embodiments, the protection model can be obtained through training based on a plurality of labeled training samples.

[0095] In some embodiments, each training sample may include sample interface request parameters and sample interface request metadata corresponding to the sample interface call request. The training sample may be constructed based on the sample interface call request. The processor may parse the sample interface call request through the user end to obtain the sample interface request parameters and sample interface request metadata. For instructions on how to obtain the sample interface request parameters and sample interface request metadata, see Figure 2 See the relevant instructions in .

[0096] In some embodiments, the tag may be a security value corresponding to the sample interface call request.

[0097] In some embodiments, the tag is related to whether the sample interface call request is a high-frequency request or whether the sample interface call request is a request issued by a high-frequency user. For example, the security value of the sample interface call request corresponding to high-frequency requests and high-frequency users can be preset to a relatively high value.

[0098] Labels can be obtained through manual tagging. For example, those skilled in the art can determine the statistical number of sample call requests of the same type that were intercepted by the server or attacked the server based on the request type, virtual address, geographic location, etc. corresponding to the sample call requests; and manually tag them based on the statistical number of times and whether the sample interface call requests are high-frequency requests or requests issued by high-frequency users.

[0099] For example, if the virtual address of a sample interface call request has not been intercepted or attacked by the server in history, but is not a high-frequency request or a request from a high-frequency user, the manually marked security value can be marked as 0.6. For another example, if the virtual address of a sample interface call request has been used to attack the server in the past, the security value of the sample interface call request will not be preset to the highest value. For another example, if a client is sending an interface call request for the first time, that is, the client is not a high-frequency user, the security value corresponding to the sample interface call request issued by the client will be preset to a relatively low value.

[0100] In some embodiments, the processor can obtain one or more training samples and the label corresponding to each training sample; perform multiple rounds of iterations, and when the iteration end condition is met, end the iteration to obtain a trained protection model. Each round of iteration includes: selecting a training sample from the training samples, inputting the training sample into the initial protection model, and obtaining the predicted output of the initial protection model corresponding to the training sample; according to the predicted output and the label of the training sample, substituting them into the formula of a predefined loss function to calculate the value of the loss function; according to the value of the loss function, reversely updating the model parameters in the initial protection model. Various methods can be used to reversely update the model parameters in the protection model. For example, the model parameters in the initial protection model can be reversely updated based on the gradient descent method. The iteration end condition may include the number of iterations reaching a threshold, etc.

[0101] In some embodiments of the present specification, through a trained protection model, the processor can quickly obtain a security value corresponding to a relatively reasonable interface call request.

[0102] Step 320 : Based on the security value 313 and the security value threshold 321 , determine whether to enable the backend security component 322 .

[0103] The safety value threshold refers to the critical value of the safety value. The safety value threshold used for the first time can be preset by those skilled in the art based on experience.

[0104] In some embodiments, the processor may update the security threshold at predetermined intervals to obtain an updated security threshold. Thus, when the server is under intensive attack (i.e., the average security threshold may be significantly reduced), the security threshold is automatically raised to enable more interface call requests to activate the backend security component. When the server is under less attack (i.e., the average security threshold may be significantly increased), the security threshold is automatically lowered to enable fewer interface call requests to activate the backend security component, thereby reducing the server hardware load.

[0105] In some embodiments, the updated safety value threshold is related to an average safety value within a recent preset time period.

[0106] The average security value refers to the average value of the security values ​​corresponding to all interface call requests received by the front-end call component within a preset time period.

[0107] The most recent preset period refers to the time period between the current update of the safety value threshold and the last update of the safety value threshold. The length of the most recent preset period can be determined in a variety of ways. For example, the length of the most recent preset period can be preset by a person skilled in the art based on experience. For example, the most recent preset period can be 5 minutes before the time point of the interface call request. The length of the preset period can reflect the frequency of updating the safety value threshold.

[0108] In some embodiments, the length of the preset time period is related to the request density of the interface call requests.

[0109] Request density refers to the number of interface call requests received by the front-end call component per second.

[0110] In some embodiments, the greater the request density, the shorter the length of the preset period can be. As an example only, the processor can use the following first algorithm to determine the length of the adjusted preset period:

[0111] The length of the adjusted preset period = original length * (1 - request density of the most recent preset period / request density of the previous preset period). The previous preset period refers to the period between the last update of the safety threshold and the last update of the safety threshold. The original length refers to the length of the preset period after the last update. The original length of the preset period used for the first time can be preset by those skilled in the art based on experience.

[0112] In some embodiments of the present specification, the length of the preset time period is related to the request density, and the update frequency of the security value threshold can be dynamically adjusted according to the number of interface call requests, thereby ensuring the protection effect while avoiding excessive increase in the burden on the server.

[0113] In some embodiments, the processor may use the following second algorithm to determine the updated safety value threshold:

[0114] Updated safety threshold = original safety threshold * (1 - average safety value of the most recent preset period / average safety value of the previous preset period). The original safety threshold refers to the safety threshold after the last update. The original safety threshold set for the first time can be preset by those skilled in the art based on experience.

[0115] In some embodiments of the present specification, the security value threshold is updated every preset period, which can better dynamically adjust whether to enable the backend security component.

[0116] In some embodiments, the processor may compare a security value corresponding to the interface call request with a security value threshold, and determine to enable the backend security component in response to the security value corresponding to the interface call request being lower than the security value threshold.

[0117] In some embodiments, the backend security component is configured to perform protection processing on subsequent interface call requests.

[0118] In some embodiments, the backend security component is a plug-in module structure, and whether it is enabled is controlled by the processor.

[0119] The plug-in module structure allows the software to enhance or expand the functionality of the backend security software by loading specific plug-ins.

[0120] In some embodiments of this specification, whether to enable backend security components is determined based on security values ​​and security value thresholds, so as to minimize the additional feedback lag caused by WebAPI protection while ensuring server security.

[0121] In addition, the back-end security components are set up as a minimally invasive plug-in module structure to improve the security of the server. At the same time, it can also provide targeted security protection and is easy to start and stop.

[0122] Figure 4 This is another exemplary flow chart for determining whether to enable backend security components according to some embodiments of this specification. Figure 4 As shown, the process 400 includes the following steps 410 to 440. In some embodiments, the process 400 may be executed by the protection component 120 controlled by the processor 110.

[0123] Step 410: Based on the interface call request, estimate the waiting time corresponding to executing the protection process.

[0124] The protection process refers to the protection component's processing of interface call requests. For a description of interface call requests, see Figure 2 The instructions in step 210 in FIG.

[0125] Waiting time refers to the time between when a user sends an interface call request and when the user terminal receives feedback data from the server. If the waiting time is too long, the user may resend the interface call request through the user terminal.

[0126] In some embodiments, the waiting time includes the time corresponding to executing the call request instruction, encryption processing, and decryption processing.

[0127] In some embodiments, the processor can estimate the waiting time corresponding to the execution of the protection process through the waiting schedule based on the interface request parameters corresponding to the interface call request, the interface request metadata, and whether the interface call request is a high-frequency request.

[0128] The waiting time table contains the reference interface request parameters and metadata corresponding to the reference interface call request, as well as the relationship between whether the reference interface call request is a high-frequency request and the estimated reference waiting time corresponding to the execution protection process. For instructions on how to determine whether a reference interface call request is a high-frequency request, see Figure 2 Relevant instructions in step 220.

[0129] The waiting time table can be determined based on historical interface processing data. Historical interface processing data refers to data related to historical interface call requests. Historical interface processing data may include interface request parameters, high-frequency attributes of historical interface call requests, and the average historical waiting time corresponding to the metadata of the same type of interface requests. The high-frequency attributes of historical interface call requests can be used to indicate whether the historical interface call requests are high-frequency requests or not. For methods to determine whether historical interface call requests are high-frequency requests, please refer to Figure 2 Instructions in step 220.

[0130] For example, the processor can construct a waiting time table based on the correspondence between the same interface request parameters, high-frequency attributes of historical interface call requests, the same type of interface request metadata and the average historical waiting time corresponding to the same type of interface request metadata in historical interface processing data.

[0131] Step 420: After receiving the interface call request from the client, obtain the number and interval of target interface call requests from the client.

[0132] The target interface call request refers to an interface call request that meets a preset condition. The preset condition can be an interface call request of the same request type sent by the same client within a preset time period.

[0133] The number of target interface call requests refers to the total number of interface call requests of the same request type sent by the same client as of the current moment.

[0134] The interval time refers to the time interval between the current target interface call request and the previous target interface call request of the same request type sent by the same client.

[0135] In some embodiments, the number and interval time of each target interface call request of the same client can be represented by a vector, such as, (request 1, number 1, request type (e.g., login request), request time point (10:04:24), interval time 0 seconds; request 2, number 2, request type (e.g., login request), request time point (10:04:53), interval time 29 seconds;....).

[0136] In some embodiments, after receiving an interface call request from a client, the processor may determine the number and interval of target interface call requests from the same client based on interface request parameters corresponding to all interface call requests sent by the same client.

[0137] Step 430: Evaluate the impact of the waiting time on the user based on the number of times and the interval time.

[0138] The degree of influence can represent the user's dislike for a certain waiting time length. In some embodiments, the degree of influence can be represented by a numerical value, where a larger numerical value indicates that the user is more disliked at the waiting time and is more inclined to resend the interface call request on the same client.

[0139] In some embodiments, the greater the number of times and the longer the interval, the greater the impact of the waiting time on the user. As an example only, the processor can use the following third algorithm to determine the impact of the waiting time on the user:

[0140] The impact of waiting time on users Where i refers to the i-th interface call request, n refers to the total number of interface call requests of the same request type as the interface call request currently issued by the client; t i is the interval between the current interface call request and the most recent target interface call request among interface call requests of the same request type as the interface call request currently issued by the client; a1 is the first preset coefficient; and e is an irrational number. The preset coefficient can be preset by those skilled in the art based on experience.

[0141] In some embodiments, the processor may further evaluate the impact of the waiting time on the user based on the number of times, the interval time, whether the user is a high-frequency customer, and / or whether the target interface call request is a high-frequency request.

[0142] In some embodiments, the processor may adjust the value of the first preset coefficient a1 in the aforementioned third algorithm to a larger second preset coefficient a2 in response to the user being a high-frequency client and / or the target interface call request being a high-frequency request, and then evaluate the impact of the waiting time on the user according to the aforementioned third algorithm.

[0143] In some embodiments, the processor may use the following fourth algorithm to determine the second preset coefficient a2:

[0144] The second preset coefficient a2=a1*(1+number of target interface call requests / 100).

[0145] In some embodiments of the present specification, when determining the degree of impact, it is also considered whether the user is a high-frequency customer and / or whether the target interface call request is a high-frequency request. This can effectively ensure the usage experience of high-frequency users and avoid causing user disgust while ensuring server security.

[0146] Step 440: Determine whether to enable the backend security component based on the impact level.

[0147] In some embodiments, the processor may compare the impact level with a preset impact level threshold. If the impact level is greater than the preset impact level threshold, the backend security component is not enabled; otherwise, the backend security component is enabled. The impact level threshold may be preset by those skilled in the art based on experience. For example, the impact level threshold may be the maximum impact level corresponding to the client's historical interface processing data, including historical interface call requests that attacked the server or were intercepted by the server.

[0148] In some embodiments, the processor may further determine whether to enable the backend security component based on the impact level and the security value.

[0149] In some embodiments, the processor may use the product of the impact level and the security value as the revised security value; and in response to the revised security value being less than the security value threshold, determine to enable the backend security component, otherwise do not enable the backend security component. For details about the security value and the security value threshold, see Figure 3 Instructions in .

[0150] In some embodiments of this specification, by evaluating the impact of waiting time on users, it is possible to effectively assess whether the client is at risk of attacking the server, and then decide whether to enable back-end security components, while providing reasonable security protection and avoiding affecting the experience of non-malicious users.

[0151] In addition, before deciding whether to enable back-end security software, in addition to evaluating the security of the target interface call request, a reasonable assessment should be made of the impact of the delay (i.e., waiting time) caused by enabling the back-end security software on the client. The back-end security software can be applied in a targeted manner for protection, reducing the probability of a successful attack on the server while avoiding affecting the user experience of normal users.

[0152] While the basic concepts have been described above, it will be apparent to those skilled in the art that the detailed disclosure is merely illustrative and does not limit this specification. Although not explicitly stated herein, various modifications, improvements, and revisions to this specification may be made by those skilled in the art. Such modifications, improvements, and revisions are suggested in this specification and remain within the spirit and scope of the exemplary embodiments of this specification.

[0153] This specification also uses specific terms to describe the embodiments of this specification. For example, "one embodiment," "an embodiment," and / or "some embodiments" refer to a feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "one embodiment," "an embodiment," or "an alternative embodiment" two or more times in different locations in this specification do not necessarily refer to the same embodiment. Furthermore, certain features, structures, or characteristics of one or more embodiments of this specification may be appropriately combined.

[0154] In addition, unless expressly stated in the claims, the order of the processing elements and sequences, the use of alphanumeric characters, or the use of other names described in this specification are not intended to limit the order of the processes and methods of this specification. Although the above disclosure discusses some of the invention embodiments currently considered useful through various examples, it should be understood that such details are for illustrative purposes only, and the appended claims are not limited to the disclosed embodiments. On the contrary, the claims are intended to cover all modifications and equivalent combinations that are consistent with the spirit and scope of the embodiments of this specification. For example, although the system components described above can be implemented by hardware devices, they can also be implemented only by software solutions, such as installing the described system on an existing server or mobile device.

[0155] Similarly, it should be noted that, in order to simplify the presentation of this specification and thus facilitate understanding of one or more embodiments of the invention, the foregoing descriptions of the embodiments of this specification sometimes combine multiple features into a single embodiment, figure, or description thereof. However, this disclosure method does not imply that the subject matter of this specification requires more features than those recited in the claims. In fact, an embodiment may have fewer features than all of the features of a single disclosed embodiment.

[0156] In some embodiments, numbers are used to describe the quantity of components and attributes. It should be understood that such numbers used in the description of the embodiments are modified by the modifiers "about", "approximately" or "substantially" in some examples. Unless otherwise stated, "about", "approximately" or "substantially" indicate that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in the description and claims are approximate values, which may change according to the required characteristics of individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and adopt the general method of retaining digits. Although the numerical domains and parameters used to confirm the breadth of their range in some embodiments of this specification are approximate values, in specific embodiments, the settings of such numerical values ​​are as accurate as possible within the feasible range.

[0157] Each patent, patent application, patent application publication, and other materials, such as articles, books, specifications, publications, and documents, cited in this specification is hereby incorporated by reference in its entirety. This includes application history documents that are inconsistent with or conflict with the content of this specification, as well as documents (currently or subsequently attached to this specification) that limit the broadest scope of the claims of this specification. It should be noted that if the descriptions, definitions, and / or terminology used in the accompanying materials are inconsistent or conflicting with the content of this specification, the descriptions, definitions, and / or terminology used in this specification will control.

[0158] Finally, it should be understood that the embodiments described in this specification are intended only to illustrate the principles of the embodiments of this specification. Other variations may also fall within the scope of this specification. Therefore, by way of example and not limitation, alternative configurations of the embodiments of this specification may be considered consistent with the teachings of this specification. Accordingly, the embodiments of this specification are not limited to the embodiments explicitly described and illustrated in this specification.

Claims

1. A WebAPI protection method, characterized in that: The WebAPI protection method is executed by a processor-controlled protection component, which includes a front-end call component and a back-end security component. The back-end security component is configured to perform protection processing on interface call requests. The back-end security component is a plug-in module structure, and the processor controls whether to enable it. The method comprises: Receiving an interface call request from a client through the front-end calling component, wherein the interface call request corresponds to an interface request parameter; Controlling the front-end calling component to determine a call request instruction matching the interface call request according to the interface request parameters; Controlling the front-end calling component to receive the interface request metadata sent by the client according to the call request instruction, and encrypting the interface request metadata to generate a first ciphertext; receiving the first ciphertext through the backend security component, and decrypting the first ciphertext to regenerate the interface request metadata; In response to satisfying a preset call condition, sending the interface request metadata to a backend service component through the backend security component; receiving feedback data from the backend service component through the backend security component, and encrypting the feedback data to generate a second ciphertext; Receive the second ciphertext through the front-end calling component and perform decryption processing to regenerate the feedback data; and Sending the feedback data to the client through the front-end calling component; The method further comprises: Based on the interface request parameters corresponding to the interface call request, the interface request metadata, and the number of interface call requests issued by the same client, a security value of the interface call request is determined through a protection model, where the protection model is a machine learning model; Based on the security value and the security value threshold, it is determined whether to enable the backend security component.

2. The WebAPI protection method according to claim 1, characterized in that: The front-end calling component further includes a cache component, wherein the cache component is configured to cache the call request instructions corresponding to high-frequency requests and / or high-frequency user interface call requests; The controlling the front-end calling component to determine a call request instruction matching the interface call request according to the interface request parameter includes: In response to identifying the high-frequency request or the high-frequency user, the front-end calling component is controlled to determine the call request instruction corresponding to the high-frequency request and / or the interface call request of the high-frequency user through the cache component according to the interface request parameters.

3. The WebAPI protection method according to claim 1, characterized in that: The method further comprises: Based on the interface call request, estimate the waiting time corresponding to executing the protection process, the waiting time including the waiting time corresponding to executing the call request instruction, the encryption process, and the decryption process; After receiving the interface call request sent by the client, obtaining the number and interval of target interface call requests from the client, wherein the target interface call request is the interface call request that meets a preset condition; Based on the number of times and the interval time, evaluating the impact of the waiting time on the user; and Based on the impact level, it is determined whether to enable the backend security component.

4. A WebAPI protection system, characterized in that: The system comprises a processor and a protection component, the processor and the protection component are electrically connected, the protection component comprises a front-end call component and a back-end security component; the back-end security component is configured to perform protection processing of interface call requests, the back-end security component is a plug-in module structure, and whether it is enabled is controlled by the processor; The processor is configured to: Receiving an interface call request from a client through the front-end calling component, wherein the interface call request corresponds to an interface request parameter; Controlling the front-end calling component to determine a call request instruction matching the interface call request according to the interface request parameters; Controlling the front-end calling component to receive the interface request metadata sent by the client according to the call request instruction, and encrypting the interface request metadata to generate a first ciphertext; receiving the first ciphertext through the backend security component, and decrypting the first ciphertext to regenerate the interface request metadata; In response to satisfying a preset call condition, sending the interface request metadata to a backend service component through the backend security component; receiving feedback data from the backend service component through the backend security component, and encrypting the feedback data to generate a second ciphertext; Receiving the second ciphertext through the front-end calling component and performing decryption processing to regenerate the feedback data; as well as Sending the feedback data to the client through the front-end calling component; The processor is further configured to: Based on the interface request parameters corresponding to the interface call request, the interface request metadata, and the number of interface call requests issued by the same client, a security value of the interface call request is determined through a protection model, where the protection model is a machine learning model; Based on the security value and the security value threshold, it is determined whether to enable the backend security component.

5. The system according to claim 4, characterized in that The front-end calling component further includes a cache component, wherein the cache component is configured to cache the call request instructions corresponding to high-frequency requests and / or high-frequency user interface call requests; The processor is further configured to: In response to identifying the high-frequency request or the high-frequency user, the front-end calling component is controlled to determine the call request instruction corresponding to the high-frequency request and / or the interface call request of the high-frequency user through the cache component according to the interface request parameters.

6. The system according to claim 4, characterized in that The processor is further configured to: Based on the interface call request, estimate the waiting time corresponding to executing the protection process, the waiting time including the waiting time corresponding to executing the call request instruction, the encryption process, and the decryption process; After receiving the interface call request sent by the client, obtaining the number and interval of target interface call requests from the client, wherein the target interface call request is the interface call request that meets a preset condition; Based on the number of times and the interval time, evaluating the impact of the waiting time on the user; as well as Based on the impact level, it is determined whether to enable the backend security component.

7. A WebAPI protection device, characterized in that: The apparatus comprises at least one processor and at least one memory; The at least one memory is for storing computer instructions; The at least one processor is used to execute at least part of the computer instructions to implement the WebAPI protection method as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that The storage medium stores computer instructions. When the computer reads the computer instructions in the storage medium, the computer executes the WebAPI protection method according to any one of claims 1 to 3.

Images