Automatic evaluation and reinforcement processing method, system and equipment for security configuration of service interface and storage medium

Abstract

The invention relates to a service interface security configuration automatic evaluation and reinforcement processing method, system and device and a storage medium. The method comprises the steps of receiving a security evaluation request submitted by a user, and generating a service interface behavior portrait in combination with an interface historical access record; identifying potential security risk points of the service interface through an anomaly detection algorithm, and outputting a detailed risk assessment report; based on the detailed risk assessment report, a decision tree algorithm is adopted to monitor the influence of the reinforcement process on the service interface performance, and a reinforced performance monitoring report is generated; and performing security assessment verification on the reinforced service interface to generate an optimized security configuration report. According to the method, by integrating an advanced data analysis technology and a security protection strategy, the accuracy and efficiency of security assessment are improved, automation and performance monitoring of security reinforcement measures and continuous optimization of security configuration are also realized, and an efficient, reliable and intelligent security management solution is provided for a user.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a method, system, device and storage medium for automated evaluation and reinforcement of service interface security configuration. Background Art

[0002] With the development of Internet technology, various online services and applications are increasing day by day. As a bridge for communication between different systems, the security of service interfaces has become particularly important. In many fields such as finance, e-commerce, and medical care, the security of service interfaces is directly related to the security of user data and the protection of personal privacy. Therefore, regular security assessments of interfaces and timely discovery and repair of potential security vulnerabilities have become one of the important means to ensure system security. However, traditional security assessment methods often rely on manual audits, which are time-consuming and costly, and cannot meet rapidly changing business needs.

[0003] At present, there are some tools and platforms for service interface security assessment on the market, which mainly use a combination of static analysis and dynamic testing to perform security checks on service interfaces. Static analysis focuses on code-level review, aiming to find coding errors and potential security vulnerabilities; dynamic testing simulates real attacks and detects the behavior of the interface by sending specific requests to identify security issues. In addition, some solutions try to combine machine learning technology to establish a normal behavior model by analyzing the historical access records of the interface, and then detect abnormal behavior.

[0004] Although existing service interface security assessment solutions have achieved certain results, there are still some shortcomings. First, although static analysis and dynamic testing can discover some security issues, their ability to identify complex business logic and hidden security threats is limited. Second, most solutions lack an in-depth understanding of service interface behavior and dynamic adaptability, and are unable to automatically adjust security policies based on the actual usage of the interface. Finally, existing solutions often ignore the impact assessment of service interface performance during security reinforcement, which may lead to a decrease in interface performance after the reinforcement measures are implemented, affecting user experience and service quality. Therefore, a more intelligent, automated service interface security assessment method that takes into account both security and performance is needed. Summary of the invention

[0005] The present invention provides a method, system, device and storage medium for automatically evaluating and reinforcing the security configuration of a service interface, which can solve the problem of limited identification capability of the prior art for complex business logic and hidden security threats. The specific technical solution is as follows:

[0006] In a first aspect, the present invention provides a method for automatically evaluating and reinforcing a service interface security configuration, including the following process:

[0007] S100: receiving a security assessment request submitted by a user, processing service interface identification information, and generating a service interface behavior profile in combination with historical interface access records;

[0008] S200: Based on the service interface behavior profile, identify potential security risk points of the service interface through an anomaly detection algorithm, and output a detailed risk assessment report in combination with interface configuration parameters;

[0009] S300: Based on the detailed risk assessment report, a decision tree algorithm is used to monitor the impact of the reinforcement process on the service interface performance by interacting with the service interface management system API, ensure automation of reinforcement measures, and generate a performance monitoring report after reinforcement;

[0010] S400: Based on the performance monitoring report after reinforcement, security assessment and verification are performed on the reinforced service interface to ensure the effectiveness of the reinforcement measures, and an optimized security configuration report is generated through feedback optimization mechanism adjustments.

[0011] In a second aspect, the present invention provides a service interface security configuration automated assessment and reinforcement processing system, comprising:

[0012] The receiving module is used to receive the security assessment request submitted by the user, process the service interface identification information, and generate the service interface behavior profile in combination with the historical access record of the interface;

[0013] An identification module is used to identify potential security risk points of the service interface based on the service interface behavior profile through an anomaly detection algorithm, and output a detailed risk assessment report in combination with interface configuration parameters;

[0014] A monitoring module is used to monitor the impact of the reinforcement process on the performance of the service interface based on the detailed risk assessment report, using a decision tree algorithm, by interacting with the service interface management system API, ensuring the automation of reinforcement measures, and generating a performance monitoring report after reinforcement;

[0015] The adjustment module is used to perform security assessment and verification on the reinforced service interface based on the reinforced performance monitoring report, ensure the effectiveness of the reinforcement measures, and generate an optimized security configuration report through feedback optimization mechanism adjustment.

[0016] In a third aspect, the present invention provides a computing device comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a service interface security configuration automated assessment and reinforcement processing method as described in the first aspect.

[0017] In a fourth aspect, the present invention provides a computer storage medium storing a computer program, which, when executed by a computer, implements a method for automated assessment and reinforcement of service interface security configuration as described in the first aspect.

[0018] The advantages of the present invention over the prior art are as follows:

[0019] (I) The present invention can quickly and accurately identify the normal behavior pattern of the service interface by receiving the security assessment request submitted by the user, processing the service interface identification information, and generating the service interface behavior portrait in combination with the interface historical access record. Based on this behavior portrait, the potential security risk points of the service interface are identified through the anomaly detection algorithm, which improves the accuracy and efficiency of the security assessment; combined with the interface configuration parameters, a detailed risk assessment report is output, which can not only point out the existing security risk points, but also provide specific risk levels and possible impact ranges, helping managers make more scientific and reasonable risk management decisions; based on the detailed reputation report, a decision tree algorithm is adopted, and the automatic deployment of security reinforcement measures is realized through interaction with the service interface management system API. At the same time, the impact of the reinforcement process on the performance of the service interface is monitored to ensure that the reinforcement measures will not negatively affect the normal operation of the system, thereby improving the stability and security of the system; based on the performance monitoring report after reinforcement, the security assessment verification of the reinforced service interface is carried out to ensure the effectiveness of the reinforcement measures. By establishing a feedback optimization mechanism, the security configuration can be adjusted according to the actual operation situation, and the continuous optimization of security protection is realized, which improves the long-term security and reliability of the system. In summary, this method not only improves the accuracy and efficiency of security assessment by integrating advanced data analysis technology and security protection strategies, but also realizes the automation and performance monitoring of security reinforcement measures, as well as the continuous optimization of security configuration, providing users with an efficient, reliable and intelligent security management solution.

[0020] (ii) In the embodiments, by generating a normal behavior baseline for the service interface and using an anomaly detection algorithm to identify abnormal activities, it is possible to more accurately identify potential security risk points, reduce false positives and negative alerts, and improve the accuracy of security assessments; in combination with the configuration parameters of the service interface, the authenticity of the security threats posed by abnormal activities is deeply analyzed, the risk level is calculated, and risk assessment results are generated, providing managers with a more detailed and reliable basis for decision-making; based on the risk assessment results, the impact of potential security risk points is comprehensively analyzed, targeted measures are recommended, and a detailed risk assessment report is generated to ensure the effectiveness and pertinence of security protection measures and improve the overall security of the system.

[0021] (III) In the embodiments, by generating a normal behavior baseline of the service interface and using an anomaly detection algorithm to identify abnormal activities, it is possible to more accurately identify potential security risk points, reduce false positives and false negatives, and improve the accuracy of security assessments; in combination with the configuration parameters of the service interface, the authenticity of the security threats posed by abnormal activities is deeply analyzed, the risk level is calculated, and risk assessment results are generated, providing managers with a more detailed and reliable basis for decision-making; based on the risk assessment results, the impact of potential security risk points is comprehensively analyzed, targeted measures are recommended, and a detailed risk assessment report is generated to ensure the effectiveness and pertinence of security protection measures and improve the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A flowchart of a method for automated assessment and reinforcement of service interface security configuration provided by the present invention;

[0024] Figure 2 A schematic diagram of the structure of a service interface security configuration automated assessment and reinforcement processing system provided by the present invention;

[0025] Figure 3 A schematic diagram of the structure of a computing device provided by the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the present invention.

[0027] In some of the processes described in the specification and claims of the present invention and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The sequence numbers of the operations, such as S100, S200, etc., are only used to distinguish different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0028] The following will be combined with the accompanying drawings of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0029] like Figure 1 As shown, a method for automatically evaluating and reinforcing the security configuration of a service interface includes the following steps:

[0030] S100: receiving a security assessment request submitted by a user, processing service interface identification information, and generating a service interface behavior profile in combination with historical interface access records;

[0031] Security assessment requests initiated by users in some way, such as API calls, web form submissions, etc., usually contain the service interface identification information to be evaluated and other related parameters; information used to uniquely identify a service interface, such as interface name, path, version number, etc.; all access records of the service interface in the past period of time, including request time, request method, request parameters, response time, response status code and other data; a model describing the normal behavior pattern of the service interface generated by analyzing the historical access records of the interface, including common request frequency, response time distribution, common request parameters and other features; the system receives the security assessment request submitted by the user and parses the service interface identification information in the request; obtains the historical access records of the interface from the database or log system based on the service interface identification information; uses the historical access records to generate a behavior profile of the service interface through statistical analysis and machine learning methods. The behavior profile reflects the behavior pattern of the interface under normal working conditions and provides a benchmark for subsequent anomaly detection.

[0032] Suppose there is an online payment platform that provides multiple service interfaces for third-party applications to call, such as payment interface, order query interface, etc. In order to ensure the security of these interfaces, the platform needs to conduct security assessments regularly; users (such as the platform's security administrator) submit security assessment requests through the Web interface or API interface provided by the platform; the request contains the service interface identification information to be evaluated, such as the interface name ( / api / payment), interface version (v1.0), etc.; after receiving the request, the system parses the service interface identification information in the request; the parsed information is stored in a temporary variable or database for subsequent processing; the system queries the historical access records of the interface from the log system or database based on the service interface identification information; the historical access records include the timestamp of each request, request method (GET, POST, etc.), request parameters, response time, response status code, etc.; the obtained historical access records are statistically analyzed to calculate the following features: the average number of requests per minute; the average, median, maximum, minimum, etc. of the response time; the request parameters with higher frequency and their common values; the number of occurrences and proportions of each response status code. Use machine learning methods (such as cluster analysis, principal component analysis, etc.) to model these features and generate service interface behavior profiles.

[0033] S200: Based on the service interface behavior profile, identify potential security risk points of the service interface through an anomaly detection algorithm, and output a detailed risk assessment report in combination with interface configuration parameters;

[0034] Algorithms used to identify abnormal activities that deviate from normal behavior patterns, such as statistical-based methods and machine learning-based methods; possible security issues identified by anomaly detection algorithms, such as abnormal request frequencies, abnormal request parameters, abnormal response times, etc.; configuration information of service interfaces, such as authentication methods, permission control, input validation rules, etc., to assist in assessing the authenticity and severity of security risks; based on the generated service interface behavior portrait, use anomaly detection algorithms to conduct comparative analysis of the actual behavior of the service interface, identify abnormal activities that deviate from normal behavior, and generate potential security risk points; combine interface configuration parameters to conduct in-depth analysis of potential security risk points, assess the authenticity of security threats posed by abnormal activities, and calculate risk levels; summarize the assessment results to generate a detailed risk assessment report, which includes identified security risk points, risk levels, possible impact ranges, and recommended countermeasures.

[0035] The S200 includes the following process:

[0036] S210: Analyze the behavior pattern, request frequency, response time and other characteristics of the service interface using the service interface behavior profile to generate a normal behavior baseline;

[0037] S220: Based on the normal behavior baseline, using an anomaly detection algorithm, performing a comparative analysis on the actual behavior of the service interface,

[0038] Identify abnormal activities that deviate from normal behavior and generate potential security risk points;

[0039] S230: Based on the potential security risk points and in combination with the configuration parameters of the service interface, deeply analyze the abnormal activities, evaluate the authenticity of the security threats of the abnormal activities, calculate the risk level, and generate a risk assessment result;

[0040] S240: Based on the risk assessment results, comprehensively analyze the impact of the potential safety risk points, formulate targeted measures and suggestions, and generate a detailed risk assessment report.

[0041] Suppose there is an e-commerce platform that provides an order query interface. In order to ensure the security of this interface, the platform needs to conduct security assessments regularly. The common request method is GET, and the request parameters include order_id and customer_id; the average number of requests per minute is 20; the average response time is 150 milliseconds, the median is 140 milliseconds, the maximum is 300 milliseconds, and the minimum is 100 milliseconds; the common values ​​of order_id and customer_id are 12345 and user123 respectively; the status code 200 appears the most, accounting for 90%; the system collected access records for the most recent day and found that the response time of some requests significantly exceeded the normal range, and the request frequency also increased significantly; using a statistical-based method, the deviation of actual behavior data from the normal behavior baseline was calculated; it was found that the response time of some requests exceeded 300 milliseconds, and the request frequency reached 50 times per minute, generating potential security risk points; abnormal response time and abnormal request frequency; the authentication method is OAuth2.0, and the permission control is to only allow authorized users to access, and the input verification rules include that order_id and customer_id must be filled in and the format is correct; combined with the interface configuration parameters, the authenticity of the security threat of abnormal activities is evaluated. It was found that the order_id and customer_id formats of some requests were correct, but the source IP addresses changed frequently, which may indicate malicious scanning behavior; the risk level of abnormal response time and abnormal request frequency was medium, and the possible impact range included increased server load and user access delay; a detailed risk assessment report was generated: the security risk points were abnormal response time and abnormal request frequency; the risk level was medium; the possible impact range included increased server load and user access delay; the recommended countermeasures were to increase the request frequency limit to no more than 30 times per minute; introduce an IP blacklist mechanism to limit frequently accessed IP addresses; and regularly audit logs to monitor abnormal activities.

[0042] Through the above steps, the system successfully generated a detailed risk assessment report for the order query interface, providing a basis for subsequent security reinforcement and management.

[0043] The present invention considers that in the security management of service interfaces, identifying and handling abnormal activities is the key to ensuring system stability and security. The proposed method uses an anomaly detection algorithm to compare and analyze the actual behavior of the service interface, identify abnormal activities that deviate from normal behavior, and generate potential security risk points.

[0044] The S220 includes the following process:

[0045] S221: Collect historical access records of the service interface and pre-process the behavior feature data of the service interface;

[0046] S222: extract key behavior features, combine request frequency and response time, generate statistical parameters of key behavior features, and provide basic support for local density value and anomaly score calculation;

[0047] S223: Calculate the local density value using the following formula:

[0048]

[0049] Among them, D i is the local density value of the ith data point; X i is the actual value of the behavior characteristics of the ith service interface, such as request frequency, response time, etc.; X j is the actual value of the jth service interface behavior feature; i is the index of the data point, from i to N; N is the total number of data points; σ is the standard deviation of the Gaussian kernel; d(X i ,X j ) is X i and X j The Euclidean distance between them; ∈ is the neighborhood radius parameter;

[0050] S224: Calculate the abnormality score using the following formula:

[0051]

[0052] Among them, Z i is the abnormal score of the i-th data point; D i is the local density value of the i-th data point; is the maximum value of all local density values; tanh is the hyperbolic tangent function; α is the hyperbolic tangent adjustment coefficient, which is used to enhance the sensitivity to extreme values; β is the logarithmic adjustment coefficient, which is used to enhance the sensitivity to large deviation values; is the average value of all local density values; σ D is the standard deviation of all local density values;

[0053] S225: Based on the local density value D i and anomaly score Z i , normalize the anomaly scores to ensure that the anomaly scores of different features are comparable, introduce multiple nonlinear adjustment items to enhance the sensitivity to different types of outliers, and generate a comprehensive anomaly score; calculate the comprehensive anomaly score through the following formula:

[0054]

[0055] Among them, S is the comprehensive abnormality score; Z i is the anomaly score of the i-th data point; i is the index of the data point, from i to N; N is the total number of data points; is the maximum value of all anomaly scores; γ is the sine adjustment coefficient, which is used to capture periodic changes; δ is the S-type function adjustment coefficient, which is used to enhance the sensitivity to extreme values; θ is the logarithmic S-type function adjustment coefficient, which is used to enhance the sensitivity to small deviation values; φ is the square root adjustment coefficient, which is used to enhance the sensitivity to medium deviation values; is the average of all anomaly scores; σ Z is the standard deviation of all anomaly scores;

[0056] S226: Setting a specific threshold value. If the comprehensive anomaly score S exceeds the specific threshold value, marking the data point corresponding to the comprehensive anomaly score S, and treating the data point as a potential security risk point.

[0057] This method aims to identify abnormal activities that deviate from normal behavior by comprehensively considering the data of various behavioral characteristics in the service interface, using local density values ​​and anomaly score calculations, generating potential security risk points, and ensuring that the system can promptly detect and handle potential security threats.

[0058] At the local density value D i In, X i is the actual value of the behavior characteristics of the ith service interface, such as request frequency, response time, etc.; X j is the actual value of the jth service interface behavior feature; i is the index of the data point, from 1 to N; N is the total number of data points; σ is the standard deviation of the Gaussian kernel; d(X i ,X j ) is X i and X j The Euclidean distance between them; ∈ is the neighborhood radius parameter.

[0059] In the anomaly score Z i In, Z i is the abnormal score of the i-th data point; D i is the local density value of the i-th data point; is the maximum value of all local density values; tanh is the hyperbolic tangent function; α is the hyperbolic tangent adjustment coefficient, which is used to enhance the sensitivity to extreme values; β is the logarithmic adjustment coefficient, which is used to enhance the sensitivity to large deviation values; is the average value of all local density values; σ D is the standard deviation of all local density values.

[0060] In the comprehensive anomaly score S, Z i is the anomaly score of the i-th data point; i is the index of the data point, from 1 to N; N is the total number of data points; is the maximum value of all anomaly scores; γ is the sine adjustment coefficient, which is used to capture periodic changes; δ is the S-type function adjustment coefficient, which is used to enhance the sensitivity to extreme values; θ is the logarithmic S-type function adjustment coefficient, which is used to enhance the sensitivity to small deviation values; φ is the square root adjustment coefficient, which is used to enhance the sensitivity to medium deviation values; is the average of all anomaly scores; σ Z is the standard deviation of all anomaly scores.

[0061] Among them, σ is usually set through experiments or experience to smooth data; d(X i ,X j ) is the Euclidean distance between the i-th and j-th data points; ∈ is usually set through experiments or experience to define the neighborhood range; D i Obtained by calculating the local density value formula; is the maximum value of all local density values; α is usually set through experiments or experience to enhance the sensitivity to extreme values; β is usually set through experiments or experience to enhance the sensitivity to large deviation values; and σ D Obtained by calculating the mean and standard deviation of all local density values; Z i Obtained by calculating the anomaly score formula; is the maximum value of all anomaly scores; γ is usually set through experiments or experience to capture periodic changes; δ is usually set through experiments or experience to enhance the sensitivity to extreme values; θ is usually set through experiments or experience to enhance the sensitivity to small deviation values; φ is usually set through experiments or experience to enhance the sensitivity to medium deviation values; and σ Z Obtained by calculating the mean and standard deviation of all anomaly scores.

[0062] Suppose there is an online payment platform that provides a payment interface / api / payment. In order to ensure the security of this interface, it is necessary to identify potential security risk points through anomaly detection algorithms. The following are the detailed steps.

[0063] Collect access records of service interfaces in the past month, including request frequency, response time, etc.; extract request frequency and response time as key behavioral features; generate statistical parameters of request frequency and response time, such as mean, standard deviation, etc.

[0064] Local density value formula:

[0065]

[0066] Among them, X i and X j is the actual value of request frequency and response time; σ is the standard deviation of the Gaussian kernel, which is set to 1.0; d(X i ,X j ) is X i and X j The Euclidean distance between them; ∈ is the neighborhood radius parameter, which is set to 0.5.

[0067] Anomaly score formula:

[0068]

[0069] Among them, D i is the local density value of the i-th data point; is the maximum value among all local density values; α is the hyperbolic tangent adjustment coefficient, which is set to 0.5; β is the logarithmic adjustment coefficient, which is set to 0.3; and σ D is the mean and standard deviation of all local density values.

[0070] Comprehensive anomaly score formula:

[0071]

[0072] Among them, Z i is the anomaly score of the i-th data point; is the maximum value of all abnormal scores; γ is the sine adjustment coefficient, set to 0.4; δ is the S-type function adjustment coefficient, set to 0.6; θ is the logarithmic S-type function adjustment coefficient, set to 0.7; φ is the square root adjustment coefficient, set to 0.8; and σ Z is the mean and standard deviation of all anomaly scores;

[0073] Set a threshold and mark potential security risk points; set the threshold of the comprehensive anomaly score S to 2.0; if the comprehensive anomaly score S exceeds 2.0, mark the corresponding data point and treat it as a potential security risk point.

[0074] Through the above process, this embodiment realizes early identification and timely processing of potential security threats by comprehensively considering the local density values ​​and anomaly scores of various behavioral characteristics in the service interface and utilizing multiple nonlinear adjustment items, thereby improving the overall security and stability of the system, optimizing resource utilization, enhancing the system's adaptability, and providing detailed anomaly reports, ultimately enhancing user trust.

[0075] The S230 includes the following process:

[0076] S231: Based on the potential security risk points and in combination with the configuration parameters of the service interface, the abnormal activity background information is supplemented to generate abnormal activity enhancement information;

[0077] S232: Based on the abnormal activity enhancement information, a multi-factor comprehensive analysis method is used to evaluate the authenticity of the security threat of the abnormal activity and generate a security threat assessment result;

[0078] S233: Based on the security threat assessment result, combined with various indicators of abnormal activities, using a risk assessment model, calculating the risk level of the abnormal activities, and generating a risk level of the abnormal activities;

[0079] S234: Based on the risk level of the abnormal activity, the priority of the potential security risk points is analyzed to form a final risk assessment result.

[0080] Suppose there is an online payment platform that provides a payment interface. In order to ensure the security of the interface, the platform needs to conduct security assessments regularly. Two potential security risk points are identified through the anomaly detection algorithm: Risk point 1: abnormal request frequency, with more than 50 requests per minute; Risk point 2: abnormal response time, with a response time of more than 500 milliseconds; authentication method OAuth2.0; only authorized users are allowed to access; amount and currency are required and the format is correct; Risk point 1: the source IP address of the abnormal request changes frequently, the request time is concentrated between 2 am and 4 am, and the request parameter amount is a large transaction; Risk point 2: the source IP address of the request with abnormal response time is fixed, the request parameter amount is a small transaction, and the response time fluctuates greatly; Risk point 1: consider factors such as the frequency of abnormal requests, changes in the source IP, and the concentration of request time to assess the authenticity of the security threat; Risk point 2 Consider factors such as the duration of abnormal response time, the fixedness of the source IP, and the small transaction of request parameters to assess the authenticity of the security threat; Risk point 1 has a high probability and a wide impact range, and there may be malicious scanning or attack behavior; Risk point 2 has a low probability and a small impact range, which may be a problem with the back-end processing logic; Consider factors such as the possibility of the threat and the severity of the impact, and use the risk assessment model to calculate the risk level of abnormal activities; Risk point 1 has a high risk level, with a risk level of 80 points; Risk point 2 has a low risk level, with a risk level of 30 points; Risk point 1 has a high priority and needs to be processed immediately; Risk point 2 has a low priority and can be processed later; Risk point 1 has an abnormal request frequency, a high risk level, and a risk level of 80 points. The possible impact range includes excessive server load and impact on user experience. Recommended measures include increasing the request frequency limit to no more than 30 times per minute and starting log auditing; Risk point 2 has an abnormal response time, a low risk level, and a risk level of 30 points. The possible impact range includes request timeouts for individual users. Recommended measures include optimizing the back-end processing logic, reducing the response time, and subsequently strengthening server performance monitoring as appropriate.

[0081] Through the above steps, the system successfully generated the final risk assessment report of the payment interface, providing detailed guidance and suggestions for subsequent security reinforcement and management.

[0082] The S240 includes the following process:

[0083] S241: Based on the risk assessment results, comprehensively analyze the impact of the potential safety risk points, and generate risk priorities using a combination of quantitative and qualitative methods;

[0084] S242: Based on the risk priorities, design mitigation measures and prevention strategies for different impact levels and generate preliminary measures recommendations;

[0085] S243: Based on the preliminary measure suggestion, combined with multiple feasibility factors, optimizing the preliminary measure suggestion, and generating targeted measure suggestions;

[0086] S244: Based on the targeted measures proposed, combined with the existing security architecture, analyze adaptability and room for improvement, and generate a detailed risk assessment report.

[0087] Suppose there is an online education platform that provides a course registration interface. In order to ensure the security of the interface, the platform needs to conduct security assessments regularly. Generate risk priority: The risk assessment result is that two potential security risk points are identified through the anomaly detection algorithm: Risk point 1 is the abnormal request frequency, with more than 50 requests per minute; Risk point 2 is the abnormal response time, with the response time exceeding 500 milliseconds; Risk point 1 has a high probability of occurrence and a wide range of impact, which may cause the server to be overloaded and affect the user experience. The risk level is high; Risk point 2 has a low probability of occurrence and a small range of impact, which may cause individual users' requests to time out. The risk level is medium; design mitigation measures and prevention strategies: Risk point 1 is abnormal request frequency; technical measures are to increase the request frequency limit to no more than 30 times per minute; management measures are to regularly audit logs and monitor abnormal activities; Risk point 2 is abnormal response time; technical measures are to optimize the back-end processing logic and reduce the response time; management measures are to strengthen server performance monitoring and timely discover and solve problems; Risk point 1 is to consider the difficulty and cost of implementation, and decide to implement the request frequency limit first, no more than 30 times per minute, and start log audit at the same time; Risk point 2 is because the response time abnormality has a small impact, so decide to optimize the back-end processing logic first, and then strengthen server performance monitoring as appropriate; Risk level is high, impact The scope is wide, which may cause excessive server load and affect user experience; the risk level is medium, the impact scope is small, and it may cause request timeouts for individual users; abnormal request frequency > abnormal response time; increase the request frequency limit to no more than 30 times per minute; audit logs regularly to monitor abnormal activities; optimize back-end processing logic to reduce response time; strengthen server performance monitoring to promptly discover and solve problems; implement request frequency limit to no more than 30 times per minute; start log auditing; optimize back-end processing logic to reduce response time; strengthen server performance monitoring in the future as appropriate; consider introducing a flow control mechanism to further optimize the request processing logic; conduct performance tests regularly and continuously optimize the back-end processing logic.

[0088] Through the above steps, the system successfully generated a detailed risk assessment report for the course registration interface, providing detailed guidance and suggestions for subsequent security reinforcement and management.

[0089] S300: Based on the detailed risk assessment report, a decision tree algorithm is used to monitor the impact of the reinforcement process on the service interface performance by interacting with the service interface management system API, ensure automation of reinforcement measures, and generate a performance monitoring report after reinforcement;

[0090] A commonly used machine learning algorithm selects the optimal reinforcement solution by building a decision tree model; technical measures are taken for the identified security risk points, such as adding authentication steps, limiting request frequency, and enhancing input validation; the API interface used to manage and configure the service interface can be used to automatically execute reinforcement measures; during the reinforcement process, a performance change report is generated by monitoring the key performance indicators of the service interface (such as response time, throughput, etc.); based on the detailed risk assessment report, the security risk points that need to be reinforced are identified and a reinforcement requirements list is generated; a decision tree algorithm is used to comprehensively consider the effectiveness of the reinforcement measures, automatically select the optimal reinforcement solution, and generate a reinforcement plan; reinforcement measures are automatically executed by interacting with the service interface management system API, and the performance data of the service interface is monitored in real time; during the reinforcement process, the key performance indicators of the service interface are continuously monitored, and a performance monitoring report is generated to ensure that the reinforcement measures will not have a negative impact on performance.

[0091] The S300 includes the following process:

[0092] S310: Based on the detailed risk assessment report, identify security risk points that need to be reinforced and generate a reinforcement requirements list;

[0093] S320: Based on the reinforcement requirement list, a decision tree algorithm is used to comprehensively consider the effectiveness of reinforcement measures, automatically select the optimal reinforcement solution, and generate a reinforcement plan;

[0094] S330: Based on the reinforcement plan, the reinforcement measures are automatically executed by interacting with the service interface management system API, and the service interface performance data is monitored to obtain a performance monitoring data stream;

[0095] S340: monitors the key performance indicators of the service interface during the reinforcement process, analyzes the response time and throughput changes in real time, and generates performance monitoring results;

[0096] S350: Based on the performance monitoring results, comprehensively analyze the performance changes before and after the reinforcement, and generate a performance monitoring report after the reinforcement.

[0097] Suppose there is an online payment platform that provides a payment interface. In order to ensure the security of the interface, the platform needs to conduct security assessments and reinforcements regularly; identify two security risk points: Risk point 1: abnormal request frequency, high risk level, recommended measures to increase the request frequency limit, no more than 30 times per minute; Risk point 2: abnormal response time, medium risk level, recommended measures to optimize the backend processing logic and reduce the response time; comprehensively consider the effectiveness of the reinforcement measures, implementation difficulty and impact on the business, automatically select the best reinforcement plan; automatically execute reinforcement measures through the API interface; monitor the performance data of the service interface in real time and generate performance monitoring data streams; modify the service interface configuration, increase the request frequency limit, no more than 30 times per minute; start log auditing and monitor abnormal activities; optimize the backend processing logic and reduce response time; strengthen server performance monitoring, timely discover and solve problems; analyze the response time and throughput changes in real time; based on the performance monitoring results, comprehensively analyze the performance changes before and after reinforcement.

[0098] Through the above steps, the system successfully generated a performance monitoring report for the payment interface after reinforcement, ensuring the effectiveness of the reinforcement measures and the negative impact on performance within an acceptable range. This provides detailed guidance and suggestions for subsequent security management and optimization.

[0099] Optionally, based on the reinforcement plan, the reinforcement measures are automatically executed by interacting with a service interface management system API, and the service interface performance data is monitored to obtain a performance monitoring data stream, including:

[0100] Based on the reinforcement plan, specific reinforcement measures and execution sequence are planned, and a reinforcement task execution list is generated; based on the reinforcement task execution list, the service interface management system API is called to automatically execute reinforcement measures to ensure that the reinforcement process is efficient and accurate, and a reinforcement execution record is generated; based on the reinforcement execution record, the performance monitoring module is started to collect key performance indicator data of the service interface in real time and generate preliminary performance monitoring data; based on the preliminary performance monitoring data, the service interface reinforcement performance is analyzed in real time to ensure the smooth implementation of reinforcement measures and generate a performance monitoring data stream.

[0101] Assume that there is an online payment platform that provides a payment interface / api / payment. During the security reinforcement process, it is necessary to interact with the service interface management system API to automatically execute reinforcement measures and monitor performance data.Detailed risk assessment report: Risk point 1: abnormal request frequency, risk level 0.9, probability of occurrence 0.8; Risk point 2: abnormal response time, risk level 0.7, probability of occurrence 0.6; Reinforcement requirements list: Risk point 1: abnormal request frequency, risk level 0.9, probability of occurrence 0.8; Risk point 2: abnormal response time, risk level 0.7, probability of occurrence 0.6; Consider the weight of risk points, effectiveness of reinforcement measures, reliability score and cost, and select the best reinforcement plan; Increase request frequency limit, no more than 30 times per minute; Effectiveness score 7.94; Modify service interface configuration, increase request frequency limit; Start log auditing to monitor abnormal activities; Plan specific Reinforcement measures and execution order: Measure 1 increases the request frequency limit to no more than 30 times per minute; Measure 2 optimizes the backend processing logic and reduces the response time; Task 1 modifies the service interface configuration and increases the request frequency limit; Task 2 optimizes the backend processing logic and reduces the response time; Call the API to execute Task 1, modify the service interface configuration, and increase the request frequency limit; Call the API to execute Task 2, optimize the backend processing logic and reduce the response time; Task 1 is executed successfully, and the request frequency limit has been set to no more than 30 times per minute; Task 2 is executed successfully, and the backend processing logic has been optimized; Real-time collection of key performance indicator data of the service interface, including response time, throughput, resource utilization, etc.; Average response time Increased from 100ms to 120ms; the number of requests processed per second decreased from 1000 to 900; CPU utilization increased from 30% to 35%, and memory utilization increased from 40% to 45%; the response time increased slightly, but it is still within the acceptable range; the throughput decreased, but it is still within the system design range; the resource utilization increased slightly, but it did not exceed the system threshold; the average response time decreased from 120ms to 110ms; the number of requests processed per second increased from 900 to 950; the CPU utilization decreased from 35% to 32%, and the memory utilization decreased from 45% to 42%; the response time increased from 100ms to 110ms, which is a slight increase but still within the acceptable range; the throughput The volume increased from 1000 times / second to 950 times / second, which decreased but was still within the system design range; resource utilization increased from 30% and 40% to 32% and 42%, which increased slightly but did not exceed the system threshold; this report summarizes the performance monitoring data after reinforcement to ensure that the service interface reaches the optimal security state while maintaining high performance; no more than 30 times per minute; reduce resource consumption and improve processing efficiency; the average response time increased from 100ms to 110ms; the number of requests processed per second increased from 1000 to 950; CPU utilization increased from 30% to 32%, and memory utilization increased from 40% to 42%; all identified security risk points were effectively handled and the reinforcement measures were effective.

[0102] Through the above steps, the system successfully generated a hardened performance monitoring report, ensuring that the service interface achieves optimal security status while maintaining high performance, and providing detailed guidance and reference for subsequent security management and maintenance.

[0103] The present invention takes into account that in the process of security reinforcement of service interfaces, selecting the optimal reinforcement measures is a complex decision-making problem. In order to ensure the effectiveness and economy of the reinforcement measures, a scientific decision-making method is required. The decision tree algorithm proposed in this paper automatically selects the optimal reinforcement solution by calculating the weight of the risk point and the effectiveness score of the reinforcement measures, comprehensively considering multiple evaluation indicators.

[0104] Optionally, based on the reinforcement requirement list, a decision tree algorithm is used to comprehensively consider the effectiveness of reinforcement measures, automatically select the optimal reinforcement solution, and generate a reinforcement plan, including:

[0105] S321: Based on the reinforcement requirement list, extract the risk level and occurrence probability of the risk point, and collect the reliability scores and costs of all candidate reinforcement measures;

[0106] S322: Perform data cleaning and extreme value processing to ensure data integrity and consistency, and provide parameter support for the calculation of risk point weights and reinforcement measures effectiveness scores;

[0107] S323: Calculate the weight of the risk point using the following formula:

[0108]

[0109] Among them, w i is the weight of the ith risk point; r i is the risk level of the ith risk point, ranging from [0,1]; p i is the probability of occurrence of the i-th risk point, ranging from [0,1]; m is the total number of risk points; α is the logarithmic adjustment coefficient, which is used to enhance the sensitivity to high risk points; β is the sinusoidal adjustment coefficient, which is used to capture periodic changes; σ r is the standard deviation of all risk levels; σ p is the standard deviation of all occurrence probabilities; j is the index of the risk point, from 1 to m; m is the total number of risk points;

[0110] S324: Calculate the effectiveness score of the reinforcement measures using the following formula:

[0111]

[0112] Among them, E j Score the effectiveness of the jth reinforcement measure; w i is the weight of the ith risk point; f ijis the mitigation effect of the j-th reinforcement measure on the i-th risk point, and its value range is [0, 1]; γ is the hyperbolic tangent adjustment coefficient, which is used to enhance the sensitivity to reliability; r j is the reliability score of the jth reinforcement measure, ranging from [0,1]; δ is the logarithmic adjustment coefficient, which is used to balance the cost factor; c j is the cost of the jth reinforcement measure; is the average of all reliability scores; σ r standard deviation for all reliability scores; is the average of all costs; σ c is the standard deviation of all costs; i is the index of the risk point, from 1 to m; m is the total number of risk points;

[0113] S325: Taking into account multiple evaluation indicators, a sensitivity analysis is performed on the effectiveness score of the reinforcement measures to evaluate the impact of different parameter changes on the score, so as to generate the index of the optimal reinforcement solution; the index of the optimal reinforcement solution is calculated by the following formula:

[0114]

[0115] Among them, J * is the index of the optimal reinforcement solution; j is the index of the candidate reinforcement measure, from 1 to n; n is the total number of candidate reinforcement measures; E j is the effectiveness score of the jth reinforcement measure; β is the sine adjustment coefficient, which is used to capture periodic changes; θ is the S-type function adjustment coefficient, which is used to enhance the sensitivity to extreme values; φ is the logarithmic S-type function adjustment coefficient, which is used to enhance the sensitivity to small deviation values; is the average of all effectiveness scores; σ E standard deviation for all effectiveness scores;

[0116] S326: Based on the index of the optimal reinforcement solution, evaluate the specific implementation steps, set up a monitoring and feedback mechanism, monitor the key performance indicators of the reinforcement process in real time, and generate a reinforcement plan.

[0117] This method aims to comprehensively consider the importance of each risk point in the service interface and the multi-faceted effects of reinforcement measures, and use the decision tree algorithm to automatically select the optimal reinforcement plan to ensure that the high performance and stability of the system are maintained while improving security.

[0118] The weight w at the risk point i In the calculation, the risk level and probability of occurrence r i and p i Respectively represent the risk level and occurrence probability of the i-th risk point, with a value range of [0, 1]; standardized Used to standardize the weights of risk points to make them comparable; logarithmic adjustment Used to enhance the sensitivity to high risk points, α is the adjustment coefficient; sine adjustment Used to capture periodic changes, β is the adjustment coefficient; standard deviation σ r and σ p are the standard deviations of all risk levels and occurrence probabilities, used for standardization and adjustment, respectively.

[0119] The effectiveness score of the reinforcement measures is E j The weight of the risk point is w i is the weight of the i-th risk point; the mitigation effect f ij is the mitigation effect of the j-th reinforcement measure on the i-th risk point, and its value range is [0,1]; the reliability score r j is the reliability score of the jth reinforcement measure, ranging from [0,1]; the cost c j is the cost of the jth reinforcement measure; hyperbolic tangent adjustment Used to enhance the sensitivity to reliability, γ is the adjustment coefficient; logarithmic adjustment Used to balance cost factors, δ is the adjustment coefficient; mean and standard deviation and are the averages of all reliability scores and costs, σ r and σ c are the standard deviations of all reliability scores and costs, used for normalization and adjustment, respectively.

[0120] The index J of the optimal reinforcement solution * Calculating, E j Score the effectiveness of the jth reinforcement measure; Used to capture periodic changes, β is the adjustment coefficient; Used to enhance sensitivity to extreme values, θ is the adjustment coefficient; Used to enhance the sensitivity to small deviation values, φ is the adjustment coefficient; and σ E The mean and standard deviation of all effectiveness scores were used for standardization and adjustment, respectively.

[0121] Among them, r i Obtained through risk levels in detailed risk assessment reports; i Obtained through the probability of occurrence in the detailed risk assessment report; α and β are usually set through experiments or experience to enhance sensitivity to high-risk points and periodic changes; σ r and σ p Obtained by calculating the standard deviation of all risk levels and occurrence probabilities; i Obtained by calculating the weight of risk points; f ij Obtained through expert evaluation or historical data; jObtained through expert evaluation or historical data; c j Obtained through cost estimation or historical data; γ and δ are usually set through experiments or experience to enhance the sensitivity to reliability and cost; σ r and σ c Obtained by calculating the mean and standard deviation of all reliability scores and costs; E j Obtained by calculating the effectiveness score of the reinforcement measures; β, θ, and φ are usually set through experiments or experience to enhance the sensitivity to different types of reinforcement measures; and σ E Obtained by calculating the mean and standard deviation of all effectiveness scores.

[0122] Suppose there is an online payment platform that provides a payment interface. In order to ensure the security of the interface, the platform needs to conduct security assessments and reinforcements regularly. Through the detailed risk assessment report, two security risk points are identified: Risk point 1 is abnormal request frequency, with a high risk level and a high probability of occurrence; Risk point 2 is abnormal response time, with a medium risk level and a medium probability of occurrence; the reinforcement requirements list is as follows: Risk point 1 is abnormal request frequency, with a risk level of 0.9 and a probability of occurrence of 0.8; Risk point 2 is abnormal response time, with a risk level of 0.7 and a probability of occurrence of 0.6.

[0123] Risk point 1: r1 = 0.9, p1 = 0.8; Risk point 2: r2 = 0.7, p2 = 0.6

[0124]

[0125] α=0.5,β=0.3;σ r =0.1,σ p =0.1

[0126]

[0127] Candidate reinforcement measures: Measure 1 increases the request frequency limit to no more than 30 times per minute; Measure 2 optimizes the backend processing logic to reduce the response time; w1≈5.14, w2≈4.42; f 11 =0.9,f 12 =0.3; f 21 =0.4, f 22 =0.8; r1=0.8r2=0.7

[0128] c1=1000; c2=800; γ=0.5, δ=0.3; σ r =0.07, σ c =100,

[0129]

[0130] E1≈7.94, E2≈7.12; β=0.4, θ=0.6, φ=0.7; σ E =0.41

[0131]

[0132] Optimal reinforcement plan: Measure 1 Increase the request frequency limit to no more than 30 times per minute; Increase the request frequency limit to no more than 30 times per minute; Effectiveness score 14.54; Modify the service interface configuration to increase the request frequency limit; Enable log auditing to monitor abnormal activities.

[0133] Through the above steps, the system successfully generated the optimal reinforcement plan for the payment interface, ensuring the effectiveness and economy of the reinforcement measures. This provides detailed guidance and suggestions for subsequent security management and optimization.

[0134] S400: Based on the performance monitoring report after reinforcement, security assessment and verification are performed on the reinforced service interface to ensure the effectiveness of the reinforcement measures, and an optimized security configuration report is generated through feedback optimization mechanism adjustments.

[0135] After the reinforcement measures are implemented, re-evaluate the security of the service interface to verify whether the reinforcement measures are effective; adjust the reinforcement measures and optimize the security configuration based on the performance monitoring report and the results of the security assessment verification; include a report on the optimized security configuration information and verification results; based on the reinforced performance monitoring report, conduct a security assessment on the reinforced service interface to verify whether the reinforcement measures are effective and ensure that security risk points have been properly addressed; if it is found that the reinforcement measures have a negative impact on performance, or there are still unresolved security issues, adjust the reinforcement measures through the feedback optimization mechanism and optimize the security configuration; summarize the optimized security configuration information and verification results to generate an optimized security configuration report to provide a reference for subsequent security management and maintenance.

[0136] The S400 includes the following process:

[0137] S410: Based on the performance monitoring report after reinforcement, the performance of the service interface after reinforcement is evaluated to ensure that the reinforcement measures have no negative impact, and a performance evaluation result is generated;

[0138] S420: Based on the performance evaluation result, a secondary security evaluation is performed on the reinforced service interface to verify the security risk point identification effect of the reinforcement measures and generate a security evaluation verification result;

[0139] S430: Based on the security assessment verification results, the effectiveness of the reinforcement measures is evaluated through a feedback optimization mechanism, specific adjustment suggestions are put forward, and an optimization adjustment plan is generated;

[0140] S440: Based on the optimization and adjustment scheme, optimize and adjust the service interface security configuration to ensure that the service interface is in the best security performance, and generate an optimized security configuration report.

[0141] Suppose there is an online payment platform that provides a payment interface. After implementing the reinforcement measures, it is necessary to conduct performance and security assessments on the service interface to ensure the effectiveness of the reinforcement measures and make adjustments through the feedback optimization mechanism; collect performance data of the reinforced service interface in actual operation, including response time, throughput, resource utilization, etc.; the average response time increased from 100ms to 120ms; the number of requests processed per second decreased from 1,000 to 900; the CPU utilization increased from 30% to 35%, and the memory utilization increased from 40% to 45%; the response time increased slightly, but it was still within the acceptable range; the throughput decreased, but it was still within the system design range The resource utilization rate increased slightly, but did not exceed the system threshold. Risk point 1: The request frequency was abnormal. The reinforcement measure was to increase the request frequency limit to no more than 30 times per minute. The request frequency was effectively controlled and no abnormal requests were found. Risk point 2: The response time was abnormal. The reinforcement measure was to optimize the backend processing logic and reduce the response time. The response time was significantly reduced and no abnormal responses were found. All identified security risk points were effectively handled and the reinforcement measures were effective. The performance evaluation results showed that the reinforcement measures had a certain impact on the performance, but it was still within an acceptable range. The security assessment verification results showed that the reinforcement measures were effective and the risk points were Efficient processing; fine-tuned the request frequency limit from 30 times per minute to 40 times per minute to improve throughput; further optimized the backend processing logic to reduce CPU and memory usage; adjusted the request frequency limit to no more than 40 times per minute; optimized the backend processing logic to reduce resource consumption; the request frequency limit is no more than 40 times per minute; the backend processing logic optimization reduces resource consumption and improves processing efficiency; the average response time is reduced from 120ms to 110ms; the number of requests processed per second is increased from 900 to 950; CPU usage is reduced from 35% to 32%, and memory usage is reduced from 4 5% reduced to 42%; all identified security risk points have been effectively handled and reinforcement measures are effective; this report summarizes the optimized security configuration information and verification results to ensure that the service interface reaches the optimal security state while maintaining high performance; no more than 40 times per minute; reduce resource consumption and improve processing efficiency; the average response time is reduced from 120ms to 110ms; the number of requests processed per second is increased from 900 to 950; CPU utilization is reduced from 35% to 32%, and memory utilization is reduced from 45% to 42%; all identified security risk points have been effectively handled and reinforcement measures are effective.

[0142] Through the above steps, the system successfully generated an optimized security configuration report, ensuring that the service interface achieves the optimal security state while maintaining high performance, and providing detailed guidance and reference for subsequent security management and maintenance.

[0143] like Figure 2 As shown, a service interface security configuration automatic assessment and reinforcement processing system includes:

[0144] The receiving module 21 is used to receive the security assessment request submitted by the user, process the service interface identification information, and generate the service interface behavior profile in combination with the interface historical access record;

[0145] Identification module 22, used to identify potential security risk points of the service interface through anomaly detection algorithm based on the service interface behavior profile, and output a detailed risk assessment report in combination with interface configuration parameters;

[0146] Monitoring module 23, used to monitor the impact of the reinforcement process on the service interface performance based on the detailed risk assessment report, using a decision tree algorithm, by interacting with the service interface management system API, ensuring the automation of reinforcement measures, and generating a performance monitoring report after reinforcement;

[0147] The adjustment module 24 is used to perform security assessment and verification on the reinforced service interface based on the reinforced performance monitoring report to ensure the effectiveness of the reinforcement measures, and to generate an optimized security configuration report through feedback optimization mechanism adjustment.

[0148] Figure 2 The service interface security configuration automated assessment and reinforcement processing system can execute Figure 1 The implementation principle and technical effect of the service interface security configuration automated assessment and reinforcement processing method described in the illustrated embodiment will not be described in detail. The specific manner in which each module and unit performs operations in the service interface security configuration automated assessment and reinforcement processing system in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0149] In one possible design, Figure 2 The service interface security configuration automated assessment and reinforcement processing system of the illustrated embodiment can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0150] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0151] The processing component 32 is used to: receive security assessment requests submitted by users, process service interface identification information, and generate a service interface behavior portrait in combination with historical interface access records; based on the service interface behavior portrait, identify potential security risk points of the service interface through an anomaly detection algorithm, and output a detailed risk assessment report in combination with interface configuration parameters; based on the detailed risk assessment report, use a decision tree algorithm to interact with the service interface management system API to monitor the impact of the reinforcement process on the performance of the service interface, ensure the automation of reinforcement measures, and generate a performance monitoring report after reinforcement; based on the performance monitoring report after reinforcement, perform security assessment verification on the reinforced service interface to ensure the effectiveness of the reinforcement measures, and adjust through the feedback optimization mechanism to generate an optimized security configuration report.

[0152] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0153] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0154] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0155] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0156] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0157] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0158] The embodiment of the present invention further provides a computer storage medium storing a computer program, which can achieve the above-mentioned Figure 1 A method for automated assessment and reinforcement of service interface security configuration is shown.

[0159] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0160] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of this solution. Those of ordinary skill in the art may understand and implement it without creative effort.

[0161] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0162] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for automated assessment and reinforcement of service interface security configuration, characterized in that: The process includes the following: S100: receiving a security assessment request submitted by a user, processing service interface identification information, and generating a service interface behavior profile in combination with historical interface access records; S200: Based on the service interface behavior profile, identify potential security risk points of the service interface through an anomaly detection algorithm, and output a detailed risk assessment report in combination with interface configuration parameters; S300: Based on the detailed risk assessment report, a decision tree algorithm is used to monitor the impact of the reinforcement process on the service interface performance by interacting with the service interface management system API, ensure automation of reinforcement measures, and generate a performance monitoring report after reinforcement; S400: Based on the performance monitoring report after reinforcement, security assessment and verification are performed on the reinforced service interface to ensure the effectiveness of the reinforcement measures, and an optimized security configuration report is generated through feedback optimization mechanism adjustments.

2. The method according to claim 1, characterized in that The S200 includes the following process: S210: Analyze the behavior pattern, request frequency, and response time characteristics of the service interface using the service interface behavior profile to generate a normal behavior baseline; S220: Based on the normal behavior baseline, using an anomaly detection algorithm, performing comparative analysis on the actual behavior of the service interface, identifying abnormal activities that deviate from normal behavior, and generating potential security risk points; specifically including: S221: Collect historical access records of the service interface and pre-process the behavior feature data of the service interface; S222: extract key behavior features, combine request frequency and response time, generate statistical parameters of key behavior features, and provide basic support for local density value and anomaly score calculation; S223: Calculate the local density value using the following formula: Among them, D i is the local density value of the ith data point; X i is the actual value of the behavior characteristics of the ith service interface, such as request frequency and response time; X j is the actual value of the jth service interface behavior feature; i is the index of the data point, from i to N; N is the total number of data points; σ is the standard deviation of the Gaussian kernel; d(X i ,X j ) is X i and X j The Euclidean distance between them; ∈ is the neighborhood radius parameter; S224: Calculate the abnormality score using the following formula: Among them, Z i is the abnormal score of the i-th data point; D i is the local density value of the i-th data point; is the maximum value of all local density values; tanh is the hyperbolic tangent function; α is the hyperbolic tangent adjustment coefficient, which is used to enhance the sensitivity to extreme values; β is the logarithmic adjustment coefficient, which is used to enhance the sensitivity to large deviation values; is the average value of all local density values; σ D is the standard deviation of all local density values; S225: Based on the local density value D i and anomaly score Z i , normalize the anomaly scores to ensure that the anomaly scores of different features are comparable, introduce multiple nonlinear adjustment items to enhance the sensitivity to different types of outliers, and generate a comprehensive anomaly score; The comprehensive abnormality score is calculated using the following formula: Among them, S is the comprehensive abnormality score; Z i is the anomaly score of the i-th data point; i is the index of the data point, from i to N; N is the total number of data points; is the maximum value of all anomaly scores; γ is the sine adjustment coefficient, which is used to capture periodic changes; δ is the S-type function adjustment coefficient, which is used to enhance the sensitivity to extreme values; θ is the logarithmic S-type function adjustment coefficient, which is used to enhance the sensitivity to small deviation values; φ is the square root adjustment coefficient, which is used to enhance the sensitivity to deviation values; is the average of all anomaly scores; σ Z is the standard deviation of all anomaly scores; S226: Setting a specific threshold value, if the comprehensive anomaly score S exceeds the specific threshold value, marking the data point corresponding to the comprehensive anomaly score S, and treating the data point as a potential security risk point; S230: Based on the potential security risk points and in combination with the configuration parameters of the service interface, deeply analyze the abnormal activities, evaluate the authenticity of the security threats of the abnormal activities, calculate the risk level, and generate a risk assessment result; S240: Based on the risk assessment results, comprehensively analyze the impact of the potential safety risk points, formulate targeted measures and suggestions, and generate a detailed risk assessment report.

3. The method according to claim 2, characterized in that The S230 includes the following process: S231: Based on the potential security risk points and in combination with the configuration parameters of the service interface, the abnormal activity background information is supplemented to generate abnormal activity enhancement information; S232: Based on the abnormal activity enhancement information, a multi-factor comprehensive analysis method is used to evaluate the authenticity of the security threat of the abnormal activity and generate a security threat assessment result; S233: Based on the security threat assessment result, combined with various indicators of abnormal activities, using a risk assessment model, calculating the risk level of the abnormal activities, and generating a risk level of the abnormal activities; S234: Based on the risk level of the abnormal activity, the priority of the potential security risk points is analyzed to form a final risk assessment result.

4. The method according to claim 2, characterized in that: The S240 includes the following process: S241: Based on the risk assessment results, comprehensively analyze the impact of the potential safety risk points, and generate risk priorities using a combination of quantitative and qualitative methods; S242: Based on the risk priorities, design mitigation measures and prevention strategies for different impact levels and generate preliminary measures recommendations; S243: Based on the preliminary measure suggestion, combined with multiple feasibility factors, optimizing the preliminary measure suggestion, and generating targeted measure suggestions; S244: Based on the targeted measures proposed, combined with the existing security architecture, analyze adaptability and room for improvement, and generate a detailed risk assessment report.

5. The method according to claim 1, characterized in that The S300 includes the following process: S310: Based on the detailed risk assessment report, identify security risk points that need to be reinforced and generate a reinforcement requirements list; S320: Based on the reinforcement requirement list, a decision tree algorithm is used to comprehensively consider the effectiveness of reinforcement measures, automatically select the optimal reinforcement solution, and generate a reinforcement plan; specifically, the following process is included: S321: Based on the reinforcement requirement list, extract the risk level and occurrence probability of the risk point, and collect the reliability scores and costs of all candidate reinforcement measures; S322: Perform data cleaning and extreme value processing to ensure data integrity and consistency, and provide parameter support for the calculation of risk point weights and reinforcement measures effectiveness scores; S323: Calculate the weight of the risk point using the following formula: Among them, w i is the weight of the ith risk point; r i is the risk level of the ith risk point, ranging from [0,1]; p i is the probability of occurrence of the i-th risk point, ranging from [0,1]; m is the total number of risk points; α is the logarithmic adjustment coefficient, which is used to enhance the sensitivity to high risk points; β is the sinusoidal adjustment coefficient, which is used to capture periodic changes; σ r is the standard deviation of all risk levels; σ p is the standard deviation of all occurrence probabilities; j is the index of the risk point, from 1 to m; m is the total number of risk points; S324: Calculate the effectiveness score of the reinforcement measures using the following formula: Among them, E j Score the effectiveness of the jth reinforcement measure; w i is the weight of the ith risk point; f ij is the mitigation effect of the j-th reinforcement measure on the i-th risk point, and its value range is [0, 1]; γ is the hyperbolic tangent adjustment coefficient, which is used to enhance the sensitivity to reliability; r j is the reliability score of the jth reinforcement measure, ranging from [0,1]; δ is the logarithmic adjustment coefficient, which is used to balance the cost factor; c j is the cost of the jth reinforcement measure; is the average of all reliability scores; σ r standard deviation for all reliability scores; is the average of all costs; σ c is the standard deviation of all costs; i is the index of the risk point, from 1 to m; m is the total number of risk points; S325: Taking into account multiple evaluation indicators, a sensitivity analysis is performed on the effectiveness score of the reinforcement measures to evaluate the impact of different parameter changes on the score, so as to generate the index of the optimal reinforcement solution; the index of the optimal reinforcement solution is calculated by the following formula: Among them, J * is the index of the optimal reinforcement solution; j is the index of the candidate reinforcement measure, from 1 to n; n is the total number of candidate reinforcement measures; E j is the effectiveness score of the jth reinforcement measure; β is the sine adjustment coefficient, which is used to capture periodic changes; θ is the S-type function adjustment coefficient, which is used to enhance the sensitivity to extreme values; φ is the logarithmic S-type function adjustment coefficient, which is used to enhance the sensitivity to small deviation values; is the average of all effectiveness scores; σ E standard deviation for all effectiveness scores; S326: Based on the index of the optimal reinforcement solution, evaluate specific implementation steps, set up a monitoring and feedback mechanism, monitor key performance indicators of the reinforcement process in real time, and generate a reinforcement plan; S330: Based on the reinforcement plan, the reinforcement measures are automatically executed by interacting with the service interface management system API, and the service interface performance data is monitored to obtain a performance monitoring data stream; S340: monitors the key performance indicators of the service interface during the reinforcement process, analyzes the response time and throughput changes in real time, and generates performance monitoring results; S350: Based on the performance monitoring results, comprehensively analyze the performance changes before and after the reinforcement, and generate a performance monitoring report after the reinforcement.

6. The method according to claim 5, characterized in that The S330 includes the following process: S331: Based on the reinforcement plan, plan specific reinforcement measures and execution sequence, and generate a reinforcement task execution list; S332: Based on the reinforcement task execution list, the service interface management system API is called to automatically execute reinforcement measures to ensure that the reinforcement process is efficient and accurate, and a reinforcement execution record is generated; S333: Based on the reinforcement execution record, start the performance monitoring module, collect key performance indicator data of the service interface in real time, and generate preliminary performance monitoring data; S334: Based on the preliminary performance monitoring data, the service interface reinforcement performance is analyzed in real time to ensure smooth implementation of reinforcement measures and generate a performance monitoring data stream.

7. The method according to claim 1, characterized in that The S400 includes the following process: S410: Based on the performance monitoring report after reinforcement, the performance of the service interface after reinforcement is evaluated to ensure that the reinforcement measures have no negative impact, and a performance evaluation result is generated; S420: Based on the performance evaluation result, a secondary security evaluation is performed on the reinforced service interface to verify the security risk point identification effect of the reinforcement measures and generate a security evaluation verification result; S430: Based on the security assessment verification results, the effectiveness of the reinforcement measures is evaluated through a feedback optimization mechanism, specific adjustment suggestions are put forward, and an optimization adjustment plan is generated; S440: Based on the optimization and adjustment scheme, optimize and adjust the service interface security configuration to ensure that the service interface is in the best security performance, and generate an optimized security configuration report.

8. A service interface security configuration automated assessment and reinforcement processing system, characterized in that: include: The receiving module is used to receive the security assessment request submitted by the user, process the service interface identification information, and generate the service interface behavior profile in combination with the historical access record of the interface; An identification module is used to identify potential security risk points of the service interface based on the service interface behavior profile through an anomaly detection algorithm, and output a detailed risk assessment report in combination with interface configuration parameters; A monitoring module is used to monitor the impact of the reinforcement process on the performance of the service interface based on the detailed risk assessment report, using a decision tree algorithm, by interacting with the service interface management system API, ensuring the automation of reinforcement measures, and generating a performance monitoring report after reinforcement; The adjustment module is used to perform security assessment and verification on the reinforced service interface based on the reinforced performance monitoring report to ensure the effectiveness of the reinforcement measures, and to generate an optimized security configuration report through feedback optimization mechanism adjustment.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a service interface security configuration automated assessment and reinforcement processing method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, a service interface security configuration automatic assessment and reinforcement processing method as described in any one of claims 1 to 7 is implemented.

Images