Network security analysis method and device and electronic equipment

Abstract

The invention relates to the technical field of network security, in particular to a network security analysis method and device and electronic equipment. The method comprises the following steps: acquiring to-be-detected network flow data containing an access request, and extracting user behavior characteristics from the to-be-detected network flow data; wherein the user behavior characteristics are used for representing interaction information when the user accesses an application programming interface (API). And matching the corresponding relationship between the user and the target API in the user behavior characteristics with the access permission mapping set, and determining whether the user has the permission to access the target API or not. If the user has the authority to access the target API, the user behavior features are converted into feature vectors; and inputting the feature vector into an anomaly detection model, and outputting a detection result representing whether the access is abnormal or not. According to the scheme, the API security threat detection efficiency can be improved, and the false alarm rate can be reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security analysis method, device and electronic equipment. Background Art

[0002] With the success of digital business transformation, Application Programming Interface (API) has become the link connecting various digital business applications, promoting the exchange of data and information between applications, containers and microservices.

[0003] However, the popularity of APIs also brings potential security threats. Traditional network security analysis techniques mainly rely on predefined rules and thresholds to detect abnormal behaviors. For example, the frequency or parameter range of specific users accessing certain APIs is limited. However, this approach has obvious limitations, including poor security monitoring flexibility, difficulty in responding to new attacks, and a high false alarm rate.

[0004] How to improve the efficiency of API security threat detection and reduce the false alarm rate has become a question worth discussing. Summary of the invention

[0005] The embodiments of the present application provide a network security analysis method, device, and electronic device for improving the efficiency of API security threat detection and reducing the false alarm rate.

[0006] In a first aspect, an embodiment of the present application provides a network security analysis method, the method comprising:

[0007] Acquire the network traffic data to be detected that includes the access request, and extract the user behavior characteristics from the network traffic data to be detected, where the user behavior characteristics are used to represent the interaction information when the user accesses the application programming interface API;

[0008] Matching the corresponding relationship between the user and the target API in the user behavior feature with the access permission mapping set to determine whether the user has the permission to access the target API, the access permission mapping set including the mapping relationship between the user and the accessible API;

[0009] If the user has permission to access the target API, the user behavior features are converted into feature vectors;

[0010] The feature vector is input into the anomaly detection model, and the detection result indicating whether the access is abnormal is output. The anomaly detection model is obtained by analyzing the user behavior characteristics in the historical network traffic data using an unsupervised learning algorithm.

[0011] Optionally, the access permission mapping set is obtained in the following way:

[0012] Obtain historical network traffic data and perform standardization on the historical network traffic data;

[0013] Extracting a historical user behavior feature set from the standardized historical network traffic data;

[0014] The standardized historical network traffic data is grouped according to the user ID and API ID;

[0015] Count the behavior characteristics of grouped users to get the number of times each user visits different APIs;

[0016] Based on the user ID, the API ID, and the number of times each user accesses different APIs, a mapping relationship is constructed to obtain an access mapping set.

[0017] Optionally, the corresponding relationship between the user and the target API in the user behavior feature is matched with the access permission mapping set to determine whether the user has the permission to access the target API, specifically including:

[0018] Determine the historical number of times the user accesses the target API from the access permission mapping set;

[0019] Compare the historical access count with the preset access threshold, which is used to indicate the maximum number of times a user can access the target API;

[0020] If the historical access count is less than the access threshold, it is determined that the user has the authority to access the target API;

[0021] If the historical access count is greater than or equal to the access threshold, it is determined that the user does not have permission to access the target API.

[0022] Optionally, the anomaly detection model is obtained by analyzing user behavior characteristics in historical network traffic data using an unsupervised learning algorithm, specifically including:

[0023] Obtain historical network traffic data and perform standardization on the historical network traffic data;

[0024] Extracting a set of historical user behavior features from standardized historical network traffic data;

[0025] Convert each historical user behavior feature into a feature vector to obtain a set of historical feature vectors;

[0026] Based on the historical feature vector set, the anomaly detection model to be trained is trained using an isolation forest algorithm until the training is completed to obtain the anomaly detection model.

[0027] Optionally, the user behavior characteristics include at least one or more of user ID, request time, target API ID, request parameters, response time, return status code, and user's geographic location information.

[0028] Optionally, if the user does not have permission to access the target API, store the exception request in the permission exception log.

[0029] Optionally, if the detection result indicates an access anomaly, the abnormal request is stored in a parameter anomaly log.

[0030] In a second aspect, an embodiment of the present application provides a network security analysis device, the device comprising:

[0031] A communication module, used for obtaining the network traffic data to be detected including the access request;

[0032] A processing module, used for extracting user behavior features from the network traffic data to be detected, where the user behavior features are used to represent interaction information when a user accesses an application programming interface API;

[0033] The processing module is further used to match the corresponding relationship between the user and the target API in the user behavior feature with the access permission mapping set to determine whether the user has the permission to access the target API, and the access permission mapping set includes the mapping relationship between the user and the accessible API;

[0034] The processing module is also used to convert the user behavior feature into a feature vector if the user has permission to access the target API;

[0035] The processing module is also used to input the feature vector into the anomaly detection model and output a detection result indicating whether the access is abnormal. The anomaly detection model is obtained by analyzing the user behavior characteristics in the historical network traffic data using an unsupervised learning algorithm.

[0036] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the processor implements any one of the network security analysis methods described in the first aspect.

[0037] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the network security analysis method of any one of the first aspects is implemented.

[0038] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program, which is executed by a processor to implement a network security analysis method as described in any one of the first aspects above.

[0039] The technical effects brought about by any one of the implementation methods in the second to fifth aspects can refer to the technical effects brought about by the corresponding implementation method in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of an application scenario of network security analysis provided in an embodiment of the present application;

[0041] Figure 2 A flow chart of a network security analysis method provided in an embodiment of the present application;

[0042] Figure 3 An exemplary flowchart of a network security analysis provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of a device for network security analysis provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0046] The application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those skilled in the art that with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more.

[0047] With the success of digital business transformation, Application Programming Interface (API) has become the link connecting various digital business applications, promoting the exchange of data and information between applications, containers and microservices. However, the popularity of API also brings potential security threats. Traditional network security analysis technology mainly relies on predefined rules and thresholds to detect abnormal behavior. For example, limiting the frequency or parameter range of specific users accessing certain APIs. However, this approach has obvious limitations, including poor flexibility of security monitoring, difficulty in responding to new attacks, and high false alarm rate. How to improve the efficiency of API security threat detection and reduce the false alarm rate has become a question worth discussing.

[0048] In order to solve the above problems, an embodiment of the present application provides a network security analysis method. The method includes: obtaining network traffic data to be detected that includes access requests, extracting user behavior features from the network traffic data to be detected, and the user behavior features are used to represent the interaction information when the user accesses the application programming interface API. The correspondence between the user and the target API in the user behavior features is matched with the access permission mapping set to determine whether the user has the authority to access the target API. The access permission mapping set includes the mapping relationship between the user and the accessible API. If the user has the authority to access the target API, the user behavior features are converted into a feature vector. The feature vector is input into the anomaly detection model, and a detection result indicating whether the access is abnormal is output. The anomaly detection model is obtained by analyzing the user behavior features in the historical network traffic data using an unsupervised learning algorithm.

[0049] In this way, by acquiring the network traffic data to be detected in real time and extracting user behavior characteristics, users' API access behavior can be monitored in real time. Once abnormal access is found, security measures can be taken in a quick response. By ensuring that users can only access their authorized APIs, security risks caused by unauthorized access can be prevented and API security threats can be reduced. By using unsupervised learning algorithms to analyze user behavior characteristics, it is possible to timely detect whether there are abnormal behaviors when users access APIs, adapt to the ever-changing network environment, reduce the false alarm rate caused by outdated or inaccurate rules, and improve the flexibility of security detection.

[0050] A schematic diagram of an application scenario of an optional network security analysis method in an embodiment of the present application. Figure 1 As shown, it includes a server 100 and a terminal 101. The server 100 and the terminal 101 can be communicatively connected through a network to implement the network security analysis method of the present application.

[0051] The user can use the server 100 to interact with the terminal 101 through the network, such as receiving or sending messages, etc. Various client applications can be installed on the terminal 101, such as program writing applications, web browser applications, search applications, etc.

[0052] It is understandable that in the embodiment of the present application, the server 100 can be implemented as an independent server or a server cluster composed of multiple servers. The terminal 101 can be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, desktop computers, etc.

[0053] The server 100 can be used to obtain the network traffic data to be detected that includes access requests, and extract user behavior features from the network traffic data to be detected. The user behavior features are used to represent the interaction information when the user accesses the application programming interface API. The correspondence between the user and the target API in the user behavior features is matched with the access permission mapping set to determine whether the user has the authority to access the target API. The access permission mapping set includes the mapping relationship between the user and the accessible API. If the user has the authority to access the target API, the user behavior features are converted into a feature vector. The feature vector is input into the anomaly detection model, and a detection result indicating whether the access is abnormal is output. The anomaly detection model is obtained by analyzing the user behavior features in the historical network traffic data using an unsupervised learning algorithm.

[0054] like Figure 2 As shown, a flowchart of a network security analysis method provided in an embodiment of the present application may specifically include the following steps.

[0055] Step S201: Obtain the network traffic data to be detected that includes the access request, and extract the user behavior characteristics from the network traffic data to be detected.

[0056] Among them, user behavior features are used to represent the interaction information when users access the application programming interface API.

[0057] Optionally, the user behavior characteristics include at least one or more of user ID, request time, target API ID, request parameters, response time, return status code, and user's geographic location information.

[0058] The user ID is a unique code or string used to identify a user account, such as an account asset identity (ID). The API ID is a code or string used to uniquely identify an API asset, such as an API asset ID.

[0059] For example, the user ID is U123456, which indicates a unique user code used to distinguish different users. The request time is 2023-04-01 12:34:56. The target API ID is getUserProfile. It indicates that the user is requesting an API to obtain user personal information. The request parameters are {"userId":"U123456","fields":["name","email"]}. It indicates that the user is requesting to obtain the name and email address information of the user with ID U123456. The response time is 300ms, which indicates that the time interval from the user sending the request to the server returning the response is 300 milliseconds. The return status code is 200, which indicates that the user's request has been successfully received, understood and accepted by the server, and the server has returned the resource requested by the user. The user's geographic location information is {"country":"China","city":"Beijing"}, which indicates that the user's geographic location when making the request is in Beijing, China.

[0060] Optionally, the user behavior feature may also include a Uniform Resource Locator (URL) for accessing a specific API asset.

[0061] Optionally, after obtaining the network traffic data to be detected, the network traffic data to be detected can be standardized to extract user behavior features from the standardized network traffic data to be detected. For example, spaces and special characters can be deleted, upper and lower case characters can be unified, missing values ​​and null values ​​can be processed.

[0062] For example, use network monitoring tools (such as network protocol analysis software (Wireshark)) or a specific network traffic log system to obtain network traffic data. After obtaining the network traffic data, you can delete invalid data in the network traffic data to be detected, such as repeated requests, illegal request formats, etc., to ensure the accuracy and consistency of the data. Unify the HTTP requests, URLs, etc. in the network traffic data into uppercase or lowercase to maintain consistency. Check the missing values ​​in the data, which can be filled by interpolation, mean, mode filling, etc.

[0063] Step S202: Match the corresponding relationship between the user and the target API in the user behavior feature with the access permission mapping set to determine whether the user has the permission to access the target API. The access permission mapping set includes the mapping relationship between the user and the accessible API.

[0064] The following describes how to obtain the access permission mapping set:

[0065] Obtain historical network traffic data and perform standardization on the historical network traffic data. Extract a set of historical user behavior features from the standardized historical network traffic data. Group the standardized historical network traffic data according to the user ID and API ID. Count the grouped user behavior features to obtain the number of visits to different APIs by each user. Based on the user ID, API ID, and the number of visits to different APIs by each user, construct a mapping relationship to obtain an access mapping set.

[0066] For example, network traffic data within a historical time period from a network monitoring log. The historical network traffic data is standardized to ensure that the historical network traffic data has a consistent format. Standardization may include steps such as data cleaning (such as removing duplicate data, processing missing values, etc.), data conversion (such as unifying the time format, converting data types, etc.), and data normalization (such as scaling the data to a specific range). Features related to user behavior are extracted to form a historical user behavior feature set. The historical user behavior feature set may include at least one or more of user ID, request time, API ID, request parameters, response time, and return status code. The standardized historical network traffic data is grouped according to user ID and API ID. Each group represents a specific user's access record to a specific API. The number of visits to different APIs by each user is counted to obtain the number of visits to different APIs by each user. Based on the user ID, API ID, and the number of visits to different APIs by each user, a mapping relationship is constructed to obtain an access mapping set.

[0067] For example, you can use the following code to get the access permission mapping set:

[0068] import json

[0069] import pandas as pd

[0070] #Read JSON file

[0071] with open('. / apisec_logs_202409211610.json','r')as f:

[0072] data = f.readlines()

[0073] data_list=json.loads("".join(data))["data"]

[0074] #Create DataFrame

[0075] df = pd.DataFrame(data_list)

[0076] #Use groupby to group by username and aggregate the API URLs into a list

[0077] result=df.groupby('ds_account_id')['ds_api_url'].agg(list).reset_index()

[0078] #If you want a dictionary instead of a DataFrame

[0079] result_dict=result.set_index('ds_account_id').to_dict()['ds_api_url']

[0080] #Print results

[0081] print(result_dict)

[0082] Optionally, after obtaining historical network traffic data, it is possible to determine whether the historical network traffic data contains fields that can uniquely identify the user, such as user ID, session ID, IP address. Identify the path and parameters in the request URL or the response information of the API, such as the response status code and response body content, to determine whether the API exists.

[0083] In this way, through the field that uniquely identifies the user, the behavior patterns of individual users can be tracked and analyzed, including their active time, access frequency, preferences, etc. By identifying the request URL and API response information, it is easy to analyze user behavior and API usage in the future to determine whether it is an abnormal access.

[0084] Optionally, after obtaining the historical network traffic data, in order to determine whether the access request is completed, it is also possible to determine whether the HTTP response code of the historical network traffic data is a successful response code. If it is a successful response code, it means that the request has been successfully received, understood and accepted by the server. Then the historical network traffic data can be used to determine the access permission mapping set. If it is not a successful response code, it means that the request was not successfully completed.

[0085] For example, 200 is a successful HTTP response code, indicating that the request has been successfully received, understood, and accepted by the server. It can be determined whether the HTTP response code of historical network traffic data is 200.

[0086] Optionally, the mapping relationship between users, APIs, and access times in the access permission mapping set may be stored in a mapping table, and the mapping table may be exported as a file (such as an Excel spreadsheet) for subsequent data analysis.

[0087] In an optional embodiment, the number of historical accesses of a user to a target API can be determined from the access permission mapping set. The number of historical accesses is compared with a preset access threshold, which is used to represent the maximum number of times a user can access the target API. If the number of historical accesses is less than the access threshold, it is determined that the user has the permission to access the target API. If the number of historical accesses is greater than or equal to the access threshold, it is determined that the user does not have the permission to access the target API.

[0088] It is understandable that the access threshold can be set according to user needs. The access threshold can be changed based on different application scenarios. For example, the access threshold is 100. For another example, the access threshold is 50.

[0089] For example, in the network traffic to be detected, the user ID is 123 and the target API is API2. Assume that the historical access count of user ID 123 to API2 in the access permission mapping set is 95. The access threshold of user ID 123 to API2 is 100. Compare the historical access count 95 with the access threshold 00. The historical access count 95 is less than the access threshold 100, and user ID 123 has the permission to access API2.

[0090] Step S203: If the user has the authority to access the target API, the user behavior features are converted into feature vectors.

[0091] For example, for non-numerical features, they are encoded to convert them into numerical form. For example, label encoding is used for encoding. For numerical features, scaling is required to ensure that they are on the same scale. For example, standardization (scaling the feature value to between 0 and 1) and normalization (scaling the feature value to have unit variance and zero mean) are used.

[0092] Optionally, to facilitate subsequent data analysis, if the user does not have permission to access the target API, store the exception request in the permission exception log.

[0093] Step S204: input the feature vector into an anomaly detection model, and output a detection result indicating whether the access is abnormal. The anomaly detection model is obtained by analyzing user behavior characteristics in historical network traffic data using an unsupervised learning algorithm.

[0094] For example, the unsupervised learning algorithm may be an isolation forest algorithm. The unsupervised learning algorithm may also be a clustering algorithm. The feature vector is input into an anomaly detection model, and the output detection result may be a normal (1) or an abnormal (-1) label.

[0095] The following is an example of how to train an anomaly detection model:

[0096] Obtain historical network traffic data and perform standardization on the historical network traffic data. Extract a historical user behavior feature set from the standardized historical network traffic data. Convert each historical user behavior feature into a feature vector to obtain a historical feature vector set. Based on the historical feature vector set, use the isolation forest algorithm to train the anomaly detection model to be trained until the training is completed to obtain the anomaly detection model.

[0097] For ease of understanding, the anomaly detection model trained using the isolation forest algorithm is referred to as the isolation forest model below. The isolation forest model identifies abnormal data by building multiple isolated trees and calculating the anomaly score of the input data.

[0098] It is understandable that the parameters of the isolation forest model are preset by the user. They can be changed according to different application scenarios. For example, the parameters of the isolation forest model may include: setting the number of trees to 100, the maximum depth required for a sample to split in a tree to "auto" to use 256 samples, and the proportion of outliers in the data to 10%.

[0099] For example, the historical feature vector set is divided into a training set and a test set. The training set is used to train the model, and the test set is used to evaluate the model performance. Use the training set to train the isolation forest model. The isolation forest model can build multiple decision trees and put the training data points into the decision trees. By randomly selecting features and split values, try to isolate each data point into the leaf nodes of the tree. When all decision trees have been built and the training data points have been put into the corresponding trees, the preliminary training is completed. Use the test set to evaluate the performance of the isolation forest model. Input the data points in the test set into the trained isolation forest model, and observe whether the isolation forest model can correctly identify abnormal points and normal points. Until the preset training conditions are met, it is determined that the training is completed. For example, if the accuracy of identifying abnormal points is greater than or equal to the preset accuracy threshold, it is determined that the isolation forest model does not need to adjust parameters and the training is completed.

[0100] For example, the following code can be used to train the isolation forest model:

[0101] import json

[0102] import pandas as pd

[0103] from sklearn.ensemble import IsolationForest

[0104] import joblib

[0105] #1. Data loading

[0106] with open('. / apisec_logs_202409211610.json','r')as f:

[0107] data = f.readlines()

[0108] data_list=json.loads("".join(data))["data"]

[0109] #2. Feature extraction

[0110] #Select the required features

[0111] features=data[['ds_account_id','ds_api_id','request_time','param_feature1','param_feature2']]

[0112] #4. Model selection

[0113] #Define Isolation Forest Model

[0114] model=IsolationForest(n_estimators=100,contamination=0.05,random_state=42)

[0115] #5. Model training

[0116] model.fit(features)

[0117] #6. Test data prediction

[0118] #Assume the test data is stored in another DataFrame

[0119] test_data=pd.read_csv('api_test_requests.csv')

[0120] test_features=test_data[['ds_account_id','ds_api_id','request_time','param_feature1','param_feature2']]

[0121] # Make predictions

[0122] predictions=model.predict(test_features)

[0123] #7. Identify potential outliers

[0124] test_data['anomaly']=predictions

[0125] test_data['anomaly']=test_data['anomaly'].map({1:'normal',-1:'anomaly'})#Map prediction results

[0126] #8. Model saving

[0127] joblib.dump(model,'isolation_forest_model.pkl')

[0128] #9. Output test results

[0129] print(test_data[['user','api','anomaly']])

[0130] Optionally, you can use a serialization tool to save the trained anomaly detection model to a file, so that you can load the model from the file later for real-time anomaly detection.

[0131] Optionally, in order to improve the accuracy of network security detection, historical network traffic data can be collected regularly. The collected historical network traffic data is divided into a training set and a test set. The training set is used to train the anomaly detection model, and the test set is used to evaluate the performance of the anomaly detection model and update the model.

[0132] Optionally, to facilitate subsequent data analysis, you can also manage the version of the anomaly detection model and record the reason, time, performance, and other information for each update.

[0133] like Figure 3 As shown, an exemplary flowchart of a network security analysis method provided in an embodiment of the present application may include the following steps:

[0134] Step S301: obtaining network traffic data to be detected including access requests, and extracting user behavior features from the network traffic data to be detected;

[0135] Step S302: Determine the historical number of times the user has accessed the target API from the access permission mapping set;

[0136] Step S303, compare the historical access times with the preset access threshold, if the historical access times are greater than or equal to the access threshold, execute step S304, if the historical access times are less than the access threshold, execute step S305;

[0137] Step S304: store the abnormal request in the permission abnormality log;

[0138] Step S305: converting the user behavior features into feature vectors;

[0139] Step S306: Input the feature vector into an anomaly detection model, and output a detection result indicating whether the access is abnormal.

[0140] Figure 4 This is a schematic diagram of the structure of a network security analysis device provided in an embodiment of the present application. Figure 4 As shown, the device includes: a communication module 401 and a processing module 402.

[0141] The communication module 401 is used to obtain the network traffic data to be detected including the access request;

[0142] The processing module 402 is used to extract user behavior characteristics from the network traffic data to be detected, where the user behavior characteristics are used to represent the interaction information when the user accesses the application programming interface API;

[0143] The processing module 402 is further used to match the corresponding relationship between the user and the target API in the user behavior feature with the access permission mapping set to determine whether the user has the permission to access the target API, and the access permission mapping set includes the mapping relationship between the user and the accessible API;

[0144] The processing module 402 is further used to convert the user behavior feature into a feature vector if the user has the authority to access the target API;

[0145] The processing module 402 is also used to input the feature vector into the anomaly detection model and output a detection result indicating whether the access is abnormal. The isolation forest model identifies abnormal data by constructing multiple isolated trees and calculating the anomaly score of the input data.

[0146] Optionally, the access permission mapping set is obtained in the following manner, and the processing module 402 is further used to:

[0147] Obtain historical network traffic data and perform standardization on the historical network traffic data;

[0148] Extracting a historical user behavior feature set from the standardized historical network traffic data;

[0149] The standardized historical network traffic data is grouped according to the user ID and API ID;

[0150] Count the behavior characteristics of grouped users to get the number of times each user visits different APIs;

[0151] Based on the user ID, the API ID, and the number of times each user accesses different APIs, a mapping relationship is constructed to obtain an access mapping set.

[0152] Optionally, the corresponding relationship between the user and the target API in the user behavior feature is matched with the access permission mapping set to determine whether the user has the permission to access the target API. The processing module 402 is specifically used to:

[0153] Determine the historical number of times the user accesses the target API from the access permission mapping set;

[0154] Compare the historical access count with the preset access threshold, which is used to indicate the maximum number of times a user can access the target API;

[0155] If the historical access count is less than the access threshold, it is determined that the user has the authority to access the target API;

[0156] If the historical access count is greater than or equal to the access threshold, it is determined that the user does not have permission to access the target API.

[0157] Optionally, the above anomaly detection model is obtained by analyzing user behavior characteristics in historical network traffic data using an unsupervised learning algorithm, and the processing module 402 is specifically used for:

[0158] Obtain historical network traffic data and perform standardization on the historical network traffic data;

[0159] Extracting a set of historical user behavior features from standardized historical network traffic data;

[0160] Convert each historical user behavior feature into a feature vector to obtain a set of historical feature vectors;

[0161] Based on the historical feature vector set, the isolation forest algorithm is used to train the anomaly detection model to be trained until the training is completed to obtain the anomaly detection model.

[0162] Optionally, the user behavior characteristics include at least one or more of user ID, request time, target API ID, request parameters, response time, return status code, and user's geographic location information.

[0163] Optionally, the processing module 402 is further configured to:

[0164] If the user does not have permission to access the target API, the exception request is stored in the permission exception log.

[0165] Optionally, the processing module 402 is further configured to:

[0166] If the detection result indicates an access anomaly, the abnormal request is stored in the parameter anomaly log.

[0167] Based on the same technical concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the functions of the aforementioned network security analysis device.

[0168] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0169] At least one processor 501, and a memory 502 connected to the at least one processor 501. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 In the example, the processor 501 and the memory 502 are connected via a bus 500. The bus 500 is Figure 5 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 500 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller, and there is no limitation on the name.

[0170] In the embodiment of the present application, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 can execute a network security analysis method discussed above by executing the instructions stored in the memory 502. The processor 501 can implement Figure 4 The functions of each module in the device shown.

[0171] Among them, the processor 501 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, the various functions of the device and processing data, the device can be monitored as a whole.

[0172] In one possible design, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a driver interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0173] The processor 501 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of a network security analysis method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0174] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0175] By programming the processor 501, the code corresponding to the network security analysis method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 The embodiment shown is a network security analysis method. How to design and program the processor 501 is a technology well known to those skilled in the art and will not be described in detail here.

[0176] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0177] An embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. The computer-executable instructions are used to enable a computer to execute a network security analysis method in the above embodiment.

[0178] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0179] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 Flow or flows and / or boxes Figure 1 A device that performs the functions specified in a box or multiple boxes.

[0180] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 Flow or flows and / or boxes Figure 1 The functions specified in one or more boxes.

[0181] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 Flow or flows and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0182] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network security analysis method, characterized in that: The method comprises: Acquire the network traffic data to be detected that includes the access request, and extract the user behavior characteristics from the network traffic data to be detected, wherein the user behavior characteristics are used to represent the interaction information when the user accesses the application programming interface API; Matching the corresponding relationship between the user and the target API in the user behavior feature with an access permission mapping set to determine whether the user has the permission to access the target API, the access permission mapping set including the mapping relationship between the user and the accessible API; If the user has permission to access the target API, convert the user behavior feature into a feature vector; The feature vector is input into an anomaly detection model, and a detection result indicating whether the access is abnormal is output. The anomaly detection model is obtained by analyzing user behavior characteristics in historical network traffic data using an unsupervised learning algorithm.

2. The method according to claim 1, characterized in that The access permission mapping set is obtained in the following manner: Acquire historical network traffic data, and perform standardization processing on the historical network traffic data; Extract historical user behavior feature sets from standardized historical network traffic data; Grouping the standardized historical network traffic data according to the user identifier and the API identifier; Count the behavior characteristics of grouped users to get the number of times each user visits different APIs; Based on the user identifier, the API identifier, and the number of times each user accesses different APIs, a mapping relationship is constructed to obtain the access mapping set.

3. The method according to claim 1, characterized in that The matching of the correspondence between the user and the target API in the user behavior feature with the access permission mapping set to determine whether the user has the permission to access the target API specifically includes: Determine the historical number of times the user accesses the target API from the access permission mapping set; Compare the historical access count with a preset access threshold, where the access threshold is used to indicate the maximum limit of the number of times the user can access the target API; If the historical access count is less than the access threshold, determining that the user has the authority to access the target API; If the historical access times is greater than or equal to the access threshold, it is determined that the user does not have the authority to access the target API.

4. The method according to claim 1, characterized in that The anomaly detection model is obtained by analyzing the user behavior characteristics in historical network traffic data using an unsupervised learning algorithm, specifically including: Acquire the historical network traffic data, and perform standardization processing on the historical network traffic data; Extract historical user behavior feature sets from standardized historical network traffic data; Convert each historical user behavior feature into a feature vector to obtain a set of historical feature vectors; Based on the historical feature vector set, the anomaly detection model to be trained is trained using an isolation forest algorithm until the training is completed to obtain the anomaly detection model.

5. The method according to claim 1, characterized in that The user behavior characteristics include at least one or more of user ID, request time, target API ID, request parameters, response time, return status code, and user's geographic location information.

6. The method according to claim 1, characterized in that The method further comprises: If the user does not have permission to access the target API, the exception request is stored in a permission exception log.

7. The method according to claim 1, characterized in that The method further comprises: If the detection result indicates that the access is abnormal, the abnormal request is stored in the parameter abnormality log.

8. A network security analysis device, characterized in that: The device comprises: A communication module, used for obtaining the network traffic data to be detected including the access request; A processing module, used to extract user behavior features from the network traffic data to be detected, wherein the user behavior features are used to represent interaction information when a user accesses an application programming interface API; The processing module is further used to match the corresponding relationship between the user and the target API in the user behavior feature with the access permission mapping set to determine whether the user has the authority to access the target API, and the access permission mapping set includes the mapping relationship between the user and the accessible API; The processing module is further configured to convert the user behavior feature into a feature vector if the user has the authority to access the target API; The processing module is also used to input the feature vector into an anomaly detection model and output a detection result indicating whether the access is abnormal. The anomaly detection model is obtained by analyzing user behavior characteristics in historical network traffic data using an unsupervised learning algorithm.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to cause the computer to execute the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

Images