Dynamic data interface anomaly detection method based on quantity ratio analysis

Abstract

The invention discloses a dynamic data interface anomaly detection method based on quantity ratio analysis, relates to the field of data security, and aims at solving the problems that an existing data interface detection method is low in detection precision, high in false alarm rate and incapable of self-adapting to dynamic change. The output is formatted data; s2, extracting data interface information according to each business system feature, and performing data aggregation and quantity ratio index calculation on the data interface information; and S3, comparing the calculated quantity ratio index with a built-in information white list of the business system, determining a risk level according to the volatility of the interface, and determining whether to give an alarm according to the risk level. According to the dynamic data interface anomaly detection method based on quantity ratio analysis, the access behavior of the data interface can be dynamically monitored and analyzed, potential safety risks are accurately identified, and efficient and accurate anomaly detection and early warning are achieved.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a method for detecting anomalies in a dynamic data interface based on quantitative ratio analysis. Background Art

[0002] Existing security detection methods often focus on the security control of the basic network layer and the transport layer, such as filtering suspicious requests through traditional firewalls and simple traffic restrictions. However, these methods are powerless in the face of complex data interface call scenarios and diverse data flow patterns. And passive monitoring of data interfaces using DPI alone is still not enough to efficiently identify abnormal risks. Existing detection methods may result in high false alarm rates or missed alarm rates when faced with dynamically variable interface access scenarios, and cannot adaptively and quickly adjust to the optimal detection threshold, thereby reducing the accuracy and timeliness of abnormal analysis. For example, the interface data security monitoring method, device, storage medium and electronic device with publication number CN119128958A still cannot solve the above-mentioned problems. Summary of the invention

[0003] Aiming at the shortcomings of existing data interface detection methods, such as low detection accuracy, high false alarm rate and inability to adapt to dynamic changes, a dynamic data interface anomaly detection method based on quantity ratio analysis is proposed, which can dynamically monitor and analyze the access behavior of data interfaces, accurately identify potential security risks, and achieve efficient and accurate anomaly detection and early warning.

[0004] In order to achieve the above object, the present invention adopts the following technical solution: a method for detecting abnormality of a dynamic data interface based on quantity ratio analysis, comprising the following steps: S1, obtains the traffic of the business system, reorganizes and restores the traffic, and outputs it as formatted data; S2, extracting data interface information according to the characteristics of each business system, performing data aggregation and quantity ratio index calculation on the data interface information; S3, compares the calculated quantity ratio index with the built-in information whitelist of the business system, determines the risk level according to the volatility of the interface, and determines whether to issue an alarm based on the risk level.

[0005] In this technical solution, deep data packet parsing technology and traffic reassembly and restoration are combined to output corresponding formatted data. Based on multi-dimensional quantitative indicators, it can dynamically monitor and analyze the access behavior of data interfaces, accurately identify potential security risks, and achieve efficient and accurate anomaly detection, thereby improving the security and reliability of the data transmission process.

[0006] The present invention is further configured as follows: Step S1 comprises: S11, obtain the traffic of the business system in real time based on the network proxy soft probe; S12, deeply analyzing the traffic transmitted by the data interface to extract key information of the data packet; S13, reassemble the scattered traffic packets into complete data, and then output them as structured formatted data.

[0007] In this technical solution, after capturing the traffic of the business system in real time, the traffic transmitted by the data interface is deeply analyzed to extract the key information of the data packet; through the reorganization and restoration technology, the traffic packet is reorganized into complete session data to ensure the integrity and consistency of the data.

[0008] The present invention is further configured as follows: the data aggregation and quantity ratio index calculation of the data interface information includes: Based on the extracted data interface information, it is aggregated every hour, and then the ratio of the current real-time traffic per hour to the hourly traffic in the past month is calculated to obtain the traffic volume ratio of the volume ratio indicator.

[0009] In this technical solution, the quantity ratio index includes not only the flow quantity ratio, but also the data packet size quantity ratio, the access frequency quantity ratio and the access time period quantity ratio.

[0010] The present invention is further configured as follows: before step S3, the following steps are further included: A set of built-in information whitelists with quantity ratio indicators are defined for the data interface of each managed business system. The built-in information whitelist includes a data interface identifier, and a hash value is calculated based on the extracted partial features to serve as the data interface identifier.

[0011] In this technical solution, the built-in information whitelist includes not only the above-mentioned data interface identifier, but also the business system name and quantity ratio indicator range.

[0012] The present invention is further configured as follows: Step S3 comprises: The quantity ratio index calculated in step S2 is compared with the relevant quantity ratio index in the built-in information whitelist, and the fluctuation range of each quantity ratio index is calculated. The interface risk level is divided into three levels according to the fluctuation range, and the interface data with a high interface risk level is saved as alarm information and an alarm is triggered; the fluctuation range of the quantity ratio index is specifically the difference between the current quantity ratio index and 1.

[0013] In this technical solution, the volatility of the data interface is observed by calculating the fluctuation amplitude, and large volatility is determined to be high risk, and the high-risk data is saved as warning information.

[0014] The present invention is further configured such that: in the step S12, deep packet parsing technology is specifically used to parse the traffic transmitted by the data interface.

[0015] The present invention is further configured as follows: after step S3, the following steps are further included: After each cycle of step S1 to step S3 is completed, the volume ratio indicator is dynamically adjusted based on the latest historical data to ensure that the detection logic adapts to the traffic fluctuations caused by business changes.

[0016] The present invention is further configured as follows: the built-in information whitelist also includes a quantity ratio mean and a standard deviation and upper and lower limit thresholds of the quantity ratio.

[0017] In this technical solution, the whitelist table information mainly includes update time, business system name (BusinessSystemName), data interface identifier (APIHash), flow ratio mean (FlowRatioMean), flow ratio standard deviation (FlowRatioStdDev), flow ratio lower limit threshold, and flow ratio upper limit threshold.

[0018] The present invention is further configured as follows: the interface risk levels specifically include: low risk, whose fluctuation range is within ±10%; medium risk: the fluctuation range is between ±10% and ±20%; high risk: the fluctuation range exceeds ±20%.

[0019] In this technical solution, whether to issue an alarm is determined by determining the risk level of the interface.

[0020] The present invention is further configured to: when the fluctuation range of the quantity ratio index of a certain data interface exceeds a preset threshold, an alarm is automatically triggered, and detailed information of the high-risk interface is saved in an alarm database.

[0021] In this technical solution, the detailed information of the high-risk interface includes timestamp, interface characteristics and quantity ratio index value.

[0022] The present invention can bring the following beneficial effects: The present invention relates to a dynamic data interface anomaly detection method based on quantity ratio analysis, which can monitor interface traffic in real time, identify potential attack risks, and quantitatively rate interface risks through volatility assessment, thereby optimizing alarm management and security response strategies. Different from the traditional monitoring method based on static thresholds, the present invention can achieve more flexible and intelligent risk detection based on real-time traffic data and an adaptive quantity ratio adjustment mechanism, avoiding the limitations of manually setting fixed thresholds, and greatly improving the flexibility and adaptability of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flow chart of a method for detecting anomalies in a dynamic data interface based on quantitative ratio analysis in the present application.

[0024] Figure 2This is a schematic diagram of the data interface information extracted from each business system feature in a dynamic data interface anomaly detection method based on quantity ratio analysis of the present application.

[0025] Figure 3 It is a schematic diagram of risk level classification of a dynamic data interface anomaly detection method based on quantitative ratio analysis in the present application. DETAILED DESCRIPTION

[0026] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation method described herein is only an optimal embodiment of the present invention, which is only used to explain the present invention and does not limit the scope of protection of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0027] In the big data environment, due to the huge amount of data, diverse data types, and complex and changing interface types, the security of data interfaces, as key nodes of data interaction, is facing severe challenges.

[0028] Modern data interfaces can take various forms, including API interfaces, Web service interfaces, database connections, and message queue endpoints. These interfaces often need to be exposed publicly or semi-publicly to the external network in order to meet the elasticity and flexibility requirements of distributed systems, microservice architectures, cloud computing, and hybrid environments. However, the wide openness of such interfaces also increases the potential attack surface. When attackers are able to exploit data interfaces, sensitive data may be illegally intercepted, parsed, or tampered with during transmission, resulting in serious consequences such as data leakage, data pollution, or destruction of business logic.

[0029] Existing security detection methods often focus on security control of the basic network layer and the transport layer, such as filtering suspicious requests through traditional firewalls and simple traffic restrictions. However, these methods are inadequate in the face of complex data interface call scenarios and diverse data flow patterns. At the same time, with the increasing popularity of encrypted transmission and mixed traffic, simple shallow content inspection has become difficult to fully identify potential risks. The emergence and maturity of Deep Packet Inspection (DPI) technology has provided a technical foundation for more in-depth and fine-grained interface behavior analysis. DPI can parse and correlate data packet content at a higher level, thereby better identifying abnormal behavior, potential attacks, and security risks.

[0030] However, passive monitoring of data interfaces using DPI alone is still insufficient to efficiently identify abnormal risks. Since modern data interface access is highly sequential and unbalanced, the access patterns, traffic characteristics, access frequencies, and data packet distributions of different interfaces often differ significantly. Existing detection methods may result in high false alarm or missed alarm rates when faced with dynamically variable interface access scenarios, and cannot adaptively and quickly adjust to the optimal detection threshold, thereby reducing the accuracy and timeliness of abnormal analysis.

[0031] Example 1 As the number of data interfaces open to the outside world by enterprise information systems increases, the security risks of interface exposure also increase. Network attackers often use interface vulnerabilities to obtain sensitive information or launch malicious attacks. Traditional security monitoring methods, such as traffic monitoring and access control based on fixed rules, are vulnerable to challenges from variant attacks. In view of the shortcomings of the prior art, such as low detection accuracy, high false alarm rate, and inability to adapt to dynamic changes, this embodiment proposes a dynamic data interface anomaly detection method based on quantity ratio analysis. By real-time monitoring of indicators such as data interface traffic, data packet size, and access frequency, combined with dynamic comparison of historical data, potential abnormal traffic can be discovered in a timely manner and risk alarms can be automatically triggered, thereby improving interface security. For reference, Figure 1 The present embodiment provides a method for detecting anomalies in a dynamic data interface based on quantity ratio analysis, which mainly includes the following steps.

[0032] Step S1, first, obtain the traffic of the business system, then reorganize and restore the traffic, and finally output it as formatted data.

[0033] The above steps mainly include the following sub-steps.

[0034] Step S11, specifically, capturing the traffic of the business system in real time through a network proxy soft probe.

[0035] Step S12, deeply analyzing the traffic transmitted by the data interface to extract key information of the data packet. Specifically, deep packet analysis is used to deeply analyze the traffic.

[0036] Step S13, through the reorganization and restoration technology, the scattered traffic packets are reassembled into complete session data to ensure the integrity and consistency of the data; the parsed and reorganized data are output as structured formatted data, specifically including the session-level features of the current session's unique identifier (sessionID), the MAC address of the source data end (SrcMac), the MAC address of the destination end (DstMac), the network layer features of the source IP (SrcIP), the destination IP (DstIP), the transport layer features of the source port number (SrcPort), the destination port number (DstPort), the transport protocol (Protocol), the time feature (Timestamp), the traffic feature of the total size of the traffic packet (bytes) (TotalLength), the total number of traffic packets (TotalPacketCount), the application layer features of the request method (ReqMethod), the request URI (ReqURI), the requested host name Host, the requested User-Agent information (UA), the requested data segment type (ContentType), the requested query information (ReqQuery), and the requested content (Content).

[0037] In the above technical solution, after capturing the traffic of the business system in real time, the traffic transmitted by the data interface is deeply analyzed to extract the key information of the data packet; through the reconstruction and restoration technology, the traffic packet is reorganized into complete session data to ensure the integrity and consistency of the data.

[0038] Step S2, extracting data interface information according to the characteristics of each business system, and then performing data aggregation and quantity ratio index calculation on the extracted data interface information.

[0039] In more detail, based on the above formatted data, extract data interface information according to the characteristics of each managed business system. For details on the extraction process, please refer to Figure 2 , mainly including destination IP, destination port number, requested host name Host, request URI, and request method.

[0040] For the above-mentioned data aggregation and volume ratio index calculation, in more detail, based on the above-mentioned extracted data interface feature information, according to hourly aggregation, the ratio of the current hourly real-time traffic to the hourly traffic in the past month is calculated, and finally the traffic volume ratio of the volume ratio index for anomaly detection can be performed. In this embodiment, the volume ratio indicators mainly include traffic volume ratio, data packet size ratio, access frequency ratio, and access time period ratio.

[0041] The calculation method of the above flow rate ratio is as follows: FlowRation = current hour flow rate / average flow rate at the same hour in the past month.

[0042] The data packet size calculation method refers to the following formula: PacketSizeRatio = total packet size in the current hour / average total packet size in the same hour in the past month.

[0043] The calculation method of access frequency ratio is as follows: AccessPrequencyRatio = the number of visits in the current hour / the average number of visits in the same hour in the past month.

[0044] Subsequently, before step S3 is performed, a set of built-in information whitelists of quantity ratio indicators are configured for each business system, wherein the built-in information whitelist of quantity ratio indicators mainly includes the business system name, data interface identifier, and quantity ratio indicator range, wherein the data interface identifier can calculate a hash value as a unique identifier for each data interface based on the destination IP, destination port number, requested host name (Host), request URI (ReqURI) and request method (ReqMethod) characteristics.

[0045] Step S3, compare the calculated quantity ratio index with the built-in information whitelist of the business system, evaluate the volatility and risk level of the interface, and finally determine whether to issue an alarm.

[0046] More specifically, the quantity ratio index obtained in step S2 is compared with the relevant quantity ratio index in the built-in information whitelist, the fluctuation range of each quantity ratio index is calculated, and the interface risk level can be divided into three levels according to the fluctuation range, and the interface data with a high interface level is saved as alarm information and triggers an alarm.

[0047] In this technical solution, the volatility of the data interface is observed by calculating the fluctuation amplitude, and large volatility is determined to be high risk, and the high-risk data is saved as warning information.

[0048] In order to effectively perform anomaly detection and risk assessment, it is necessary to establish a set of information whitelists for the data interface of each managed business system. The above whitelist stores the benchmark quantity ratio indicator range of each data interface, which can be compared and judged in real-time monitoring. Abnormal conditions of the interface. In this embodiment, the whitelist table information mainly includes update time, business system name (BusinessSystemName), data interface identifier (APIHash), quantity ratio mean (FlowRatioMean), quantity ratio standard deviation (FlowRatioStdDev), quantity ratio lower limit threshold, and quantity ratio upper limit threshold.

[0049] More specifically, the lower and upper thresholds of the flow ratio are expressed as: FlowRatiolowerThreshold = FlowRatioMean -k*FlowRatioStdDev FlowRatioUpperThreshold = FlowRatioMean +k*FlowRatioStdDev Here, k is a constant (usually 3).

[0050] Volatility assessment mainly depends on the volatility. For each volume ratio indicator, its volatility is calculated. The formula is as follows: Fluctuation range (%) = (current volume ratio-1)*100%.

[0051] According to the fluctuation range calculated above, the interface risk level is divided into three levels: high, medium and low. For details, refer to Figure 3 Among them, high risk refers to the situation where the fluctuation range exceeds ±20%, medium risk refers to the situation where the fluctuation range is between ±10% and ±20%, and low risk refers to the situation where the fluctuation range is within ±10%.

[0052] The interface data with high-risk volatility assessment results is saved as alarm information for subsequent security response. When the volume ratio index of a data interface reaches or exceeds the high-risk threshold, the system will automatically trigger an alarm and save the detailed information of the high-risk interface (including timestamp, interface characteristics, and volume ratio index value) to the alarm database or log system.

[0053] Update the calculation results to the built-in information whitelist to ensure that the latest threshold can be used for subsequent anomaly detection, and adaptively adjust the detection threshold of each quantity ratio indicator. Mainly through the system to continuously monitor the quantity ratio indicators of each data interface, and update the historical average and standard deviation in real time. Avoid relying on manually set fixed thresholds to improve the flexibility and adaptability of detection.

[0054] After each cycle, the volume ratio indicator is dynamically adjusted based on the latest historical data to ensure that the detection logic can adapt to business changes and traffic fluctuations. When the volume ratio indicator of an interface exceeds the high-risk threshold, the system will automatically trigger an alarm and save the detailed information of the interface (such as timestamp, interface characteristics, and volume ratio indicator value) to the alarm database or log system. Through real-time monitoring and alarms, the system can quickly identify and respond to security risks caused by interface exposure.

[0055] By introducing an anomaly detection method based on quantity ratio analysis and combining it with deep packet parsing and a dynamic threshold adjustment mechanism, this embodiment provides an efficient and flexible interface security detection solution that can monitor interface traffic in real time, identify potential attack risks, and quantify interface risks through volatility assessment, thereby optimizing alarm management and security response strategies.

[0056] Different from the traditional monitoring method based on static thresholds, the technical solution of this embodiment can achieve more flexible and intelligent risk detection based on real-time traffic data and an adaptive volume ratio adjustment mechanism, avoiding the limitations of manually setting fixed thresholds and greatly improving the flexibility and adaptability of anomaly detection.

[0057] The technical solution of this embodiment overcomes the shortcomings of the existing technology in terms of enhancing traffic monitoring, improving risk detection accuracy, and optimizing security response efficiency through innovative data interface feature extraction, volume ratio calculation, and volatility assessment methods, and provides a more efficient, accurate, and adaptable solution for data interface anomaly detection. Through this method, enterprises can better respond to security threats brought about by interface exposure and protect sensitive data from the risk of leakage and tampering.

[0058] Example 2 Based on Example 1, this example proposes a more detailed implementation process. A dynamic data interface anomaly detection method based on quantity ratio analysis, the main process of which is: based on network traffic data, through the extraction of interface access features, quantity ratio calculation and risk assessment, to achieve automatic detection and early warning of data interface exposure risks.

[0059] For data interface feature extraction, deep packet analysis (DPI) technology is used to analyze network traffic in detail and extract key information of the data interface. The key information can be found in Table 1: Table 1 Key information of data interface Fields describe Sample Data Time Record the time of interface request 2024-12-11 00:00:00 Destination IP (DstIP) Destination IP address of the data interface 21.83.158.5 Destination host (Host) The target host name (domain name) of the request ykxb.cn Request URI (ReqURI) Request URI path / open-api / affili / cooperateOrg Request method (ReqMethod) HTTP request method POST Destination Port (DstPort) The destination port number of the interface monitoring 80 Packet size (ReqSize) Size (bytes) AccessCount Number of interface accesses in the current time period TrafficSize Total size of the interface traffic in the current time period (bytes) Flow Ratio The ratio of current traffic volume to historical traffic volume Visit frequency ratio Ratio of current packet size to historical packet size Visit time period ratio The ratio of current visit frequency to historical visit frequency yes Fluctuation Range Is it in the whitelist (yes / no) 50% Risk Level Risk level calculated based on volatility high Risk Name Risk type and description Interface exposure risk For the unique identifier of the data interface and the built-in information whitelist, a unique identifier (Hash value) is calculated for each data interface through its destination IP, destination port number, request host name (Host), request URI (ReqURI), request method (ReqMethod) and other information. A set of built-in information whitelists with quantity ratio indicators are defined for each data interface. For details, refer to Table 2: Table 2 Data interface information Time DstIP Host URI ReqHost DstPort count RiskLevel RiskName 00:00:00 120.9.51.170 dw-online.ksosoft.com / api / dynamicParam / v3 / app POST 80 3 3 Interface exposure risk 00:05:00 11.25.86.202 ipr.updrv.com / api / clientevent POST 80 11 3 Interface exposure risk 00:05:00 103.52.17.36 comet.jianguoyun.com / subscribeV2 POST 80 3 3 Interface exposure risk 00:05:00 118.5.86.202 ipr.updrv.com / api / clientevent POST 80 11 3 Interface exposure risk 00:05:00 13.52.173.36 comet.jianguoyun.com / subscribeV2 POST 80 3 3 Interface exposure risk 00:20:00 18.25.86.202 ipr.updrv.com / api / clientevent POST 80 58 3 Interface exposure risk 00:20:00 13.52.173.36 comet.jianguoyun.com / subscribeV2 POST 80 5 3 Interface exposure risk 00:20:00 13.52.173.36 comet.jianguoyun.com / subscribeV2 POST 80 5 3 Interface exposure risk 00:20:00 18.25.86.202 pr.updrv.com / api / clientevent POST 80 58 3 Interface exposure risk 00:25:00 18.25.86.202 ipr.updrv.com / api / clientevent POST 80 35 3 Interface exposure risk 00:25:00 118.25.86.202 ipr.updrv.com / api / clientevent POST 80 35 3 Interface exposure risk 05:25:00 118.25.8.202 ipr.updrv.com / api / clientevent POST 80 3 3 Interface exposure risk 05:25:00 118.5.86.202 ipr.updrv.com / api / clientevent POST 80 3 3 Interface exposure risk 05:30:00 81.1.77.250 movipapi.imeitools.com / account / compatible / refresh_token POST 80 3 3 Interface exposure risk 05:30:00 81.71.77.250 movipapi.imeitools.com / account / compatible / refresh_token POST 80 3 3 Interface exposure risk 12:40:00 11.211.102.98 sd-gl.xinqiucc.com / psdk / getseeds_v2 POST 80 11 3 Interface exposure risk 12:40:00 116.21.102.98 sd-gl.xinqiucc.com / psdk / getseeds_v2 POST 80 11 3 Interface exposure risk 12:45:00 116.21.102.98 sd-gl.xinqiucc.com / psdk / getseeds_v2 POST 80 12 3 Interface exposure risk .

[0060] The calculation of the volume ratio index is as follows: Based on the characteristic data of each interface, this embodiment aggregates the traffic data every hour, calculates the ratio of the real-time traffic to the hourly traffic in the past month, and obtains the volume ratio index. The volume ratio calculation includes but is not limited to the following aspects: Traffic volume ratio: Calculate the ratio of current hourly traffic volume to historical hourly traffic volume to evaluate traffic fluctuations.

[0061] Packet size ratio: Calculates the ratio of the total packet size of the current hour to the packet size of the corresponding hour in the past month.

[0062] Visit frequency ratio: Compare the ratio of the current hour's visits to the historical number of visits to evaluate abnormalities in access patterns.

[0063] Regarding the built-in information whitelist and risk assessment: This embodiment defines a set of built-in information whitelists based on the quantity ratio calculation, which includes risk thresholds and standards for each data interface.

[0064] For example, for a data interface / api / dynamicParam / v3 / app, its historical access frequency ratio is within the normal range, which is defined as a fluctuation range of 0.8 to 1.2 times. If the current access frequency exceeds this range, it is considered a potential risk.

[0065] By comparing the current volume ratio with the standard range in the built-in information whitelist, the system evaluates the volatility of the interface. When the volume ratio fluctuation exceeds the preset threshold, it is determined to be an interface exposure risk and the corresponding risk information is recorded. For example, if the current access frequency of / api / clientevent is 58 times, and the historical average is 30 times, the access frequency volume ratio of the interface is calculated to be 1.93, which exceeds the predetermined risk threshold (such as 1.5), thereby triggering a risk alarm.

[0066] This embodiment dynamically evaluates the risk level of the interface and triggers an alarm based on the evaluation results. High-risk interfaces will be recorded and marked for subsequent security response team processing.

[0067] This embodiment further provides an adaptive adjustment mechanism based on historical data. The system continuously monitors the quantity ratio indicators of each data interface, updates the historical average and standard deviation in real time, and dynamically adjusts the detection threshold of the quantity ratio indicator. This mechanism avoids false positives and false negatives caused by relying on fixed thresholds, and improves the flexibility and adaptability of anomaly detection.

[0068] A dynamic data interface anomaly detection method based on quantitative ratio analysis in this embodiment can accurately identify potential security risks, achieve efficient and accurate anomaly detection and early warning, and thus improve the security and reliability of the data transmission process.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention is described in detail with reference to the embodiments, it should be understood by those skilled in the art that any modification or equivalent replacement of the technical solutions of the present invention does not depart from the spirit and scope of the technical solutions of the present invention and should be included in the scope of the claims of the present invention.

Claims

1. A method for detecting abnormalities in dynamic data interfaces based on quantity ratio analysis, characterized in that: The following steps are involved: S1, obtains the traffic of the business system, reorganizes and restores the traffic, and outputs it as formatted data; S2, extracting data interface information according to the characteristics of each business system, performing data aggregation and quantity ratio index calculation on the data interface information; S3, compares the calculated quantity ratio index with the built-in information whitelist of the business system, determines the risk level according to the volatility of the interface, and determines whether to issue an alarm based on the risk level.

2. A method for detecting anomalies in a dynamic data interface based on quantity ratio analysis according to claim 1, characterized in that: The step S1 comprises: S11, obtain the traffic of the business system in real time based on the network proxy soft probe; S12, deeply analyzing the traffic transmitted by the data interface to extract key information of the data packet; S13, reassemble the scattered traffic packets into complete data, and then output them as structured formatted data.

3. A method for detecting anomalies in a dynamic data interface based on quantity ratio analysis according to claim 1 or 2, characterized in that: The data aggregation and quantity ratio index calculation of the data interface information include: Based on the extracted data interface information, it is aggregated every hour, and then the ratio of the current real-time traffic per hour to the hourly traffic in the past month is calculated to obtain the traffic volume ratio of the volume ratio indicator.

4. A method for detecting anomalies in a dynamic data interface based on quantity ratio analysis according to claim 1 or 2, characterized in that: Before step S3, the following steps are also included: A set of built-in information whitelists with quantity ratio indicators are defined for the data interface of each managed business system. The built-in information whitelist includes a data interface identifier, and a hash value is calculated based on the extracted partial features to serve as the data interface identifier.

5. The method for detecting anomalies in a dynamic data interface based on quantity ratio analysis according to claim 1, characterized in that: The step S3 comprises: The quantity ratio index calculated in step S2 is compared with the relevant quantity ratio index in the built-in information whitelist, and the fluctuation range of each quantity ratio index is calculated. The interface risk level is divided into three levels according to the fluctuation range, and the interface data with a high interface risk level is saved as alarm information and an alarm is triggered; the fluctuation range of the quantity ratio index is specifically the difference between the current quantity ratio index and 1.

6. A method for detecting anomalies in a dynamic data interface based on quantity ratio analysis according to claim 2, characterized in that: In the step S12, deep packet parsing technology is specifically used to parse the traffic transmitted by the data interface.

7. The method for detecting anomalies in a dynamic data interface based on quantity ratio analysis according to claim 5, characterized in that: After step S3, the following steps are also included: After each cycle of step S1 to step S3 is completed, the volume ratio indicator is dynamically adjusted based on the latest historical data to ensure that the detection logic adapts to the traffic fluctuations caused by business changes.

8. The method for detecting anomalies in a dynamic data interface based on quantity ratio analysis according to claim 7, characterized in that: The built-in information whitelist also includes a quantity ratio mean and standard deviation and a quantity ratio upper and lower limit thresholds.

9. The method for detecting abnormality of a dynamic data interface based on quantity ratio analysis according to claim 5, characterized in that: The interface risk levels specifically include: low risk, with a fluctuation range within ±10%; medium risk: a fluctuation range between ±10% and ±20%; high risk: a fluctuation range exceeding ±20%.

10. A method for detecting abnormalities in dynamic data interfaces based on quantity ratio analysis according to claim 9, characterized in that: When the fluctuation range of the volume ratio indicator of a data interface exceeds the preset threshold, an alarm is automatically triggered and the detailed information of the high-risk interface is saved in the alarm database.

Images