Method and system for overseas application to have compliance access to API interface data

Abstract

The invention discloses a method and a system for overseas applications to have compliant access to API interface data. The method comprises the steps that a sandbox captures an API access log of an overseas application to a database in real time through a flow monitoring tool, a log analysis module analyzes the API access log based on a neural network model to obtain a log analysis result, and the sandbox obtains a sensitive data rule from a data security management center, and determining an alarm triggering condition according to the sensitive data rule and the log analysis result. According to the embodiment of the invention, the sandbox captures the API access log of the overseas application to the database in real time through the pre-deployed flow monitoring tool, and the log analysis module analyzes the API access log based on the neural network model to obtain the log analysis result, so that the sandbox determines the alarm triggering condition according to the sensitive data rule and the log analysis result; the API of the sensitive data can be accurately found, the sensitive data can be rapidly and accurately screened out, the positioning accuracy and the treatment efficiency are improved, and real-time monitoring and intelligent early warning are achieved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method and system for overseas applications to compliantly access API interface data. Background Art

[0002] With the growth of corporate data and the development of global business, more and more overseas applications have the need to access domestic enterprise internal data. Therefore, it is crucial to efficiently manage and protect the access to the enterprise's open Application Programming Interface (API), especially when facing a large number of overseas calls, to ensure the security of sensitive data.

[0003] Although the existing API management methods ensure API security through security authentication and authorization, network protection, access control, monitoring and auditing, there are still many problems. On the one hand, it is difficult to completely eliminate security risks. On the other hand, this management method is costly and requires each API to be managed one by one. Not only is the workload huge and inefficient, but it also lacks flexibility and makes it difficult to effectively identify and protect sensitive data. Summary of the invention

[0004] In view of this, the present invention provides a method and device for overseas applications to compliantly access API interface data, which can accurately discover APIs for sensitive data, quickly and accurately filter out sensitive data, improve positioning accuracy and management efficiency, and achieve real-time monitoring and intelligent early warning.

[0005] According to one aspect of the present invention, an embodiment of the present invention provides a method for overseas applications to compliantly access API interface data. The method is applied to a system for overseas applications to compliantly access API interface data. The system includes: at least two sandboxes, a log analysis module, a data security management center, and a database; wherein different sandboxes are used to monitor API access logs of different business types respectively; the method includes:

[0006] The sandbox captures API access logs of the database by overseas applications in real time through pre-deployed traffic monitoring tools;

[0007] The log analysis module analyzes the API access log based on the pre-trained neural network model to obtain a log analysis result;

[0008] The sandbox obtains pre-configured sensitive data rules from the data security management center, and determines an alarm triggering situation based on the sensitive data rules and the log analysis results.

[0009] According to another aspect of the present invention, an embodiment of the present invention further provides a system for overseas applications to compliantly access API interface data, the system comprising: at least two sandboxes, a log analysis module, a data security management center, and a database; wherein the at least two sandboxes are sandboxes of different business types; the at least two sandboxes of different business types are respectively used to monitor API access logs of different business types; the log analysis module is pre-configured with a trained neural network model;

[0010] The sandbox is used to capture the API access logs of the database by overseas applications in real time through a pre-deployed traffic monitoring tool;

[0011] The log identification module is used to analyze the API access log based on the pre-trained neural network model to obtain a log analysis result;

[0012] The sandbox is also used for the sandbox to obtain pre-configured sensitive data rules from the data security management center, and determine the alarm triggering situation according to the sensitive data rules and the log analysis results;

[0013] The data security management center is used to configure sensitive data rules and transmit the sensitive data rules to the sandbox;

[0014] The database is used to store data corresponding to the API gateway.

[0015] The above-mentioned technical scheme of the embodiment of the present invention captures the API access logs of overseas applications to the database in real time through the traffic monitoring tool pre-deployed in the sandbox, analyzes the API access logs based on the pre-trained neural network model to obtain the log analysis results, and thus determines the alarm triggering situation according to the sensitive data rules and the log analysis results, which can accurately discover the API of sensitive data, quickly and accurately screen out sensitive data, improve positioning accuracy and governance efficiency, and realize real-time monitoring and intelligent early warning.

[0016] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1A flowchart of a method for overseas applications to compliantly access API interface data provided by an embodiment of the present invention;

[0019] Figure 2 A flowchart of another method for overseas applications to compliantly access API interface data provided by an embodiment of the present invention;

[0020] Figure 3 A schematic diagram of a process for overseas applications to access API interface data in compliance with regulations provided by an embodiment of the present invention;

[0021] Figure 4 This is a structural block diagram of a system for overseas applications to compliantly access API interface data provided by an embodiment of the present invention;

[0022] Figure 5 A schematic diagram of the architecture of another system for overseas applications to compliantly access API interface data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] The acquisition, storage, use, and processing of data in the technical solution of this application comply with relevant regulations.

[0026] In one embodiment, Figure 1A flowchart of a method for overseas applications to compliantly access API interface data is provided for an embodiment of the present invention. This embodiment can be applicable to situations when overseas applications compliantly access API interface data. The method can be executed by a system for overseas applications to compliantly access API interface data.

[0027] like Figure 1 As shown, the method is applied to a system for overseas applications to compliantly access API interface data, the system comprising: at least two sandboxes, a log analysis module, a data security management center and a database; wherein different sandboxes are used to monitor API access logs of different business types; specifically, the method for overseas applications to compliantly access API interface data comprises:

[0028] S110. The sandbox uses pre-deployed traffic monitoring tools to capture API access logs of overseas applications to the database in real time.

[0029] Among them, traffic monitoring tools may include but are not limited to Filebeat lightweight log collector, Graylog and other monitoring tools, which are used to implement monitoring or capture access logs of overseas applications to APIs.

[0030] In this embodiment, there are at least two sandboxes of different business types in the sandbox; at least two sandboxes of different business types can be used to monitor API access logs of different business types respectively, and at least two sandboxes include flow monitoring tools and API gateways, etc. It can be understood that in the constructed sandbox environment, each sandbox can correspond to a data flow monitoring of a business type. When an overseas caller accesses the database through the API gateway, the flow monitoring tool in the sandbox monitors the accessed API request and the corresponding log information in real time. Therefore, through sandboxes of different business types, different access data types can be monitored through the corresponding sandboxes, etc., and the isolation of overseas applications accessing the API gateway can be achieved to prevent external interference and malicious attacks. In this embodiment, the API access log records the access time, visitor identity, API endpoint, etc.

[0031] In this embodiment, when the overseas caller accesses data in a database in the country, the API access log corresponding to the access request is first connected to the API gateway, and an access log of the requested API is generated. The log contains detailed information such as the uniform resource locator (URL) of the API request, http parameters, request header and response content. The traffic monitoring tool in the sandbox captures the access log information from the overseas API in real time to monitor the API accessed overseas. In this embodiment, the sandbox is a sandbox space of multiple different business types, and each sandbox space is deployed with a corresponding traffic monitoring tool to capture the access log of the API of the corresponding business type. It can be understood that different sandbox spaces are created according to different business needs, and traffic monitoring tools are deployed in each sandbox space. Different sandbox spaces are deployed for different businesses. The business in this embodiment can be understood as a data type. Exemplarily, the medical and health field, user behavior data, and social media data are different business types, and a sandbox space is deployed for each business type to perform traffic monitoring of the corresponding data, log analysis, etc.

[0032] S120. The log analysis module analyzes the API access log based on a pre-trained neural network model to obtain a log analysis result.

[0033] The log analysis results may include whether the API access log does not contain sensitive data or contains sensitive data, the data type and field location corresponding to the sensitive data, etc.

[0034] In this embodiment, a trained neural network model is pre-deployed in the log analysis module for in-depth analysis of API request logs, real-time monitoring and precise location of sensitive data. It can be understood that by inputting the API access log into the pre-trained neural network model, it can be output whether the API access log contains sensitive data. If sensitive data is found, the sensitive data can be located in real time, which may include but is not limited to the data type and field position corresponding to the sensitive data. In some embodiments, the IP address of the data access party and the API identifier can be used to jointly determine whether sensitive data is contained, and this embodiment does not limit this.

[0035] In one embodiment, the neural network model is constructed using the Tensor Flow framework, and the training process of the neural network model includes:

[0036] Obtain a sample set; wherein the sample set includes: a first API access log during normal access and a second API access log during abnormal access;

[0037] Annotate the first API access log and the second API access log in the sample set using a preset annotation method to obtain an annotated training sample set;

[0038] The labeled sample set is divided into a training set and a validation set, the training set is input into the neural network model, the predicted value is obtained through the forward propagation of the neural network model, the loss value between the predicted value and the true value is calculated through the loss function, and the preset optimization algorithm and back propagation are used to calculate the gradient and update the hyperparameters of the neural network model until the neural network model verifies that the loss function reaches the optimal value in the validation set or reaches the preset number of training times, thereby obtaining a trained neural network model; wherein the loss function is located between the forward propagation and back propagation of the neural network model.

[0039] The preset annotation methods may include but are not limited to entity annotation, relationship annotation, attribute annotation, and the introduction of AI-assisted annotation technology. The annotation includes: marking the content in the first API access log as 0, indicating that there is no sensitive data information, marking the content in the second API access log as 1, indicating that there is sensitive data information, and marking the sensitive data type and corresponding field position of the sensitive data information.

[0040] In this embodiment, the data preparation stage may include two stages, one is collecting and labeling data, and the other is a data preprocessing process. In this embodiment, the data collection and labeling stage may include: collecting a large number of log files as training data, and manually labeling these log files. The labeled content includes whether it contains sensitive information, where a mark of 0 indicates no sensitive information, a mark of 1 indicates sensitive information, and if there is sensitive information, the type of sensitive information, financial information, etc., needs to be labeled). For example, a log file "User A attempts to access a certain report" can be labeled as containing sensitive information (1), and the sensitive information type is financial information. The data preprocessing process may include: converting text information into a format that can be processed by a neural network. Word embedding technology is usually used to convert words in the text into vectors. Word embedding technology may include but is not limited to Word2Ve c GloV e ), etc. At the same time, operations such as word segmentation and stop word removal are performed on the log files to improve the efficiency and accuracy of the model.

[0041] In this embodiment, the architecture of the neural network model can be to use a convolutional neural network (CNN) to extract local features. The definition of the loss function corresponding to the model includes: Binary classification loss (whether it contains sensitive information): For the binary classification task of determining whether the log file contains sensitive information, a binary cross entropy loss function can be used. Assume that y is the true label (0 or 1), is the predicted probability of the model (a value between 0 and 1), and the binary cross entropy loss function formula is For example, if a log file actually contains sensitive information y = 1, and the model predicts that it contains sensitive information with a probability of Then the loss L = -[1×log(0.8)+(1-1)×log(1-0.8)] = -log(0.8). Multi-classification loss (sensitive information type): For multi-classification tasks to identify sensitive information types, the cross entropy loss function is used. If there are C sensitive information categories, the true label y is a C-dimensional one-hot vector, and the model's predicted output is is a C-dimensional probability vector, and the loss function formula is For example, in a task with three types of sensitive information (user personal information, financial information, and business information), if a log file contains financial information, then the true label y = [0, 1, 0], assuming the model predicts the output Then the loss L = -(0×log(0.1)+1×log(0.7)+0×log(0.2))=-log(0.7).

[0042] The parameter tuning of the model in this embodiment may include: using the Adam optimizer to update the parameters. Adam, as a variant of stochastic gradient descent, can better improve the training efficiency and stability. It adaptively adjusts the learning rate during the training process. In each training step, the gradient is calculated. Among them, w t is the parameter at the current moment, L is the loss function, and then the parameter is updated according to the following formula: t =β1m t-1 +(1-β1)g t , where m t is the first-order moment estimate, Among them, v t is the second-order moment estimate, Where α is the learning rate, β1 and β2 are hyperparameters (usually β1 = 0.9, β2 = 0.999), and ∈ is a small number, for example, 10 -8 , used to prevent division by zero. The learning rate α is a key hyperparameter and the appropriate value needs to be determined through experiments. Use learning rate schedulers such as step decay and cosine annealing to dynamically adjust the learning rate. At the same time, for other hyperparameters of the network, such as the number of hidden layers, the number of neurons, the word embedding dimension, etc., the optimal values ​​can also be determined through cross-validation, grid search and other methods.

[0043] In this embodiment, during training, the collected labeled data is divided into a training set, a validation set, and a test set. Usually, the training set accounts for the largest proportion (such as 70% to 80%) and is used to train the model; the validation set (such as 10% to 15%) is used to adjust the hyperparameters and monitor whether the model is overfitting during the training process; the test set (such as 10% to 15%) is used to evaluate the final performance of the model. During the training process, the log file text data in the training set is input into the neural network, the predicted output is obtained through forward propagation, and then the loss value is calculated according to the loss function. Next, an optimization algorithm (such as Adam) is used to calculate the gradient and update the network parameters through back propagation. This process is repeated until the performance of the model on the validation set no longer improves (for example, the validation loss no longer decreases) or the predetermined number of training rounds is reached. For example, 100 rounds of training are performed, and each round traverses the entire training set once, and the parameters are updated on each batch (which can be a small batch of log files, such as 32).

[0044] S130. The sandbox obtains pre-configured sensitive data rules from the data security management center, and determines the alarm triggering situation based on the sensitive data rules and log analysis results.

[0045] The alarm triggering conditions may include triggered alarm and untriggered alarm.

[0046] In this embodiment, sensitive data rules are sensitive rules for sensitive data in different scenarios; sensitive data rules include at least one of the following: sensitive data that is prohibited from access or allowed to access in preset scenarios; sensitive data that is allowed to be accessed by specified users and / or user groups; sensitive data that is allowed to be accessed by specified IP addresses and / or IP address ranges; sensitive data that is allowed to be accessed within a specified preset time period; and sensitive data that is allowed to be accessed by specified entities.

[0047] In this embodiment, the sandbox obtains the pre-configured sensitive data rules from the data security management center, and thus determines the alarm triggering situation according to the sensitive data rules and the log analysis results. It can be understood that by combining the sensitive data rules and the log analysis results to determine whether the alarm is finally triggered, in some embodiments, the sensitive data rules are matched with the log analysis results to determine whether the sensitive data rules contain the sensitive rules corresponding to the API access log. If the sensitive rules corresponding to the API access log are included, the access control corresponding to the sensitive rules is used as the analysis result; if the sensitive rules corresponding to the API access log are not included, the log analysis results are used as the analysis result; wherein the analysis results include: allowing access and prohibiting access. In the case of prohibiting access, the alarm triggering situation is determined to be triggered alarm; in the case of allowing access, the alarm triggering situation is determined to be not triggered alarm.

[0048] The above-mentioned technical scheme of the embodiment of the present invention captures the API access logs of overseas applications to the database in real time through the traffic monitoring tool pre-deployed in the sandbox, analyzes the API access logs based on the pre-trained neural network model to obtain the log analysis results, and thus determines the alarm triggering situation according to the sensitive data rules and the log analysis results, which can accurately discover the API of sensitive data, quickly and accurately screen out sensitive data, improve positioning accuracy and governance efficiency, and realize real-time monitoring and intelligent early warning.

[0049] In one embodiment, after the sandbox determines the alarm result according to the sensitive data rule and the log analysis result, it also includes:

[0050] In the case where the alarm triggering situation is a triggering alarm, the alarm information of the triggering alarm is transmitted to the alarm center, so that the alarm center selects a preset anonymization algorithm according to the detected data type, effectively processes sensitive data, and develops a new API.

[0051] Among them, the preset anonymization algorithm may include but is not limited to K-anonymity technology, L-diversity algorithm, T-closeness algorithm, differential privacy technology and other methods.

[0052] In this embodiment, when the alarm triggering situation is a triggering alarm, the alarm information of the triggering alarm is transmitted to the alarm center, so that the alarm center selects a preset anonymization algorithm according to the detected data type, effectively processes sensitive data, and develops a new API. It can be understood that when sensitive data access is detected, the alarm mechanism will be triggered to remind the administrator to urge the API developer to conduct further investigation and processing. By developing a new API, fine access control and security enhancement for overseas access to the API can be achieved. In order to protect user privacy and comply with data protection regulations, an appropriate anonymization algorithm will be recommended based on the detected data type. For example, for user personal information, K-anonymity technology can be applied; in the field of medical health, L-diversity algorithm can be used; for financial data, T-close algorithm can be used; and in user behavior data analysis, differential privacy technology can be used; geographic location data can be processed by data obfuscation technology, for example, slightly modifying the coordinates to protect the real location information. Social media data can use pseudonymization methods to replace sensitive data with pseudonyms or identifiers to maintain data integrity while preventing identity recognition. Through the corresponding algorithms, sensitive data can be effectively processed to ensure that the risk of data leakage is minimized while meeting business needs. Through this comprehensive governance approach, enterprises can more effectively manage and protect their valuable data assets while ensuring compliance within the prescribed scope.

[0053] In one embodiment, Figure 2A flowchart of another method for overseas applications to compliantly access API interface data provided by an embodiment of the present invention. Based on the above embodiments, this embodiment further refines the log analysis module to analyze the API access log based on a pre-trained neural network model to obtain the log analysis results, and the sandbox to determine the alarm triggering situation according to the sensitive data rules and the log analysis results.

[0054] like Figure 2 As shown, the method for overseas applications to compliantly access API interface data in this embodiment may specifically include the following steps:

[0055] S210. The sandbox captures the API access logs of overseas applications to the database in real time through a pre-deployed traffic monitoring tool.

[0056] S220. The log analysis module performs log analysis on the API access log to obtain a log analysis result.

[0057] In this embodiment, the log analysis module performs log analysis on the API access log to obtain log analysis results, wherein the log analysis results at least include: the URL of the API request, http parameters, request header and response content, as well as the access time, visitor identity and API endpoint. The request header may also include the Accept-Language field and IP address information.

[0058] S230, the log analysis module inputs the log parsing results into the neural network model for feature analysis to obtain the log analysis results; wherein the log analysis results include: the API access log does not contain sensitive data, and the API access log contains sensitive data, the data type and field position corresponding to the sensitive data.

[0059] In this embodiment, the log analysis results are input into the neural network model for feature analysis to obtain the log analysis results. It can be understood that these log analysis results are transmitted to a large model built based on a deep convolutional neural network (CNN). The model is implemented using the Tensor Flow framework and can automatically extract features from massive data and identify API calls that may involve sensitive data. Exemplarily, the Accept-Language field in the request header determines the possible overseas source of the request by analyzing whether the language set in the field is widely used overseas. In addition, other request header information will be comprehensively considered to first determine whether the request comes from an overseas IP, and perform sensitive data analysis on the accessed API.

[0060] S240. The sandbox obtains pre-configured sensitive data rules from the data security management center, and matches the sensitive data rules with the log analysis results to determine whether the sensitive data rules contain sensitive rules corresponding to the log analysis results.

[0061] In this embodiment, the pre-configured sensitive data rules are obtained from the data security management center, and the API access log corresponding to the log analysis result is obtained, and the sensitive data rules are matched with the log analysis result to determine whether the sensitive data rules contain the sensitive rules corresponding to the API access log. It can be understood that the sensitive data rules define rules that prohibit or allow access to sensitive data in specific scenarios, and the API access log in the log analysis result does not contain sensitive data and the API access log contains sensitive data, the data type and field position corresponding to the sensitive data, that is, when the log analysis result does not contain sensitive data, its access control can be accessed, that is, access is allowed; when the API access log contains sensitive data, the data type and field position corresponding to the sensitive data will be marked, and the corresponding access control is prohibited at this time. Therefore, the sensitive data rules can be combined with the log analysis results to jointly determine whether to issue an alarm; illustratively, the result output by the neural network model is that the API being accessed involves sensitive information, and the corresponding access type is prohibited access. However, the sensitive rules are configured to consider that the sensitive information involved can be released in a certain scenario, and the corresponding access type is allowed access. In this case, the access control corresponding to the sensitive rules is the final analysis result, and no alarm will be triggered. Similarly, if the sensitive rules do not involve relevant regulations on the sensitive information output by the large model, the result position of the model output, that is, the corresponding access type is prohibited access, will trigger an alarm.

[0062] S250. If the log analysis result contains sensitive rules corresponding to the rules, the access control corresponding to the sensitive data rules is used as the first analysis result; wherein the first analysis result includes prohibiting access and allowing access.

[0063] In this embodiment, if the sensitive data rule includes the sensitive rule corresponding to the API access log, the access control corresponding to the sensitive rule is used as the analysis result, and the analysis result includes two situations: prohibiting access and allowing access.

[0064] S260. If the sensitive rule corresponding to the log analysis result is not included, the log analysis result is a second analysis result; wherein the second analysis result includes: if the API access log does not contain sensitive data, access is allowed; if the API access log contains sensitive data, access is prohibited.

[0065] In this embodiment, if the sensitive rules corresponding to the API access log are not included, the log analysis result is the analysis result; wherein the analysis result includes: if the API access log does not contain sensitive data, access is allowed; if the API access log contains sensitive data, access is prohibited.

[0066] S270: In the case of prohibited access, determining the alarm triggering condition as triggering an alarm.

[0067] In this embodiment, in the case of prohibited access, the alarm triggering condition is determined to be triggering an alarm.

[0068] S280: When access is allowed, determine that the alarm triggering condition is that the alarm is not triggered.

[0069] In this embodiment, in the case where access is allowed, the alarm triggering condition is determined as no alarm is triggered.

[0070] The above-mentioned technical scheme of this embodiment performs log parsing on the API access log through the sandbox to obtain the log parsing result, inputs the log parsing result into the neural network model for feature analysis to obtain the log analysis result, and matches the sensitive data rule with the log analysis result to determine whether the sensitive data rule contains the sensitive rule corresponding to the log analysis result. If the sensitive rule corresponding to the log analysis result is contained, the access control corresponding to the sensitive data rule is used as the analysis result, which may include prohibiting access and allowing access. If the sensitive rule corresponding to the log analysis result is not included, the log analysis result is the analysis result, which may include: when the API access log does not contain sensitive data, access is allowed; when the API access log contains sensitive data, access is prohibited; when access is prohibited, the alarm triggering situation is determined as a triggered alarm; when access is allowed, the alarm triggering situation is determined as a non-triggered alarm. This can further accurately discover the API of sensitive data, quickly and accurately screen out sensitive data, and realize real-time monitoring and intelligent early warning.

[0071] To better understand how overseas applications can access API data in compliance, Figure 3 This is another flow diagram of an overseas application compliantly accessing API interface data provided by an embodiment of the present invention. To facilitate the display of the connection relationship between the sandbox, the log analysis module, the data security management center and the database, Figure 3 Only one sandbox is shown as an example. Figure 3As shown, first, an isolated sandbox is set up in the environment of the original open API. The scope of this sandbox needs to cover all existing APIs to ensure that the full amount of traffic and logs are collected within this scope. In addition, as a security mechanism, the sandbox can be used to block the transmission of unauthorized network packets between the inside and the outside, as a basic means of protecting the newly developed API in the future; inside the sandbox, a traffic monitoring tool is deployed to capture all access records of overseas applications to the API, and further identify potential security risks from traffic and logs through the large model trained in the log analysis module. In this embodiment, when an overseas caller accesses the database through the API gateway, the traffic monitoring tool in the sandbox monitors the accessed API requests and corresponding log information in real time, and then the API requests and corresponding log information are analyzed by the large model trained in the log analysis module to accurately locate whether the API contains sensitive data, as well as the location and content of the sensitive data. At the same time, the sandbox will obtain the pre-configured sensitive data rules from the data management center, so as to determine the alarm triggering situation according to the sensitive data rules and log analysis results, and the alarm center will generate an alarm according to the results of the large model. Once an alarm is issued indicating a security risk, the administrator will be notified and will ask the API developer to redevelop a new API version on the API gateway based on the results of sensitive identification and take the original API offline to ensure the security of overseas access.

[0072] In one embodiment, Figure 4 It is a structural block diagram of a system for overseas applications to compliantly access API interface data provided by an embodiment of the present invention. The system is applicable to the situation when overseas applications compliantly access API interface data. The system includes: at least two sandboxes 410, a log analysis module 420, a data security management center 430 and a database 440; wherein the at least two sandboxes 410 are sandboxes of different business types; the at least two sandboxes 410 of different business types are respectively used to monitor API access logs of different business types; the log analysis module 420 is pre-configured with a trained neural network model;

[0073] The sandbox 410 is used to capture the API access logs of the database by overseas applications in real time through a pre-deployed traffic monitoring tool;

[0074] The log identification module 420 is used to analyze the API access log based on the pre-trained neural network model to obtain a log analysis result;

[0075] The sandbox 410 is also used for the sandbox to obtain pre-configured sensitive data rules from the data security management center, and determine the alarm triggering situation according to the sensitive data rules and the log analysis results;

[0076] The data security management center 430 is used to configure sensitive data rules and transmit the sensitive data rules to the sandbox 420;

[0077] The database 440 is used to store data corresponding to the API gateway.

[0078] In one embodiment, the at least two sandboxes are connected to the log analysis module; the data security management center is connected to the at least two sandboxes; and the database is connected to the data security management center.

[0079] In one embodiment, the at least two sandboxes respectively include a traffic monitoring tool, a log analysis software and an API gateway.

[0080] The system for overseas applications to compliantly access API interface data provided by an embodiment of the present invention can execute the method for overseas applications to compliantly access API interface data provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0081] In one embodiment, in order to better understand the system for overseas applications to access API interface data in compliance, Figure 5 A schematic diagram of the architecture of another system for obtaining compliant access to API interface data by overseas applications provided in an embodiment of the present invention. In this embodiment, Figure 5 The large model is the trained neural network model in the above embodiment; the sandbox space is the sandbox in the above embodiment; the data gateway is the API gateway in the above embodiment; and the traffic monitoring is the traffic monitoring tool in the above embodiment. In this embodiment, multiple sandbox spaces share the same trained neural network model.

[0082] like Figure 5 As shown in the figure, a sandbox environment is built on the hosting side, and traffic monitoring, log analysis software and large model recognition system are installed and configured. For example, an enterprise can choose to create a sandbox on a cloud server, deploy Filebeat for traffic monitoring, use Tensor Flow to train large models, and effectively manage and control API access based on its own business needs, technical architecture and budget factors to ensure data security and compliance.

[0083] In this embodiment, traffic monitoring tools are deployed to capture the access logs of overseas applications to APIs in real time. These logs contain detailed information such as the URL, http parameters, IP address information, request headers, and response content of the API request. These data are transmitted to a large model built based on a deep convolutional neural network (CNN). The model is implemented using the TensorFlow framework and can automatically extract features from massive data and identify API calls that may involve sensitive data. The large model recognition system monitors and accurately locates sensitive data in real time by deeply analyzing the API request logs.

[0084] In this embodiment, an overseas application compliance access system architecture is built according to business needs; the overseas application compliance access system includes multiple sandbox spaces, a pre-trained deep convolutional neural network model, a data security management center and a database; different sandbox spaces are used to monitor different API access business type data; each sandbox space includes traffic monitoring, log analysis and data gateway; the sandbox space uses a traffic monitoring tool to capture access requests from overseas applications in real time, and when an API access request is monitored, the URL, parameters, request header and response content of the API request, as well as the access time, visitor identity and API endpoint are obtained from the API request log; the API request date is saved in the form of a SQL Server 2016 SQL Server 2016 SQL Server 2016 SQL Server 2016 SQL Server 2016 SQL Server 2016 The request log is input into a pre-trained deep convolutional neural network model to determine whether the request log includes sensitive data. If so, the data type and field location of the sensitive data. Pre-configured sensitive rules are obtained from the data security management center, including: sensitive rules for sensitive data in different scenarios, which may include prohibiting access to or allowing access to sensitive data in specific scenarios. Determine whether to trigger an alarm based on the results of the model output and the pre-configured sensitive rules. If an alarm is triggered, the alarm information is given to the alarm center so that the alarm center can recommend an appropriate anonymization algorithm based on the detected data type, effectively process sensitive data, and develop new APIs.

[0085] In this embodiment, after development is completed, once the API is online again, traffic and call logs will also be generated, and will also be automatically added to the monitoring list by the system of the present invention. If sensitive information leakage is still identified during daily calls, the developer will continue to be alerted to make modifications.

[0086] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0087] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for overseas applications to compliantly access API interface data, characterized in that: A system for compliance access to API interface data by overseas applications, the system comprising: at least two sandboxes, a log analysis module, a data security management center and a database; wherein different sandboxes are used to monitor API access logs of different business types respectively; the method comprises: The sandbox captures API access logs of the database by overseas applications in real time through pre-deployed traffic monitoring tools; The log analysis module analyzes the API access log based on the pre-trained neural network model to obtain a log analysis result; The sandbox obtains pre-configured sensitive data rules from the data security management center, and determines an alarm triggering situation based on the sensitive data rules and the log analysis results.

2. The method according to claim 1, characterized in that After determining the alarm result according to the sensitive data rule and the log analysis result, the sandbox further includes: When the alarm triggering situation is a triggering alarm, the alarm information of the triggering alarm is transmitted to the alarm center, so that the alarm center selects a preset anonymization algorithm according to the detected data type, effectively processes sensitive data, and develops a new API.

3. The method according to claim 1, characterized in that The neural network model is constructed using the Tensor Flow framework; the training process of the neural network model includes: Acquire a sample set; wherein the sample set includes: a first API access log during normal access, and a second API access log during abnormal access; The first API access log and the second API access log in the sample set are annotated using a preset annotation method to obtain an annotated training sample set; wherein the annotation includes: marking the content in the first API access log as 0, indicating that there is no sensitive data information, marking the content in the second API access log as 1, indicating that there is sensitive data information, and marking the sensitive data type and corresponding field position of the sensitive data information; Dividing the labeled sample set into a training set and a validation set; The training set is input into the neural network model, a predicted value is obtained through forward propagation of the neural network model, a loss value between the predicted value and the true value is calculated through a loss function, and a preset optimization algorithm and back propagation are used to calculate the gradient and update the hyperparameters of the neural network model until the neural network model verifies that the loss function reaches the optimal value in the validation set or reaches a preset number of training times, thereby obtaining a trained neural network model; wherein the loss function is located between the forward propagation and back propagation of the neural network model.

4. The method according to claim 1, characterized in that: The log analysis module deploys a pre-trained neural network model; accordingly, the log analysis module analyzes the API access log based on the pre-trained neural network model to obtain a log analysis result, including: Performing log analysis on the API access log to obtain a log analysis result; The log analysis result is input into the neural network model for feature analysis to obtain the log analysis result; wherein the log analysis result includes: the API access log does not contain sensitive data, and the API access log contains sensitive data, the data type and field position corresponding to the sensitive data.

5. The method according to claim 4, characterized in that The log parsing result includes at least: the URL of the API request, http parameters, request header and response content, as well as the access time, visitor identity and API endpoint.

6. The method according to claim 1, characterized in that The sensitive data rules include at least one of the following: sensitive data that is prohibited from access or allowed to access in a preset scenario; sensitive data that is allowed to be accessed by a specified user and / or user group; Allow access to sensitive data from specified IP addresses and / or IP address ranges; Sensitive data that is accessible for a specified preset time period; allows specified entities to access specified data objects and / or data sets.

7. The method according to claim 6, characterized in that The sandbox determines an alarm triggering situation according to the sensitive data rule and the log analysis result, including: Matching the sensitive data rule with the log analysis result to determine whether the sensitive data rule contains the sensitive rule corresponding to the log analysis result; If the sensitive rules corresponding to the log analysis result are included, the access control corresponding to the sensitive data rule is used as the first analysis result; wherein the first analysis result includes prohibiting access and allowing access; If the sensitive rule corresponding to the log analysis result is not included, the log analysis result is a second analysis result; wherein the second analysis result includes: if the API access log does not contain sensitive data, access is allowed; if the API access log contains sensitive data, access is prohibited; In the case of the access prohibition, determining the alarm triggering condition as triggering an alarm; In the case where access is allowed, the alarm triggering condition is determined as no alarm is triggered.

8. A system for overseas applications to compliantly access API interface data, characterized in that: The system comprises: at least two sandboxes, a log analysis module, a data security management center and a database; wherein the at least two sandboxes are sandboxes of different business types; the at least two sandboxes of different business types are respectively used to monitor API access logs of different business types; the log analysis module is pre-configured with a trained neural network model; The sandbox is used to capture the API access logs of the database by overseas applications in real time through a pre-deployed traffic monitoring tool; The log identification module is used to analyze the API access log based on the pre-trained neural network model to obtain a log analysis result; The sandbox is also used for the sandbox to obtain pre-configured sensitive data rules from the data security management center, and determine the alarm triggering situation according to the sensitive data rules and the log analysis results; The data security management center is used to configure sensitive data rules and transmit the sensitive data rules to the sandbox; The database is used to store data corresponding to the API gateway.

9. The system according to claim 8, characterized in that The at least two sandboxes are connected to the log analysis module; the data security management center is connected to the at least two sandboxes; and the database is connected to the data security management center.

10. The system according to claim 8, characterized in that The at least two sandboxes respectively include a traffic monitoring tool, a log analysis software and an API gateway.

Images