API abnormal access detection and encryption protection method based on behavior analysis

Abstract

The invention discloses an API (Application Program Interface) abnormal access detection and encryption protection method based on behavior analysis, which relates to the technical field of API security protection, and comprises the following steps: receiving API access log data, and extracting access behavior feature information from the API access log data; constructing a behavior analysis graph based on the access behavior feature information; analyzing the behavior analysis chart, and identifying abnormal behaviors in the access behaviors; and performing risk assessment on the abnormal behavior, and executing an encryption protection measure. According to the API abnormal access detection and encryption protection method based on behavior analysis provided by the invention, a dynamic behavior analysis graph is constructed, and a PageRank algorithm is combined to carry out centrality analysis on API access behaviors, so that potential abnormal nodes are accurately identified. Compared with an existing detection method based on rules or simple feature matching, the method can avoid the limitation of dependence on static rules, and has higher adaptability and accuracy.

Description

Technical Field

[0001] The present invention relates to the field of API security protection technology, and in particular to a method for detecting and encrypting API abnormal access based on behavior analysis. Background Art

[0002] With the continuous development of information technology, API (application programming interface) has become an important tool for data interaction and function call between various software and services. However, as a key link in communication between systems, the security issues of API are increasingly attracting attention. Existing API security protection technologies mainly focus on ensuring the security of API through authentication, encryption, access control and other means. Common protection methods include static rule restrictions based on IP address, user identity or request frequency, and intrusion detection systems (IDS) for detecting known attack patterns.

[0003] Although these traditional security protection methods are effective to a certain extent, they still have significant shortcomings. First, many existing systems rely on rule bases and feature matching. When attackers use new attack methods or forge normal traffic, these static methods cannot identify abnormal behavior. In addition, existing security technologies usually adopt single-dimensional protection methods and lack in-depth analysis of multi-node coordinated attack behaviors (such as DDoS attacks, distributed attacks, etc.), resulting in the inability to fully prevent complex attack modes such as distributed attacks.

[0004] Another problem is that most existing behavioral analysis methods rely on machine learning models. Although these models can handle more complex attack patterns, they often encounter performance bottlenecks when faced with large-scale traffic, resulting in processing delays. On the other hand, many machine learning-based detection methods rely on a large amount of historical data, which may lead to a high false alarm rate and affect the accuracy of the detection system.

[0005] Existing technologies also lack real-time dynamic analysis of API access behavior, and are unable to comprehensively judge the risk level of access based on multiple factors such as request frequency and time interval. For the detection of abnormal access, existing technologies are often based on simple rules, fail to effectively combine complex behavior analysis and risk assessment, and lack the ability to flexibly respond to different types of attacks. Summary of the invention

[0006] In view of the above-mentioned problems, the present invention is proposed.

[0007] Therefore, the technical problem solved by the present invention is that the existing technologies usually rely on static rules, single-dimensional analysis or feature matching methods, and cannot effectively identify new attacks or abnormal behaviors disguised as normal traffic. At the same time, traditional methods mostly rely on fixed thresholds and rules, and fail to comprehensively consider multiple factors, such as request frequency, time interval, etc., which makes it impossible to accurately assess the risk level of access behavior.

[0008] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for detecting and encrypting API access abnormality based on behavior analysis, comprising:

[0009] Receive API access log data and extract access behavior feature information from the API access log data; construct a behavior analysis graph based on the access behavior feature information; analyze the behavior analysis graph to identify abnormal behavior in the access behavior; conduct risk assessment on the abnormal behavior and execute encryption protection measures.

[0010] As a preferred solution of the API abnormal access detection and encryption protection method based on behavior analysis described in the present invention, the access behavior feature information includes user identification, IP address, API identifier, access timestamp and request frequency.

[0011] As a preferred solution of the API abnormal access detection and encryption protection method based on behavior analysis described in the present invention, wherein: the behavior analysis graph includes nodes and edges; the nodes include user nodes, API nodes and IP nodes; the edges represent the access behavior between nodes, and the attributes of the edges include access timestamps and request frequencies; for each access behavior, the access interval time is calculated according to the access timestamp, and the weight of the edge is adjusted based on the request frequency and the access interval time.

[0012] As a preferred solution of the API abnormal access detection and encryption protection method based on behavior analysis described in the present invention, wherein: the identification of abnormal behavior in access behavior includes calculating the centrality of each node in the behavior analysis graph based on the PageRank algorithm, identifying potential abnormal nodes, and if the PageRank value of the node exceeds the preset threshold, marking it as a potential abnormal node; performing weight change analysis on the edges of the potential abnormal nodes, if the weight change is greater than the preset threshold, determining that the node has abnormal access behavior; using the Louvain algorithm to perform community detection to identify whether the abnormal access behavior involves multiple nodes collaborating to launch an attack.

[0013] As a preferred solution of the API abnormal access detection and encryption protection method based on behavior analysis described in the present invention, the PageRank algorithm is expressed as: ;

[0014] in, Representation Node The PageRank value, represents the damping factor, represents the total number of nodes in the graph, Representation and Node The set of directly connected neighbor nodes, Representation Node The PageRank value, Representation Node The out-degree of .

[0015] As a preferred solution of the API abnormal access detection and encryption protection method based on behavior analysis described in the present invention, the weight change analysis is expressed as: ;

[0016] in, Representation Node With Node The edge between the The weight of Representation Node With Node The request frequency between Representation Node With Node Between time The access timestamp is Representation Node With Node Between time The access timestamp is Indicates the time threshold.

[0017] As a preferred solution of the API abnormal access detection and encryption protection method based on behavior analysis described in the present invention, the Louvain algorithm is expressed as: ; ;

[0018] in, represents modularity, represents the total number of edges in the graph, Represents the adjacency matrix, which is the node in the graph and nodes The connection strength between and Node and nodes The degree of represents the indicator function, and Node and nodes The community you belong to, represents the weighted adjacency matrix, Indicates the maximum value of the request frequency between all node pairs, and They represent the adjustment factors, Representation Node and nodes The time interval between Represents a constant.

[0019] As a preferred solution of the API abnormal access detection and encryption protection method based on behavior analysis described in the present invention, the risk assessment of abnormal behavior and the implementation of encryption protection measures include:

[0020] If there is no coordinated attack by multiple nodes, and only a single node is abnormal, it is judged as the first risk level; if there is a coordinated attack by multiple nodes, it is judged as the second risk level; when it is judged as the first risk level, the request frequency of a single node is limited, and a current limiting mechanism is adopted to limit the number of requests per unit time of a single node, and an access warning is triggered; the access behavior of a single node is monitored in real time, the behavior log is recorded, and a blacklist mechanism is established to restrict access rights; Token authentication is used for encryption protection; when it is judged as the second risk level, multiple identity authentication is adopted, and the user of the attack source or attack node is required to perform secondary authentication; AES encryption is used to encrypt all sensitive data transmission; the node of the attack source is isolated, and all coordinated attack source nodes are identified and isolated through the traffic filtering system to limit the mutual communication between malicious nodes.

[0021] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the API abnormal access detection and encryption protection method based on behavior analysis are implemented.

[0022] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the API abnormal access detection and encryption protection method based on behavior analysis as described above.

[0023] Beneficial effects of the present invention: The API abnormal access detection and encryption protection method based on behavior analysis provided by the present invention constructs a dynamic behavior analysis graph and combines the PageRank algorithm to perform centrality analysis on API access behavior, thereby accurately identifying potential abnormal nodes. Compared with existing detection methods based on rules or simple feature matching, the present invention can avoid the limitations of relying on static rules, has stronger adaptability and accuracy, and can effectively identify abnormal access behaviors, especially when facing new attack methods or attacks disguised as normal traffic.

[0024] By comprehensively considering multi-dimensional access features, a dynamic risk assessment of API access behavior is achieved. Unlike the traditional single-dimensional analysis method, the present invention can comprehensively evaluate each access behavior and then determine its abnormality and potential risks. This multi-dimensional, dynamic assessment method not only improves the accuracy of abnormal behavior identification, but also makes API security protection more flexible and adaptable, and can take targeted encryption protection measures according to different risk levels.

[0025] By introducing the Louvain algorithm for community detection, we can identify attacks initiated by multiple nodes in coordination, effectively preventing the problem of insufficient recognition of coordinated attacks in existing technologies. This method can promptly detect signs of joint attacks by multiple nodes when network traffic is abnormal, thereby providing a higher level of security protection for the system. This accurate recognition of coordinated attacks not only enhances the security of the API, but also improves the ability to recognize complex attack patterns.

[0026] Combined with refined risk assessment results, corresponding encryption protection measures can be implemented according to different attack modes and risk levels, effectively improving the security of the API and ensuring that when encountering various attack scenarios, it can respond flexibly and minimize potential security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0028] Figure 1 An overall flow chart of an API abnormal access detection and encryption protection method based on behavior analysis provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0030] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from the description, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0031] Example 1

[0032] Reference Figure 1 , is an embodiment of the present invention, and provides an API abnormal access detection and encryption protection method based on behavior analysis, including:

[0033] Receive API access log data and extract access behavior feature information from the API access log data; construct a behavior analysis graph based on the access behavior feature information; analyze the behavior analysis graph to identify abnormal behavior in the access behavior; conduct risk assessment on the abnormal behavior and execute encryption protection measures.

[0034] The access behavior characteristic information includes user identification, IP address, API identifier, access timestamp and request frequency.

[0035] Specifically, the present invention realizes the extraction of access behavior feature information through an efficient log analysis framework. It can monitor every access request of the API interface in real time, and dynamically identify and extract key information that affects the security of the API interface by obtaining features such as request frequency, time interval, access source IP, etc. This feature information extraction mechanism does not rely on static rules, but combines real-time analysis and machine learning models to ensure strong adaptability to changing access behaviors. This method significantly improves the efficiency of feature extraction through the application of parallel processing and distributed computing, and is suitable for large-scale API environments.

[0036] It should be noted that this step is particularly suitable for the current high-concurrency and high-frequency API scenarios. In traditional security mechanisms, behavioral feature extraction often relies on static models, which makes it difficult to respond to changes in attacker strategies in real time. However, the present invention uses real-time data flow analysis to continuously optimize the extraction of behavioral patterns over time. The effectiveness of this method has been verified based on historical data, significantly reducing the false positive rate and missed negative rate.

[0037] Furthermore, by accurately extracting access behavior features, the present invention can provide highly reliable data support for subsequent anomaly detection. By embedding time-sensitive behavior analysis in feature information, the system of the present invention can identify subtle differences between different access patterns in real time, thereby providing more accurate security protection. This method improves the ability of the API interface to respond to various abnormal access behaviors, significantly improves the overall security of the API, and reduces the impact of common attacks such as brute force cracking and DDoS attacks on the system.

[0038] The behavior analysis graph includes nodes and edges; the nodes include user nodes, API nodes and IP nodes; the edges represent access behaviors between nodes, and the attributes of the edges include access timestamps and request frequencies; for each access behavior, the access interval is calculated based on the access timestamp, and the weight of the edge is adjusted based on the request frequency and the access interval.

[0039] Specifically, when constructing a behavior analysis graph, the present invention uses user nodes, API nodes, and IP nodes as core elements, and uses the edges between these nodes to represent the interactions between different access behaviors. Each node contains rich access data features, and each edge is weighted by access timestamps, frequencies, and other information to form a graph structure that can dynamically reflect changes in system behavior. This structure supports efficient graph traversal and query, ensuring that access behaviors and anomaly detection can still be quickly calculated under large-scale API calls.

[0040] It should be noted that the innovation of the behavior analysis graph lies in its multi-dimensional modeling of access behavior. Unlike traditional behavior analysis methods, the behavior analysis graph does not rely solely on single-dimensional features (such as IP address or request frequency), but instead establishes a richer access behavior graph by comprehensively considering the multi-level associations between nodes. This enables the present invention to accurately identify the potential connections between different attack patterns when dealing with complex attack scenarios, thereby improving the accuracy and timeliness of attack identification.

[0041] Furthermore, through the construction of the behavior analysis graph, the present invention can not only clearly display the access associations between nodes, but also dynamically adjust the graph structure to adapt to the real-time changing access patterns. This mechanism ensures that the update of the graph is synchronized with the evolution of the actual attack behavior, providing real-time and accurate data support for subsequent anomaly detection and collaborative attack identification. Ultimately, this dynamic behavior analysis graph provides a more three-dimensional and refined security monitoring for the protection system of the API interface, which can effectively identify and defend against potential complex attacks.

[0042] The identification of abnormal behavior in access behavior includes calculating the centrality of each node in the behavior analysis graph based on the PageRank algorithm, identifying potential abnormal nodes, and marking the node as a potential abnormal node if the PageRank value of the node exceeds a preset threshold; performing weight change analysis on the edge of the potential abnormal node, and determining that the node has abnormal access behavior if the weight change is greater than the preset threshold; and using the Louvain algorithm to perform community detection to identify whether the abnormal access behavior involves multiple nodes cooperating to launch an attack.

[0043] Specifically, the identification of abnormal behavior depends on a sophisticated node centrality analysis. By using the PageRank algorithm, the present invention can calculate the centrality of each node in the behavior analysis graph and accurately identify those nodes that deviate from normal behavior patterns. These nodes are abnormally active or abnormally frequently accessed, becoming potential attack targets. By setting a reasonable centrality threshold, the system can flexibly identify and classify abnormal accesses at an early stage, ensuring the system's response speed to attacks.

[0044] It should be noted that the innovation of this abnormal behavior identification method lies in the combination of network graph structure and node importance analysis, so that even among a large number of legitimate access requests, those nodes that may have abnormal behavior can be selected. This method breaks through the limitations of traditional reliance on static rules or simple threshold judgments, and can adaptively handle different types of abnormal behaviors, such as brute force cracking, IP spoofing, etc., thereby reducing false positives and missed negatives.

[0045] Furthermore, by accurately identifying abnormal nodes, the present invention can not only detect abnormal behaviors in the early stages of an attack, but also further reveal potential attack patterns through in-depth analysis of the relationships between nodes. For example, by further calculating the behavioral characteristics of abnormal nodes such as request frequency and time interval, the system can accurately determine whether it is an abnormal access to a single node or an attack initiated by multiple nodes in collaboration, providing a decision-making basis for subsequent risk assessment and protection strategies.

[0046] The PageRank algorithm is expressed as, ;

[0047] in, Representation Node The PageRank value of the node Importance or centrality of a node in a behavior analysis graph. It can be a user node, API node or IP node. Represents the damping factor, which is set to 0.85, indicating the probability of random jumps to avoid all PageRank values ​​being concentrated on one node. Indicates the total number of nodes in the graph. In the present invention, the graph contains three nodes, namely user nodes, API nodes and IP nodes. Representation and Node The set of directly connected neighbor nodes is all nodes directly connected to the node through edges. In the present invention, nodes are connected through access behavior edges, and each edge has access timestamp and request frequency attributes. Representation Node The PageRank value, Representation Node The out-degree of .

[0048] Specifically, at the beginning of the algorithm, the PageRank value of each node are all equal, set to: ;

[0049] in, is the total number of nodes in the graph (3 in this embodiment, namely user nodes, API nodes and IP nodes).

[0050] Specifically, the present invention uses the PageRank algorithm to calculate the centrality of each node in the behavior analysis graph, aiming to determine whether there is abnormal access behavior based on the relative importance of the node in the access graph. By comprehensively considering the connection strength between the node and its adjacent nodes, the PageRank algorithm can effectively distinguish between normal users and potential attackers, especially when facing large-scale and complex access graphs, and can quickly locate those nodes with abnormal centrality.

[0051] It should be noted that the advantage of the PageRank algorithm is that it has strong robustness and scalability, and can still maintain high computational efficiency when facing large amounts of data. Unlike other simple centrality measurement methods, PageRank not only focuses on the direct connection of nodes, but considers the entire network structure, making the identification of complex attack behaviors more accurate. It can effectively deal with situations where node relationships are complex and attackers adopt decentralized strategies, thereby improving the comprehensiveness and accuracy of abnormal behavior identification.

[0052] Furthermore, the PageRank algorithm can significantly improve the recognition rate of abnormal behavior, especially in a multi-user, multi-API call environment. Through a detailed analysis of node centrality, the present invention can accurately identify the key nodes used by attackers to launch attacks, so as to take appropriate protective measures before the attack expands to prevent the attack from causing system crashes or data leaks.

[0053] The weight change analysis is expressed as, ;

[0054] in, Representation Node With Node The edge between the The weight of the node and nodes The edge weight reflects the change of request frequency and time interval. The larger the edge weight value, the stronger the node. With Node The more frequent or abnormal the access behavior is, Representation Node With Node The request frequency between In the node To Node The request frequency reflects the intensity of the access behavior. Representation Node With Node Between time The access timestamp at the time of recording To Node The specific time when the visit occurred, Representation Node With Node Between time The access timestamp is Indicates the time threshold, which is used to control the sensitivity of access time changes and determine whether changes in time intervals will have a significant impact on edge weights. If the access time interval is large, it may be considered abnormal behavior.

[0055] Specifically, the weight change analysis formula is based on the time series data of API access behavior, and uses the changes in request frequency and time interval to adjust the weight of the edge. The formula represents the intensity changes of access behavior through dynamically changing weights, allowing the system to effectively distinguish normal access from abnormal behavior. In the high-frequency, low-time interval request mode, the formula can promptly identify potential brute force or DDoS attacks.

[0056] It should be noted that the weight change analysis formula has extremely high adaptability and can continuously adjust the threshold and calculation method according to real-time data to cope with different attack modes. Traditional methods often rely on static rules and are easily circumvented by attackers, while the formula of the present invention can be dynamically adjusted according to actual access conditions, thereby improving the real-time and accuracy of abnormal behavior identification, especially when facing ever-changing attack methods.

[0057] Furthermore, the weight change analysis performed by this formula enables the anomaly detection system of the present invention to have the ability of dynamic identification and self-adjustment. When the system detects an abnormal pattern, it can quickly adjust the edge weights in the graph, and combine the subsequent abnormal behavior judgment and attack pattern identification to promptly implement targeted protection measures, such as current limiting and dynamic encryption, which greatly reduces the impact on normal users.

[0058] The Louvain algorithm is expressed as, ; ;

[0059] in, represents modularity, Represents the total number of edges in the graph, reflecting the overall size of the graph. Represents the adjacency matrix, which is the node in the graph and nodes The connection strength between nodes and nodes If there is an edge between , otherwise 0, and Node and nodes The degree of , that is, the number of edges connecting them, Represents the indicator function. If the node and nodes If they belong to the same community, it is 1; otherwise, it is 0. represents the weighted adjacency matrix, for nodes and nodes The connection relationship between nodes and nodes If there is a direct connection between ,otherwise , Indicates the maximum value of the request frequency between all node pairs, used to calculate the request frequency Normalize so that the request frequencies between different node pairs can be compared under the same standard. and They represent adjustment factors, which are used to control the impact of request frequency on the weight of the adjacency matrix. The role of this factor is to ensure that the impact of request frequency on the calculation is within an adjustable range. Representation Node and nodes The time interval between nodes With Node The time difference between the last interaction between nodes. The value of the time interval reflects the periodicity of the interaction between nodes. A shorter time interval usually indicates a high-frequency access behavior. Represents a constant.

[0060] First, each node (user node, API node, IP node) in the behavior analysis graph reflects different access entities and access patterns. The centrality of a node is a key indicator to measure the importance of the node in the network. In the present invention, the PageRank algorithm is used to evaluate the centrality of each node, and its relative importance in the access behavior is determined by calculating the PageRank value of each node. The PageRank algorithm evaluates the influence of the node by considering the in-degree of each node and the connection with other nodes. If the PageRank value of a node exceeds the preset threshold, the node is regarded as a potential abnormal node, indicating that the node has a higher risk of abnormality in the access behavior.

[0061] After the potential abnormal node is identified, the next step is to analyze the weight changes of the edges between the node and other nodes. The edges in the access behavior graph represent the interaction between different nodes, and the weight of the edge changes with the different access behaviors. For each access behavior between nodes, the weight of the edge will be adjusted according to the access timestamp and request frequency. If the weight change of a node's edge exceeds the preset threshold, it means that the access behavior of the node is abnormal, which may be caused by malicious behavior or abnormal requests. This step ensures the accurate judgment of abnormal behavior by further refining the connection relationship between nodes.

[0062] After confirming the potential abnormal nodes, these nodes are further analyzed by the community detection algorithm. In the present invention, the Louvain algorithm is used to identify the community structure between nodes. The purpose of community detection is to identify the relationship pattern between nodes and analyze whether there are attack behaviors initiated by multiple nodes in collaboration. Through the Louvain algorithm, the nodes in the behavior analysis graph will be divided into different communities according to the similarity of their access behaviors. Each community represents a group of nodes that have a certain correlation in access behavior. These nodes may be normal or malicious nodes that conduct collaborative attacks.

[0063] If multiple nodes are in the same community and have abnormal access behavior patterns, this may indicate some form of coordinated attack between these nodes. For example, if multiple IP nodes frequently request the same API node, and there are obvious abnormal patterns in the access time and frequency of these requests, this indicates that these IP nodes may have coordinated to launch a DDoS attack or other forms of distributed attacks. By identifying these signs of coordinated attacks, the Louvain algorithm can effectively reveal abnormal behavior and potential attack patterns between multiple nodes.

[0064] Specifically, the Louvain algorithm performs community detection by optimizing the modularity Q value, thereby discovering potential coordinated attack behaviors in the behavior analysis graph. By dividing nodes into different communities, the algorithm can automatically identify which nodes may jointly launch an attack, providing reliable data support for subsequent coordinated attack detection.

[0065] It should be noted that the advantage of the Louvain algorithm lies in its high degree of automation and unsupervised learning capabilities. When faced with large-scale data, it can automatically identify the distributed attack strategies that attackers may adopt, avoiding the over-reliance of traditional methods on specific attack patterns. Through precise community division, the system can identify abnormal coordinated attack patterns at the early stage of attack behavior, so as to take protective measures before the attack spreads.

[0066] Furthermore, the application of the Louvain algorithm enables the present invention to effectively identify attacks initiated by multiple nodes in a coordinated manner, especially in complex scenarios such as distributed attacks (such as DDoS and distributed crawler attacks), and to quickly identify and adopt defense strategies. Based on the results of community detection, the present invention can efficiently determine the source of the attack and take countermeasures at an early stage, greatly improving the protection capabilities of the API.

[0067] The risk assessment of abnormal behavior and the implementation of encryption protection measures include: if there is no behavior of multiple nodes cooperating to launch an attack, only a single node is abnormal, and it is judged as the first risk level; if there is a behavior of multiple nodes cooperating to launch an attack, it is judged as the second risk level; when it is judged as the first risk level: limit the request frequency of a single node, adopt a current limiting mechanism, limit the number of requests per unit time of the node, and trigger an access warning; monitor the access behavior of a single node in real time, record the behavior log, and establish a blacklist mechanism to limit the access rights of the node; use encryption protection based on Token authentication to encrypt the request of the node; when it is judged as the second risk level: adopt multiple identity authentication, require the user of the attack source or attack node to perform secondary authentication; use the Advanced Encryption Standard (AES) to encrypt and protect all sensitive data transmission; isolate the attack source node, use traffic monitoring and filtering equipment to identify and isolate all coordinated attack source nodes, limit the mutual communication between these nodes, and prevent the attack from spreading; implement a distributed defense mechanism, load balance and traffic diversion for abnormal traffic, ensure that the traffic carried by the server is within a controllable range, avoid the server from being paralyzed due to excessive traffic, and ensure the stable operation of the API service.

[0068] Example 2

[0069] An embodiment of the present invention is different from the first embodiment in that:

[0070] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0071] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0072] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0073] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0074] Example 3

[0075] An embodiment of the present invention provides an API abnormal access detection and encryption protection method based on behavior analysis. In order to verify the beneficial effects of the present invention, a scientific demonstration is carried out through simulation experiments.

[0076] The experiment was conducted on a server with an 8-core CPU, 64GB memory, and 2TB hard disk. The experimental data set is a real API access log, including 50 million data, covering various scenarios such as normal access, brute force attacks, and DDoS attacks. The damping factor of PageRank in the method of the present invention is set to 0.85, the modularity optimization parameters λ1 and λ2 in the Louvain algorithm are set to 0.5 and 0.2 respectively, the time interval threshold is set to 10 seconds, and the frequency threshold is 100 times / minute.

[0077] At the beginning of the experiment, the traditional method first collects API access log data and selects a 50GB data set containing normal requests and various attack modes (including DDoS attacks, brute force cracking, etc.). Then, the traditional rule-based anomaly detection method is used to perform anomaly detection by setting thresholds. First, the request frequency and time interval of each user or IP are calculated. When the request frequency exceeds the set threshold, it is marked as a frequency anomaly; if the time interval between adjacent accesses is less than a preset value, it is determined to be a time interval anomaly. Next, the system records the detected anomalies through logs and outputs detailed information about the abnormal requests. After anomaly detection, the system executes corresponding encryption protection measures according to preset rules. For example, if an anomaly is found in a single node, the system will limit the request frequency of the node through a current limiting mechanism. If an IP address or user of an abnormal request is detected, the system will blacklist it and prevent subsequent abnormal requests through a simple token authentication encryption method. Finally, the system monitors the access behavior of abnormal nodes and restricts abnormal traffic accordingly.

[0078] At the beginning of the experiment, the method of the present invention first collects the same API access log data as the traditional method. Then, a dynamic user-API-IP behavior analysis graph is constructed through the technical solution of the present invention, each user, API and IP address are respectively used as nodes, the access behavior is used as an edge, and the edge weights between nodes are adjusted by the access timestamp and the request frequency. First, the PageRank value of each node in the behavior analysis graph is calculated, and potential abnormal nodes are identified based on the centrality of the node. If the PageRank value of a node exceeds the set threshold, the node is marked as a potential abnormal node. Then, the edge weight changes of these potential abnormal nodes are analyzed, and the changes in request frequency and time interval are calculated. If the change exceeds the preset range, the abnormal behavior of the node is confirmed. In order to identify coordinated attack behavior, the Louvain algorithm is further used to perform community detection on the behavior analysis graph to check whether there are multiple nodes that initiate abnormal requests at a similar time. If there are signs that multiple nodes are coordinated to launch an attack, a risk assessment is performed on it, and different encryption protection measures are implemented according to the assessment results. If a single node anomaly is detected, its request frequency is limited through the current limiting mechanism, and simple Token authentication is used for encryption protection; if a coordinated attack is found, security protection is strengthened, requiring multiple authentication of the attack source IP or user, and at the same time, the encryption protocol is enhanced, and the Advanced Encryption Standard (AES) is used to encrypt and transmit sensitive data to prevent data leakage. The experimental results are shown in Table 1.

[0079] Table 1 Comparison of experimental results Detection accuracy False Alarm Rate Processing time (seconds) Anomaly detection rate Risk assessment accuracy Traditional methods 81% 10% 13 74% 78% Method of the present invention 94% 4% 8 92% 96%

[0080] Compared with the traditional method, the method of the present invention comprehensively captures and analyzes the multi-dimensional feature information in API access, including the relationship between users, IPs and API nodes, and the access behavior between nodes, by constructing a dynamic user-API-IP behavior analysis graph. The graph-based modeling method enables the identification of abnormal access at a higher dimension, while the traditional method only relies on static rules and simple thresholds and cannot adapt to complex and changeable attack patterns. The PageRank algorithm is used to perform centrality analysis on the nodes in the behavior analysis graph, so that potential abnormal nodes can be effectively identified. By calculating the request frequency, time interval and edge weight changes of the nodes, the present invention can accurately determine the potential abnormal behavior, avoiding the rough judgment of abnormal behavior in the traditional method. The traditional method relies on a fixed threshold and is easily affected by the fluctuation of normal user access behavior, resulting in false positives or false negatives. The present invention greatly improves the detection accuracy of abnormal access through dynamic adjustment of the behavior graph and multi-level data analysis.

[0081] In addition, on the basis of abnormal behavior detection, the method of the present invention also introduces the Louvain algorithm for community detection, which can effectively identify coordinated attack behaviors. Through the division of community structure, it is possible to accurately identify whether there is a pattern of coordinated attack between multiple nodes, which is impossible to achieve with traditional methods. Traditional methods cannot effectively identify when multiple attack sources work together, and are prone to miss some complex attack behaviors such as distributed attacks or account takeovers.

[0082] In terms of risk assessment and encryption protection measures execution, the processing method of the present invention is also far superior to traditional methods. Traditional methods only deal with abnormal behavior based on static rules, while the present invention can flexibly adjust the encryption protection strength and security measures according to the specific characteristics and attack patterns of abnormal behavior.

[0083] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for detecting and encrypting API access abnormality based on behavior analysis, characterized in that: include: Receive API access log data, and extract access behavior feature information from the API access log data; Constructing a behavior analysis graph based on the access behavior feature information; Analyzing the behavior analysis graph to identify abnormal behaviors in access behaviors; Conduct risk assessments on abnormal behavior and implement encryption protection measures.

2. The method for detecting and encrypting API access abnormality based on behavior analysis as claimed in claim 1, characterized in that: The access behavior characteristic information includes user identification, IP address, API identifier, access timestamp and request frequency.

3. The method for detecting abnormal API access and encrypting it based on behavior analysis as claimed in claim 2, characterized in that: The behavior analysis graph includes nodes and edges; The nodes include user nodes, API nodes and IP nodes; The edge represents the access behavior between nodes, and the attributes of the edge include access timestamp and request frequency; For each access behavior, the access interval is calculated according to the access timestamp, and the weight of the edge is adjusted based on the request frequency and access interval.

4. The method for detecting abnormal API access and encrypting it based on behavior analysis as claimed in claim 3, characterized in that: The identifying of abnormal behavior in access behavior includes calculating the centrality of each node in the behavior analysis graph based on the PageRank algorithm, identifying potential abnormal nodes, and marking the node as a potential abnormal node if the PageRank value of the node exceeds a preset threshold; Analyze the weight changes of the edges of potential abnormal nodes. If the weight change is greater than the preset threshold, it is determined that the node has abnormal access behavior; The Louvain algorithm is used for community detection to identify whether abnormal access behavior involves multiple nodes cooperating to launch attacks.

5. The method for detecting abnormal API access and encrypting protection based on behavior analysis as claimed in claim 4, characterized in that: The PageRank algorithm is expressed as, ； in, Representation Node The PageRank value, represents the damping factor, represents the total number of nodes in the graph, Representation and Node The set of directly connected neighbor nodes, Representation Node The PageRank value, Representation Node The out-degree of .

6. The method for detecting abnormal API access and encrypting protection based on behavior analysis as claimed in claim 5, characterized in that: The weight change analysis is expressed as, ； in, Representation Node With Node The edge between the The weight of Representation Node With Node The request frequency between Representation Node With Node Between time The access timestamp is Representation Node With Node Between time The access timestamp is Indicates the time threshold.

7. The method for detecting abnormal API access and encrypting protection based on behavior analysis as claimed in claim 6, characterized in that: The Louvain algorithm is expressed as, ； ； in, represents modularity, represents the total number of edges in the graph, Represents the adjacency matrix, which is the node in the graph and nodes The connection strength between and Node and nodes The degree of represents the indicator function, and Node and nodes The community you belong to, represents the weighted adjacency matrix, Indicates the maximum value of the request frequency between all node pairs, and They represent the adjustment factors, Representation Node and nodes The time interval between Represents a constant.

8. The method for detecting abnormal API access and encrypting protection based on behavior analysis as claimed in claim 7, characterized in that: The risk assessment of abnormal behavior and the implementation of encryption protection measures include: If there is no coordinated attack by multiple nodes, and only a single node is abnormal, it is judged as the first risk level; If there are multiple nodes cooperating to launch an attack, it is judged as the second risk level; When it is judged as the first risk level, the request frequency of a single node is limited, and a current limiting mechanism is adopted to limit the number of requests per unit time of a single node, and an access warning is triggered; the access behavior of a single node is monitored in real time, the behavior log is recorded, and a blacklist mechanism is established to limit access rights; Token authentication is used for encryption protection; When it is judged to be the second risk level, multi-factor authentication is used to require users of the attack source or attack node to perform secondary authentication; AES encryption is used to encrypt all sensitive data transmissions; the nodes of the attack source are isolated, and all collaborative attack source nodes are identified and isolated through the traffic filtering system to limit the mutual communication between malicious nodes.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the API abnormal access detection and encryption protection method based on behavior analysis described in any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the API abnormal access detection and encryption protection method based on behavior analysis described in any one of claims 1 to 8 are implemented.

Images