Deep learning-based internet data service security monitoring method and system

Abstract

The application discloses an internet data service security monitoring method and system based on deep learning, relates to the technical field of internet data service security monitoring, and comprises the following steps: collecting request logs of API interfaces, extracting access features of the request logs, constructing API access feature sequences, aggregating according to a user dimension, and dividing into fixed-time-length access segments; constructing a graph neural network model, mapping API calling relations in the access segments into a graph structure, extracting context features of API calling chains through graph convolution operation, generating API access mode vectors, performing density evaluation, and calculating a deviation degree of a current access behavior from historical normal access modes; when the deviation degree exceeds a dynamic threshold, it is determined that abnormal access behavior exists, and an authentication bypass attack alarm is output. The application improves the security monitoring of internet data services through the construction of access behavior collection, semantic extraction, abnormality identification and alarm feedback.

Description

Technical Field

[0001] This invention relates to the field of Internet data service security monitoring technology, and in particular to an Internet data service security monitoring method and system based on deep learning. Background Technology

[0002] With the rapid development of internet technology and the widespread application of cloud computing services, data services based on internet data service API interfaces have become a core component of modern internet application systems. Traditional internet data service API security protection technologies mainly rely on static protection measures such as identity authentication, access control, and encrypted transmission. While these methods can guarantee the security of API interfaces to a certain extent, their protective effect is often insufficient to meet practical needs in the face of increasingly complex network attack forms, especially targeted authentication bypass attacks. Existing internet data service API security monitoring methods mainly include rule-based anomaly detection, statistical feature-based behavioral analysis, and machine learning-based pattern recognition. Among these, rule-based matching methods require security experts to continuously maintain the rule base and are prone to false positives; statistical feature-based methods struggle to effectively extract the correlations between API calls and cannot accurately characterize complex access behavior patterns; and traditional machine learning-based methods have significant limitations in feature representation capabilities when processing high-dimensional, non-linear API access data.

[0003] Against the backdrop of the rapid development of deep learning technology, deep neural networks, with their powerful feature extraction and pattern recognition capabilities, have provided new technical approaches for API security monitoring. However, current mainstream deep learning models, such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs), primarily model Euclidean space data such as images and sequences, making it difficult to effectively capture the complex topological relationships between API calls. Furthermore, most existing anomaly detection algorithms employ fixed thresholds or static probability models, failing to adapt to the dynamic changes in API access patterns and easily leading to high false positive rates. In addition, traditional feature engineering methods often treat API calls as independent events, ignoring the dependencies between different APIs, making it difficult for the system to identify complex attack behaviors based on multiple API combinations.

[0004] To address the aforementioned issues, this invention provides a method and system for monitoring the security of Internet data services based on deep learning. This method models API call relationships using a graph neural network model and combines a dynamic threshold mechanism to achieve real-time detection of authentication bypass attacks, thereby improving the security protection capabilities of Internet data services. Summary of the Invention

[0005] In view of the shortcomings of existing Internet data service API security monitoring technologies in handling complex API call relationships, adapting to dynamic access pattern changes, and identifying authentication bypass attacks, this invention is proposed.

[0006] Therefore, the problem to be solved by this invention is how to build a graph neural network model to deeply model API call relationships, and combine it with a dynamic density evaluation mechanism to accurately identify abnormal access behavior, thereby effectively protecting Internet data services from the threat of authentication bypass attacks.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, embodiments of the present invention provide a method for monitoring the security of internet data services based on deep learning, comprising: Collect request logs from the API interface, extract the access characteristics from the request logs, and construct an API access characteristic sequence; The API access feature sequence is aggregated according to the user dimension and divided into access segments of fixed duration; A graph neural network model is constructed to map the API call relationships in the access segment into a graph structure. The context features of the API call chain are extracted through graph convolution operations to generate API access pattern vectors. The density of the API access pattern vector is evaluated, and the degree of deviation between the current access behavior and the historical normal access pattern is calculated. When the deviation exceeds the dynamic threshold, it is determined that there is abnormal access behavior, and an authentication bypass attack alarm is output to realize the security monitoring of Internet data services.

[0008] As a preferred embodiment of the deep learning-based internet data service security monitoring method of the present invention, the method for calculating the degree of deviation is as follows: Collect API access pattern vectors from historical normal access data, and fit the distribution of API access pattern vectors using a Gaussian mixture model to obtain K Gaussian components. Calculate the Mahalanobis distance between the current API access pattern vector x and each Gaussian component. And select the minimum Mahalanobis distance value. As an indicator for assessing the degree of deviation; Set dynamic threshold ,in The mean of the minimum Mahalanobis distance. The standard deviation of the minimum Mahalanobis distance value; When the minimum Mahalanobis distance value is greater than the dynamic threshold If so, the current API access pattern vector x is marked as a candidate anomaly, and a local outlier factor is calculated for the candidate anomaly; If the local outlier factor is greater than the preset threshold, the access behavior corresponding to the current API access pattern vector x is determined to be abnormal access behavior. A sliding window mechanism is used to maintain N normal API access pattern vectors, and the mean of the minimum Mahalanobis distance is updated in real time. Standard deviation of minimum Mahalanobis distance value This ensures that dynamic thresholds adapt to changes in access patterns. If abnormal access behavior is detected, an alarm message is output, and the false alarm sample is added to the historical normal dataset, triggering an incremental update of the Gaussian mixture model. The alarm message includes the user ID, API call sequence, and deviation score.

[0009] As a preferred embodiment of the deep learning-based internet data service security monitoring method of the present invention, the calculation of the local outlier factor for the candidate anomalies includes: Determine the k nearest neighbor set of the current API access pattern vector x. ; Calculate the k-nearest neighbor set reachable distance and locally achievable density Local outlier factor obtained .

[0010] As a preferred embodiment of the deep learning-based internet data service security monitoring method of the present invention, wherein: the method for generating the API access pattern vector is as follows: For the API call sequence of the access fragment, each API interface node is used as a vertex of the graph, and the order of API calls is used as directed edges to construct a directed weighted graph structure. Each vertex of the directed weighted graph structure is assigned an initial feature vector, wherein the initial feature vector includes the request method type, the total number of request parameters, and the response status code of the API interface; Assign a weight value to each edge of the directed weighted graph structure, wherein the weight value is calculated from the call time interval and call frequency of the vertices at both ends of the edge; Based on the aforementioned directed weighted graph structure, a graph convolutional network model is established; The graph convolutional network model is used to perform forward propagation computation on each access segment to obtain a global representation of the graph structure. The global representation of the graph structure is transformed by a fully connected layer to generate a fixed-dimensional API access pattern vector.

[0011] As a preferred embodiment of the deep learning-based Internet data service security monitoring method of the present invention, the graph convolutional network model includes a spatial domain convolutional operation layer, a temporal domain convolutional operation layer, and an attention pooling operation layer; the spatial domain convolutional operation layer is used to fuse the feature information of adjacent API nodes; the temporal domain convolutional operation layer is used to extract the temporal pattern of the API call sequence; and the attention pooling operation layer assigns higher weights to the API call relationship by introducing a self-attention mechanism.

[0012] As a preferred embodiment of the deep learning-based internet data service security monitoring method of the present invention, the method for dividing the access segment is as follows: Extract the user identifier based on the authentication token information, and group the API access feature sequence according to the user identifier; For each user group, the access feature sequence is sorted according to the timestamp to form a user-dimensional access behavior sequence; The access behavior sequence is processed using a time-series slicing method, and the access behavior sequence is divided into multiple continuous access segments of fixed duration by setting a time window length parameter, and the duration of the access segment is the preset time window length.

[0013] As a preferred embodiment of the deep learning-based internet data service security monitoring method of the present invention, the method for constructing the API access feature sequence is as follows: By deploying a log collection agent on the application server, request logs from the API gateway layer can be obtained in real time. The request logs are preprocessed, and access features are extracted according to preset feature extraction rules, wherein the access features include request method, authentication token, request parameters, and request time. The access features are arranged in ascending order of timestamps, and each feature is vectorized and encoded. The encoded access features are organized according to time sequence to construct an API access feature sequence.

[0014] Secondly, embodiments of the present invention provide an internet data service security monitoring system based on deep learning, comprising: The feature extraction module is used to collect request logs of the API interface, extract the access features of the request logs, and construct an API access feature sequence. The time-series slicing module is used to aggregate the API access feature sequence according to the user dimension and divide it into access segments of fixed duration. The generation module is used to construct a graph neural network model, map the API call relationship in the access segment into a graph structure, extract the context features of the API call chain through graph convolution operation, and generate an API access pattern vector. The density assessment module is used to assess the density of the API access pattern vector and calculate the degree of deviation between the current access behavior and the historical normal access pattern. The security alarm module is used to determine abnormal access behavior and output an authentication bypass attack alarm when the deviation exceeds a dynamic threshold, thereby realizing the security monitoring of Internet data services.

[0015] Thirdly, embodiments of the present invention provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any step of the above-described deep learning-based Internet data service security monitoring method.

[0016] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the above-described deep learning-based Internet data service security monitoring method.

[0017] Compared with existing technologies, the beneficial effects of this invention are as follows: By constructing a graph structure and introducing a graph neural network, the temporal characteristics and contextual dependencies of API call relationships are comprehensively extracted, breaking through the limitations of traditional rule matching and shallow feature methods, and realizing deep semantic modeling of complex access behaviors; Gaussian mixture model combined with Mahalanobis distance is used for deviation evaluation, and local outlier factors are used for multi-scale judgment, effectively suppressing false positives and false negatives, and improving the accuracy and reliability of abnormal access identification; a sliding window mechanism and incremental update strategy are introduced to continuously maintain the parameters of the access behavior model, enabling the monitoring system to respond in a timely manner to the natural evolution of access behavior patterns, improving the long-term stability and self-learning ability of the model; user identity is extracted through authentication tokens, access segments are divided and user behavior sequences are focused, effectively avoiding user confusion problems, and realizing refined analysis and anomaly detection for specific user behaviors; a closed-loop mechanism from access behavior collection, semantic extraction, anomaly identification to alarm feedback is constructed, which can identify and respond to authentication bypass attacks in real time and accurately, greatly improving the security protection capabilities of Internet data service platforms. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 A flowchart for a deep learning-based method for monitoring the security of internet data services. Detailed Implementation

[0019] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0020] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0021] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0022] This invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of this invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not adhering to the usual scale. Furthermore, the schematic diagrams are merely examples and should not be construed as limiting the scope of protection of this invention. In actual fabrication, the three-dimensional spatial dimensions of length, width, and depth should be included.

[0023] Furthermore, in the description of this invention, it should be noted that the terms "upper," "lower," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used solely for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. In addition, the terms "first," "second," or "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0024] Unless otherwise explicitly specified and limited, the terms "installation," "connection," and "joining" in this invention should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; similarly, they can refer to mechanical connections, electrical connections, or direct connections, or indirect connections through an intermediate medium, or internal connections between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances. Example 1

[0025] Reference Figure 1This is the first embodiment of the present invention, which provides a method for monitoring the security of Internet data services based on deep learning, including: S1: Collect request logs from the API interface, extract access characteristics from the request logs, and construct an API access characteristic sequence.

[0026] Specifically, by deploying a log collection agent in the application server, request logs from the API gateway layer can be obtained in real time.

[0027] In an optional implementation, the request logs are preprocessed, and access features are extracted according to preset feature extraction rules.

[0028] For example, preprocessing includes removing null records from log data to avoid invalid data interfering with subsequent feature extraction and modeling processes; performing a unified format conversion on the time field in the logs to standardize different time formats into a unified timestamp format to ensure the comparability and temporal correctness of feature sequences in the time dimension; and performing structured parsing on the request parameter content stored in JSON format in the logs to extract nested fields into recognizable key-value pairs, thereby facilitating the accurate extraction and vectorization encoding of subsequent access features.

[0029] For example, access characteristics include request method, authentication token, request parameters, and request time; specifically, this includes: extracting the method type used in the HTTP request, such as GET, POST, PUT, DELETE, etc., to identify the operation intent of the request; extracting authentication token information from the request header, including Bearer Token or API Key, to identify the caller's identity; parsing the request parameter values ​​in the URL, the parameter values ​​carried in the cookie, and the JSON format parameters in the request body to fully reconstruct the business data carried in the request; recording the timestamp of the request initiation to support the temporal analysis of access behavior; and obtaining the client's IP address to identify the request source and access pattern.

[0030] In an optional implementation, the access features are sorted in ascending order by timestamp, and each feature is vectorized and encoded.

[0031] For example, vectorized encoding includes One-Hot encoding of categorical features, normalization of numerical features, and word vectorization of textual features; the specific methods of vectorized encoding vary depending on the feature type, and specifically include: For categorical features, such as HTTP request methods (e.g., GET, POST, PUT, DELETE) and authentication token types (e.g., Bearer Token, API Key), a One-Hot encoding method is used. This method transforms the original category information into a sparse binary vector by constructing an independent dimension for each possible category, effectively preserving the independence between categories and avoiding the introduction of meaningless order bias. For numerical features, such as the timestamp of the request and the client IP address (which can be converted into numerical form or network segment number), a normalization strategy is adopted; the original values ​​are mapped to a uniform range between 0 and 1 to reduce the impact of the difference in units on model training and improve the model convergence efficiency and prediction stability; the timestamp can usually be encoded with periodic features (such as sine and cosine transforms of hours / minutes) to express the temporal regularity of access behavior. For text-based features, which mainly include free text fields in request parameters or descriptive text that may exist in JSON parameter values ​​in the request body, word vector conversion is required. Pre-trained word vector models (such as Word2Vec, GloVe, or BERT) can be used to convert text content into semantic expression vectors, thereby preserving the semantic relationships between words and enhancing the model's ability to understand text content.

[0032] Furthermore, the encoded access features are organized according to time sequence to construct an API access feature sequence.

[0033] For example, the API access feature sequence contains complete behavioral features for each request, and each record contains the time when the request occurred and the corresponding feature vector.

[0034] S2: Aggregate the API access feature sequence according to the user dimension and divide it into access segments of fixed duration.

[0035] Specifically, user identifiers are extracted based on authentication token information, and API access feature sequences are grouped according to user identifiers. The access feature sequences within each user group are sorted by timestamp to form user-dimensional access behavior sequences.

[0036] Furthermore, a time-series slicing method is used to process the access behavior sequence, and by setting a time window length parameter, the access behavior sequence is divided into multiple continuous and fixed-duration access segments, and the duration of the access segment is the preset time window length.

[0037] It should be noted that a sliding window mechanism is used in the process of generating access segments. The window sliding step size is a preset value to ensure that there is temporal overlap between adjacent access segments, which is used to capture access behavior features within a continuous time period. The feature sequence within each access segment is completed. When the number of requests in a segment is less than the preset number of requests, the consistency of feature dimensions is maintained by zero padding. A temporal index of the access segment is generated, recording the start and end times of each access segment.

[0038] S3: Construct a graph neural network model to map the API call relationships in the access segment into a graph structure, extract the context features of the API call chain through graph convolution operations, and generate API access pattern vectors.

[0039] Specifically, for the API call sequence of the access fragment, each API interface node is treated as a vertex of the graph, and the order of API calls is treated as directed edges, constructing a directed weighted graph structure; each vertex of the directed weighted graph structure is assigned an initial feature vector, which includes the request method type of the API interface, the total number of request parameters, and the response status code; each edge of the directed weighted graph structure is assigned a weight value, which is calculated from the call time interval and call frequency of the two vertices at the two ends of the edge.

[0040] Furthermore, a graph convolutional network model is established based on a directed weighted graph structure. The graph convolutional network model includes a spatial domain convolutional operation layer, a temporal domain convolutional operation layer, and an attention pooling operation layer. The spatial domain convolutional operation layer is used to fuse the feature information of adjacent API nodes. The temporal domain convolutional operation layer is used to extract the temporal pattern of the API call sequence. The attention pooling operation layer assigns higher weights to the API call relationship by introducing a self-attention mechanism.

[0041] For example, the spatial domain convolution operation layer adopts a graph convolution method based on the adjacency matrix, which integrates the feature information of each node and its neighboring nodes to achieve the extraction and diffusion of local structural information; this layer focuses on the local connection patterns of nodes in the call graph, which helps to capture the context dependency characteristics of API call behavior.

[0042] For example, the temporal domain convolutional operation layer combines the temporal feature information contained in the edge weights between nodes to perform one-dimensional convolution operations or temporal gating mechanism operations, thereby extracting potential temporal evolution patterns and dependency paths in the call sequence.

[0043] For example, the attention pooling operation layer introduces a self-attention mechanism to dynamically weight the importance of different call paths in the graph structure, so that the aggregation process of the global representation can pay more attention to key call nodes and high-influence call relationships.

[0044] Furthermore, a graph convolutional network model is used to perform forward propagation computation on each access segment to obtain a global representation of the graph structure; the global representation of the graph structure is then transformed by a fully connected layer to generate a fixed-dimensional API access pattern vector.

[0045] S4: Perform density evaluation on the API access pattern vector and calculate the degree of deviation between the current access behavior and the historical normal access pattern.

[0046] Specifically, API access pattern vectors are collected from historical normal access data, and a Gaussian mixture model is used to fit the distribution of the API access pattern vectors to obtain K Gaussian components, including: ; Where x is the current API access mode vector x; The number of Gaussian components represents the number of categories of normal behavior patterns; is the mixing weight coefficient of the k-th Gaussian component, with a value range of [0,1]. Let be the mean vector of the k-th Gaussian component, representing the central feature of this category; Let be the covariance matrix of the k-th Gaussian component, representing the distribution of the features; This is the time decay factor, representing the degree to which the influence of historical data is controlled. This is the current timestamp.

[0047] It should be noted that each Gaussian component includes a mean vector and a covariance matrix.

[0048] Furthermore, calculate the Mahalanobis distance between the current API access pattern vector x and each Gaussian component. And select the minimum Mahalanobis distance value. As an indicator for assessing the degree of deviation.

[0049] Preferred Mahalanobis distance The specific formula is as follows: ; Where Δt is the time interval, representing the time difference between adjacent visits; θ is the time decay coefficient, used to adjust the rate of time decay, with a value range of [1, 10].

[0050] In an optional implementation, a dynamic threshold is set. ,in This represents the mean of the minimum Mahalanobis distances within the normal sample window. The standard deviation of the minimum Mahalanobis distance value within the window; when the minimum Mahalanobis distance value is greater than the dynamic threshold. If the current API access pattern vector x is marked as a candidate exception, then the local outlier factor is calculated for the candidate exception.

[0051] In an optional implementation, calculating the local outlier factor for candidate anomalies includes: determining the k-nearest neighbor set of the current API access pattern vector x. ; Calculate the k-nearest neighbor set reachable distance and locally achievable density Local outlier factor obtained .

[0052] The preferred formula for the local outlier factor is as follows: ; in, This is the distance attenuation coefficient, used to adjust the effect of distance. Let Euclidean distance be the function between samples.

[0053] For example, suppose we collect 10,000 normal API access pattern vectors (dimension = 256), and obtain 3 Gaussian components (K = 3) by fitting a Gaussian mixture model, with the following parameters: Component 1: Component 2: Component 3: ; For example, a time decay factor is introduced. This is used to control the degree of influence of historical data. During the real-time detection phase, when the current API access pattern vector x=[0.8,-0.2,...,0.3] is received, the system calculates its time-weighted Mahalanobis distance with each Gaussian component, as follows: ; Component 1: Component 2: Component 3: Select the minimum Mahalanobis distance: .

[0054] For example, a sliding window is used to maintain the statistics of the most recent 1000 normal samples. =0.12, =0.05), set the dynamic threshold to =0.27. Since 0.16 < 0.27, the access is considered normal.

[0055] For example, when x'=[5.1,-2.3,...,4.7] and Δt=60 seconds, its minimum Mahalanobis distance is... The value ≈4.8 far exceeds the threshold of 0.27, which will trigger the verification of the local outlier factor. First, determine the set of 20 nearest neighbors N_k(x') of x', and calculate its local reachability density. and average density of neighbors =1.2, substitute into the local outlier factor formula (including distance decay coefficient α=0.5 and Euclidean distance) =8.3) The value is approximately 2.9. Since this value is greater than the preset threshold of 2.5, it is determined to be an abnormal access and an alarm is generated.

[0056] Preferably, this method effectively distinguishes between normal access and potential attack behavior through a dual mechanism of time-weighted Mahalanobis distance and dynamic threshold. The introduction of time decay factor θ and distance decay coefficient α significantly improves the model's sensitivity to temporal features and spatial distribution.

[0057] S5: When the deviation exceeds the dynamic threshold, it is determined that there is abnormal access behavior, and an authentication bypass attack alarm is output to realize the security monitoring of Internet data services.

[0058] Specifically, if the local outlier factor is greater than a preset threshold, the access behavior corresponding to the current API access pattern vector x is determined to be abnormal access behavior; a sliding window mechanism is used to maintain N normal API access pattern vectors, and the mean of the minimum Mahalanobis distance is updated in real time. Standard deviation of minimum Mahalanobis distance value This ensures that dynamic thresholds adapt to changes in access patterns.

[0059] It should be noted that the preset threshold is determined by statistically analyzing the access pattern vectors through cluster analysis and anomaly detection experiments in a large amount of real user access data to obtain the typical distribution range of local outliers under normal behavior, and then selecting an empirical value that takes into account both recall and false positive rate as the threshold.

[0060] Furthermore, if abnormal access behavior is detected, an alarm message is output, and the false alarm sample is added to the historical normal dataset, triggering an incremental update of the Gaussian mixture model. The alarm message includes the user ID, API call sequence, and deviation score.

[0061] In an optional implementation, after outputting alarm information, a tiered response strategy will be executed based on the risk level of the alarm information (such as deviation score, local outlier factor value): for high-risk anomalies (such as authentication token theft or high-frequency malicious calls), the dynamic interception module of the API gateway will be triggered immediately to terminate the current session and temporarily block the access permissions of the user identifier (such as Token or IP); for medium- and low-risk anomalies (such as abnormal parameters but no attack characteristics detected), rate limiting or challenge verification (such as CAPTCHA) will be used for secondary confirmation.

[0062] In an optional implementation, abnormal access behavior is correlated with the detection results of deep learning for attack pattern analysis. For example, if the API access pattern vector extracted by the graph convolutional network model shows an abnormal call chain (such as unauthorized access to sensitive interfaces), an attack behavior profile is automatically generated, including the call path, time distribution, and parameter features, and stored in the threat intelligence database. At the same time, an adversarial example detection module is activated to analyze whether the anomaly belongs to an evasion attack against deep learning (such as bypassing detection by perturbing request parameters), and the feature extraction rules are optimized or the attention weights of the graph convolutional network are adjusted accordingly.

[0063] In an optional implementation, an incremental learning mechanism is used to dynamically update the model. Samples identified as genuine attacks are added to the training set, triggering online fine-tuning of the Gaussian mixture model and the graph convolutional network model. Network parameters (such as convolutional kernel weights or the covariance matrix of Gaussian components) are adjusted via backpropagation to enhance the model's ability to identify novel attacks. For false positives, a negative sample learning strategy is used to correct the classification boundary, such as adjusting the dynamic threshold of the Mahalanobis distance or the number of nearest neighbors of local outliers, to reduce the subsequent false positive rate.

[0064] Example Explanation: When user A is detected making abnormal timing calls (such as intensive access to the "password change" and "transaction confirmation" interfaces within a short period of time), the system, in addition to issuing an alarm, freezes the user's session and marks it as a "credential hijacking attack." After review, the security team confirms that the behavior conforms to the attack pattern and then updates the edge weight calculation logic of the graph convolutional network model (such as shortening the time interval weight of high-frequency calls) and enhances the saliency of such call chains in the attention pooling layer. At the same time, the model encodes such abnormal patterns as new Gaussian components (K+1) and incorporates them into subsequent density evaluation.

[0065] In summary, by constructing a graph structure and introducing a graph neural network, the temporal characteristics and contextual dependencies of API call relationships are comprehensively extracted, overcoming the limitations of traditional rule matching and shallow feature methods, and achieving deep semantic modeling of complex access behaviors. A Gaussian mixture model combined with Mahalanobis distance is used for deviation evaluation, supplemented by local outlier factors for multi-scale judgment, effectively suppressing false positives and false negatives, and improving the accuracy and reliability of abnormal access identification. A sliding window mechanism and incremental update strategy are introduced to continuously maintain the access behavior model parameters, enabling the monitoring system to respond promptly to the natural evolution of access behavior patterns, improving the model's long-term stability and self-learning ability. User identity is extracted through authentication tokens, access segments are divided, and user behavior sequences are focused, effectively avoiding user confusion and achieving refined analysis and anomaly detection for specific user behaviors. A closed-loop mechanism from access behavior collection, semantic extraction, anomaly identification to alarm feedback is constructed, enabling real-time and accurate identification and response to authentication bypass attacks, significantly improving the security protection capabilities of internet data service platforms. Example 2

[0066] As a second embodiment of the present invention, this embodiment also provides an Internet data service security monitoring system based on deep learning, comprising: The feature extraction module is used to collect request logs of the API interface, extract the access features of the request logs, and construct an API access feature sequence. The time-series slicing module is used to aggregate the API access feature sequence according to the user dimension and divide it into access segments of fixed duration. The generation module is used to construct a graph neural network model, map the API call relationship in the access segment into a graph structure, extract the context features of the API call chain through graph convolution operation, and generate an API access pattern vector. The density assessment module is used to assess the density of the API access pattern vector and calculate the degree of deviation between the current access behavior and the historical normal access pattern. The security alarm module is used to determine abnormal access behavior and output an authentication bypass attack alarm when the deviation exceeds a dynamic threshold, thereby realizing the security monitoring of Internet data services.

[0067] It should be noted that the technical solution of the Internet data service security monitoring system based on deep learning described above belongs to the same concept as the technical solution of the Internet data service security monitoring method based on deep learning described above. For details not described in detail in the technical solution of the Internet data service security monitoring system based on deep learning in this embodiment, please refer to the description of the technical solution of the Internet data service security monitoring method based on deep learning described above.

[0068] The above-mentioned unit modules can be embedded in the processor of the computer device in hardware form or independent of it, or they can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0069] This embodiment also provides an electronic device, which includes a processor, a memory, a communication interface, a display screen, and an input device connected via a system bus. The processor of this computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface of the computer device is used for wired or wireless communication with external terminals. Wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a multi-task edge computing resource scheduling method. The display screen of the computer device can be a liquid crystal display screen or an e-ink display screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, a trackball, or a touchpad located on the casing of the computer device, or an external keyboard, touchpad, or mouse, etc.

[0070] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method proposed in the above embodiments.

[0071] The storage medium proposed in this embodiment belongs to the same inventive concept as the method proposed in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0072] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the method of the embodiments of the present invention.

[0073] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

[0074] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented using various computer languages.

[0075] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0076] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0078] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0079] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for monitoring the security of internet data services based on deep learning, characterized in that: include, Collect request logs from the API interface, extract the access characteristics from the request logs, and construct an API access characteristic sequence; The API access feature sequence is aggregated according to the user dimension and divided into access segments of fixed duration; A graph neural network model is constructed to map the API call relationships in the access segment into a graph structure. The context features of the API call chain are extracted through graph convolution operations to generate API access pattern vectors. The density of the API access pattern vector is evaluated, and the degree of deviation between the current access behavior and the historical normal access pattern is calculated. When the deviation exceeds the dynamic threshold, it is determined that there is abnormal access behavior, and an authentication bypass attack alarm is output to realize the security monitoring of Internet data services. The method for calculating the degree of deviation is as follows: Collect API access pattern vectors from historical normal access data, and fit the distribution of API access pattern vectors using a Gaussian mixture model to obtain K Gaussian components. Calculate the Mahalanobis distance between the current API access pattern vector x and each Gaussian component. And select the minimum Mahalanobis distance value. As an indicator for assessing the degree of deviation; Set dynamic threshold ,in The mean of the minimum Mahalanobis distance. The standard deviation of the minimum Mahalanobis distance value; When the minimum Mahalanobis distance value is greater than the dynamic threshold If so, the current API access pattern vector x is marked as a candidate anomaly, and a local outlier factor is calculated for the candidate anomaly; If the local outlier factor is greater than the preset threshold, the access behavior corresponding to the current API access pattern vector x is determined to be abnormal access behavior. A sliding window mechanism is used to maintain N normal API access pattern vectors, and the mean of the minimum Mahalanobis distance is updated in real time. Standard deviation of minimum Mahalanobis distance value This ensures that dynamic thresholds adapt to changes in access patterns. If abnormal access behavior is detected, an alarm message is output, and the false alarm sample is added to the historical normal dataset, triggering an incremental update of the Gaussian mixture model. The alarm message includes the user ID, API call sequence, and deviation score. Calculating the local outlier factor for the candidate anomalies includes: Determine the k nearest neighbor set of the current API access pattern vector x. ; Calculate the k-nearest neighbor set reachable distance and locally achievable density Local outlier factor obtained ; The method for generating the API access pattern vector is as follows: For the API call sequence of the access fragment, each API interface node is used as a vertex of the graph, and the order of API calls is used as directed edges to construct a directed weighted graph structure. Each vertex of the directed weighted graph structure is assigned an initial feature vector, wherein the initial feature vector includes the request method type, the total number of request parameters, and the response status code of the API interface; Assign a weight value to each edge of the directed weighted graph structure, wherein the weight value is calculated from the call time interval and call frequency of the vertices at both ends of the edge; Based on the aforementioned directed weighted graph structure, a graph convolutional network model is established; The graph convolutional network model is used to perform forward propagation computation on each access segment to obtain a global representation of the graph structure. The global representation of the graph structure is transformed by a fully connected layer to generate a fixed-dimensional API access pattern vector.

2. The Internet data service security monitoring method based on deep learning as described in claim 1, characterized in that: The graph convolutional network model includes a spatial domain convolutional operation layer, a temporal domain convolutional operation layer, and an attention pooling operation layer. The spatial domain convolutional operation layer is used to fuse the feature information of adjacent API nodes. The temporal domain convolutional operation layer is used to extract the temporal pattern of the API call sequence. The attention pooling operation layer assigns higher weights to the API call relationship by introducing a self-attention mechanism.

3. The Internet data service security monitoring method based on deep learning as described in claim 1, characterized in that: The method for dividing the access segment is as follows: Extract the user identifier based on the authentication token information, and group the API access feature sequence according to the user identifier; For each user group, the access feature sequence is sorted according to the timestamp to form a user-dimensional access behavior sequence; The access behavior sequence is processed using a time-series slicing method, and the access behavior sequence is divided into multiple continuous access segments of fixed duration by setting a time window length parameter, and the duration of the access segment is the preset time window length.

4. The Internet data service security monitoring method based on deep learning as described in claim 3, characterized in that: The method for constructing the API access feature sequence is as follows: By deploying a log collection agent on the application server, request logs from the API gateway layer can be obtained in real time. The request logs are preprocessed, and access features are extracted according to preset feature extraction rules, wherein the access features include request method, authentication token, request parameters, and request time. The access features are arranged in ascending order of timestamps, and each feature is vectorized and encoded. The encoded access features are organized according to time sequence to construct an API access feature sequence.

5. A deep learning-based internet data service security monitoring system, based on the deep learning-based internet data service security monitoring method according to any one of claims 1 to 4, characterized in that: include, The feature extraction module is used to collect request logs of the API interface, extract the access features of the request logs, and construct an API access feature sequence. The time-series slicing module is used to aggregate the API access feature sequence according to the user dimension and divide it into access segments of fixed duration. The generation module is used to construct a graph neural network model, map the API call relationship in the access segment into a graph structure, extract the context features of the API call chain through graph convolution operation, and generate an API access pattern vector. The density assessment module is used to assess the density of the API access pattern vector and calculate the degree of deviation between the current access behavior and the historical normal access pattern. The security alarm module is used to determine abnormal access behavior and output an authentication bypass attack alarm when the deviation exceeds a dynamic threshold, thereby realizing the security monitoring of Internet data services.

Images