Application program interface protection method and device and storage medium

Abstract

The invention relates to the technical field of network security, in particular to an application program interface protection method and device and a storage medium. The method comprises the following steps: for a plurality of deployed false interface paths corresponding to any real application program interface path, recording an access request for accessing the plurality of deployed false interface paths, and analyzing various parameters from the access request; based on the occurrence frequency of each parameter, an injection weight corresponding to each parameter is determined, and the occurrence frequency is in positive correlation with the injection weight; and determining a target parameter of which the injection weight exceeds a preset weight, and selecting a preset number of false interface paths from the plurality of deployed false interface paths to inject the target parameter. By means of the method, complex and changeable attack modes can be accurately and effectively coped with.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an application program interface protection method, device, and storage medium. Background Art

[0002] A honeypot is a decoy system disguised as a valuable target (such as a server, terminal, etc.), which is isolated from the real network and system or protected by security. A honeypot has no productive business, and any request to access the honeypot is considered an abnormal request.

[0003] Honeypot technology is one of the most commonly used API security protection methods in the security field. For example, a false API path is deployed on the API gateway or client. If the request path matches the false API path, it is considered an abnormal call. Although setting a false API path can reduce attacks on the real API path, these false API paths are generated using fixed rules. These false API paths cannot accurately and effectively protect against complex and changing attack patterns. Summary of the Invention

[0004] The embodiments of the present application provide an application program interface protection method, device, and storage medium that can accurately and effectively protect against complex and changing attack patterns.

[0005] In a first aspect, an embodiment of the present application provides an application program interface protection method, the method comprising:

[0006] For any of the multiple deployed false interface paths corresponding to a real application program interface path, recording access requests to the multiple deployed false interface paths, and parsing multiple parameters from the access requests, wherein the real application program interface path is used to indicate the location of the callable resource in the server, and the real application program interface path includes at least one parameter, and the parameter is used to instruct the server to perform a specific operation on the callable resource;

[0007] Determining an injection weight corresponding to each parameter based on an occurrence frequency of each parameter, wherein the occurrence frequency is positively correlated with the injection weight;

[0008] A target parameter whose injection weight exceeds a preset weight is determined, and a preset number of false interface paths are selected from the plurality of deployed false interface paths to inject the target parameter.

[0009] In a possible implementation, determining the injection weight corresponding to each parameter based on the occurrence frequency of each parameter includes:

[0010] For any parameter, determining the frequency of occurrence of the parameter;

[0011] Determine the time difference between the current time and the time when the access request was last received;

[0012] The occurrence frequency of any parameter and the time difference are input into the formula ω=e -λt HR(p), obtain the injection weight corresponding to any of the parameters;

[0013] Wherein, ω represents the injection weight, λ represents the preset coefficient, t represents the time difference between the current moment and the moment when the access request is most recently received, and HR(p) represents the frequency of occurrence of the parameter.

[0014] In a possible implementation, the real application program interface path includes address information of a server corresponding to the callable resource and path information of the callable resource in the server;

[0015] The false interface path is obtained by:

[0016] Parsing the address information and the path information to obtain at least one replaceable field;

[0017] For any replaceable field, a first target word having a similarity with the any replaceable field exceeding a first preset similarity is selected from a pre-built word library to replace the any replaceable field.

[0018] In one possible implementation, the method further includes:

[0019] If an access request to access the false interface path is received within a preset time period, a second target word is selected from a pre-built word library, the second target word having a similarity with any of the replaceable fields exceeding a second preset similarity, to replace the first target word, thereby obtaining an updated false interface path;

[0020] If no access request to the false interface path is received within a preset time period, selecting a third target word from a pre-built vocabulary library, whose similarity to any of the replaceable fields exceeds a third preset similarity, to replace the first target word, thereby obtaining an updated false interface path;

[0021] Among them, the second preset similarity>the first preset similarity>the third preset similarity.

[0022] In a possible implementation, the false interface path is obtained in the following manner:

[0023] Inserting a first preset content into the address information, and / or

[0024] Inserting second preset content into the path information.

[0025] In a possible implementation, the false interface path is obtained in the following manner:

[0026] Determine the word frequency-inverse text frequency corresponding to each parameter, the degree of association between each attack pattern and each parameter, and the number of occurrences of each attack pattern by parsing historical attack logs, where the attack logs contain descriptions of multiple attack patterns and multiple parameters;

[0027] Determine parameters related to each attack mode based on the obtained multiple word frequencies-inverse text frequencies and multiple correlation degrees;

[0028] The parameters related to the attack pattern that appears the most times are injected into any of the real application program interface paths.

[0029] In one possible implementation, the method further includes:

[0030] After receiving the access request, false feedback information for the access request is fed back.

[0031] In one possible implementation, the method further includes:

[0032] Determine the Internet Protocol IP address carried in the access request, and if it is determined that the number of times the same IP address accesses the deployed false interface path exceeds a preset number, determine to cancel the permission of the IP address to access any one of the real application program interface paths.

[0033] In a second aspect, an embodiment of the present application provides an application program interface protection device, the device comprising:

[0034] a parsing module configured to record, for each of the plurality of deployed pseudo interface paths corresponding to a real application program interface path, access requests to the plurality of deployed pseudo interface paths, and parse multiple parameters from the access requests, wherein the real application program interface path is used to indicate the location of a callable resource in a server, and the real application program interface path includes at least one parameter, the parameter being used to instruct the server to perform a specific operation on the callable resource;

[0035] a weight determination module, configured to determine an injection weight corresponding to each parameter based on an occurrence frequency of each parameter, wherein the occurrence frequency is positively correlated with the injection weight;

[0036] The path adjustment module is configured to determine a target parameter whose injection weight exceeds a preset weight, and select a preset number of false interface paths from the plurality of deployed false interface paths to inject the target parameter.

[0037] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising:

[0038] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of the first aspect above.

[0039] In a fourth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method in the above-mentioned first aspect.

[0040] In a fifth aspect, an embodiment of the present application provides a computer program product, which is used to enable a computer to execute the method in the first aspect above.

[0041] The embodiments of the present application disclose an application program interface protection method, device, and storage medium. By parsing multiple parameters obtained from access requests to a deployed false interface path, high-frequency parameters are determined, and the currently deployed false interface path is adjusted to cope with common attacks in the current period. This real-time path adjustment method can make the false interface path more effective in attracting attackers, thereby better protecting the real application program interface path. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without inventive work. In the drawings:

[0043] Figure 1 A schematic diagram of an application scenario of an application program interface protection method provided in an embodiment of the present application;

[0044] Figure 2 A flowchart of an application program interface protection method provided in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of a bipartite graph provided in an embodiment of the present application;

[0046] Figure 4 A schematic diagram of a specific process flow of an application program interface protection method provided in an embodiment of the present application;

[0047] Figure 5A schematic diagram of a false interface path generation process provided in an embodiment of the present application;

[0048] Figure 6 A schematic diagram of an application program interface protection device provided in an embodiment of the present application;

[0049] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of the technical solutions of this application, but not all of them. Based on the embodiments described in this application document, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the technical solutions of this application.

[0051] It should be noted that in the description of this application, "multiple" is understood to mean "at least two." "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. A and B are connected, which can mean: A and B are directly connected, and A and B are connected through C. In addition, in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying an order.

[0052] In addition, the collection, dissemination, and use of data in the technical solution of this application comply with relevant national laws and regulations.

[0053] Some technical terms in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0054] Honeypot technology: A decoy system disguised as a valuable target (such as a server, terminal, etc.) is isolated from the real network and system or protected by security. The honeypot has no productive business, and any request to access the honeypot is considered an abnormal request.

[0055] Real application program interface path: used to indicate the location of the callable resource in the server, which may include: the address information of the server corresponding to the callable resource, which may also be called the Uniform Resource Locator (URL); the path information of the callable resource in the server; and at least one parameter.

[0056] For example, a real application programming interface path might look like: http: / / www.example.com:8080 / api / v1 / products?category=books&sort=price#product-list, where "http: / / www.example.com:8080" represents the server address of the callable resource; "api / v1 / products" represents the path to the callable resource on that server; and "?category=books&sort=price#product-list" represents parameters. https represents the protocol used for communication between the client and the server; www.example.com represents the server's domain name (i.e., the network address of the server where the callable resource resides); an Internet Protocol address can also be used to represent the server's location; 8080 represents the port number (the default port for HTTP is 80, and the default port for HTTP is 443); / api represents the root path of the interface; v1 represents the interface version number; and products represents the specific resource. Parameters are used to pass additional information to the server, instructing it to perform specific operations on the callable resource, such as filtering, sorting, and paging. For example, / api / products? In category=electronics&page=2, category=electronics indicates filtering out the electronic product category, and page=2 indicates obtaining data on the second page.

[0057] Fake interface path: obtained by modifying the real application interface path.

[0058] Structured Query Language (SQL) injection: SQL injection is a common network attack technique in which attackers inject malicious SQL statements into user input or other data sources to obtain or tamper with sensitive information in the database.

[0059] Path traversal: Path traversal attacks are a common method of exploiting security vulnerabilities. Attackers manipulate file path-related input to break through application access restrictions and access or operate unauthorized files or directories. For example, relative path traversal allows attackers to use relative path notation (such as .. / ) to navigate to directories outside the current directory.

[0060] Cross-script attack: commonly known as Cross-Site Scripting (XSS), is a common network security vulnerability. Attackers exploit this vulnerability to inject malicious scripts into the target website. When users visit the website, the browser will execute these malicious scripts, resulting in security issues such as user information leakage and website tampering.

[0061] Tool fingerprints: These can refer to the unique characteristics of network attack tools or malware. By analyzing these characteristics in network traffic, system logs, and other data, security personnel can detect the use of specific attack tools and take appropriate preventive and countermeasure measures.

[0062] The following is a detailed description of the application program interface protection method in the embodiment of the present application with reference to the accompanying drawings.

[0063] like Figure 1 The following is an application scenario of an application program interface protection method provided by an embodiment of the present application. The application scenario includes at least one client (such as Figure 1 The client 101_1, client 101_2, ..., client 101_N) and at least one server (such as Figure 1 , 102_1, 102_2, ..., 101_N are shown in FIG. 1 . The client is used to send an access request to the server to access certain resources or call certain services, and the server feeds back data corresponding to the access request or provides corresponding services to the client.

[0064] The client and server can be independent physical servers, or they can be cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The embodiments of this application do not specifically limit this.

[0065] Based on the problem that the existing false interface path cannot accurately and effectively protect against complex and changeable attack modes, the embodiment of the present application provides an application program interface protection method, such as Figure 2 As shown, the method includes:

[0066] S201: For any multiple deployed false interface paths corresponding to a real application program interface path, record access requests for accessing the multiple deployed false interface paths, and parse multiple parameters from the access requests.

[0067] When deploying fake interface paths, any real application interface path can correspond to one or more fake interface paths. Because the fake interface paths are designed to attract attackers, the format and content of the fake interface paths must be similar to the corresponding real application interface paths. In other words, the fake interface paths are modified versions of the corresponding real application interface paths.

[0068] Before constructing a false interface path, it is first necessary to determine the format and content of the real application interface path. Specifically, the real application interface path can be parsed through a finite state machine, such as http: / / www.example.com:8080 / api / v1 / users / {userid=123}. After obtaining the real application interface path, the parameter name, type, maximum value, minimum value, length limit and enumeration value are extracted and recorded. For example, in the above example, the parameter name is userid, the parameter value is 123 (indicating data with the user name 123), and the type is integer. For the resource with the parameter name userid, the maximum value is a (not shown in the above example), the minimum value is b (not shown in the above example), the length limit is c (not shown in the above example), and the enumeration value is userid=XXX,...,userid=YYY (not shown in the above example). The embodiment of the present application does not specifically limit the information of the recorded real application interface path.

[0069] Specifically, constructing the false interface path may be performed through at least one of the following implementations.

[0070] (1)Semantic substitution.

[0071] In a possible implementation, the address information and the path information contained in the real application program interface path are parsed to obtain at least one replaceable field;

[0072] For any replaceable field, a first target word having a similarity with the any replaceable field exceeding a first preset similarity is selected from a pre-built word library to replace the any replaceable field.

[0073] Taking the path information / api / v1 / users / as an example, the path information is parsed to obtain the replaceable field: users, and then each word in the pre-built vocabulary is compared with users to obtain the similarity between each word and users. The similarity can be cosine similarity, which is not specifically limited in this embodiment of the application. Cosine similarity can be calculated by the formula Among them, w i is the word vector of the replaceable field, w j Represents the word vector of any word in the vocabulary, sim(wi ,w j ) represents cosine similarity, ||w i || represents w i The norm of the vector w i The sum of the absolute values ​​of each element, ||w j || represents w j The norm of the vector w j The sum of the absolute values ​​of the elements.

[0074] Specifically, we can construct word vectors for users and each word separately, and then compare the word vectors. When comparing, we first set a first preset similarity, such as θ1 = 0.7 (θ1 represents the first preset similarity), and then perform a "serial comparison", that is, when a word with a similarity exceeding 0.7 appears, the "replace" operation is triggered. For example, when the word "accounts" is compared, the similarity exceeds 0.7, and users is replaced with "accounts".

[0075] In addition, the comparison process can also be a "parallel comparison". In this case, the similarity between multiple words and users may exceed 0.7. Since a real application interface path can correspond to multiple false interface paths, in this case, multiple words can be used to replace users respectively to obtain multiple false interface paths.

[0076] In an embodiment of the present application, multiple replaceable fields in a real application interface path can be replaced simultaneously to obtain a false interface path, or only one can be replaced to obtain a false interface path, or different replaceable fields in the real application interface path can be replaced separately to obtain multiple different false interface paths. The embodiment of the present application does not limit the specific "replacement process".

[0077] (2) Path confusion.

[0078] In a possible implementation, a first preset content is inserted into the address information, and / or

[0079] Inserting second preset content into the path information.

[0080] Taking the path information / api / v1 / users / as an example, inserting "legacy_" before "api" yields " / legacy_api / v1 / users / ." In this embodiment, preset content can be inserted simultaneously at multiple target locations or at a single location to yield a single false interface path. Preset content can also be inserted at each target location to yield multiple different false interface paths. This embodiment does not specify the specific content to be inserted or the actual insertion location.

[0081] In a possible implementation, the version number in the path information may also be modified, for example, / legacy_api / v1 / users / may be modified to / legacy_api / v0 / users / .

[0082] (3) Parameter injection.

[0083] In one possible implementation, by parsing historical attack logs, the word frequency-inverse text frequency corresponding to each parameter, the degree of correlation between each attack pattern and each parameter, and the number of occurrences of each attack pattern are determined;

[0084] Determine parameters related to each attack mode based on the obtained multiple word frequencies-inverse text frequencies and multiple correlation degrees;

[0085] The parameters related to the attack pattern that appears the most times are injected into any of the real application program interface paths.

[0086] Parsing historical attack logs can parse logs within a preset historical time period, for example, parsing attack logs from a month. These attack logs contain descriptions and parameters for multiple attack patterns, including Structured Query Language (SQL) injection, path traversal, and cross-script attacks. After obtaining the descriptions and parameters for the attack patterns, a bipartite graph of parameters and attack patterns is constructed to obtain the target parameters that need to be injected into the actual application program interface path.

[0087] The bipartite graph of parameter-attack pattern is as follows Figure 3 As shown, the attack mode is related to parameter 1, and the attack mode is related to parameter 1 and parameter 2. That is, one attack mode may correspond to multiple parameters, and one parameter may correspond to multiple attack modes. This embodiment of the present application does not specifically limit this.

[0088] In the implementation example of this application, the implementation method for determining parameters related to the attack mode is as follows:

[0089] The first step is to parse historical attack logs to find the number of times each parameter appears in the log corresponding to each attack mode, the total number of parameters that appear in the log corresponding to each attack mode, the total number of attack modes, and the number of attack modes that include each parameter. Then, based on this information, the word frequency - inverse text frequency of each parameter is calculated.

[0090] Specifically, it can be calculated by the following formula 1:

[0091] TF-IDF(p)=TF(p)IDF(p) Formula 1

[0092] In Formula 1, TF-IDF(p) represents the term frequency minus the inverse text frequency of parameter p in the log corresponding to attack pattern a. TF(p) = (number of times parameter p appears in the log corresponding to attack pattern a) / (total number of parameters appearing in the log corresponding to attack pattern a). IDF(p) = log[(total number of attack patterns appearing in historical logs) / (number of attack patterns containing parameter p + 1)]. For SQL injection attack logs and path traversal attack logs containing parameter p, the number of attack patterns containing parameter p is 2.

[0093] The first step is to parse the historical attack logs to find the correlation between each attack mode and each parameter.

[0094] Specifically, the correlation degree between the attack pattern a and the parameter p can be calculated using Formula 2.

[0095]

[0096] in, CosSim(a,p) It represents the degree of association between attack mode a and parameter p, a1 represents the word vector of the description information of attack mode a, and p1 represents the word vector corresponding to the parameter name.

[0097] In the third step, the weight between each attack mode and each parameter can be determined through Formula 1 and Formula 2.

[0098] Specifically, w(p,a)=TF-IDF(p)* CosSim(a,p) , where w(p,a) represents the weight between attack pattern a and parameter p, and TF-IDF(p) is the word frequency-inverse text frequency of parameter p in the corresponding log in attack pattern a. CosSim(a,p) Indicates the degree of correlation between attack pattern a and parameter p.

[0099] The three steps above yield the weights between each attack mode and each parameter. The parameter with the largest weight is then used as the parameter associated with that attack mode. For example, if the weight between attack mode a and parameter 1 is 0.2, the weight between attack mode a and parameter 2 is 0.3, the weight between attack mode a and parameter 3 is 0.5, and the weight between attack mode a and parameter 4 is 0.8, then the weight associated with attack mode a is parameter 4.

[0100] The fourth step is to parse the historical attack logs to find the most frequently occurring attack patterns, and then inject the parameters associated with these patterns into any real application interface path. For example, if the most frequently occurring attack pattern is attack pattern a, and the parameter associated with attack pattern a is parameter 4, then the parameter name and corresponding value of parameter 4 will be injected.

[0101] In the embodiment of the present application, parameters related to attack patterns that appear more than a preset number of times may be injected, and parameters related to all attack patterns that appear may also be injected, which is not specifically limited here.

[0102] In an embodiment of the present application, if the parameters in the real application interface path and the parameters to be injected do not belong to the same category, they can be added directly or replaced, that is, the original parameters can be deleted and the new parameters injected; in addition, if the parameters in the real application interface path and the parameters to be injected belong to the same category, the specific parameter values ​​can be changed before injection. For example, the original parameter is {userid=1}, when the parameter to be injected belongs to the same category as the original parameter, after injection it is {userid=1&userid=3} or {userid=3}; during injection, the injected content is the parameter name and parameter value, and the specific injection process is not limited here.

[0103] It should be noted that, in actual applications, one or more of the above-mentioned embodiments for constructing false interface paths can be adopted. Furthermore, after obtaining the false interface path, further format validation can be performed to ensure that the injected parameters comply with the interface format rules. For example, query parameters must begin with a "?", and multiple parameters must be connected with "&". If no "&" is detected between multiple parameters, an alarm message will be generated to remind relevant personnel that the false interface path has not passed verification and needs to be modified. A real application interface path can correspond to multiple false interface paths.

[0104] After constructing the fake interface path, it is deployed on the gateway and runs in conjunction with the real application interface, allowing the fake interface to lure attackers into accessing it. Whenever an access request to the fake interface path is received, the source address, attack fingerprint, and other information carried in the request are recorded, and the parameters present are counted to provide data support for subsequent adjustments to the deployed fake interface path.

[0105] S202: Determine the injection weight corresponding to each parameter based on the occurrence frequency of each parameter.

[0106] The above-mentioned occurrence frequency can be counted periodically, for example, once every week, or once every 100 access requests are received, which is not specifically limited in the embodiments of the present application.

[0107] Taking the number of attacks as an example, if the userid parameter appears 3 times in 100 attacks, the userid frequency is 3 / 100 = 0.3. Taking time as an example, if the userid parameter appears 1 time per week, the userid frequency is 1 / 7. This embodiment of the application does not limit the specific method for calculating the frequency.

[0108] In a possible implementation, determining the injection weight corresponding to each parameter based on the occurrence frequency of each parameter includes:

[0109] For any parameter, determining the frequency of occurrence of the parameter;

[0110] Determine the time difference between the current time and the time when the access request was last received;

[0111] The occurrence frequency of any parameter and the time difference are input into the formula ω=e -λt HR(p), obtain the injection weight corresponding to any of the parameters;

[0112] Wherein, ω represents the injection weight, λ represents the preset coefficient, which can be 0.1 and is not specifically limited here, t represents the time difference between the current moment and the moment when the access request was last received, HR(p) represents the frequency of occurrence of parameter p, which reflects the current popularity of the parameter, and the exponential decay e -λt Reduce the impact of historical attack data. Wherein, the occurrence frequency is positively correlated with the injection weight.

[0113] For example, if HR(p) = 0.3 and t is 5 hours, the injection weight of parameter p is ω = e -0.1×5 0.3.

[0114] S203: Determine a target parameter whose injection weight exceeds a preset weight, and select a preset number of false interface paths from the plurality of deployed false interface paths to inject the target parameter.

[0115] The preset weight can be set to 0.2. If the injection weight of parameter p exceeds 0.2, a preset number (e.g., two) of the deployed false interface paths are selected to inject parameter p. When selecting a false interface path, a random selection or a false interface path that does not contain parameter p can be selected. This embodiment of the present application does not specifically limit this.

[0116] In one possible implementation, if the injection weight is less than a preset value, such as 0.05, the use of the parameter is reduced or stopped. For example, if the injection weight of the debug_mode parameter is less than 0.05, the debug_mode parameter in the false interface path containing the debug_mode parameter can be deleted or replaced with a parameter with a higher injection weight. The parameter injection process here is similar to the parameter injection process in S201 above and will not be repeated here.

[0117] In the embodiment of the present application, in addition to adjusting the deployed false interface path by injecting parameters as described above, the first preset similarity θ1 in S201 may also be adjusted.

[0118] Specifically, if an access request to access the false interface path is received within a preset time period, a second target word is selected from a pre-built word library, the second target word having a similarity with any of the replaceable fields exceeding a second preset similarity, to replace the first target word, thereby obtaining an updated false interface path;

[0119] If no access request to the false interface path is received within a preset time period, selecting a third target word from a pre-built vocabulary library, whose similarity to any of the replaceable fields exceeds a third preset similarity, to replace the first target word, thereby obtaining an updated false interface path;

[0120] Among them, the second preset similarity > the first preset similarity > the third preset similarity, the second preset similarity can be θ2 = 0.8, and the third preset similarity can be θ3 = 0.5.

[0121] That is to say, after deploying the fake interface path, if the fake path is accessed, the scope of the search and replacement words is narrowed, that is, the replaced words are more similar to the real ones, thereby improving the simulation degree of the fake path. In this way, the adjusted fake interface path is more attractive to attackers. If the fake interface path is not accessed, the scope of the replacement words is expanded to increase the diversity of the fake interface path, thereby preventing variable attack modes.

[0122] In existing fake interface path deployments, no false information is returned, making it easy for attackers to detect that the accessed interface path is a fake one. In an embodiment of the present application, based on the format of the feedback information obtained by accessing the real application interface path, after determining that the fake interface path has been accessed, false feedback information for the access request (such as false feedback information containing contradictory business rules) is fed back. For example, when a mobile phone number should actually be fed back, after determining that the fake interface path has been accessed, a false mobile phone number is generated for feedback.

[0123] Because the fake interface does not provide business services, any Internet Protocol (IP) address that accesses the fake interface can be considered an attacker. However, the purpose of this application is to protect the real address, so the access permission to the real address is cancelled.

[0124] Specifically, the IP address carried in the access request is determined, and if it is determined that the number of times the same IP address accesses the deployed false interface path exceeds a preset number, the permission of the IP address to access any one of the real application interface paths is revoked.

[0125] Specifically, the method for canceling the IP address's permission to access any of the real application interface paths is to notify the gateway to revoke the access token of the IP address, or to perform sandbox isolation on the IP address, that is, redirecting the attacking device to a sandbox environment to simulate false business data to continuously induce attacks.

[0126] For example, when the same IP address accesses the fake interface path more than three times, the gateway is notified to revoke the access token of the IP address, or to perform sandbox isolation on the IP address.

[0127] Furthermore, based on the attack log, an auditable threat report containing information such as the type of attack tool and time pattern can be generated, so that relevant personnel can better protect the network based on the threat report.

[0128] The following is based on Figure 4 The overall process of generating, deploying and adjusting the false interface path provided in the embodiment of the present application is described.

[0129] S401: Obtain a real application program interface path, wherein the real application program interface path is obtained by parsing using a finite state machine.

[0130] S402: Response simulation, that is, extracting data fields and format rules in real feedback information. For example, the data field is "mobile phone number", the format rule is "11-digit string", and the real feedback information is the information obtained by accessing the real application interface path.

[0131] S403: Generate a false interface path. The false interface path is obtained by modifying the real application program interface path. The specific modification method is the same as the implementation method in S101 above, which will not be repeated here.

[0132] S404: Deploy a fake interface path, that is, deploy the fake interface path on the corresponding gateway to operate in coordination with the real application interface path. The coordinated operation means protecting the real application interface path against access information accessing the fake interface path.

[0133] S405: Attack behavior monitoring, that is, recording the source IP, tool fingerprint and parameters of the request to access the false interface path to better protect.

[0134] S406: Feedback false information and adjust the false interface path, that is, feedback false information for the access request to the false interface path. The solution for adjusting the false interface path can be the parameter injection and continued similar word replacement in the above implementation, which will not be repeated here.

[0135] The following is based on Figure 5 The process of generating a false interface path is described in detail.

[0136] S501: Start, that is, obtain the real application program interface path as in S401.

[0137] S502: semantic replacement, which is specifically implemented as in the above S201 and will not be described again here.

[0138] S503: Path and / or version obfuscation is specifically implemented as in the above S201 and will not be repeated here.

[0139] S504: Parameter injection, specifically as implemented in the above S201, will not be repeated here.

[0140] S403: Generate a false interface path.

[0141] This patent proposes an application interface protection method, which can effectively induce attackers to access fake interface paths through various methods such as synonym replacement, path and / or version obfuscation to generate highly simulated fake interface paths, and parameter injection. The embodiment of this application provides protection against parameter tampering attacks and can detect malicious loads and logical vulnerabilities; it also further generates false feedback information containing contradictory business rules to trigger the detection of attackers' unauthorized behavior.

[0142] Furthermore, the present application also adjusts the deployed false interface paths in real time based on access requests, and can dynamically adjust the false interface path density and parameter trap complexity according to attack behavior.

[0143] The embodiment of the present application also blocks attackers based on access requests to the fake interface path through the linked gateway and generates a threat report to better protect the real interface.

[0144] Based on the same inventive concept, the embodiment of the present application also provides an application program interface protection device, such as Figure 6 As shown, the device includes:

[0145] Parsing module 601 is configured to record access requests to multiple deployed pseudo interface paths corresponding to any one real application program interface path, and parse multiple parameters from the access requests, wherein the real application program interface path is used to indicate the location of a callable resource on a server, and the real application program interface path includes at least one parameter, wherein the parameter is used to instruct the server to perform a specific operation on the callable resource;

[0146] A weight determination module 602 is configured to determine an injection weight corresponding to each parameter based on an occurrence frequency of each parameter, wherein the occurrence frequency is positively correlated with the injection weight;

[0147] The path adjustment module 603 is configured to determine a target parameter whose injection weight exceeds a preset weight, and select a preset number of false interface paths from the plurality of deployed false interface paths to inject the target parameter.

[0148] In one possible implementation, the weight determination module 602 is configured to:

[0149] For any parameter, determining the frequency of occurrence of the parameter;

[0150] Determine the time difference between the current time and the time when the access request was last received;

[0151] The occurrence frequency of any parameter and the time difference are input into the formula ω=e λt HR(p), obtain the injection weight corresponding to any of the parameters;

[0152] Wherein, ω represents the injection weight, λ represents the preset coefficient, t represents the time difference between the current moment and the moment when the access request is most recently received, and HR(p) represents the frequency of occurrence of the parameter.

[0153] In a possible implementation, the real application program interface path includes address information of a server corresponding to the callable resource and path information of the callable resource in the server;

[0154] The device also includes a path construction module, which is used to obtain the false interface path by:

[0155] Parsing the address information and the path information to obtain at least one replaceable field;

[0156] For any replaceable field, a first target word having a similarity with the any replaceable field exceeding a first preset similarity is selected from a pre-built word library to replace the any replaceable field.

[0157] In a possible implementation, the path adjustment module 603 is configured to:

[0158] When an access request to access the false interface path is received within a preset time period, a second target word is selected from a pre-built word library, the second target word having a similarity with any of the replaceable fields exceeding a second preset similarity, to replace the first target word, thereby obtaining an updated false interface path;

[0159] When no access request to the false interface path is received within a preset time period, a third target word is selected from a pre-built vocabulary library, the third target word having a similarity with any of the replaceable fields exceeding a third preset similarity, to replace the first target word, thereby obtaining an updated false interface path;

[0160] Among them, the second preset similarity>the first preset similarity>the third preset similarity.

[0161] In a possible implementation, the path construction module is configured to obtain the false interface path in the following manner:

[0162] Inserting a first preset content into the address information, and / or

[0163] Inserting second preset content into the path information.

[0164] In a possible implementation, the path construction module is configured to obtain the false interface path in the following manner:

[0165] Determine the word frequency-inverse text frequency corresponding to each parameter, the degree of association between each attack pattern and each parameter, and the number of occurrences of each attack pattern by parsing historical attack logs, where the attack logs contain descriptions of multiple attack patterns and multiple parameters;

[0166] Determine parameters related to each attack mode based on the obtained multiple word frequencies-inverse text frequencies and multiple correlation degrees;

[0167] The parameters related to the attack pattern that appears the most times are injected into any of the real application program interface paths.

[0168] In a possible implementation, the device further includes a feedback module, configured to:

[0169] After receiving the access request, false feedback information for the access request is fed back.

[0170] In a possible implementation, the device further includes a protection module, configured to:

[0171] Determine the Internet Protocol IP address carried in the access request, and if it is determined that the number of times the same IP address accesses the deployed false interface path exceeds a preset number, determine to cancel the permission of the IP address to access any one of the real application program interface paths.

[0172] Based on the same inventive concept, an embodiment of the present application further provides an electronic device, the device comprising:

[0173] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform an application interface protection method.

[0174] like Figure 7 shown. Figure 7 The electronic device 70 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0175] like Figure 7 As shown, the electronic device 70 is a general electronic device. Components of the electronic device 70 may include, but are not limited to, the at least one processor 71, the at least one memory 72, and a bus 73 connecting different system components (including the memory 72 and the processor 71).

[0176] The processor 71 is used to read and execute instructions in the memory 72, so that the at least one processor can execute an application program interface protection method provided by the above embodiment.

[0177] Bus 73 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0178] The memory 72 and the memory 702 may include readable media in the form of volatile memory, such as a random access memory (RAM) 721 and / or a cache memory 722 , and may further include a read-only memory (ROM) 723 .

[0179] The memory 72 may also include a program / utility 725 having a set (at least one) of program modules 724, such program modules 724 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0180] The electronic device 70 can also communicate with one or more external devices 74 (e.g., keyboards, pointing devices, etc.), one or more devices that enable an administrator to interact with the electronic device 70, and / or any device that enables the electronic device 70 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). This communication can occur via an input / output (I / O) interface 75. Furthermore, the electronic device 70 can communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 76. As shown, the network adapter 76 communicates with other modules of the electronic device 70 via a bus 73. It should be understood that, although not shown, other hardware and / or software modules can be used in conjunction with the electronic device 70, including but not limited to microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0181] In some possible implementations, various aspects of an application program interface protection method provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of an application program interface protection method according to various exemplary implementations of the present application described above in this specification.

[0182] In addition, the present application also provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, wherein the computer program is used to enable a computer to execute the method described in any one of the above embodiments.

[0183] These computer program instructions may be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0184] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0185] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0186] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. An application program interface protection method, characterized in that: The method comprises: For any of the multiple deployed false interface paths corresponding to a real application program interface path, recording access requests to the multiple deployed false interface paths, and parsing multiple parameters from the access requests, wherein the real application program interface path is used to indicate the location of the callable resource in the server, and the real application program interface path includes at least one parameter, and the parameter is used to instruct the server to perform a specific operation on the callable resource; Determining an injection weight corresponding to each parameter based on an occurrence frequency of each parameter, wherein the occurrence frequency is positively correlated with the injection weight; A target parameter whose injection weight exceeds a preset weight is determined, and a preset number of false interface paths are selected from the plurality of deployed false interface paths to inject the target parameter.

2. The method according to claim 1, characterized in that The determining, based on the occurrence frequency of each parameter, the injection weight corresponding to each parameter includes: For any parameter, determining the frequency of occurrence of the parameter; Determine the time difference between the current time and the time when the access request was last received; The occurrence frequency of any parameter and the time difference are input into the formula ω=e -λt HR(p), obtain the injection weight corresponding to any of the parameters; Wherein, ω represents the injection weight, λ represents the preset coefficient, t represents the time difference between the current moment and the moment when the access request is most recently received, and HR(p) represents the frequency of occurrence of the parameter.

3. The method according to claim 1, characterized in that The real application program interface path includes the address information of the server corresponding to the callable resource and the path information of the callable resource in the server; The false interface path is obtained by: Parsing the address information and the path information to obtain at least one replaceable field; For any replaceable field, a first target word having a similarity with the any replaceable field exceeding a first preset similarity is selected from a pre-built word library to replace the any replaceable field.

4. The method according to claim 3, characterized in that The method further comprises: If an access request to access the false interface path is received within a preset time period, a second target word is selected from a pre-built word library, the second target word having a similarity with any of the replaceable fields exceeding a second preset similarity, to replace the first target word, thereby obtaining an updated false interface path; If no access request to the false interface path is received within a preset time period, selecting a third target word from a pre-built vocabulary library, whose similarity to any of the replaceable fields exceeds a third preset similarity, to replace the first target word, thereby obtaining an updated false interface path; Among them, the second preset similarity>the first preset similarity>the third preset similarity.

5. The method according to claim 3, characterized in that The false interface path is obtained by: Inserting a first preset content into the address information, and / or Inserting second preset content into the path information.

6. The method according to claim 1, characterized in that The false interface path is obtained by: Determine the word frequency-inverse text frequency corresponding to each parameter, the degree of association between each attack pattern and each parameter, and the number of occurrences of each attack pattern by parsing historical attack logs, where the attack logs contain descriptions of multiple attack patterns and multiple parameters; Determine parameters related to each attack mode based on the obtained multiple word frequencies-inverse text frequencies and multiple correlation degrees; The parameters related to the attack pattern that appears the most times are injected into any of the real application program interface paths.

7. The method according to claim 1, characterized in that The method further comprises: After receiving the access request, false feedback information for the access request is fed back.

8. The method according to claim 1, characterized in that The method further comprises: Determine the Internet Protocol IP address carried in the access request, and if it is determined that the number of times the same IP address accesses the deployed false interface path exceeds a preset number, determine to cancel the permission of the IP address to access any one of the real application program interface paths.

9. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to cause the at least one processor to perform any one of the methods of claims 1-8.

10. A computer storage medium, characterized in that The computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method according to any one of claims 1 to 8.

Images