An API behavior prediction and security policy management method based on machine learning

Abstract

The application provides an API behavior prediction and security policy management method based on machine learning, relates to the field of computer network security, and comprises the following steps: acquiring API original data in real time, preprocessing the original data to obtain preprocessed original data, acquiring API dimension features in real time based on the preprocessed original data, and fusing to obtain unstructured data; a dynamic characteristic validity verification rule is established to preprocess the unstructured data, and a unified dimension standardization feature tensor is obtained; the joint modeling of API behavior space-time features is performed through the collaborative architecture of a multi-head time attention mechanism and a dynamic graph neural network, API behavior prediction is performed, API dynamic security management and control strategies are generated in real time through a strategy engine, strategy execution is performed, the security strategy execution effect is monitored in real time, and iterative optimization is performed. The application solves the problems of fixed and rigid security management and control strategies of a traditional API gateway, and the difficulty in dynamically adjusting security strategies according to real-time access conditions and behaviors.

Description

Technical Field

[0001] This invention relates to the field of computer network security, and in particular to a method for predicting API behavior and managing security policies based on machine learning. Background Technology

[0002] With the accelerated advancement of digital transformation, APIs (Application Programming Interfaces) have become a crucial bridge connecting different software systems, enabling data sharing and functional interaction. In today's internet ecosystem, e-commerce platforms, financial institutions, social media, and IoT devices all heavily rely on APIs to realize various business functions. For example, e-commerce platforms use APIs to connect with logistics and payment systems to achieve order delivery and payment processing; financial institutions use APIs to provide customers with online financial management and loan application services; social media platforms use APIs to allow third-party developers to develop related applications, enriching platform functions and user experience; and IoT devices use APIs to transmit collected data to the cloud for analysis and processing.

[0003] Static API security protection solutions based on rule engines are currently a widely used approach. They filter and verify API requests by formulating a series of rules. However, these rules are often based on known security risks, making it difficult to respond quickly to and handle newly emerging abnormal behaviors and security threats. Moreover, the maintenance cost of these rules is high, requiring continuous updates and adjustments based on new security developments.

[0004] API anomaly detection solutions based on traditional machine learning models attempt to detect abnormal API behavior using machine learning techniques. Common models include decision trees and support vector machines. These models learn from historical API call data to build models of normal behavior patterns, and then use these models to determine whether new API requests constitute abnormal behavior. However, these simple machine learning models still suffer from limitations in feature dimensions and model drift failure when faced with complex and ever-changing API behavior. When the API usage scenario changes significantly, the model may require a long time to retrain and adjust, failing to meet higher real-time risk control requirements, and may not be able to accurately identify some subtle abnormal behavior patterns.

[0005] However, the widespread use of APIs has also brought many security and stability challenges. API behavior is becoming increasingly complex and variable due to various factors such as user groups, business scenarios, and network environments. Traditional static and lagging security strategies are difficult to adapt to its dynamic changes, and the efficiency of abnormal behavior detection and processing is extremely low. Summary of the Invention

[0006] This invention provides a machine learning-based method for API behavior prediction and security policy control, which solves the problem that the security control policies of traditional API gateways are fixed and rigid, making it difficult to dynamically adjust security policies according to real-time access conditions and behaviors.

[0007] On the one hand, this invention provides a method for API behavior prediction and security policy control based on machine learning, including:

[0008] The API raw data is acquired in real time, and the raw data is preprocessed to obtain preprocessed raw data. The raw data includes API access logs, network traffic data, and system operation status information.

[0009] Based on the preprocessed raw data, API dimension features are acquired in real time and fused to obtain a multi-dimensional feature vector, i.e. unstructured data. The dimension features include temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features.

[0010] Establish dynamic feature validity verification rules to preprocess unstructured data and obtain standardized feature tensors with unified dimensions;

[0011] Based on standardized feature tensors, a joint modeling of the spatiotemporal features of API behavior is performed through a multi-head temporal attention mechanism and a dynamic graph neural network, generating an API behavior prediction model and performing API behavior prediction to obtain prediction results.

[0012] Based on the prediction results of the API behavior prediction model, the policy engine generates dynamic security control policies for APIs in real time and executes the policies to obtain the security policy execution effect.

[0013] The system monitors the effectiveness of security policy implementation in real time and iteratively optimizes model parameters and policy rules through a feedback mechanism.

[0014] Furthermore, raw API data is acquired in real time, preprocessed, and preprocessed to obtain preprocessed raw data. This raw data includes API access logs, network traffic data, and system operating status information, including:

[0015] In the API gateway layer, a data acquisition component is used to obtain raw API data, which includes API access logs, network traffic data, and system running status information. Specifically, API access logs are obtained in real time through the gateway log interface to obtain request metadata, network traffic data is extracted by parsing the protocol load, and system status information is collected by integrating monitoring tools to collect runtime metrics such as gateway CPU, memory, and connection pool.

[0016] The collected API access logs, network traffic data, and system operation status information are merged to obtain a multi-dimensional data source;

[0017] The multidimensional data source is cleaned to obtain the preprocessed raw data.

[0018] Furthermore, based on the preprocessed raw data, API-dimensional features are acquired in real time and fused to obtain a multi-dimensional feature vector, i.e., unstructured data. These dimensional features include temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features, including:

[0019] Based on the preprocessed raw data, the API path distribution is statistically analyzed in real time, the request entropy value is calculated, the standard deviation of the interval between adjacent API calls is calculated, and the request pattern of long-cycle sessions is periodically analyzed to obtain the time-series behavioral characteristics.

[0020] Based on the preprocessed raw data, the device hardware parameters, network environment fingerprint, and behavioral biometric features are collected through the mobile SDK to generate a tamper-proof unique device identifier, namely the device fingerprint feature.

[0021] Based on the preprocessed raw data, a pre-trained NLP model is used to convert API parameter values ​​into semantic vectors, capture the potential intent of the parameter values, and obtain semantic deep parsing features.

[0022] Based on the preprocessed raw data, business context features are obtained by recording the user permission group state migration trajectory, collecting cross-microservice call chain topology, and detecting the deviation of resource access frequency from historical baselines.

[0023] The acquired temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features are fused to obtain a multi-dimensional feature vector, i.e., unstructured data.

[0024] Furthermore, dynamic feature validity verification rules are established to preprocess unstructured data, resulting in standardized feature tensors of uniform dimensions, including:

[0025] Based on preset dynamic feature validity verification rules, erroneous records, duplicate data, and data that do not meet the format requirements in unstructured data are removed to obtain cleaned data;

[0026] Based on the cleaned data, outliers are identified and processed using statistical methods and machine learning algorithms, while the time series data is smoothed to obtain denoised data.

[0027] Based on the denoised data, the numerical data is converted into a uniform scale by normalization, and the coded categorical data is converted into a form suitable for machine learning model input, thus obtaining the normalized data.

[0028] Based on the normalized data, the time series data is transformed by shifting, scaling and other methods to obtain the expanded data, that is, the preprocessed data;

[0029] The preprocessed data is standardized to obtain a standardized feature tensor with a unified dimension.

[0030] Furthermore, based on the standardized feature tensor, a joint modeling of the spatiotemporal features of API behavior is performed through a multi-head temporal attention mechanism and a dynamic graph neural network architecture. This generates an API behavior prediction model and performs API behavior prediction to obtain prediction results, including:

[0031] Based on the standardized feature tensor, a multi-head self-attention mechanism is used to capture the local temporal patterns and global abnormal fluctuations of API call sequences, and each attention head independently learns features at different time scales to obtain a multi-dimensional temporal embedding vector.

[0032] Based on standardized feature tensors, a dynamic graph structure is constructed by obtaining real-time call relationships of API endpoints. A graph attention network is then used to aggregate neighbor node features and capture implicit dependencies to generate spatial structure embeddings.

[0033] Cross-dimensional attention fusion is performed between multi-dimensional temporal embedding vectors and spatial structure embeddings, and spatiotemporal feature weights are dynamically adjusted through a gating mechanism to generate a joint spatiotemporal feature representation.

[0034] Based on joint spatiotemporal feature representation, an incremental learning framework combining elastic weight solidification and sliding window retraining is adopted to achieve minute-level model updates and generate an API behavior prediction model.

[0035] Use the generated API behavior prediction model to predict API behavior and obtain the prediction results.

[0036] Furthermore, based on the prediction results of the API behavior prediction model, the policy engine generates dynamic API security control policies in real time and executes these policies to obtain the security policy execution effects, including:

[0037] Based on the prediction results of the API behavior prediction model, a two-branch policy network is constructed. The prediction results and environmental state are input to generate the probability distribution of API behavior actions.

[0038] The prediction results are concatenated with the current environmental state to form a state vector. The dual-branch policy network samples actions based on the state vector and generates dynamic policy instructions.

[0039] Injecting policy commands into the API gateway allows for real-time adjustment of rate limiting thresholds or triggering of secondary authentication, thus achieving the desired security policy execution effect.

[0040] Furthermore, the effectiveness of security policy implementation is monitored in real time, and the model parameters and policy rules are iteratively optimized through a feedback mechanism, including:

[0041] Use the monitoring module to collect key metrics after the strategy is executed, and form an effect evaluation;

[0042] Based on preset thresholds and effect evaluation, a feedback signal is generated;

[0043] Collect feedback signals and store them in the playback pool;

[0044] Data is periodically sampled from the playback pool and iteratively optimized.

[0045] On the other hand, a machine learning-based API behavior prediction and security policy management system includes:

[0046] The acquisition module is used to acquire API raw data in real time, preprocess the raw data, and obtain preprocessed raw data. The raw data includes API access logs, network traffic data, and system operation status information.

[0047] The processing module is used to acquire API dimensional features in real time based on preprocessed raw data and fuse them to obtain multi-dimensional feature vectors, i.e., unstructured data. The dimensional features include temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features. Dynamic feature validity verification rules are established to preprocess the unstructured data, resulting in a standardized feature tensor of a unified dimension. Based on the standardized feature tensor, a joint modeling of API behavior spatiotemporal features is performed using a multi-head temporal attention mechanism and a dynamic graph neural network architecture to generate an API behavior prediction model and predict API behavior to obtain prediction results. Based on the prediction results of the API behavior prediction model, a policy engine generates dynamic API security control policies in real time and executes the policies to obtain the security policy execution effect. The security policy execution effect is monitored in real time, and the model parameters and policy rules are iteratively optimized through a feedback mechanism.

[0048] On the other hand, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the machine learning-based API behavior prediction and security policy control method as described above.

[0049] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the machine learning-based API behavior prediction and security policy control method as described above.

[0050] On the other hand, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the machine learning-based API behavior prediction and security policy control method as described above.

[0051] The present invention provides a machine learning-based API behavior prediction and security policy management method. Based on feature dimension and collection timeliness, the present invention can significantly improve coverage, anti-spoofing and real-time performance, providing high-quality input for subsequent behavior prediction engines and solving the limitations of traditional solutions in data collection.

[0052] Spatiotemporal joint modeling and efficient incremental learning enable real-time prediction of API dynamic behavior, allowing for more timely responses to changes in API business scenarios and dynamic behavior; and solve the problems of poor adaptability and model drift in traditional models.

[0053] High-quality data collection input can effectively improve the accuracy of behavior prediction, build a policy network, and rely on the input of behavior prediction to collect policies with higher accuracy probability more automatically; at the same time, based on the timeliness of incremental learning, it can more effectively ensure the real-time performance and security of dynamic policies.

[0054] The monitoring and feedback module monitors the API's operational status, the accuracy of the prediction model, and the effectiveness of the security policy in real time; it collects real-time data of API requests, system logs, model prediction results, and other relevant data to evaluate the prediction model and security policy; once it finds that the prediction is inaccurate or the security policy is not performing well, it sends feedback information to the data preprocessing module, the machine learning model module, and the security policy management module, prompting each module to make corresponding adjustments and optimizations, forming a closed-loop optimization system. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0056] Figure 1 This is a flowchart illustrating the API behavior prediction and security policy control method based on machine learning provided in this embodiment of the invention.

[0057] Figure 2 This is a schematic diagram of the API behavior prediction and security policy management system based on machine learning provided in an embodiment of the present invention;

[0058] Figure 3This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0060] Figure 1 This is one of the flowcharts illustrating the API behavior prediction and security policy control method based on machine learning provided in this embodiment of the invention.

[0061] like Figure 1 As shown in the figure, the API behavior prediction and security policy control method based on machine learning provided in this embodiment of the invention mainly includes the following steps:

[0062] 11. Obtain API raw data in real time, preprocess the raw data to obtain preprocessed raw data, the raw data including API access logs, network traffic data and system operating status information;

[0063] 12. Based on the preprocessed raw data, API dimension features are obtained in real time and fused to obtain a multi-dimensional feature vector, i.e. unstructured data. The dimension features include time-series behavior features, device fingerprint features, semantic deep parsing features, and business context features.

[0064] 13. Establish dynamic feature validity verification rules to preprocess unstructured data and obtain standardized feature tensors with unified dimensions;

[0065] 14. Based on the standardized feature tensor, the spatiotemporal features of API behavior are jointly modeled through the collaborative architecture of multi-head temporal attention mechanism and dynamic graph neural network, generating API behavior prediction model and performing API behavior prediction to obtain prediction results.

[0066] 15. Based on the prediction results of the API behavior prediction model, the policy engine generates dynamic security control policies for APIs in real time and executes the policies to obtain the security policy execution effect.

[0067] 16. Monitor the effectiveness of security policy implementation in real time, and iteratively optimize model parameters and policy rules through feedback mechanisms.

[0068] In this embodiment of the invention, as the data foundation of the entire protection system, ensuring the real-time and comprehensiveness of subsequent analysis, API access logs, network traffic, and system status are captured in real time through full-traffic non-intrusive monitoring, providing a high-fidelity data source for feature extraction and model training, solving the problems of data collection lag and single dimension in traditional solutions; key behavioral patterns are extracted from the raw data to construct a multi-dimensional feature space, integrating four major categories of features: temporal behavior (such as request entropy value capturing call randomness), device fingerprint (anti-tampering identifier blocking simulated attacks), semantic parsing (parameter intent recognition logic abuse), and business context (permission migration trajectory to prevent unauthorized access), forming a high-dimensional feature vector, providing holographic input for the prediction model, significantly improving anomaly detection coverage; ensuring feature data quality, eliminating noise and redundancy, automatically filtering collection noise (such as crawler interference) through a dynamic rule engine, standardizing feature dimensions, and generating feature tensors in a unified format, improving the signal-to-noise ratio of the model input signal and increasing training efficiency; breaking through the limitations of traditional models in spatiotemporal correlation modeling, achieving accurate threat prediction, the Spatiotemporal Gated Network (TSGN) uses multi-head Attention captures millisecond-level call fluctuations (such as DDoS attacks), and dynamic graph neural networks reconstruct microservice dependency topologies in real time (such as container drift), reducing new threat detection response time from days to minutes and improving threat interception rates. Predictive results are transformed into executable security actions, achieving closed-loop protection. The policy network automatically outputs rate limiting thresholds or secondary authentication commands based on risk scores, with policy execution latency <100ms. False positive rates are significantly reduced compared to traditional solutions, reducing manual intervention costs. A continuous evolutionary closed loop adapts to dynamic changes in API behavior. By monitoring policy execution effects (such as interception rates and service availability), incremental learning (EWC + sliding window) and dynamic rule adjustments are triggered, reducing the amount of data required for model updates and decreasing the time cost to adapt to business changes from weeks to minutes, thus lowering the total cost of ownership (TCO). From data collection to policy execution, end-to-end latency is controlled at the millisecond level, meeting the extreme performance requirements of cloud-native API gateways. Through a "perception-decision-execution-learning" cycle, a leap from passive protection to proactive defense is achieved, providing fundamental technical support for business continuity in the API economy era.

[0069] like Figure 1 As shown in Figure 11, the API raw data is acquired in real time, and preprocessed to obtain preprocessed raw data. The raw data includes API access logs, network traffic data, and system operating status information, including:

[0070] 111. At the API gateway layer, a data acquisition component is used to obtain raw API data. The raw data includes API access logs, network traffic data, and system running status information. Specifically, the API access logs obtain request metadata in real time through the gateway log interface, the network traffic data is extracted by parsing the protocol load, and the system status information is collected by integrating monitoring tools to collect runtime indicators such as gateway CPU, memory, and connection pool.

[0071] 112. The collected API access logs, network traffic data, and system operation status information are integrated to obtain a multi-dimensional data source;

[0072] 113. Clean the multidimensional data source to obtain the preprocessed raw data.

[0073] In this embodiment of the invention, a lightweight data acquisition component is embedded in the API gateway layer to achieve full traffic monitoring, capturing API access logs (request metadata), network traffic data (protocol parsing load), and system status information (CPU / memory / connection pool metrics) in real time, thus solving the problem of a single data source in traditional solutions. In-memory computing technology is employed to ensure that the end-to-end latency of data acquisition and preprocessing is <500μs, with an impact on gateway performance of <2%, avoiding service delays caused by intrusive data collection in traditional solutions. Logs, traffic, and system status data are correlated and integrated; for example, combining the user ID in the access logs with the data in the network traffic logs... Device fingerprinting can accurately identify simulated login attacks, correlate system status indicators (such as connection pool full load) with traffic surges, and provide early warnings of DDoS attacks. It covers three-dimensional data of the request layer (logs), transport layer (traffic), and resource layer (system status), solving the problem of missed detection caused by traditional solutions relying on only a single dimension. It filters noisy data through dynamic feature validity verification rules, automatically removes collection noise (such as crawler interference) and corrects format errors (such as missing log fields), improving the signal-to-noise ratio of feature input and outputting standardized feature tensors. This solves the model compatibility problem caused by chaotic data formats in traditional solutions and reduces the cost of subsequent feature engineering.

[0074] like Figure 1 As shown in Figure 12, based on the preprocessed raw data, API dimension features are acquired in real time and fused to obtain a multi-dimensional feature vector, i.e., unstructured data. The dimension features include temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features, including:

[0075] 121. Based on the preprocessed raw data, the API path distribution is statistically analyzed in real time, the request entropy value is calculated, the standard deviation of the interval between adjacent API calls is calculated, and the request pattern of long-cycle sessions is periodically analyzed to obtain the time-series behavior characteristics.

[0076] 122. Based on the preprocessed raw data, the device hardware parameters, network environment fingerprint, and behavioral biometric features are collected through the mobile SDK to generate a tamper-proof unique device identifier, namely the device fingerprint feature.

[0077] 123. Based on the preprocessed raw data, a pre-trained NLP model is used to convert API parameter values ​​into semantic vectors, capture the potential intent of the parameter values, and obtain semantic deep parsing features;

[0078] 124. Based on the preprocessed raw data, business context features are obtained by recording the user permission group state migration trajectory, collecting cross-microservice call chain topology relationships, and detecting the deviation of resource access frequency from historical baselines:

[0079] 125. The acquired temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features are fused to obtain a multi-dimensional feature vector, i.e., unstructured data.

[0080] In this embodiment of the invention, by analyzing the distribution of API paths, request entropy values, standard deviation of call intervals, and long-term session patterns, the timing patterns of API calls are characterized. Sudden increases in request entropy values ​​can identify brute-force attacks (such as attempting numerous API paths), and abnormal fluctuations in the standard deviation of call intervals can capture DDoS attacks (such as request intervals approaching 0). Fourier transform analysis is performed on long-term sessions (such as daily scheduled tasks) to accurately identify abnormal business logic (such as API calls during non-working hours). Anti-tampering device identifiers are constructed based on hardware parameters, network fingerprints, and behavioral biometrics. Over 30 dimensions of features, including hardware UUID, TLS fingerprints, and mouse movement trajectories, are integrated to generate device hash values, increasing the detection rate of emulator attacks. Behavioral biometrics (such as key press rhythm and swipe speed) are used to verify device legitimacy in real time, blocking automated tool attacks (such as API scanners). A pre-trained NLP model (such as BERT) is used to analyze API calls. PI parameter values ​​are converted into semantic vectors, mapping SQL injection parameters (such as 'OR1=1--') to malicious semantic vectors. Even if the parameters are encoded and obfuscated, they can still be identified. Semantic analysis is performed on the monetary parameters of financial transaction APIs to identify abnormally large transactions (such as exceeding the user's historical average of 3σ). By analyzing user permission migration trajectories, microservice call chain topology, and resource access baselines, business logic correlations are characterized, and the history of user permission group changes (such as a sudden change from a regular user to an administrator) is recorded. Combined with call chain topology, illegal API access paths are identified, and sudden increases in CPU / memory usage of containerized APIs are detected, preventing cryptocurrency mining attacks in advance. The four types of features—time series, device, semantics, and business—are fused into a high-dimensional feature vector, covering the four-dimensional attack surface of the request layer, device layer, data layer, and business layer. This solves the problem of missed detection in traditional single-dimensional solutions. For example, by combining device fingerprint anomalies with semantic parsing anomalies, composite attacks can be accurately identified.

[0081] like Figure 1 As shown in Figure 13, dynamic feature validity verification rules are established to preprocess unstructured data, resulting in standardized feature tensors of uniform dimensions, including:

[0082] 131. Based on preset dynamic feature validity verification rules, remove erroneous records, duplicate data, and data that does not meet the format requirements from unstructured data to obtain cleaned data;

[0083] 132. Based on the cleaned data, outliers are identified and processed using statistical methods and machine learning algorithms, while the time series data is smoothed to obtain denoised data;

[0084] 133. Based on the denoised data, normalization is used to convert numerical data into a uniform scale and to transform coded categorical data into a form suitable for machine learning model input, thus obtaining normalized data;

[0085] 134. Based on the normalized data, the time series data is transformed by shifting, scaling, etc., to obtain the expanded data, that is, the preprocessed data;

[0086] 135. Standardize the preprocessed data to obtain a standardized feature tensor with a unified dimension.

[0087] In this embodiment of the invention, invalid data is automatically filtered by a preset rule engine to ensure input quality, dynamically detect and remove collection noise, format errors, and duplicate requests, increasing the data cleaning rate; based on an incremental learning framework, the rule engine can automatically adapt to newly emerging abnormal patterns, solving the problem of high maintenance costs of traditional hard-coded rules; random fluctuations and outliers in the data are eliminated, retaining the real business patterns, and combined with statistical methods and the isolated forest algorithm, increasing the number of identifiable abnormal calls; exponentially weighted moving averages are used to smooth the call interval, eliminating short-term fluctuation interference and improving the accuracy of long-cycle session pattern analysis; unified numerical scales and encoding formats eliminate differences in feature dimensions, and Min-Max scaling maps CPU utilization (0-100%) and request entropy values ​​(0-1) to […]. The model converges faster by using the [0,1] interval. Hash embedding is used for API paths to map millions of categories to low-dimensional dense vectors, reducing memory usage. Temporal transformations increase data diversity and improve model generalization. Random time shifts (e.g., ±10%) of the call interval sequence enhance the model's robustness to temporal phase changes. Dynamic time warping generates call sequences with different speeds, effectively defending against slow attacks. A structured feature tensor is constructed to adapt to deep learning model inputs. Temporal behavior, device fingerprints, semantic parsing, and business context features are concatenated into a 480-dimensional tensor, solving the problem of messy feature concatenation in traditional solutions. Through tensor partitioning and parallel computing, the feature standardization processing latency is reduced to <200μs, supporting real-time inference for API gateways with 100,000 QPS.

[0088] like Figure 1 As shown in Figure 14, based on the standardized feature tensor, a joint modeling of the spatiotemporal features of API behavior is performed through a multi-head temporal attention mechanism and a dynamic graph neural network collaborative architecture. This generates an API behavior prediction model and performs API behavior prediction to obtain prediction results, including:

[0089] 141. Based on the standardized feature tensor, a multi-head self-attention mechanism is used to capture the local temporal patterns and global abnormal fluctuations of API call sequences, and each attention head independently learns features at different time scales to obtain a multi-dimensional temporal embedding vector.

[0090] 142. Based on standardized feature tensors, a dynamic graph structure is constructed by obtaining real-time call relationships of API endpoints. A graph attention network is then used to aggregate neighbor node features and capture implicit dependencies to generate spatial structure embeddings.

[0091] 143. Perform cross-dimensional attention fusion between multi-dimensional temporal embedding vectors and spatial structure embeddings, and dynamically adjust the spatiotemporal feature weights through a gating mechanism to generate a joint spatiotemporal feature representation;

[0092] 144. Based on joint spatiotemporal feature representation, an incremental learning framework combining elastic weight solidification and sliding window retraining is adopted to achieve minute-level model updates and generate an API behavior prediction model.

[0093] 145. Use the generated API behavior prediction model to predict API behavior and obtain prediction results.

[0094] In this embodiment of the invention, a collaborative architecture of multi-head temporal attention mechanism and dynamic graph neural network is used to achieve joint modeling of the spatiotemporal features of API behavior. This overcomes the limitations of traditional time series models in capturing periodic patterns and relying on manually defined graph structures. The multi-head temporal attention mechanism captures multi-scale periodic patterns and abnormal fluctuations in API call sequences, solving the problem of insufficient modeling capability of traditional LSTM / GRU for long-period dependencies. The dynamic graph neural network models the implicit dependencies between API endpoints, solving the problem that static graph structures cannot adapt to dynamic business topologies.

[0095] Existing technologies struggle to update models promptly based on changes in API runtime data and business scenarios. This invention addresses this by employing an incremental learning framework that combines elastic weight fixation with sliding window retraining to achieve minute-level model updates. This framework can capture dynamic changes in API behavior in a timely manner, maintain accurate prediction capabilities for API behavior, and effectively reduce model maintenance costs by addressing concept drift.

[0096] Behavioral prediction first obtains the API call sequence X = {x1, x2, x3, ..., x...} T}∈R T×d Where T is the time step, d is the API call feature dimension, X is the sequence, and R represents the matrix dimension; an adjacency matrix A0 is generated based on the call relationship of API endpoints within the initial window, or it is dynamically constructed through feature similarity to initialize the dynamic graph;

[0097] The multi-head time attention mechanism divides the input sequence X into subsequences with different time granularities (such as hours, days, weeks): Among them, X (k) Let X be a subsequence, R be a sequence, and w be the matrix dimension. k N is the time window length of the k-th attention head. k It is based on the time window length w of the kth attention head k The calculated number of columns is as follows: Where T is the time step;

[0098] For each subsequence X (k) Calculate query Q (k) Key K (k) Value V (k) :

[0099] Q (k) =X (k) W Q (k) K (k) =X (k) W k (k) V (k) =X (k) W v (k)

[0100] in, X is a learnable parameter. (k) For subsequences;

[0101] Attention output is Among them, Attn (k) Q represents the weighted sum of attention of the k-th attention head to the input sequence. (k) For querying, T is the time step, and d is the time d. h V represents the dimension of the data processed by each attention head. (k) Value;

[0102] Segmenting and projecting all attention outputs:

[0103] H time =Concat(Attn) (1) , ..., Attn (k) W o ∈R T×d , where H time This represents the temporal features after processing by the attention mechanism, where T is the number of time steps, d is the feature dimension, and Attn is the time dimension. (k) W represents the weighted sum of attention of the k-th attention head to the input sequence. o The matrix used to project the concatenated attention output onto the target feature space, where R represents the matrix dimension;

[0104] Based on the current time node feature H time Calculate the similarity between nodes:

[0105] A ij =δ(MLP(h) i ||h j )), h i h j ∈H time , where A ij For node h i and node h jThe similarity between nodes, δ is the Sigmoid function used to map the similarity between nodes to the (0,1) interval, representing the probability that there is a connection between nodes, making the generated adjacency matrix probabilistically interpretable, || is the concatenation of identifier features, H time Features based on time nodes;

[0106] Message passing is performed using a dynamic adjacency matrix A: H space =ReLU(AH time W G )∈R T×d Among them, W G ∈R T×d Here, A represents the graph convolution weights, A is the dynamic adjacency matrix composed of the similarity between nodes, representing the connection relationships between nodes, ReLU is the activation function, and H is the graph convolution weights. time H represents the time node feature. space Spatial features;

[0107] By fusing temporal and spatial features through a spatiotemporal gating mechanism:

[0108] H space =G⊙H time +(1-G)⊙H space Where G is the gating signal, generated by a spatiotemporal gating mechanism, used to control the fusion ratio of temporal and spatial features, δ is the sigmoid function, and W... g W is the weight matrix for the spatiotemporal gating mechanism. g ∈R 2d×d ⊙ represents element-wise multiplication, H time H represents the time node feature. space Spatial features;

[0109] The steps for behavior prediction output are as follows: First, for H... final Connect the projection: Output API behavior category (e.g., normal / abnormal) or regression value (e.g., number of calls), where H final This represents the final feature representation obtained after a series of processing steps during the behavior prediction process. It is the prediction result of API behavior, W p It is the weight parameter, h t It is the input hidden state, b p It is a bias parameter;

[0110] Maintain a dynamic sliding window D window ={X t-M+1 , ..., X t The window size M is set according to business needs (e.g., updating every minute / hour / day), where D... windowThis represents a dynamic sliding window containing data from time t-M+1 to time t;

[0111] The Elastic Weight Solidification (EWC) regularization steps are as follows:

[0112] The loss function is Among them, L EWC For the loss function of Elastic Weight Fixed (EWC) regularization, L NEW For the cross-entropy loss of the new data, F is an important parameter for historical missions. i λ represents the diagonal term of the Fisher information matrix, θ represents the model parameters, and λ is a hyperparameter representing the regularization strength.

[0113] The incremental model update steps are as follows: First, perform sliding window retraining, and every Δt minutes, use D... window Data calculation loss L NEW The model parameters are updated by incorporating the EWC regularization term. Where η is the learning rate, θ is the model parameter, and L EWC For the loss function of Elastic Weight Fixed (EWC) regularization, L NEW The cross-entropy loss for new data is used to update the model to predict new API behavior. By iterating through the above steps, the model can be updated on a minute-by-minute basis to address the concept drift problem.

[0114] like Figure 1 As shown in Figure 15, based on the prediction results of the API behavior prediction model, the policy engine generates dynamic API security control policies in real time and executes the policies to obtain the security policy execution effects, including:

[0115] Based on the prediction results of the API behavior prediction model, a two-branch policy network is constructed. The prediction results and environmental state are input to generate the probability distribution of API behavior actions.

[0116] The prediction results are concatenated with the current environmental state to form a state vector. The dual-branch policy network samples actions based on the state vector and generates dynamic policy instructions.

[0117] Injecting policy commands into the API gateway allows for real-time adjustment of rate limiting thresholds or triggering of secondary authentication, thus achieving the desired security policy execution effect.

[0118] In this embodiment of the invention, a policy network system is constructed based on the dynamic security policy generation of the PPO algorithm. This system is used to generate the probability distribution of security policy actions based on the current state information. The policy network automatically adopts different security policies such as rate limiting, circuit breaking, and verification based on the output of the API behavior engine. As new API behavior data and system environment data are continuously input, the policy network is continuously updated using the PPO algorithm, so that the policy network can dynamically generate security policies that are more in line with the current security needs and system performance requirements based on real-time state information.

[0119] State vector It consists of two parts; the API behavior prediction result is the output of the Spatiotemporal Gated Network (TSGN). (e.g., abnormal call counts, resource abuse, suspected risks, etc.), system environment data includes real-time load. t Historical action feedback a t-1 API endpoint availability t The action space includes a discrete or continuous set of executable security policy actions such as rate limiting, circuit breaking, verification, and access control, as shown in the formula:

[0120] Based on state s t Generate action probability distribution π(a|s) t ), parameterized as a deep neural network: π θ (a|s t =Softmax(MLP) θ (S t For continuous actions, the mean and variance of the Gaussian distribution are used to describe the probability distribution of the continuous actions, where s t Let π(a|s) be the state vector. t Let θ be the action probability distribution, representing the probability distribution of a policy network with parameter θ in state s. t The probability of taking action 'a';

[0121] State value estimation V φ (s t ), used to calculate the advantage function and evaluate the performance in state s t The system value under the given state, that is, the expected cumulative reward that may be obtained after performing a series of actions starting from this state, provides important reference information for the optimization of the policy network, helps to judge the quality of the current state, and thus knows how the policy network generates a better action probability distribution;

[0122] The dominance value A is calculated using generalized dominance estimation (GAE). t , δ t =r t +γV θ (st+1 )-V θ (S t ), where A t δ is the advantage value, γ is the discount factor, λ is the GAE smoothing coefficient, used to measure the impact of current actions on future returns. t V(s) typically represents the difference or increment between the reward at time step t and the estimated state value. t ) and V(s t+1 ) are respectively in state s t and s t+1 State value estimation under the following conditions; the objective of maximizing the policy gradient after pruning is L. CLIP (θ)=E t [min(ρ t (θ)A t ,clip(ρ t (θ), 1-ε, 1+ε)A t ],in, ρ is the importance sampling rate, and ε is the pruning threshold. This is achieved by limiting the probability ratio ρ between the old and new strategies. t (θ), exploring and utilizing balanced strategies, and optimizing strategy network parameters θ;

[0123] Combining policy loss, value function loss, and entropy regularization, we get L(θ,φ)=L CLIP (θ)-c1L VF (φ)+c2H(π θ (·|s t )),

[0124] The value function loss is L VF (φ)=E t [(V φ (s t )-V target (s t ) 2 ],

[0125] Entropy regularization is H(π) θ )=-∑ a π θ (a|s t logπ θ (a|s t ),

[0126] Among them, the collaborative optimization strategy network (parameter θ) and value network (parameter φ) ensure that the strategy is both efficient and exploratory. c1 and c2 are constant coefficients, and L CLIP为 Strategy loss, L VF The loss is the value function, H is the entropy regularization term, and π(a|s) is the value function loss. t Let V be the probability distribution of the action. φ (st V represents the state value estimate. target The preset state value target value;

[0127] Based on the probability distribution π output by the policy network θ (a|s t Sampling action a t Implement security policies (such as adjusting rate limiting thresholds and triggering circuit breakers), and reward r. t Both security and system performance need to be considered simultaneously: t =α·Security(a t )+β.Performance(a t ), where r t For the reward, α and β are weighting coefficients, Security(a t ) is action a t Safety performance, Performance(a t ) is action a t System performance;

[0128] Security rewards are awarded for preventing the number of abnormal API calls and reducing feedback of successful attacks; performance rewards are awarded for the percentage decrease in system load and the reduction in API response time.

[0129] like Figure 1 As shown in Figure 16, the system monitors the effectiveness of security policy implementation in real time and iteratively optimizes model parameters and policy rules through a feedback mechanism, including:

[0130] 161. Use the monitoring module to collect key indicators after the strategy is executed, and form an effect evaluation;

[0131] 162. Generate feedback signals based on preset thresholds and effect evaluation;

[0132] 163. Collect feedback signals and store them in the playback pool;

[0133] 164. Periodically sample data from the playback pool and perform iterative optimization.

[0134] In this embodiment of the invention, by deploying a monitoring module, key indicators after the execution of security policies can be collected in real time. This allows for the measurement of the proportion of malicious attacks successfully prevented by the policies, the assessment of the accuracy of policy judgments, and the prevention of impacting normal business operations or missing real threats. It also monitors the impact of policy execution on system performance, preventing excessive resource consumption, understanding the frequency of policy triggering, and assessing the security posture. Real-time monitoring enables the security team to promptly grasp the effectiveness of policy execution, avoiding "policy black box" operation, and providing a data foundation for subsequent effect evaluation and policy adjustments, ensuring that policy execution is visible and measurable. Based on the collected key indicators, the effectiveness of security policy execution is quantitatively evaluated; this is not merely simple data collection, but rather data analysis and... The interpretation process involves observing the trends of indicators over time to determine whether the strategy's effectiveness is improving, stabilizing, or declining. Comparison with historical data, baselines, or different strategy versions highlights strategy improvements or issues, explores correlations between different indicators, and identifies potential problems or optimization points in strategy implementation. Effectiveness evaluation transforms raw monitoring data into valuable insights, helping the security team objectively and comprehensively understand the actual effectiveness of the strategy, avoiding subjective assumptions, and providing a basis for generating feedback signals and developing optimization strategies. Based on preset thresholds (e.g., the maximum allowed false positive rate) and effectiveness evaluation results, feedback signals are automatically or manually generated. These signals indicate whether the strategy's effectiveness has met expectations and how adjustments are needed. Feedback signals can be positive... Positive signals indicate that the strategy is performing well and the results are as expected, requiring no immediate adjustment; negative signals indicate that the strategy is performing poorly and the results are not as expected, requiring adjustment and optimization; specific adjustment instructions directly indicate the direction or parameters that need to be adjusted; feedback signals are the bridge connecting the strategy's performance and optimization adjustments, making the strategy dynamic and adaptable based on actual conditions, thus achieving the strategy's self-adaptive capability; the generated feedback signals are collected and stored to form a replay pool. The replay pool's role is not just simple signal storage; it accumulates historical feedback signals to form an experience base for strategy optimization, providing a reference for future strategy adjustments. Historical data can be resampled from the replay pool for offline analysis and model training. Alternatively, strategy backtesting can improve data utilization and optimization efficiency, prevent the loss of valuable feedback signals, and ensure that the strategy optimization process is traceable and reproducible. The establishment of a replay pool makes the strategy optimization process no longer a "one-off" process, but one that can continuously learn and improve, providing infrastructure for long-term strategy optimization and knowledge accumulation. Data is sampled from the replay pool periodically (rather than once) and combined with the latest security threat intelligence and business needs to iteratively optimize the security strategy. Optimization may include: adjusting parameters such as thresholds and weights in the strategy to improve the strategy effect, updating or adding strategy rules to cope with new attack methods or business changes, and if the strategy is based on a machine learning model, the model needs to be retrained or updated to improve model performance.Regular iterative optimization is key to maintaining the long-term effectiveness of security strategies. Through continuous learning and improvement, strategies can adapt to ever-changing security threats and business environments, always maintaining the best protection effect. At the same time, iterative optimization is also a gradual improvement process that can gradually enhance the intelligence and automation level of strategies.

[0135] Experience replay is a storage of experience tuples (s) t a t T t S t+1 ) to buffer D, batch update to resample mini-batch data from D every K isolation steps, calculate advantage A t and target value V target Optimize L(θ, φ) through gradient ascent: θ←θ+η θ ▽ θ L(θ, φ), φ←φ+η φ ▽ φ L(θ, φ), where η θ η φ Let A be the learning rate. t As an advantage, V target Let θ and φ be the target value, and S be the policy network parameters. t+1 The next state represents the action a taken by the agent at time step t. t Afterwards, the environment transitions to a new state, T t To achieve the target value, we continuously improve the policy network's ability to generate security policies.

[0136] like Figure 2 As shown, an API behavior prediction and security policy management system 20 based on machine learning includes:

[0137] The acquisition module 21 is used to acquire API raw data in real time, preprocess the raw data, and obtain preprocessed raw data. The raw data includes API access logs, network traffic data, and system operation status information.

[0138] Processing module 22 is used to acquire API dimensional features in real time based on preprocessed raw data, and fuse them to obtain multi-dimensional feature vectors, i.e., unstructured data. The dimensional features include temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features. Dynamic feature validity verification rules are established to preprocess the unstructured data, resulting in a standardized feature tensor of a unified dimension. Based on the standardized feature tensor, a joint modeling of API behavior spatiotemporal features is performed using a multi-head temporal attention mechanism and a dynamic graph neural network architecture to generate an API behavior prediction model and predict API behavior to obtain prediction results. Based on the prediction results of the API behavior prediction model, a dynamic security control policy for API is generated in real time through a policy engine, and the policy is executed to obtain the security policy execution effect. The security policy execution effect is monitored in real time, and the model parameters and policy rules are iteratively optimized through a feedback mechanism.

[0139] Figure 3 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention.

[0140] like Figure 3 As shown, the electronic device may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640. The processor 610, communications interface 620, and memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions from the memory 630 to execute a machine learning-based API behavior prediction and security policy control method.

[0141] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0142] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the machine learning-based API behavior prediction and security policy control methods provided by the above methods.

[0143] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the machine learning-based API behavior prediction and security policy control methods provided by the above methods.

[0144] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for API behavior prediction and security policy control based on machine learning, characterized in that, include: The API raw data is acquired in real time, and the raw data is preprocessed to obtain preprocessed raw data. The raw data includes API access logs, network traffic data, and system operation status information. Based on the preprocessed raw data, API dimension features are acquired in real time and fused to obtain a multi-dimensional feature vector, i.e. unstructured data. The dimension features include temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features. Establish dynamic feature validity verification rules to preprocess unstructured data and obtain standardized feature tensors with unified dimensions; Based on standardized feature tensors, a joint modeling of the spatiotemporal features of API behavior is performed through a multi-head temporal attention mechanism and a dynamic graph neural network, generating an API behavior prediction model and performing API behavior prediction to obtain prediction results. Based on the prediction results of the API behavior prediction model, the policy engine generates dynamic security control policies for APIs in real time and executes the policies to obtain the security policy execution effect. The system monitors the effectiveness of security policy implementation in real time and iteratively optimizes model parameters and policy rules through a feedback mechanism.

2. The method for API behavior prediction and security policy control based on machine learning according to claim 1, characterized in that, The system acquires raw API data in real time, preprocesses the raw data to obtain preprocessed raw data, which includes API access logs, network traffic data, and system operating status information, including: In the API gateway layer, a data acquisition component is used to obtain raw API data, which includes API access logs, network traffic data, and system operation status information. Specifically, API access logs are obtained in real time through the gateway log interface to obtain request metadata, network traffic data is extracted by parsing the protocol load, and system status information is collected by integrating monitoring tools to collect gateway CPU, memory, and connection pool runtime metrics. The collected API access logs, network traffic data, and system operation status information are merged to obtain a multi-dimensional data source; The multidimensional data source is cleaned to obtain the preprocessed raw data.

3. The API behavior prediction and security policy control method based on machine learning according to claim 2, characterized in that, Based on the preprocessed raw data, API-dimensional features are acquired in real time and fused to obtain a multi-dimensional feature vector, i.e., unstructured data. These dimensional features include temporal behavioral features, device fingerprint features, semantic deep parsing features, and business context features, including: Based on the preprocessed raw data, the API path distribution is statistically analyzed in real time, the request entropy value is calculated, the standard deviation of the interval between adjacent API calls is calculated, and the request pattern of long-cycle sessions is periodically analyzed to obtain the time-series behavioral characteristics. Based on the preprocessed raw data, the device hardware parameters, network environment fingerprint, and behavioral biometric features are collected through the mobile SDK to generate a tamper-proof unique device identifier, namely the device fingerprint feature. Based on the preprocessed raw data, a pre-trained NLP model is used to convert API parameter values ​​into semantic vectors, capture the potential intent of the parameter values, and obtain semantic deep parsing features. Based on the preprocessed raw data, business context features are obtained by recording the user permission group state migration trajectory, collecting cross-microservice call chain topology, and detecting the deviation of resource access frequency from historical baselines. The acquired temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features are fused to obtain a multi-dimensional feature vector, i.e., unstructured data.

4. The method for API behavior prediction and security policy control based on machine learning according to claim 3, characterized in that, A dynamic feature validity verification rule is established to preprocess unstructured data, resulting in a standardized feature tensor with a unified dimension, including: Based on preset dynamic feature validity verification rules, erroneous records, duplicate data, and data that do not meet the format requirements in unstructured data are removed to obtain cleaned data; Based on the cleaned data, outliers are identified and processed using statistical methods and machine learning algorithms, while the time series data is smoothed to obtain denoised data. Based on the denoised data, the numerical data is converted into a uniform scale by normalization, and the coded categorical data is converted into a form suitable for machine learning model input, thus obtaining the normalized data. Based on the normalized data, the time series data is transformed by translation and scaling to obtain the expanded data, i.e., the preprocessed data; The preprocessed data is standardized to obtain a standardized feature tensor with a unified dimension.

5. The API behavior prediction and security policy control method based on machine learning according to claim 4, characterized in that, Based on standardized feature tensors, a joint modeling of the spatiotemporal features of API behavior is performed through a collaborative architecture of multi-head temporal attention mechanism and dynamic graph neural network. This generates an API behavior prediction model and performs API behavior prediction to obtain prediction results, including: Based on the standardized feature tensor, a multi-head self-attention mechanism is used to capture the local temporal patterns and global abnormal fluctuations of API call sequences, and each attention head independently learns features at different time scales to obtain a multi-dimensional temporal embedding vector. Based on standardized feature tensors, a dynamic graph structure is constructed by obtaining real-time call relationships of API endpoints. A graph attention network is then used to aggregate neighbor node features and capture implicit dependencies to generate spatial structure embeddings. Cross-dimensional attention fusion is performed between multi-dimensional temporal embedding vectors and spatial structure embeddings, and spatiotemporal feature weights are dynamically adjusted through a gating mechanism to generate a joint spatiotemporal feature representation. Based on joint spatiotemporal feature representation use An incremental learning framework combining elastic weight fixation and sliding window retraining enables minute-level model updates and generates API behavior prediction models. Use the generated API behavior prediction model to predict API behavior and obtain the prediction results.

6. The method for API behavior prediction and security policy control based on machine learning according to claim 5, characterized in that, Based on the prediction results of the API behavior prediction model, a policy engine generates dynamic API security control policies in real time, executes the policies, and obtains the security policy execution effects, including: Based on the prediction results of the API behavior prediction model, a two-branch policy network is constructed. The prediction results and environmental state are input to generate the probability distribution of API behavior actions. The prediction results are concatenated with the current environmental state to form a state vector. The dual-branch policy network samples actions based on the state vector and generates dynamic policy instructions. Injecting policy commands into the API gateway allows for real-time adjustment of rate limiting thresholds or triggering of secondary authentication, thus achieving the desired security policy execution effect.

7. The method for API behavior prediction and security policy control based on machine learning according to claim 6, characterized in that, Real-time monitoring of the effectiveness of security policy implementation, and iterative optimization of model parameters and policy rules through feedback mechanisms, including: Use the monitoring module to collect key metrics after the strategy is executed, and form an effect evaluation; Based on preset thresholds and effect evaluation, a feedback signal is generated; Collect feedback signals and store them in the playback pool; Data is periodically sampled from the playback pool and iteratively optimized.

8. A machine learning-based API behavior prediction and security policy control system, characterized in that, include: The acquisition module is used to acquire API raw data in real time, preprocess the raw data, and obtain preprocessed raw data. The raw data includes API access logs, network traffic data, and system operation status information. The processing module is used to acquire API dimensional features in real time based on preprocessed raw data, and fuse them to obtain a multi-dimensional feature vector, i.e., unstructured data. The dimensional features include temporal behavior features, device fingerprint features, semantic deep parsing features, and business context features. Dynamic feature validity verification rules are established to preprocess the unstructured data, resulting in a standardized feature tensor of a unified dimension. Based on the standardized feature tensor, a joint modeling of API behavior spatiotemporal features is performed through a multi-head temporal attention mechanism and a dynamic graph neural network architecture to generate an API behavior prediction model and predict API behavior to obtain prediction results. Based on the prediction results of the API behavior prediction model, a dynamic security control policy for APIs is generated in real time through a policy engine, and the policy is executed to obtain the security policy execution effect. The system monitors the effectiveness of security policy implementation in real time and iteratively optimizes model parameters and policy rules through a feedback mechanism.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the machine learning-based API behavior prediction and security policy control method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the machine learning-based API behavior prediction and security policy control method as described in any one of claims 1 to 7.

Images