Small sample API malicious traffic detection method, system and device and storage medium
By combining TF-IDF and GPT2 feature extraction methods, the problems of insufficient feature extraction and data scarcity in small-sample API malicious traffic detection are solved, achieving more efficient and accurate malicious traffic detection.
Patent Information
- Application Number
- CN202510704786.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-29
- Publication Date
- 2025-09-05
AI Technical Summary
Existing API malicious traffic detection technology has problems such as insufficient feature extraction on small sample data sets, easy overfitting of pre-trained models, and data scarcity and imbalance causing the model to be biased towards normal traffic, thereby reducing the ability to detect malicious traffic.
Combining the TF-IDF and GPT2 feature extraction methods, the word frequency and inverse document frequency of keywords are extracted through TF-IDF features to generate TF-IDF feature numerical vectors. The GPT2 model is then used to capture semantic features. After feature fusion, the classifier is trained to detect malicious traffic.
It significantly improves the accuracy and recall of API malicious traffic classification on small sample data sets, avoids overfitting problems, enhances the adaptability and generalization ability of the model, and improves detection efficiency and reliability.
Smart Images
Figure CN120602136A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of API malicious traffic detection, and in particular to a small sample API malicious traffic detection method, system, device and storage medium. Background Art
[0002] With the widespread adoption of APIs (Application Programming Interfaces), malicious traffic attacks pose an increasingly serious threat to network security. However, existing malicious traffic detection technologies suffer from significant flaws when used with small sample datasets, which limits their effectiveness and reliability in practical applications.
[0003] First, the traditional TF-IDF (Term Frequency-Inverse Document Frequency) method performs poorly on small-sample datasets. TF-IDF primarily assesses word importance based on word frequency and inverse document frequency. This method often fails to fully capture key data features when data is limited. Due to the uneven distribution of small-sample data, certain important feature words may be overlooked due to their low frequency, resulting in the omission of crucial information. Furthermore, TF-IDF lacks understanding of semantic relationships between words and cannot identify malicious intent hidden by combining common words in malicious requests. This makes it prone to misjudgment when faced with complex malicious traffic. Furthermore, TF-IDF's sensitivity to data distribution leads to inaccurate feature weights calculated on small-sample datasets, further impacting classification results. Second, while pre-trained models such as GPT2 perform well on large-scale datasets, they suffer from a serious overfitting problem on small-sample datasets. Pre-trained models typically have a large number of parameters, which makes them prone to overlearning noise and details in small-sample data and failing to generalize to new data. This overfitting phenomenon not only reduces the model's generalization ability but also increases training costs, as parameter optimization requires significant computational resources and time. Furthermore, pre-trained models require high data quality. Noise or mislabeling in the data can severely impact model training, resulting in the model's inability to accurately distinguish between legitimate and malicious traffic. Furthermore, the training and fine-tuning of pre-trained models on small datasets is complex, requiring extensive experimentation and debugging to find the optimal parameter configuration, further limiting their feasibility in practical applications. Finally, data scarcity is a common issue in the field of API malicious traffic detection. Most APIs are developed and managed by large internet companies, which, for privacy and security reasons, typically do not disclose their API traffic data, particularly malicious traffic data. This makes it difficult for researchers and developers to obtain large quantities of real malicious traffic samples, thus limiting the development of malicious traffic detection technology. Even if some malicious traffic data is available, it is often significantly imbalanced with legitimate traffic data, with legitimate traffic often significantly outnumbering malicious traffic. This can easily bias the model towards legitimate traffic during training, reducing its ability to detect malicious traffic. In addition, API usage scenarios and attack methods are constantly changing, and existing malicious traffic data may be outdated and unable to reflect current attack trends and characteristics, which further exacerbates the data scarcity problem. Summary of the Invention
[0004] In view of the above-mentioned problems, the present invention is proposed.
[0005] Therefore, the technical problem solved by the present invention is that the existing API malicious traffic detection technology has insufficient feature extraction on small sample data sets (traditional TF-IDF is difficult to fully capture key features and lacks semantic understanding capabilities, and pre-trained models such as GPT2 are prone to overfitting), and data scarcity and data imbalance cause the model to be biased towards normal traffic, reducing the ability to detect malicious traffic.
[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:
[0007] In a first aspect, an embodiment of the present invention provides a method for detecting malicious API traffic with a small sample size, including:
[0008] Collect API traffic data and perform standardization to obtain API request text;
[0009] Based on the API request text, TF-IDF feature extraction is performed to obtain the keyword-based TF-IDF feature value vector;
[0010] Based on the API request text, GPT2 feature extraction is performed to obtain a dense semantic feature numerical vector of fixed dimension;
[0011] Perform feature fusion on the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector;
[0012] A classifier is selected for malicious traffic classification, the classifier is trained by comprehensive numerical feature vectors, and the trained classifier is used to detect the traffic to be detected.
[0013] As a preferred method for detecting small sample API malicious traffic, it:
[0014] The API traffic data is collected and standardized to obtain the API request text including:
[0015] Collect API traffic data, remove invalid data, remove duplicate data, unify the encoding format, and convert all text content to a unified case.
[0016] As a preferred method for detecting small sample API malicious traffic, it:
[0017] The TF-IDF feature extraction based on the API request text to obtain the keyword-based TF-IDF feature value vector includes:
[0018] The method, path, and parameters in the API request text are considered as words, and the entire traffic log is considered as a document. The API request text is segmented, stop words are removed, and keywords are extracted.
[0019] As a preferred method for detecting small sample API malicious traffic, it:
[0020] The step of extracting TF-IDF features based on the API request text to obtain a keyword-based TF-IDF feature value vector also includes:
[0021] For the extracted keywords, the word frequency and inverse document frequency are calculated, and the TF-IDF value of each keyword is obtained through the word frequency and inverse document frequency.
[0022] As a preferred solution for detecting malicious API traffic with small samples:
[0023] The step of extracting TF-IDF features based on the API request text to obtain a keyword-based TF-IDF feature value vector also includes:
[0024] Sort the keywords according to the TF-IDF value, set the number of feature words N, and select the first N keywords as feature words in descending order of TF-IDF values to form a TF-IDF feature value vector.
[0025] As a preferred solution for detecting malicious API traffic with small samples:
[0026] The feature fusion of the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector includes:
[0027] The TF-IDF feature vector and the GPT2 feature vector are normalized separately, and a weighted fusion method is introduced to assign different weights according to the importance of the features, and the weighted sum is calculated to obtain a comprehensive numerical feature vector.
[0028] The beneficial effect of this preferred technical solution is that it combines the keyword recognition ability of TF-IDF and the semantic understanding ability of GPT2 to more comprehensively capture the key features of API traffic. At the same time, it highlights important features through weighted fusion, improves the effectiveness of features, and thus improves the efficiency and reliability of malicious traffic detection.
[0029] As a preferred solution for detecting malicious API traffic with small samples:
[0030] The classifier is selected for malicious traffic classification, the classifier is trained by comprehensive numerical feature vectors, and the trained classifier is used to detect the traffic to be detected, including:
[0031] The comprehensive feature vector obtained by feature fusion of the traffic to be detected is input into the trained classifier to predict malicious traffic; based on the output of the classifier, the traffic type of the new data is interpreted.
[0032] The beneficial effect of this preferred technical solution is that by inputting the comprehensive feature vector of the traffic to be detected into the trained classifier, the comprehensive feature vector integrates the TF-IDF feature numerical vector and the dense semantic feature numerical vector, which can more comprehensively and accurately reflect the characteristics of API traffic; TF-IDF features can capture the importance of keywords in the API request text, while dense semantic features describe the meaning of the API request from a semantic level. The combination of the two enables the classifier to analyze traffic from multiple angles, thereby more accurately identifying malicious traffic; the classifier is trained based on a large number of comprehensive numerical feature vectors. During the training process, the classifier learns the relationship between different features and traffic types (normal or malicious). Therefore, when predicting the traffic to be detected, the classifier can accurately judge whether the traffic is malicious traffic based on the learned pattern, effectively reducing the false positive rate and missed judgment rate.
[0033] In a second aspect, an embodiment of the present invention provides a small sample API malicious traffic detection system, comprising:
[0034] API request text acquisition module, used to collect API traffic data and perform standardization processing to obtain API request text;
[0035] The TF-IDF feature extraction module is used to extract TF-IDF features based on the API request text and obtain the keyword-based TF-IDF feature numerical vector;
[0036] GPT2 feature extraction module, which is used to extract GPT2 features based on API request text and obtain a dense semantic feature numerical vector of fixed dimension;
[0037] The feature fusion module is used to fuse the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector;
[0038] The detection module is used to select a classifier for malicious traffic classification, train the classifier through comprehensive numerical feature vectors, and detect the traffic to be detected through the trained classifier.
[0039] In a third aspect, an embodiment of the present invention provides an electronic device, including:
[0040] memory and processor;
[0041] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the one or more programs are executed by the one or more processors, the one or more processors implement the small sample API malicious traffic detection method as described in any embodiment of the present invention.
[0042] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the small sample API malicious traffic detection method.
[0043] The beneficial effects of the present invention are as follows: by integrating the features of TF-IDF and GPT2, the present invention significantly improves the accuracy, recall rate and F1 score of API malicious traffic classification on small sample data sets, which is better than the method of using TF-IDF or GPT2 alone; it effectively avoids the overfitting problem of the pre-trained model on small sample data sets, and improves the adaptability and generalization ability of the model to different data sets; combining the keyword recognition ability of TF-IDF and the semantic understanding ability of GPT2, it can more comprehensively capture the key features of API traffic, thereby improving the efficiency and reliability of malicious traffic detection; it is not only suitable for API malicious traffic classification, but can also be promoted to traffic analysis and anomaly detection tasks in other network security fields, and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0045] Figure 1 This is the overall flow chart of the small sample API malicious traffic detection method provided by the present invention. DETAILED DESCRIPTION
[0046] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.
[0047] Example 1, reference Figure 1 , which is the first embodiment of the present invention, provides a method for detecting malicious API traffic using a small sample, including:
[0048] S1: Collect API traffic data and perform standardization to obtain API request text;
[0049] S2: Perform TF-IDF feature extraction based on the API request text to obtain a keyword-based TF-IDF feature value vector;
[0050] S3: Based on the API request text, perform GPT2 feature extraction to obtain a dense semantic feature numerical vector of fixed dimension;
[0051] S4: Perform feature fusion on the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector;
[0052] S5: Select a classifier for malicious traffic classification, train the classifier through the comprehensive numerical feature vector, and detect the traffic to be detected through the trained classifier.
[0053] It should be noted that, through steps S1-S5, this embodiment generates a comprehensive feature vector by combining the keyword recognition capability of TF-IDF and the semantic understanding capability of GPT2, and uses multiple classifiers to detect malicious traffic. It is suitable for small sample data sets and can effectively solve the defects of existing technologies in feature extraction, data scarcity and data imbalance, and classification accuracy.
[0054] Example 2, reference Figure 1 , which is an embodiment of the present invention, provides a small sample API malicious traffic detection method based on the previous embodiment, including:
[0055] In this embodiment, in step S1, API traffic data is collected and standardized to obtain the API request text including:
[0056] Collect API traffic data, remove invalid data, and remove duplicate data;
[0057] It should be noted that API traffic data may contain some invalid or erroneous records, such as those missing key fields (such as request method, path, parameters, etc.) or records whose data formats do not conform to API specifications. This invalid data may interfere with model training and classification, so it needs to be removed during the preprocessing stage.
[0058] API traffic data may contain a large number of duplicate request records. This duplicate data not only increases the data volume but can also lead to model overfitting. By detecting and removing duplicate data, we can reduce data redundancy and improve data quality and representativeness.
[0059] Standardization includes:
[0060] Unified encoding format: The text content in API traffic data may use different encoding formats, such as UTF-8 and ASCII. All text data needs to be converted to a standard encoding format (such as UTF-8) to avoid problems caused by inconsistent encoding.
[0061] Case conversion: Convert all text content to a uniform case (usually lowercase) to eliminate the impact of case differences on feature extraction.
[0062] For example, "API" and "api" are semantically identical, but without case conversion, they would be considered two different features.
[0063] In this embodiment, in step S2 above, TF-IDF feature extraction is performed based on the API request text, and the keyword-based TF-IDF feature value vector obtained includes:
[0064] The method, path, and parameters in the API request text are regarded as words, and the entire traffic log is regarded as a document. Preprocessing operations such as word segmentation and stop word removal are performed on the API request text to extract meaningful keywords.
[0065] In another possible implementation, regular expressions can be used to segment the method, path, and parameters in the API request text. For example, the path / api / v1 / users / 123 can be segmented by the character / to obtain the words api, v1, users, 123, etc.
[0066] A stop word list suitable for API traffic data can be established. In addition to common stop words (such as the, and, or, etc.), it should also include some common words that have no practical meaning in API requests (such as api, v1, etc.).
[0067] Calculate the term frequency (TF), that is, calculate the TF-IDF value, expressed as:
[0068]
[0069] Among them, TF i,j represents the frequency of word i in document j, n i,j, represents the number of occurrences of word i in document j; ∑ k n k,j represents the sum of the occurrences of all words in document j.
[0070] Calculate the inverse document frequency (IDF), expressed as:
[0071]
[0072] Among them, IDF i represents the inverse document frequency of word i, |D| represents the total number of documents in the corpus, |j:t i ∈d j | represents the number of documents containing word i.
[0073] The TF-IDF value of each word is obtained by TF-IDF=TF×IDF.
[0074] Sort the keywords according to the TF-IDF value, set the number of feature words N, and select the first N keywords as feature words in descending order of TF-IDF values to form a TF-IDF feature value vector.
[0075] It should be noted that the specific number of words selected, that is, the size of N, depends on the size of the dataset, the sparsity of the features, and the complexity requirements of the model.
[0076] In this embodiment, in step S3 above, GPT2 feature extraction is performed based on the API request text to obtain a dense semantic feature numerical vector of fixed dimension, including:
[0077] Input the API request text into the GPT2 model and use the encoder part of the GPT2 model to obtain the semantic feature vector of the text.
[0078] It should be noted that the GPT2 model, through its multi-layer Transformer architecture, can capture semantic information and contextual relationships in text and generate high-quality semantic feature numerical vectors.
[0079] In another possible implementation, before the API request text is fed into the GPT2 model, it can be truncated or padded to make its length conform to the input requirements of the GPT2 model. Typically, the maximum input length of the GPT2 model is 1024 tokens.
[0080] You can add some special markers before the API request text, such as the start marker <|START|> and the end marker <|END|>, to help the model better understand the boundaries of the text.
[0081] In this embodiment, the step S4 of performing feature fusion on the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector includes:
[0082] It should be noted that TF-IDF feature vectors are typically sparse vectors based on keywords, and their dimensionality can be very high (e.g., containing thousands of keywords). In contrast, feature vectors generated by GPT2 are typically dense vectors of fixed dimensionality (e.g., 768 dimensions). This significant difference in dimensionality makes direct fusion difficult. Before fusion, the TF-IDF and GPT2 feature vectors are normalized to ensure that their value ranges are consistent.
[0083] Specifically, the TF-IDF feature vector and the GPT2 feature vector are normalized to between 0 and 1. A weighted fusion method is introduced to assign different weights according to the importance of the features.
[0084] For example, weights α and β can be assigned to TF-IDF features and GPT2 features respectively, where α+β=1, and then the weighted sum is calculated to obtain a comprehensive numerical feature vector.
[0085] It should be noted that this fusion method can balance the importance of the two features and make full use of the keyword recognition ability of TF-IDF and the semantic understanding ability of GPT2.
[0086] In this embodiment, in step S5, a classifier is selected for malicious traffic classification, the classifier is trained by synthesizing numerical feature vectors, and the trained classifier is used to detect the traffic to be detected, including:
[0087] Choose a variety of classifiers suitable for small sample data, including support vector machine (SVM), naive Bayes, decision tree, and K-nearest neighbor (KNN).
[0088] The classifier is trained using the synthetic numerical feature vector as input. The model is evaluated using cross-validation to avoid overfitting.
[0089] Based on the results of cross-validation, the parameters of the classifier are adjusted to optimize the model performance.
[0090] The performance of the classifier is evaluated using metrics such as accuracy, recall, and F1 score. The best performing classifier is selected for malicious traffic classification.
[0091] The comprehensive feature vector generated by steps S2-S4 of the traffic to be detected is input into the trained classifier to predict malicious traffic.
[0092] Based on the output of the classifier, the traffic type of the new data is interpreted.
[0093] For example, if the classifier output is "malicious traffic", the request may be further analyzed to determine the type of attack that it may contain (such as SQL injection, cross-site scripting attack, etc.).
[0094] In another possible implementation, for small sample datasets, a semi-supervised learning approach can be employed. This approach utilizes a small amount of labeled data and a large amount of unlabeled data for training. For example, a self-training algorithm can be used to first train an initial classifier using labeled data. This classifier is then used to make predictions on unlabeled data. Unlabeled data with higher prediction confidence is then added to the labeled dataset, and the classifier is retrained. This iterative process improves model performance.
[0095] Example 3. The above is a schematic scheme of the small sample API malicious traffic detection method of this embodiment. It should be noted that the technical scheme of the small sample API malicious traffic detection system and the technical scheme of the above-mentioned small sample API malicious traffic detection method are of the same concept. For details not described in detail in the technical scheme of the small sample API malicious traffic detection system in this embodiment, please refer to the description of the technical scheme of the above-mentioned small sample API malicious traffic detection method.
[0096] This embodiment also provides a small sample API malicious traffic detection system, including:
[0097] API request text acquisition module, used to collect API traffic data and perform standardization processing to obtain API request text;
[0098] The TF-IDF feature extraction module is used to extract TF-IDF features based on the API request text and obtain the keyword-based TF-IDF feature numerical vector;
[0099] GPT2 feature extraction module, which is used to extract GPT2 features based on API request text and obtain a dense semantic feature numerical vector of fixed dimension;
[0100] The feature fusion module is used to fuse the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector;
[0101] The detection module is used to select a classifier for malicious traffic classification, train the classifier through comprehensive numerical feature vectors, and detect the traffic to be detected through the trained classifier.
[0102] This embodiment further provides an electronic device applicable to the small sample API malicious traffic detection method, including:
[0103] Memory and processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the small sample API malicious traffic detection method proposed in the above embodiment.
[0104] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for detecting malicious traffic of a small sample API is implemented as proposed in the above embodiment.
[0105] The storage medium proposed in this embodiment and the small sample API malicious traffic detection method proposed in the above embodiment belong to the same inventive concept. The technical details not described in detail in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.
[0106] Example 4 provides a small sample API malicious traffic detection method. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through simulation experiments.
[0107] Dataset Preparation: We randomly sampled 300 samples from the CSIC2010 dataset, using 70% for training, 20% for testing, and 10% for evaluation. The dataset contains both normal and malicious requests. To simulate a real-world environment, we limited the number of malicious requests to 10%. Malicious requests include various attack types, such as SQL injection and cross-site scripting.
[0108] Feature extraction:
[0109] TF-IDF feature extraction: The API request text is segmented and stop words are removed. The TF-IDF value of each word is calculated. The top 100 words with the highest TF-IDF values are selected as feature words to form a TF-IDF feature vector.
[0110] GPT2 feature extraction: Input the preprocessed API request text into the GPT2 model to obtain the semantic feature vector of each sample.
[0111] Feature fusion: The additive fusion method is used to weightedly fuse the TF-IDF feature vector and the GPT2 feature vector to obtain a comprehensive feature vector.
[0112] Classifier training and evaluation:
[0113] Classifier selection: Select four classifiers: SVM, Naive Bayes, Decision Tree and KNN.
[0114] Training process: Four classifiers were trained using comprehensive feature vectors, and the models were evaluated using a 5-fold cross-validation method.
[0115] Performance evaluation: Evaluate the performance of the classifier on the test set.
[0116] It should be noted that by combining the feature extraction capabilities of TF-IDF and GPT2, this method can fully utilize the advantages of keyword recognition and semantic understanding to generate more comprehensive and accurate feature vectors, effectively solving the recognition accuracy problem of existing technologies in small sample spaces.
[0117] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.
Claims
1. A method for detecting malicious API traffic with a small sample size, characterized in that: include: Collect API traffic data and perform standardization to obtain API request text; Based on the API request text, TF-IDF feature extraction is performed to obtain the keyword-based TF-IDF feature value vector; Based on the API request text, GPT2 feature extraction is performed to obtain a dense semantic feature numerical vector of fixed dimension; Perform feature fusion on the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector; A classifier is selected for malicious traffic classification, the classifier is trained by comprehensive numerical feature vectors, and the trained classifier is used to detect the traffic to be detected.
2. A small sample API malicious traffic detection method as claimed in claim 1, characterized in that: The API traffic data is collected and standardized to obtain the API request text including: Collect API traffic data, remove invalid data, remove duplicate data, unify the encoding format, and convert all text content to a unified case.
3. A small sample API malicious traffic detection method as described in claim 2, characterized in that: The TF-IDF feature extraction based on the API request text to obtain the keyword-based TF-IDF feature value vector includes: The method, path, and parameters in the API request text are considered as words, and the entire traffic log is considered as a document. The API request text is segmented, stop words are removed, and keywords are extracted.
4. A small sample API malicious traffic detection method as described in claim 3, characterized in that: The step of extracting TF-IDF features based on the API request text to obtain a keyword-based TF-IDF feature value vector also includes: For the extracted keywords, the word frequency and inverse document frequency are calculated, and the TF-IDF value of each keyword is obtained through the word frequency and inverse document frequency.
5. A small sample API malicious traffic detection method as described in claim 4, characterized in that: The step of extracting TF-IDF features based on the API request text to obtain a keyword-based TF-IDF feature value vector also includes: Sort the keywords according to the TF-IDF value, set the number of feature words N, and select the first N keywords as feature words in descending order of TF-IDF values to form a TF-IDF feature value vector.
6. A small sample API malicious traffic detection method as claimed in claim 5, characterized in that: The feature fusion of the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector includes: The TF-IDF feature vector and the GPT2 feature vector are normalized separately, and a weighted fusion method is introduced to assign different weights according to the importance of the features, and the weighted sum is calculated to obtain a comprehensive numerical feature vector.
7. A small sample API malicious traffic detection method as claimed in claim 6, characterized in that: The classifier is selected for malicious traffic classification, the classifier is trained by comprehensive numerical feature vectors, and the trained classifier is used to detect the traffic to be detected, including: The comprehensive feature vector obtained by feature fusion of the traffic to be detected is input into the trained classifier to predict malicious traffic; based on the output of the classifier, the traffic type of the new data is interpreted.
8. A small sample API malicious traffic detection system, applying the method according to any one of claims 1 to 7, characterized in that: include: API request text acquisition module, used to collect API traffic data and perform standardization processing to obtain API request text; The TF-IDF feature extraction module is used to extract TF-IDF features based on the API request text and obtain the keyword-based TF-IDF feature numerical vector; GPT2 feature extraction module, which is used to extract GPT2 features based on API request text and obtain a dense semantic feature numerical vector of fixed dimension; The feature fusion module is used to fuse the TF-IDF feature numerical vector and the dense semantic feature numerical vector to generate a comprehensive numerical feature vector; The detection module is used to select a classifier for malicious traffic classification, train the classifier through comprehensive numerical feature vectors, and detect the traffic to be detected through the trained classifier.
9. An electronic device, characterized in that: include: memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium, characterized in that It stores computer-executable instructions, which implement the steps of the method according to any one of claims 1 to 7 when executed by a processor.