API (Application Program Interface) security baseline sensing calculation method, system and equipment oriented to cross-application system and medium
By using structured feature representation and federated learning framework, the problem of unified awareness and dynamic optimization of API security baselines across application systems is solved, enabling cross-system security judgment and dynamic optimization, thereby improving security and user experience.
Patent Information
- Application Number
- CN202511053847.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-30
- Publication Date
- 2025-11-07
AI Technical Summary
The existing API security baseline design cannot meet the unified security judgment across application systems, lacks the ability to express structured features, and cannot dynamically correct misjudged samples, making it difficult to uniformly perceive and dynamically optimize the security baseline.
By using structured feature representation and a federated learning framework, API interface data is collected and parsed to build a security baseline feature index library, train a unified API behavior analysis model, and perform model parameter aggregation and incremental training of false positive and false negative samples through the federated learning framework, thereby achieving unified security judgment and dynamic optimization across systems.
It achieves unified awareness and dynamic optimization of cross-system API security baselines, improves the accuracy and adaptability of security judgments, and enhances user experience and the collaborative defense capabilities of the model.
Smart Images
Figure CN120915512A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of cross-system API security, and in particular to an API security baseline perception calculation method, system, device and medium for cross-application systems. BACKGROUND
[0002] Existing API security baseline designs generally use a single-system dependent mechanism, which cannot meet the unified security judgment needs of cross-application systems. Focusing only on the security of a single interface calling process cannot perceive the compliance of cross-system API behavior (such as parameter verification, sensitive data desensitization, etc.), and cannot adapt to the dynamic changes of API parameters and authentication mechanisms in multiple systems, making it difficult to unify the security baseline. This method is poor in generalization ability in the face of different application systems, and is prone to misjudgment due to parameter differences (such as calling frequency, authentication strength).
[0003] Existing technologies lack the ability to express the structural features of API security baseline design. Industry safety standards usually exist in the form of documents, and existing technologies lack the ability to convert them into structured features that machine learning models can understand. API abnormal behaviors are detected through predefined rules, but thresholds such as calling frequency and parameter range need to be defined manually, and security features such as authentication strength and sensitive parameter proportion in interface design cannot be automatically extracted, resulting in low efficiency of compliance evaluation.
[0004] Existing technologies do not design a continuous feedback optimization mechanism, making it difficult to dynamically correct misjudgment samples and improve long-term performance. The encryption strategy is adjusted according to the reliability of the user's identity and the amount of interaction data, but the evaluation model misjudges legal users as abnormal through false positives, resulting in a decline in user experience in the long-term application, and even leading to a decline or even abandonment of the API interface call. SUMMARY
[0005] In view of the above existing problems, the present application is proposed.
[0006] Therefore, the present application provides an API security baseline perception calculation method for cross-application systems, which can solve the technical defects of cross-system API security baseline difficulty in unified perception, dynamic evaluation and continuous optimization, and realize unified security judgment and adaptive optimization of multiple systems through structured feature expression and federated learning framework.
[0007] To solve the above technical problems, the application provides the following technical scheme, a kind of API security baseline perception calculation method for cross-application system, comprising: collecting the API interface data of different application systems, API interface data is parsed into the structured data of uniform format;Security baseline feature index library containing quantification security feature index is built;Unified API behavior analysis model is obtained by training based on structured data and security baseline feature index library using federated learning framework;The API behavior of different application systems is monitored and analyzed in real time based on unified API behavior analysis model respectively, and the security determination result of the API behavior of each application system is output;Collect the false positive sample or false negative sample output by unified API behavior analysis model, and the incremental training and optimization of unified API behavior analysis model are carried out.
[0008] As a preferred scheme of the API security baseline perception calculation method for cross-application system described in the application, wherein: the API interface data of different application systems is collected, API interface document data and API behavior log data are obtained;
[0009] Interface name, interface path, request method, parameter list, response format, response status code and sensitive field marking information are extracted from API interface document data and API behavior log data.
[0010] As a preferred scheme of the API security baseline perception calculation method for cross-application system described in the application, wherein: the API interface data is parsed into the structured data of uniform format, comprising,
[0011] The extracted interface name, interface path, request method, parameter list, response format, response status code and sensitive field marking information are converted into uniform formatted JSON object through predefined field mapping rule.
[0012] As a preferred scheme of the API security baseline perception calculation method for cross-application system described in the application, wherein: the security baseline feature index library containing quantification security feature index is built, comprising,
[0013] Quantification security feature index is defined, and the quantification security feature index at least includes authentication strength level, sensitive field exposure degree and interface exposure level;
[0014] Wherein, the sensitive field exposure degree is obtained by calculating the proportion of sensitive field in parameter and response.
[0015] As a preferred scheme of the API security baseline perception calculation method for cross-application systems, the training method of the unified API behavior analysis model comprises, at each application system locally, training a local XGBoost model using structured data of a local API interface and a feature vector in a corresponding security baseline feature index library.
[0016] The model parameters of each local XGBoost model and the corresponding training sample quantity are uploaded to a central server.
[0017] The central server aggregates the model parameters according to the training sample quantity of each local XGBoost model to generate global model parameters by using a weighted average algorithm.
[0018] The global model parameters are distributed to each application system to update each local XGBoost model, thereby forming a unified API behavior analysis model.
[0019] As a preferred scheme of the API security baseline perception calculation method for cross-application systems, the model parameters of each local XGBoost model and the corresponding training sample quantity are uploaded to a central server, and the global model parameters are distributed to each application system by using a TLS encryption protocol.
[0020] As a preferred scheme of the API security baseline perception calculation method for cross-application systems, the incremental training and optimization of the unified API behavior analysis model comprises adding false positive samples or false negative samples to a local training data set.
[0021] In each application system locally, the local unified API behavior analysis model is retrained using a training data set containing the false positive samples and / or false negative samples, and in each preset period, the model parameter aggregation and update process of each local unified API behavior analysis model is triggered.
[0022] In this embodiment, the local retraining of false positive and false negative samples and the periodic global parameter aggregation mechanism significantly improve the accuracy, adaptability and collaborative defense capability of API security baseline perception, dynamically respond to API ecological changes, and balance privacy and efficiency.
[0023] The application provides an API security baseline perception calculation system for cross-application systems.
[0024] As a preferred scheme of the API security baseline perception calculation system for cross-application systems, the system comprises a data collection and analysis module, a feature management module, a federal modeling module, a security analysis module and a feedback optimization module.
[0025] The data collection and analysis module automatically collects API raw data of different systems and uniformly analyzes the structured data in a standard format.
[0026] The feature management module defines, stores and calculates quantitative security indicators to provide structured feature input for the model.
[0027] The federal modeling module includes a local computing unit and a central coordination unit.
[0028] The local computing unit trains the XGBoost model locally in each system, and the central coordination unit aggregates the global model parameters and synchronizes them to each node to form a unified model across systems.
[0029] The security analysis module loads the unified model, performs security risk assessment on real-time API behavior, and outputs the judgment result.
[0030] The feedback optimization module collects misjudgment samples, triggers local model incremental training and periodic global model update, and realizes dynamic optimization.
[0031] The application provides a computer device, including a memory and a processor, the memory stores a computer program, and the processor realizes the steps of an API security baseline perception calculation method for cross-application systems when executing the computer program.
[0032] The application provides a computer readable storage medium, which stores a computer program, and the computer program realizes the steps of an API security baseline perception calculation method for cross-application systems when executed by a processor.
[0033] The application has the following advantages: the application solves the problem of different security baselines in multiple systems caused by traditional single-system dependence mechanism through the cooperation of federal learning framework and local-global model. Under the condition of unified local model architecture, XGBoost and global parameter aggregation FedAvg algorithm are deployed uniformly, and TLS encryption communication is used to synchronize model parameters, ensuring the consistency of cross-system evaluation.
[0034] Through incremental learning and periodic global model parameter weighted aggregation, the problem of unable to dynamically correct misjudgment samples in the prior art is solved. After the expert labels the false positive / false negative samples, the local model incremental training is triggered, and the global model parameters are updated to realize dynamic optimization of the model. BRIEF DESCRIPTION OF DRAWINGS
[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.
[0036] Figure 1 A flowchart of an API security baseline-aware computing method for cross-application systems is provided for an embodiment of the present application. DETAILED DESCRIPTION
[0037] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.
[0038] Embodiment 1, refer to Figure 1 For the first embodiment of the present application, the embodiment provides an API security baseline-aware computing method for cross-application systems, comprising:
[0039] S100: Collect API interface data of different application systems, and parse the API interface data into structured data in a unified format.
[0040] S200: Construct a security baseline feature index library containing quantitative security feature indexes
[0041] S300: Using a federated learning framework, based on the structured data and the security baseline feature index library, a unified API behavior analysis model is trained.
[0042] S400: Based on the unified API behavior analysis model, the API behaviors of different application systems are monitored and analyzed in real time, and the security determination results of the API behaviors of each application system are output. The false positive samples or false negative samples output by the unified API behavior analysis model are collected, and the unified API behavior analysis model is incrementally trained and optimized.
[0043] It should be noted that the prior art solution generally lacks effective continuous feedback and dynamic optimization mechanism. When the system misjudges a legitimate user or normal API call as abnormal (false positive), or fails to identify a real attack (false negative), there is a lack of mechanism to dynamically correct the evaluation model itself using these misjudgment samples. This leads to the model being unable to adapt to the evolution of business logic such as the addition of new API interfaces, changes in security policies, changes in user behavior patterns, or the emergence of new attack methods during long-term operation, ultimately causing the model performance to degrade, user experience to decline, such as legitimate users being frequently intercepted, and even possibly leading to API interfaces being abandoned due to availability issues.
[0044] The present embodiment addresses the problem of the lack of ability to uniformly perceive, evaluate and determine the security compliance of API behavior in different application system environments, and automatically converts industry security standard texts, i.e. API design security baseline specifications, into structured feature vectors that can be efficiently processed by machine learning models. Based on false positive / false negative feedback data, the safety baseline judgment model is continuously learned and dynamically optimized to adapt to long-term business changes and improve model robustness.
[0045] Embodiment 2, based on the above embodiment, provides an API security baseline perception calculation method for cross-application systems.
[0046] In the present application embodiment, the API interface data of different application systems is collected in step S100, and the API interface data is parsed into structured data in a unified format, specifically:
[0047] A1: Collect and structure the API interface data of different application systems into a unified input format.
[0048] The API interface data information that needs to be obtained includes:
[0049] Interface name: a unique name that identifies the API interface, usually used to distinguish different interface functions.
[0050] Interface path: the access URL path of the API interface, defining the specific call address of the interface.
[0051] Request method: specifies the HTTP method used to call the interface, including GET, POST, PUT, DELETE, etc., used to determine the interface operation type.
[0052] Parameter list: lists all input parameters of the interface, including the name, type, and position of each parameter.
[0053] Response format: describes the data structure format of the interface response body, commonly such as JSON, XML, etc., used for interface consistency and content security detection.
[0054] Response status codes: Lists the HTTP status codes that the interface may return and their meanings, used to identify abnormal returns and clues to security events.
[0055] Sensitive field markers: These mark whether request parameters or response fields contain sensitive information (such as ID card numbers, passwords, mobile phone numbers, etc.) and are used for sensitive data exposure risk modeling.
[0056] A2: The API documentation uses OpenAPI format, while the behavior logs are in JSON format. Data formats are converted using field extraction and unified mapping rules, transforming the above data into uniformly formatted JSON objects. During this process, there may be differences in fields between different application systems; for example, some may call them "request method," some "request header," and some "call method," etc. All fields across multiple systems need to be uniformly referred to as "request method."
[0057] In an optional embodiment, the data format conversion can also be achieved through XML structured conversion. Specifically, the original fields such as interface name and path are parsed from the OpenAPI documentation / JSON logs to create a standard XML Schema; the extracted fields are filled according to the tag mapping to generate a unified XML file; and tags are selected according to preset priority for field name conflicts.
[0058] In another alternative embodiment, data format conversion can also be achieved through relational database mapping. Specifically, a database table structure is created, and the original data is written into the database according to column name mapping rules. A standardized view is generated through SQL queries and used as input for subsequent modules.
[0059] In this embodiment of the application, step S200 involves constructing a security baseline feature index library containing quantified security feature indicators, specifically as follows:
[0060] B1: Based on the mainstream industry security standards and specifications, "OWASP API Security Top 10," construct an API security baseline characteristic indicator library. Typical characteristic indicators include, but are not limited to:
[0061] a. Authentication strength level: such as Basic Auth (1 point), OAuth2.0 (3 points), JWT+MFA (5 points) are used to reflect the security level of interface access control.
[0062] b. Sensitive field exposure: Used to assess the potential risk of data breach.
[0063] c. Interface exposure level: such as whether it is publicly accessible, whether there is permission verification, etc.
[0064] B2: Calculate the proportion of sensitive fields (such as ID card, mobile phone number, etc.) in parameters and responses, and the index. When the proportion is between 0 and 0.3, it is determined to be "safe"; the proportion is between 0.3 and 0.7, which belongs to "medium risk"; if it exceeds 0.7, it is classified as "high risk", which indicates a high possibility of sensitive data leakage.
[0065] B3: Set identification rules:
[0066] Internal interface + permission verification → low exposure level, give 2;
[0067] External interface + no authentication mechanism → high exposure level, give 0;
[0068] All feature indicators will be combined in the form of a vector. Subsequently, according to business needs, more feature indicators should be designed.
[0069] In an optional embodiment, the exposure degree of sensitive fields can also be calculated by hierarchical weighting. Specifically, sensitive levels are divided, and three levels of sensitive fields are defined. Assign weights according to the level: 1st level = 3, 2nd level = 2, 3rd level = 1. After weighted calculation, replace the simple proportion.
[0070] In another optional embodiment, the exposure degree of sensitive fields can also be determined by context association analysis. Specifically, according to interface function classification to identify scenarios, set sensitive field threshold according to scenarios (such as more than 2 sensitive fields in payment interface triggers high risk), and generate risk label combining sensitive field number and interface type.
[0071] In the embodiment of the application, in step S300, a unified API behavior analysis model is trained based on structured data and a security baseline feature index library using a federated learning framework. Specifically:
[0072] C1: The training data samples of the XGBoost local model include original interface field information, security baseline feature vectors, and manually labeled security level labels "safe", "medium risk", and "high risk", which are assigned values of 0, 1, and 2 respectively. The model training uses cross-entropy loss as the optimization objective.
[0073] In an optional embodiment, when in a scenario requiring probability output, the unified API behavior analysis model is trained to use log loss instead of cross-entropy in local training, output risk probability score for dynamic strategy, and the federated process remains unchanged.
[0074] C2: After the training is completed, each system uploads the parameter weights of the local model and the model parameters and the number of samples obtained by training to the central server. The central server aggregates the local model parameters of each system by the FedAvg algorithm, and performs weighted average aggregation according to the number of samples. After the weighted average is completed, the new round of global model parameters generated are the unified API behavior analysis model shared across systems.
[0075] In an optional embodiment, after the training of the unified API behavior analysis model is completed, a simple average arithmetic aggregation can also be performed, and the new round of global model parameters generated after the aggregation are used as the unified API behavior analysis model.
[0076] In another optional embodiment, after the training of the unified API behavior analysis model is completed, a median aggregation can also be performed on the local model parameters of all systems, ignoring the sample quantity weight, and the new round of global model parameters generated after the aggregation are used as the unified model.
[0077] C3: The central server returns the global model parameters to each local node through the TLS encryption protocol, overwrites the old model and reinitializes, so as to ensure that all nodes use consistent evaluation standards and parameter configurations in the new round of model deployment. The new round of model analyzes the new API behavior in real time and outputs the security classification label and risk score.
[0078] It should be noted that the global parameter aggregation of the federal modeling module can realize privacy protection collaborative modeling of the cross-system security baseline. Without sharing the original data, the local model obtains global knowledge through encrypted transmission of model parameters and weighted average aggregation, thereby guaranteeing data sovereignty and unifying the multi-system security judgment standard.
[0079] In the embodiment of the application, in step S400, the API behaviors of different application systems are monitored and analyzed in real time based on the unified API behavior analysis model, and the security judgment results of the API behaviors of the corresponding application systems are output; false positive samples or false negative samples output by the unified API behavior analysis model are collected, and the unified API behavior analysis model is incrementally trained and optimized, specifically as follows:
[0080] D1: The security judgment result includes: "safe", "medium risk", and "high risk"; and is used to evaluate the security of different interface API behaviors in each application system.
[0081] D2: False positive / missed feedback samples after the local model of each system is deployed are collected regularly. The feedback samples are added to the local training data to retrain the model to realize incremental learning. The global model is periodically triggered to be re-aggregated and synchronously deployed.
[0082] Embodiment 3, which is different from the first two embodiments, is a third embodiment of the application.
[0083] The embodiment also provides an API security baseline perception computing system for a cross-application system, comprising a data collection and analysis module, a feature management module, a federated modeling module, a security analysis module, and a feedback optimization module.
[0084] The data collection and analysis module automatically collects API raw data of different systems and uniformly analyzes the API raw data into structured data in a standard format.
[0085] The feature management module defines, stores, and calculates quantitative security indicators to provide structured feature input for the model.
[0086] The federated modeling module comprises a local computing unit and a central coordination unit.
[0087] The local computing unit locally trains an XGBoost model in each system, and the central coordination unit aggregates global model parameters and synchronously encrypts the global model parameters to each node to form a unified model across systems.
[0088] The security analysis module loads the unified model, performs security risk assessment on real-time API behavior, and outputs a judgment result.
[0089] The feedback optimization module collects misjudgment samples, triggers local model incremental training and periodic global model updating, and realizes dynamic optimization.
[0090] The embodiment also provides an electronic device suitable for high-temperature pipeline health online monitoring, comprising a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the high-temperature pipeline health online monitoring method proposed in the above embodiment.
[0091] The embodiment also provides a storage medium having a computer program stored thereon, and the computer program is executed by a processor to realize the high-temperature pipeline health online monitoring method proposed in the above embodiment.
[0092] The storage medium proposed in the embodiment and the high-temperature pipeline health online monitoring method proposed in the above embodiment belong to the same inventive concept, and the technical details not described in the embodiment can be referred to the above embodiment, and the embodiment has the same beneficial effects as the above embodiment.
[0093] Those skilled in the art can clearly understand the present application by the above description of the embodiments, and the present application can be realized by software and necessary general hardware, and of course, can also be realized by hardware. Based on such understanding, the technical solutions of the present application or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH, a hard disk, or an optical disc, and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods of various embodiments of the present application.
[0094] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application, and although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all should be covered in the scope of the claims of the present application.
Claims
1. An API security baseline-aware computing method for cross-application systems, characterized in that: The application comprises the following steps: Collecting API interface data of different application systems, and parsing the API interface data into structured data in a unified format; Building a security baseline feature index library containing quantitative security feature indexes; Training a unified API behavior analysis model based on the structured data and the security baseline feature index library using a federated learning framework; Real-time monitoring and analyzing the API behavior of different application systems based on the unified API behavior analysis model, and outputting the security determination results of the API behavior of each application system; Collecting false positive samples or false negative samples output by the unified API behavior analysis model, and incrementally training and optimizing the unified API behavior analysis model.
2. The API security baseline-aware computing method for cross-application system according to claim 1, wherein: The collection of API interface data of different application systems comprises information collection and structured processing of API interfaces of different application systems; Parsing the API interface data and extracting label information.
3. The API security baseline-aware computing method for cross-application system of claim 2, wherein: The parsing of the API interface data into structured data in a unified format comprises the following steps: Converting the extracted label information into a unified formatted JSON object through a predefined field mapping rule.
4. The API security baseline-aware computing method for cross-application system of claim 3, wherein: The construction of the security baseline feature index library containing quantitative security feature indexes comprises the following steps: Defining security feature indexes, and quantifying the security feature indexes through a set of feature indexes; Building an API security baseline feature index library based on security standards and specifications.
5. The API security baseline-aware computing method for cross-application system of claim 4, wherein: The training method of the unified API behavior analysis model comprises the following steps: Training a local XGBoost model using the structured data of the local API interface and the feature vectors in the corresponding security baseline feature index library in each application system; Uploading the model parameters of each local XGBoost model and the corresponding number of training samples to a central server; Using a weighted average algorithm to aggregate the model parameters according to the number of training samples of each local XGBoost model in the central server, and generating global model parameters; 6. The API security baseline-aware computing method for cross-application system of claim 5, wherein: Distributing the global model parameters to each application system to update each local XGBoost model, forming a unified API behavior analysis model.
7. The API security baseline-aware computing method for cross-application system of claim 6, wherein: The uploading of the model parameters of each local XGBoost model and the corresponding number of training samples to the central server, and the distribution of the global model parameters to each application system are performed through the TLS encryption protocol. The incremental training and optimization of the unified API behavior analysis model comprises the following steps:
8. A cross-application system oriented API security baseline aware computing system, applying a cross-application system oriented API security baseline aware computing method according to any one of claims 1-7, characterized in that, Adding false positive samples or false negative samples to the local training data set; Re-training the local unified API behavior analysis model using the training data set containing the false positive samples and / or false negative samples in each application system, and triggering the model parameter aggregation and update process of each local unified API behavior analysis model in each preset period. The application comprises the following steps: Data collection and analysis module, feature management module, federated modeling module, security analysis module and feedback optimization module; The data collection and analysis module automatically collects API raw data of different systems and uniformly parses them into structured data in a standard format; The feature management module defines, stores and calculates quantitative security indexes to provide structured feature input for the model; The federal modeling module comprises a local computing unit and a central coordination unit; The local computing unit trains an XGBoost model locally in each system, and the central coordination unit aggregates global model parameters and synchronizes them to each node in an encrypted manner to form a unified model across systems. The security analysis module loads the unified model, conducts security risk assessment on real-time API behavior, and outputs a judgment result. The feedback optimization module collects misjudgment samples, triggers local model incremental training and periodic global model updating, and realizes dynamic optimization. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the API security baseline-aware computing method for cross-application systems according to any one of claims 1 to 7.
10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the API security baseline-aware computing method for cross-application systems according to any one of claims 1 to 7.