An application API abnormal access identification method and system based on user big data

Abstract

The application provides an application API abnormal access identification method and system based on user big data, and relates to the technical field of API security, which comprises the following steps: obtaining user login information, user registration time and user historical data of a user, wherein the user login information comprises a user login location, a user login IP and a user login device; obtaining user operation data of the user in an identification period; determining whether the user is a new user according to the user registration time; in the case that the user is a new user, determining a user behavior abnormality coefficient according to the user login information and the user operation data; in the case that the user is not a new user, determining the user behavior abnormality coefficient according to the user login information, the user operation data and the user historical data; and determining whether there is application API abnormal access according to the user behavior abnormality coefficient. According to the application, the accuracy of application API abnormal access identification can be improved.

Description

Technical Field

[0001] This invention relates to the field of API security technology, and in particular to a method and system for identifying abnormal access to application APIs based on user big data. Background Technology

[0002] In related technologies, abnormal access can be detected and blocked in real time through API gateways and web application firewalls. However, these technologies are difficult to effectively deal with unknown threats and variant attacks, and are difficult to adapt to dynamically changing behavioral baselines. In other words, they are difficult to improve the accuracy of API abnormal access identification based on historical user profiles.

[0003] The information disclosed in the background section of this application is intended only to enhance the understanding of the general background of this application and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0004] This invention provides a method and system for identifying abnormal access to application APIs based on user big data, which can solve the technical problem that related technologies are unable to improve the accuracy of identifying abnormal API access based on historical user profiles.

[0005] According to a first aspect of the present invention, a method for identifying abnormal access to application APIs based on user big data is provided, comprising:

[0006] The system obtains the user's login information, registration time, and historical data, wherein the login information includes: the user's login location, login IP address, and login device.

[0007] Acquire user action data during the recognition period;

[0008] Based on the user's registration time, determine whether the user is a new user;

[0009] If the user is a new user, determine the user behavior anomaly coefficient based on the user login information and the user operation data;

[0010] If the user is not a new user, determine the user behavior anomaly coefficient based on the user login information, the user operation data, and the user historical data.

[0011] Based on the user behavior anomaly coefficient, determine whether there is any abnormal access to the application API.

[0012] According to the present invention, when the user is a new user, a user behavior anomaly coefficient is determined based on the user login information and the user operation data, including:

[0013] Determine the user login anomaly coefficient based on the user login IP and the user login device;

[0014] Retrieve historical abnormal user operation data for new users with historical anomalies;

[0015] Based on the historical abnormal user operation data and the user operation data, determine the user operation abnormality coefficient;

[0016] If the user is a new user, the user behavior anomaly coefficient is determined based on the user login anomaly coefficient and the user operation anomaly coefficient.

[0017] According to the present invention, determining a user login anomaly coefficient based on the user login IP and the user login device includes:

[0018] Based on the user's login IP, the malicious IP identification result is determined;

[0019] Based on the user's login device, determine the login device abnormality result;

[0020] Based on the malicious IP identification results and the login device anomaly results, the user login anomaly coefficient is determined.

[0021] According to the present invention, determining a user operation anomaly coefficient based on the historical user abnormal operation data and the user operation data includes:

[0022] Based on the historical abnormal user operation data, determine the abnormal request frequency threshold and the unauthorized operation frequency threshold;

[0023] Based on the user operation data, determine the user behavior sequence, user request interval, user request frequency, and unauthorized operation frequency;

[0024] Based on the user behavior sequence, determine the abnormal results of the user behavior sequence;

[0025] The user operation anomaly coefficient is determined based on the abnormal results of the user behavior sequence, the user request interval, the user request frequency, the unauthorized operation frequency, the abnormal request frequency threshold, and the unauthorized operation frequency threshold.

[0026] According to the present invention, determining the user operation anomaly coefficient based on the user behavior sequence anomaly result, the user request interval, the user request frequency, the unauthorized operation frequency, the anomaly request frequency threshold, and the unauthorized operation frequency threshold includes: according to the formula: ,

[0027] Determine the coefficient of user operation anomaly Where, if is a conditional function, The interval between the r-th request and the (r-1)-th request is the user request interval. The interval between the (r+1)th request and the rth request is... For abnormal results of user behavior sequences, , For user request frequency, This is a threshold for the frequency of abnormal requests. For unauthorized operation frequency, R is the threshold for the frequency of unauthorized operations, where R is the number of user requests, R is greater than 1, r ≤ R, and both r and R are positive integers.

[0028] According to the present invention, when the user is not a new user, a user behavior anomaly coefficient is determined based on the user login information, the user operation data, and the user historical data, including:

[0029] Based on the user login information and the user operation data, determine the first user behavior anomaly coefficient;

[0030] The second user behavior anomaly coefficient is determined based on the user login information, the user operation data, and the user historical data.

[0031] If the user is not a new user, the user behavior anomaly coefficient is determined based on the first user behavior anomaly coefficient and the second user behavior anomaly coefficient.

[0032] According to the present invention, determining a second user behavior anomaly coefficient based on the user login information, the user operation data, and the user historical data includes:

[0033] Based on the user's historical data, determine the historical login device, historical login location, historical login IP, historical API call frequency, historical API call percentage, historical read / write ratio, and historical request error rate;

[0034] Based on the user operation data, determine the user's API call frequency, user's API call percentage, user read / write ratio, and user request error rate;

[0035] Based on the historical login IPs and the user login IPs, the commonly used login IP identification results are determined;

[0036] Based on the historical login devices and the user login devices, the commonly used login device identification result is determined;

[0037] Based on the historical login locations and the user login locations, the commonly used login location identification results are determined;

[0038] The probability of detecting user anomalies is determined by analyzing the commonly used login IP identification results, the commonly used login device identification results, the commonly used login location identification results, the historical API call frequency, the historical API call percentage, the historical read / write ratio, the historical request error rate, the user API call frequency, the user API call percentage, the user read / write ratio, and the user request error rate using a trained user anomaly identification model.

[0039] The second user behavior anomaly coefficient is determined based on the user anomaly detection probability.

[0040] According to the present invention, the training steps of the user anomaly detection model include:

[0041] The system acquires sample user operation data and sample user historical data from multiple training users across multiple historical recognition periods. The sample user operation data includes: sample login device, sample login location, sample login IP, sample API call frequency, sample API call percentage, sample read / write ratio, and sample request error rate. The sample user historical data includes: sample historical login device, sample historical login location, sample historical login IP, sample historical API call frequency, sample historical API call percentage, sample historical read / write ratio, and sample historical request error rate.

[0042] Based on the sample login device, the sample login location, the sample login IP, the sample historical login device, the sample historical login location, and the sample historical login IP, determine the sample commonly used login IP identification result, the sample commonly used login device identification result, and the sample commonly used login location identification result;

[0043] The user anomaly detection model is used to process the commonly used login IP identification results, the commonly used login device identification results, the commonly used login location identification results, the user operation data, and the user historical data to obtain the user anomaly detection probability.

[0044] Obtain the actual historical anomaly detection results of multiple sample training users;

[0045] Based on the sample user anomaly detection probability, the actual historical anomaly detection results, the sample commonly used login IP identification results, the sample commonly used login device identification results, the sample commonly used login location identification results, the sample user operation data, and the sample user historical data, determine the training loss function of the user anomaly identification model;

[0046] The user anomaly detection model is trained using the training loss function of the user anomaly detection model to obtain a trained user anomaly detection model.

[0047] According to the present invention, the training loss function of the user anomaly detection model is determined based on the sample user anomaly detection probability, the actual historical anomaly detection results, the sample commonly used login IP identification results, the sample commonly used login device identification results, the sample commonly used login location identification results, the sample user operation data, and the sample user historical data, including: according to the formula:

[0048] ,

[0049] Determine the training loss function for the user anomaly detection model. ,in, For the k-th sample, train the sample read / write ratio of the user in the i-th historical recognition period. The sample history read / write ratio of the training user for the k-th sample. To train the sample request error rate of the user in the i-th historical recognition period for the k-th sample, The error rate of the sample history request for the user training the k-th sample. Let the probability of anomaly detection for the user in the i-th historical recognition period be the training probability for the user in the k-th sample. For the k-th sample, train the user's actual historical anomaly detection results in the i-th historical recognition period. , To identify the commonly used login IPs of the user in the i-th historical identification period for the k-th sample,

[0050] , For the k-th sample, the commonly used login device recognition results of the user in the i-th historical recognition period are used for training.

[0051] , To identify the frequently used login locations of the user in the i-th historical identification period for the k-th sample,

[0052] , For the k-th sample, train the user's API call frequency for the j-th important API during the i-th historical recognition period. For the k-th sample, train the historical API call frequency of users to the j-th important API. For the k-th sample, the percentage of API calls made by the user to the j-th important API during the i-th historical recognition period is used as the training sample. Let K be the percentage of historical API calls made by the training user of the k-th sample to the j-th important API in the i-th historical recognition period. K is the number of training users, k≤K, n is the number of historical recognition periods, i≤n, m is the number of important APIs, j≤m, and k, K, i, n, j and m are all positive integers.

[0053] According to a second aspect of the present invention, a system for identifying abnormal access to application APIs based on user big data is provided, comprising:

[0054] The user information module is used to obtain the user's login information, user registration time, and user historical data. The user login information includes: user login location, user login IP, and user login device.

[0055] The real-time data module is used to acquire user operation data during the recognition period;

[0056] The user identification module is used to determine whether a user is a new user based on the user's registration time.

[0057] The first anomaly module is used to determine the user behavior anomaly coefficient based on the user login information and the user operation data when the user is a new user.

[0058] The second anomaly module is used to determine the user behavior anomaly coefficient based on the user login information, the user operation data, and the user historical data when the user is not a new user.

[0059] The anomaly detection module is used to determine whether there is any abnormal access to the application API based on the user behavior anomaly coefficient.

[0060] Technical Effects: According to the present invention, it is possible to determine whether a user is a new user based on the user registration time. If the user is a new user, the system assesses whether the user has abnormal API access based on the user login information and user operation data. If the user is not a new user, the system assesses whether the user has abnormal API access based on the user login information, user operation data, and user historical data, thus improving the accuracy of identifying abnormal API access. When determining the user operation anomaly coefficient, it can be determined based on abnormal results of user behavior sequences, user request intervals, user request frequencies, unauthorized operation frequencies, abnormal request frequency thresholds, and unauthorized operation frequency thresholds. During the calculation process, the user operation anomaly can be evaluated from four aspects: abnormal user request intervals, abnormal user behavior sequences, abnormal user request frequencies, and abnormal unauthorized operation frequencies, thus determining the user operation anomaly coefficient and improving its comprehensiveness and accuracy. When determining the training loss function of the user anomaly detection model, it can be based on the sample user anomaly detection probability, actual historical anomaly detection results, sample commonly used login IP identification results, sample commonly used login device identification results, sample commonly used login location identification results, sample user operation data, and sample user historical data. During the calculation process, the impact of the above data on the error of the sample user anomaly detection probability can be determined based on the possible influence of the user's operation status and login status on the occurrence of API anomaly detection. Based on this influence and the error of the sample user anomaly detection probability, the training loss function can be set to reduce the training loss function during the training process, thereby more effectively improving the accuracy of the user anomaly detection model.

[0061] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Other features and aspects of the invention will become clearer from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0063] Figure 1 An exemplary flowchart of an application API abnormal access identification method based on user big data according to an embodiment of the present invention is shown.

[0064] Figure 2An exemplary diagram illustrating the determination of user behavior anomaly coefficients when the user is a new user, according to an embodiment of the present invention;

[0065] Figure 3 An exemplary diagram illustrating the determination of user behavior anomaly coefficients when the user is not a new user, according to an embodiment of the present invention;

[0066] Figure 4 An exemplary block diagram of an application API anomaly access identification system based on user big data according to an embodiment of the present invention is shown. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0069] Figure 1 An exemplary flowchart illustrates a method for identifying abnormal access to application APIs based on user big data according to an embodiment of the present invention. The method includes:

[0070] Step S1: Obtain the user's login information, user registration time, and user historical data. The user login information includes: user login location, user login IP, and user login device.

[0071] Step S2: Obtain user operation data during the recognition period;

[0072] Step S3: Determine whether the user is a new user based on the user registration time;

[0073] Step S4: If the user is a new user, determine the user behavior anomaly coefficient based on the user login information and the user operation data.

[0074] Step S5: If the user is not a new user, determine the user behavior anomaly coefficient based on the user login information, the user operation data, and the user historical data.

[0075] Step S6: Determine whether there is any abnormal access to the application API based on the user behavior anomaly coefficient.

[0076] According to an embodiment of the present invention, the application API abnormal access identification method based on user big data can determine whether a user is a new user based on the user's registration time. If the user is a new user, the method assesses whether the user has abnormal API access based on the user's login information and user operation data. If the user is not a new user, the method assesses whether the user has abnormal API access based on the user's login information, user operation data, and user historical data, thereby improving the accuracy of application API abnormal access identification.

[0077] According to an embodiment of the present invention, in step S1, the user's login information, user registration time, and user historical data are obtained, wherein the user login information includes: user login location, user login IP, and user login device.

[0078] For example, the system will store the data collected during the historical identification period into Elasticsearch or HDFS. Therefore, user operation data and login data during the historical period can be obtained through Elasticsearch or HDFS, that is, user historical data. User login information is obtained automatically through the network layer / application layer, and user registration time is obtained by querying the business database.

[0079] According to one embodiment of the present invention, in step S2, user operation data during the identification period is acquired.

[0080] For example, by capturing detailed logs of each API request through an API gateway or application middleware, user operation data during the identification period can be obtained, such as user request frequency (the frequency with which users send requests to the API), and the collected data can be stored in Elasticsearch or HDFS.

[0081] According to one embodiment of the present invention, in step S3, it is determined whether the user is a new user based on the user registration time.

[0082] For example, if a user's registration time is less than or equal to 3 days, the user is determined to be a new user; if a user's registration time is greater than 3 days, the user is determined to be a non-new user.

[0083] According to an embodiment of the present invention, in step S4, if the user is a new user, the user behavior anomaly coefficient is determined based on the user login information and the user operation data.

[0084] For example, if a user is a new user, the user's historical data in the historical period is insufficient to generate a historical profile. Therefore, it is impossible to judge the abnormality of user behavior based on the historical profile. In this case, the abnormality coefficient of user behavior is determined based on the user's login information and user operation data.

[0085] Figure 2 An exemplary diagram illustrating the determination of user behavior anomaly coefficients when the user is a new user, according to an embodiment of the present invention.

[0086] According to an embodiment of the present invention, step S4 includes:

[0087] Step S41: Determine the user login anomaly coefficient based on the user login IP and the user login device;

[0088] Step S42: Obtain historical abnormal user operation data for historical abnormal new users;

[0089] Step S43: Determine the user operation anomaly coefficient based on the historical user abnormal operation data and the user operation data;

[0090] Step S44: If the user is a new user, determine the user behavior anomaly coefficient based on the user login anomaly coefficient and the user operation anomaly coefficient.

[0091] For example, based on the user's login IP and login device, assess the abnormality of the user login and determine the user login abnormality coefficient; obtain the operation data of new users who have been identified as having abnormal API access, i.e., historical user abnormal operation data; based on the historical user abnormal operation data and the user operation data, assess the abnormality of the user operation and determine the user operation abnormality coefficient.

[0092] According to an embodiment of the present invention, step S41 includes:

[0093] Step S411: Determine the malicious IP identification result based on the user login IP;

[0094] Step S412: Determine the login device abnormality result based on the user login device;

[0095] Step S413: Determine the user login anomaly coefficient based on the malicious IP identification result and the login device anomaly result.

[0096] For example, by using publicly available threat intelligence databases (such as Tor egress nodes, data center IPs, known proxy or VPN server IP ranges), known malicious IPs are obtained. If the user's login IP belongs to a known malicious IP, the malicious IP identification result is 1; otherwise, the malicious IP identification result is 0. Based on the user's login device, it is determined whether the device fingerprint has been associated with malicious behavior before, or whether the device parameters of the device are abnormal (such as IMEI tampering, abnormal model, root / jailbreak). If the device fingerprint has been associated with malicious behavior before, or whether the device parameters of the device are abnormal, the login device abnormality result is 1; otherwise, the login device abnormality result is 0. The user login abnormality coefficient is determined by adding the malicious IP identification result and the login device abnormality result.

[0097] According to an embodiment of the present invention, step S43 includes:

[0098] Step S431: Determine the abnormal request frequency threshold and the unauthorized operation frequency threshold based on the historical user abnormal operation data;

[0099] Step S432: Based on the user operation data, determine the user behavior sequence, user request interval, user request frequency, and unauthorized operation frequency;

[0100] Step S433: Determine abnormal results of the user behavior sequence based on the user behavior sequence;

[0101] Step S434: Determine the user operation anomaly coefficient based on the user behavior sequence anomaly result, the user request interval, the user request frequency, the unauthorized operation frequency, the abnormal request frequency threshold, and the unauthorized operation frequency threshold.

[0102] For example, based on the average of historical abnormal user operation data from multiple new users identified as having abnormal API access, the thresholds for abnormal request frequency and unauthorized operation frequency are determined. Based on user operation data, the user behavior sequence (e.g., user access path), user request interval (the time interval between two user requests), user request frequency, and unauthorized operation frequency are determined. Based on the user behavior sequence, the abnormal results of the user behavior sequence are determined. For example, abnormal behavior may be rigid and repetitive, manifested as: skipping the front-end page and directly making high-frequency calls to the back-end core API, continuously repeating the "get SMS verification code -> register" loop, and sequentially batch traversing resource IDs (e.g., / product / 1, / product / 2, / product / 3...). If the user behavior sequence exhibits the above phenomena, the abnormal result of the user behavior sequence is 1; otherwise, it is 0. Based on the abnormal results of the user behavior sequence, user request interval, user request frequency, unauthorized operation frequency, abnormal request frequency threshold, and unauthorized operation frequency threshold, the abnormality of user operations is evaluated, and the user operation abnormality coefficient is determined.

[0103] According to an embodiment of the present invention, step S434 includes: determining the user operation anomaly coefficient according to formula (1). ,

[0104] (1)

[0105] Where if is a conditional function, The interval between the r-th request and the (r-1)-th request is the user request interval. The interval between the (r+1)th request and the rth request is... For abnormal results of user behavior sequences, , For user request frequency, This is a threshold for the frequency of abnormal requests. For unauthorized operation frequency, R is the threshold for the frequency of unauthorized operations, where R is the number of user requests, R is greater than 1, r ≤ R, and both r and R are positive integers.

[0106] According to an embodiment of the present invention, in formula (1), the condition function The value includes the following two cases, when the following conditions are met: When the condition is met, it means that the interval between two consecutive user requests is equal, and the value of the condition function is 1. Otherwise, the condition is not met. When the condition is met, the value of the condition function is 0. This indicates a summation based on the number of requests. Since the intervals between requests issued by machine scripts are relatively fixed, while human operations involve random pauses and variations, therefore... The larger the value, the more fixed the interval between requests will be, and the greater the possibility that the request is issued by a machine script. Mechanical requests may cause server overload, waste of resources, or be used for malicious activities such as vote rigging or web scraping, affecting fairness and data security. The more abnormal the user's operation, the more likely it is to be abnormal.

[0107] According to one embodiment of the present invention, This indicates an anomaly in the user's behavior sequence. When a user's behavior sequence is abnormal, it may indicate a security threat or malicious attack. A value of 1 indicates more abnormal user behavior, and vice versa. The value is 0. This is the ratio of user request frequency to an abnormal request frequency threshold. The higher the ratio, the higher the user request frequency, indicating a greater likelihood of denial-of-service attacks, brute-force attacks, malicious web scraping, and data breaches, and more abnormal user behavior. This is the ratio of the frequency of unauthorized operations to the threshold for the frequency of unauthorized operations. The larger this ratio is, the higher the frequency of unauthorized operations, the greater the possibility of proactive attacks, malicious exploitation, and abuse of business logic, and the more abnormal the user's operations are.

[0108] According to one embodiment of the present invention, This indicates that the user operation anomaly coefficient is determined based on four aspects: user request interval, user behavior sequence, user request frequency, and unauthorized operation frequency.

[0109] In this way, the user operation anomaly coefficient can be determined based on the abnormal results of user behavior sequence, user request interval, user request frequency, unauthorized operation frequency, abnormal request frequency threshold, and unauthorized operation frequency threshold. During the calculation process, the user operation anomaly can be evaluated from four aspects: abnormal user request interval, abnormal user behavior sequence, abnormal user request frequency, and abnormal unauthorized operation frequency, thereby determining the user operation anomaly coefficient and improving the comprehensiveness and accuracy of the user operation anomaly coefficient.

[0110] According to an embodiment of the present invention, in step S5, if the user is not a new user, a user behavior anomaly coefficient is determined based on the user login information, the user operation data, and the user historical data.

[0111] Figure 3 An exemplary diagram illustrating the determination of user behavior anomaly coefficients when the user is not a new user, according to an embodiment of the present invention.

[0112] According to an embodiment of the present invention, step S5 includes:

[0113] Step S51: Determine the first user behavior anomaly coefficient based on the user login information and the user operation data;

[0114] Step S52: Determine the second user behavior anomaly coefficient based on the user login information, the user operation data, and the user historical data;

[0115] Step S53: If the user is not a new user, determine the user behavior anomaly coefficient based on the first user behavior anomaly coefficient and the second user behavior anomaly coefficient.

[0116] For example, based on user login information and user operation data, a first user behavior anomaly coefficient is determined. The method for determining the first user behavior anomaly coefficient is similar to that for users who are new users, and will not be repeated here. Based on user login information, user operation data, and user historical data, the abnormality of user behavior is assessed, and a second user behavior anomaly coefficient is determined. If the user is not a new user, the user behavior anomaly coefficient is determined based on the first and second user behavior anomaly coefficients.

[0117] According to an embodiment of the present invention, step S53 includes:

[0118] Step S531: Based on the user's historical data, determine the historical login device, historical login location, historical login IP, historical API call frequency, historical API call percentage, historical read / write ratio, and historical request error rate.

[0119] Step S532: Based on the user operation data, determine the user's API call frequency, user's API call percentage, user read / write ratio, and user request error rate.

[0120] Step S533: Determine the commonly used login IP identification result based on the historical login IP and the user login IP;

[0121] Step S534: Determine the commonly used login device identification result based on the historical login devices and the user login devices;

[0122] Step S535: Determine the frequently used login location identification result based on the historical login location and the user login location;

[0123] Step S536: Using the trained user anomaly identification model, determine the probability of user anomaly detection based on the identification results of the commonly used login IP, the commonly used login device, the commonly used login location, the historical API call frequency, the historical API call percentage, the historical read / write ratio, the historical request error rate, the user API call frequency, the user API call percentage, the user read / write ratio, and the user request error rate.

[0124] Step S537: Determine the second user behavior anomaly coefficient based on the user anomaly detection probability.

[0125] For example, based on the user's historical data acquired during the historical identification period, the following can be determined: historical login device, historical login location, historical login IP, historical API call frequency (call frequency of a single API), historical API call percentage (call percentage of a single API), historical read / write ratio, and historical request error rate. Based on user operation data, the following can be determined for the current identification period: user API call frequency, user API call percentage, user read / write ratio, and user request error rate. Based on the historical login IP and the user's login IP, a frequently used login IP identification result can be determined. If the user's login IP is a frequently used login IP, the frequently used login IP identification result is 1; otherwise, it is 0. Similarly, based on the historical login device and the user's login device, a frequently used login device identification result can be determined. For example, based on the historical login device, a frequently used login device identification result can be determined. If the user's login device is a frequently used login device, the frequently used login device identification result is 1; otherwise, it is 0. The result is 0. Based on historical login locations and user login locations, the frequently used login location identification result is determined. For example, if the user login location is a frequently used login location, the frequently used login location identification result is 1; otherwise, it is 0. The user anomaly identification model is a type of neural network model, including: a data preprocessing and input layer, a feature extraction layer, a feature fusion layer, and a decision and output layer. The user anomaly identification model is trained using historical data to output the user anomaly detection probability. The trained user anomaly identification model is used to determine the user anomaly detection probability based on the frequently used login IP identification result, frequently used login device identification result, frequently used login location identification result, historical API call frequency, historical API call percentage, historical read / write ratio, historical request error rate, user API call frequency, user API call percentage, user read / write ratio, and user request error rate. The second user behavior anomaly coefficient is determined by multiplying the user anomaly detection probability by 6.

[0126] According to an embodiment of the present invention, the training steps of the user anomaly detection model include:

[0127] The system acquires sample user operation data and sample user historical data from multiple training users across multiple historical recognition periods. The sample user operation data includes: sample login device, sample login location, sample login IP, sample API call frequency, sample API call percentage, sample read / write ratio, and sample request error rate. The sample user historical data includes: sample historical login device, sample historical login location, sample historical login IP, sample historical API call frequency, sample historical API call percentage, sample historical read / write ratio, and sample historical request error rate.

[0128] Based on the sample login device, the sample login location, the sample login IP, the sample historical login device, the sample historical login location, and the sample historical login IP, determine the sample commonly used login IP identification result, the sample commonly used login device identification result, and the sample commonly used login location identification result;

[0129] The user anomaly detection model is used to process the commonly used login IP identification results, the commonly used login device identification results, the commonly used login location identification results, the user operation data, and the user historical data to obtain the user anomaly detection probability.

[0130] Obtain the actual historical anomaly detection results of multiple sample training users;

[0131] Based on the sample user anomaly detection probability, the actual historical anomaly detection results, the sample commonly used login IP identification results, the sample commonly used login device identification results, the sample commonly used login location identification results, the sample user operation data, and the sample user historical data, determine the training loss function of the user anomaly identification model;

[0132] The user anomaly detection model is trained using the training loss function of the user anomaly detection model to obtain a trained user anomaly detection model.

[0133] For example, acquire sample user operation data from multiple training users (those detected to have engaged in API anomaly access and those not detected) during a historical identification period, as well as historical user data from before the historical identification period. Based on the sample login device, sample login location, sample login IP, sample historical login device, sample historical login location, and sample historical login IP, determine the sample's frequently used login IP identification results, sample's frequently used login device identification results, and sample's frequently used login location identification results. The methods for determining these results are similar to those for determining the frequently used login IP identification results, frequently used login device identification results, and frequently used login location identification results, and will not be elaborated further here. Then, use the user anomaly identification model to analyze the sample's frequently used login IP identification results, sample's frequently used login device identification results, sample's frequently used login location identification results, and sample user operation data. The system processes the sample user data and historical data to obtain the anomaly detection probability of the sample user. It then obtains the actual historical anomaly detection results of multiple sample training users. For example, if the first sample training user is detected to have abnormal API access in the first historical identification period, the actual historical anomaly detection result for the first sample training user in the first historical identification period is 1; otherwise, the actual historical anomaly detection result for the first sample training user in the first historical identification period is 0. Based on the sample user anomaly detection probability, actual historical anomaly detection results, commonly used login IP identification results, commonly used login device identification results, commonly used login location identification results, sample user operation data, and sample user historical data, the system determines the training loss function of the user anomaly identification model. Finally, it trains the user anomaly identification model based on the training loss function to improve the model's accuracy in identifying abnormal API access, thus obtaining the trained user anomaly identification model.

[0134] According to an embodiment of the present invention, the training loss function of the user anomaly detection model is determined based on the sample user anomaly detection probability, the actual historical anomaly detection result, the sample commonly used login IP identification result, the sample commonly used login device identification result, the sample commonly used login location identification result, the sample user operation data, and the sample user historical data, including: determining the training loss function of the user anomaly detection model according to formula (2). , (2)

[0135] in, For the k-th sample, train the sample read / write ratio of the user in the i-th historical recognition period. The sample history read / write ratio of the training user for the k-th sample. To train the sample request error rate of the user in the i-th historical recognition period for the k-th sample, The error rate of the sample history request for the user training the k-th sample. Let the probability of anomaly detection for the user in the i-th historical recognition period be the training probability for the user in the k-th sample. For the k-th sample, train the user's actual historical anomaly detection results in the i-th historical recognition period. , To identify the commonly used login IPs of the user in the i-th historical identification period for the k-th sample, , For the k-th sample, the commonly used login device recognition results of the user in the i-th historical recognition period are used for training.

[0136] , To identify the frequently used login locations of the user in the i-th historical identification period for the k-th sample,

[0137] , For the k-th sample, train the user's API call frequency for the j-th important API during the i-th historical recognition period. For the k-th sample, train the historical API call frequency of users to the j-th important API. For the k-th sample, the percentage of API calls made by the user to the j-th important API during the i-th historical recognition period is used as the training sample. Let K be the percentage of historical API calls made by the training user of the k-th sample to the j-th important API in the i-th historical recognition period. K is the number of training users, k≤K, n is the number of historical recognition periods, i≤n, m is the number of important APIs, j≤m, and k, K, i, n, j and m are all positive integers.

[0138] According to one embodiment of the present invention, This represents the frequently used login IP identification results of the training user for the k-th sample in the i-th historical identification period. When the login IP of the training user for the k-th sample in the i-th historical identification period is not a frequently used IP, it indicates a potential risk of account theft and a certain security threat. It is 0, otherwise, =1, The training sample for the k-th user is used to identify the commonly used login devices in the i-th historical identification period. When the login device of the training sample for the k-th user in the i-th historical identification period is not among the commonly used login devices, it indicates that an attacker may have obtained the user's account credentials through data leakage, phishing, credential stuffing, etc., and successfully logged in on their own device, posing a certain security threat. If it is 0, then... =1, This represents the frequently used login locations identified by the training user for the k-th sample during the i-th historical identification period. When the login location of the training user for the k-th sample during the i-th historical identification period is not among the frequently used login locations, it indicates a potential risk of account theft and a certain security threat. If it is 0, then... =1, This represents the normal login status of the k-th training user in the ith historical recognition period. The larger the value, the more normal the login status.

[0139] According to one embodiment of the present invention, This is the relative difference between the sample API call frequency of the k-th training user in the i-th historical recognition period and the sample historical API call frequency of the k-th training user for the j-th important API. The larger this ratio, the greater the difference between the sample API call frequency and the sample historical API call frequency. Important APIs include: "Query", "Add Payment Account", "Withdraw", etc. This is the relative difference between the percentage of sample API calls made by the user training the k-th sample to the j-th important API during the i-th historical recognition period and the percentage of historical API calls made by the user training the k-th sample to the j-th important API during the i-th historical recognition period. The larger this ratio, the greater the difference between the percentage of sample API calls and the percentage of historical API calls made. This represents the difference between the k-th sample training user's historical habits regarding the j-th important API in terms of call frequency and call percentage during the i-th historical recognition period, and those of the same sample training user. This represents the difference between the k-th sample training user and the historical habits of that sample training user in the ith historical recognition period regarding the frequency and percentage of calls to all important APIs. The larger the size, the greater the difference.

[0140] According to one embodiment of the present invention, This represents the relative difference between the sample read / write ratio of the training user with the k-th sample in the i-th historical recognition period and the historical read / write ratio of the training user with the k-th sample. The larger this ratio, the greater the difference between the sample read / write ratio and the historical read / write ratio. The ratio of the sample request error rate of the user training the k-th sample in the i-th historical recognition period to the sample historical request error rate of the user training the k-th sample is the larger the ratio is, the larger the sample request error rate is.

[0141] According to one embodiment of the present invention, This indicates the differences between the sample training users' historical habits regarding the frequency and percentage of calls to important APIs and those of the sample training users; the differences between the sample read / write ratio and the historical read / write ratio; and a positive correlation between the sample request error rate and the probability of anomaly detection for the sample users. Conversely, a negative correlation exists between the normal login status of the sample training users and the probability of anomaly detection for the sample users. For example, The larger the value, the more normal the login status of the sample training users, the lower the possibility of account theft, the lower the possibility of abnormal access to the application API, and the lower the probability of abnormal detection of sample users. The larger the value, the greater the difference between the sample training user's historical habits regarding the frequency and percentage of calls to important APIs and those of the sample training user. This indicates that the user may be engaging in malicious activities such as data scraping, brute-force attacks, fraudulent transactions, or data leaks, and the higher the probability of anomaly detection for the sample user. The larger the value, the greater the difference between the sample read / write ratio and the historical read / write ratio. When the "write" operation ratio increases significantly, users shift from passive viewing to active modification, potentially attempting to disrupt the system, commit fraud, or abuse resources. When the "read" operation ratio increases significantly, it indicates that user behavior has shifted from interactive use to greedy data acquisition, possibly spying on or stealing data. The higher the probability of anomaly detection for sample users, the greater the likelihood of anomalies. The larger the value, the higher the sample request error rate, indicating a greater likelihood of credential stuffing attacks, brute-force attacks, or API abuse, and a higher probability of detecting abnormal user behavior. Therefore, terms related to the normal login status of sample training users are placed in the denominator, representing... The larger the value, the lower the probability of anomaly detection for the sample user. The differences between the sample training user's call frequency and percentage for important APIs and the historical habits of that sample training user, the differences between the sample read / write ratio and the historical read / write ratio, and the sample request error rate are placed in the numerator, representing... , , The larger the value, the greater the probability of anomaly detection for the sample user.

[0142] According to one embodiment of the present invention, The error between the anomaly detection probability of the training user for the k-th sample in the i-th historical recognition period and the actual historical anomaly detection result is used. The training loss function is obtained by weighted averaging the error between the sample user anomaly detection probability and the actual historical anomaly detection result for the k-th training user in the i-th historical recognition period. During training, the training loss function is reduced, thereby reducing the error between the sample user anomaly detection probability and the actual historical anomaly detection result, improving the detection accuracy of the user anomaly identification model for API anomaly access, and thus enhancing the overall accuracy of the user anomaly identification model.

[0143] In this way, the training loss function of the user anomaly detection model can be determined based on the sample user anomaly detection probability, actual historical anomaly detection results, sample commonly used login IP identification results, sample commonly used login device identification results, sample commonly used login location identification results, sample user operation data, and sample user historical data. During the calculation process, the impact of the above data on the error of the sample user anomaly detection probability can be determined based on the possible influence of the user's operation status and login status on the occurrence of API anomaly detection. Based on this influence and the error of the sample user anomaly detection probability, the training loss function can be set, so that the training loss function is reduced during the training process of the user anomaly detection model, and the accuracy of the user anomaly detection model can be improved more effectively.

[0144] According to an embodiment of the present invention, in step S6, it is determined whether there is abnormal access to the application API based on the user behavior anomaly coefficient.

[0145] For example, if the user behavior anomaly coefficient is greater than 5, it indicates that there is abnormal access to the application API.

[0146] The application API abnormal access identification method based on user big data according to embodiments of the present invention can determine whether a user is a new user based on the user's registration time. If the user is a new user, the method assesses whether the user has abnormal API access based on the user's login information and user operation data. If the user is not a new user, the method assesses whether the user has abnormal API access based on the user's login information, user operation data, and user historical data, thereby improving the accuracy of application API abnormal access identification. When determining the user operation abnormality coefficient, the method can be based on abnormal results of user behavior sequences, user request intervals, user request frequencies, unauthorized operation frequencies, abnormal request frequency thresholds, and unauthorized operation frequency thresholds. During the calculation process, the user operation abnormality can be evaluated from four aspects: abnormal user request intervals, abnormal user behavior sequences, abnormal user request frequencies, and abnormal unauthorized operation frequencies, thereby determining the user operation abnormality coefficient and improving its comprehensiveness and accuracy. When determining the training loss function of the user anomaly detection model, it can be based on the sample user anomaly detection probability, actual historical anomaly detection results, sample commonly used login IP identification results, sample commonly used login device identification results, sample commonly used login location identification results, sample user operation data, and sample user historical data. During the calculation process, the impact of the above data on the error of the sample user anomaly detection probability can be determined based on the possible influence of the user's operation status and login status on the occurrence of API anomaly detection. Based on this influence and the error of the sample user anomaly detection probability, the training loss function can be set to reduce the training loss function during the training process, thereby more effectively improving the accuracy of the user anomaly detection model.

[0147] Figure 4 An exemplary block diagram of an application API anomaly access identification system based on user big data according to an embodiment of the present invention is shown, the system comprising:

[0148] The user information module is used to obtain the user's login information, user registration time, and user historical data. The user login information includes: user login location, user login IP, and user login device.

[0149] The real-time data module is used to acquire user operation data during the recognition period;

[0150] The user identification module is used to determine whether a user is a new user based on the user's registration time.

[0151] The first anomaly module is used to determine the user behavior anomaly coefficient based on the user login information and the user operation data when the user is a new user.

[0152] The second anomaly module is used to determine the user behavior anomaly coefficient based on the user login information, the user operation data, and the user historical data when the user is not a new user.

[0153] The anomaly detection module is used to determine whether there is any abnormal access to the application API based on the user behavior anomaly coefficient.

[0154] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0155] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are merely examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functions and structural principles of the present invention have been demonstrated and explained in the embodiments, and any variations or modifications may be made to the implementation of the present invention without departing from the stated principles.

Claims

1. A method for identifying abnormal access to application APIs based on user big data, characterized in that, include: The system obtains the user's login information, registration time, and historical data, wherein the login information includes: the user's login location, login IP address, and login device. Acquire user action data during the recognition period; Based on the user's registration time, determine whether the user is a new user; If the user is a new user, determine the user behavior anomaly coefficient based on the user login information and the user operation data; If the user is not a new user, determine the user behavior anomaly coefficient based on the user login information, the user operation data, and the user historical data. Based on the user behavior anomaly coefficient, determine whether there is any abnormal access to the application API; If the user is not a new user, a user behavior anomaly coefficient is determined based on the user login information, the user operation data, and the user historical data, including: Based on the user login information and the user operation data, determine the first user behavior anomaly coefficient; The second user behavior anomaly coefficient is determined based on the user login information, the user operation data, and the user historical data. If the user is not a new user, the user behavior anomaly coefficient is determined based on the first user behavior anomaly coefficient and the second user behavior anomaly coefficient. Based on the user login information, the user operation data, and the user historical data, a second user behavior anomaly coefficient is determined, including: Based on the user's historical data, determine the historical login device, historical login location, historical login IP, historical API call frequency, historical API call percentage, historical read / write ratio, and historical request error rate; Based on the user operation data, determine the user's API call frequency, user's API call percentage, user read / write ratio, and user request error rate. The historical API call frequency is the frequency of a user's call to a single API during the historical identification period, and the historical API call percentage is the percentage of a user's call to a single API during the historical identification period. Based on the historical login IPs and the user login IPs, the commonly used login IP identification results are determined; Based on the historical login devices and the user login devices, the commonly used login device identification result is determined; Based on the historical login locations and the user login locations, the commonly used login location identification results are determined; The trained user anomaly detection model processes the commonly used login IP identification results, the commonly used login device identification results, the commonly used login location identification results, the historical API call frequency, the historical API call percentage, the historical read / write ratio, the historical request error rate, the user API call frequency, the user API call percentage, the user read / write ratio, and the user request error rate to determine the probability of user anomaly detection. The second user behavior anomaly coefficient is determined based on the user anomaly detection probability. The training steps of the user anomaly detection model include: The system acquires sample user operation data and sample user historical data from multiple training users across multiple historical recognition periods. The sample user operation data includes: sample login device, sample login location, sample login IP, sample API call frequency, sample API call percentage, sample read / write ratio, and sample request error rate. The sample user historical data includes: sample historical login device, sample historical login location, sample historical login IP, sample historical API call frequency, sample historical API call percentage, sample historical read / write ratio, and sample historical request error rate. Based on the sample login device, the sample login location, the sample login IP, the sample historical login device, the sample historical login location, and the sample historical login IP, determine the sample commonly used login IP identification result, the sample commonly used login device identification result, and the sample commonly used login location identification result; The user anomaly detection model is used to process the commonly used login IP identification results, the commonly used login device identification results, the commonly used login location identification results, the user operation data, and the user historical data to obtain the user anomaly detection probability. Obtain the actual historical anomaly detection results of multiple sample training users; Based on the sample user anomaly detection probability, the actual historical anomaly detection results, the sample commonly used login IP identification results, the sample commonly used login device identification results, the sample commonly used login location identification results, the sample user operation data, and the sample user historical data, determine the training loss function of the user anomaly identification model; The user anomaly identification model is trained according to the training loss function of the user anomaly identification model to obtain the trained user anomaly identification model. Based on the sample user anomaly detection probability, the actual historical anomaly detection results, the sample's commonly used login IP identification results, the sample's commonly used login device identification results, the sample's commonly used login location identification results, the sample user operation data, and the sample user historical data, the training loss function of the user anomaly detection model is determined, including: according to the formula: Determine the training loss function for the user anomaly detection model. ,in, For the k-th sample, train the sample read / write ratio of the user in the i-th historical recognition period. The sample history read / write ratio of the training user for the k-th sample. To train the sample request error rate of the user in the i-th historical recognition period for the k-th sample, The error rate of the sample history request for the user training the k-th sample. Let the probability of anomaly detection for the user in the i-th historical recognition period be the training probability for the user in the k-th sample. For the k-th sample, train the user's actual historical anomaly detection results in the i-th historical recognition period. , To identify the commonly used login IPs of the user in the i-th historical identification period for the k-th sample, , For the k-th sample, the commonly used login device recognition results of the user in the i-th historical recognition period are used for training. , To identify the frequently used login locations of the user in the i-th historical identification period for the k-th sample, , For the k-th sample, train the user's API call frequency for the j-th important API during the i-th historical recognition period. For the k-th sample, train the historical API call frequency of users to the j-th important API. For the k-th sample, the percentage of API calls made by the user to the j-th important API during the i-th historical recognition period is used as the training sample. Let K be the percentage of historical API calls made by the training user of the k-th sample to the j-th important API in the i-th historical recognition period. K is the number of training users, k≤K, n is the number of historical recognition periods, i≤n, m is the number of important APIs, j≤m, and k, K, i, n, j and m are all positive integers.

2. The method for identifying abnormal access to application APIs based on user big data according to claim 1, characterized in that, When the user is a new user, the user behavior anomaly coefficient is determined based on the user login information and the user operation data, including: Determine the user login anomaly coefficient based on the user login IP and the user login device; Retrieve historical abnormal user operation data for new users with historical anomalies; Based on the historical abnormal user operation data and the user operation data, determine the user operation abnormality coefficient; If the user is a new user, the user behavior anomaly coefficient is determined based on the user login anomaly coefficient and the user operation anomaly coefficient.

3. The method for identifying abnormal access to application APIs based on user big data according to claim 2, characterized in that, Based on the user login IP and the user login device, a user login anomaly coefficient is determined, including: Based on the user's login IP, the malicious IP identification result is determined; Based on the user's login device, determine the login device abnormality result; Based on the malicious IP identification results and the login device anomaly results, the user login anomaly coefficient is determined.

4. The method for identifying abnormal access to application APIs based on user big data according to claim 2, characterized in that, Based on the historical abnormal user operation data and the user operation data, the user operation abnormality coefficient is determined, including: Based on the historical abnormal user operation data, determine the abnormal request frequency threshold and the unauthorized operation frequency threshold; Based on the user operation data, determine the user behavior sequence, user request interval, user request frequency, and unauthorized operation frequency; Based on the user behavior sequence, determine the abnormal results of the user behavior sequence; The user operation anomaly coefficient is determined based on the abnormal results of the user behavior sequence, the user request interval, the user request frequency, the unauthorized operation frequency, the abnormal request frequency threshold, and the unauthorized operation frequency threshold.

5. The method for identifying abnormal access to application APIs based on user big data according to claim 4, characterized in that, Based on the abnormal results of the user behavior sequence, the user request interval, the user request frequency, the unauthorized operation frequency, the abnormal request frequency threshold, and the unauthorized operation frequency threshold, the user operation abnormality coefficient is determined, including: according to the formula: Determine the coefficient of user operation anomaly Where, if is a conditional function, The interval between the r-th request and the (r-1)-th request is the user request interval. The interval between the (r+1)th request and the rth request is... For abnormal results of user behavior sequences, , For user request frequency, This is a threshold for the frequency of abnormal requests. For unauthorized operation frequency, R is the threshold for the frequency of unauthorized operations, where R is the number of user requests, R is greater than 1, r ≤ R, and both r and R are positive integers.

6. A system for identifying abnormal access to application APIs based on user big data, used to execute the method according to any one of claims 1-5, characterized in that, include: The user information module is used to obtain the user's login information, user registration time, and user historical data. The user login information includes: user login location, user login IP, and user login device. The real-time data module is used to acquire user operation data during the recognition period; The user identification module is used to determine whether a user is a new user based on the user's registration time. The first anomaly module is used to determine the user behavior anomaly coefficient based on the user login information and the user operation data when the user is a new user. The second anomaly module is used to determine the user behavior anomaly coefficient based on the user login information, the user operation data, and the user historical data when the user is not a new user. The anomaly detection module is used to determine whether there is any abnormal access to the application API based on the user behavior anomaly coefficient.

Images