API encryption parameter tampering real-time detection method and system based on deep learning

Abstract

The invention provides an API encryption parameter tampering real-time detection method and system based on deep learning, and the method comprises the steps: obtaining an API call record in real time, and extracting an API encryption parameter in the API call record; digitalizing the API encryption parameters character by character by using a dynamic character mapping table to obtain a discrete numerical sequence; the discrete numerical value sequence is input into a pre-trained CNN-LSTM detection model for space-time fusion feature extraction, tampering attack real-time detection of API encryption parameters is carried out based on space-time fusion features, a detection result is output, the detection result comprises whether the API call record is abnormal or not and the abnormal probability, and if yes, the API call record is detected to be abnormal. According to the method, the characteristics of the encrypted characters can be captured under the API parameter encryption scene to carry out tampering attack real-time detection, the problem of complete failure caused by parameter semantic loss in a traditional rule detection method is solved, and the security of a network interface is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for real-time detection of API encryption parameter tampering based on deep learning. Background Technology

[0002] APIs (Application Programming Interfaces) have always played a crucial role as channels for data interaction between programs. Modern application development often reserves numerous predefined interfaces to improve the program's scalability and compatibility. Especially in microservice architectures, each application is subdivided as much as possible, so they need APIs to interact with each other. However, this also creates a problem: the explosive growth in the number of APIs. This explosive growth makes it difficult to fully monitor the security risks faced by APIs.

[0003] When a business system provides services via a plaintext API, the parameters in that API can be directly read, and the caller can directly modify the API parameters to construct new calls that conform to the API rules, easily implementing rich functionality. However, APIs that provide services in plaintext also face significant security risks. For example, attackers can construct malicious parameters based on the semantic information in the obtained API parameters and parameter names to achieve malicious purposes, thereby enabling attacks such as tampering with the business system and stealing data.

[0004] To enhance API security, some high-security or privately accessible APIs will use encrypted parameters. API designers can pre-agree on a key with the caller and then use the same symmetric encryption algorithm when constructing the API URL (Uniform Resource Locator), employing the same key for both encryption and decryption. The encrypted parameters completely lose their semantic information, making the information in the string incomprehensible to humans. This prevents attackers from tampering with the parameters to compromise the business system. Even if an attacker tampers with the parameters, the server, using the pre-agreed decryption method, will be unable to decrypt usable parameters conforming to API rules, thus failing the attack and protecting the system.

[0005] Among the existing detection technologies for parameter tampering attacks on APIs, there are still relatively few schemes for encrypted parameter risk identification, and most of them are through switching keys after the risk problem occurs for defense. However, switching keys will cause the original key to be invalid, so that the original normal caller cannot use the service, and re-distributing the key not only makes it difficult to ensure the absolute security of the key during the distribution process, but also greatly affects the normal operation of the business due to frequent key switching.

[0006] Further, the existing scheme attempts to implement signature and verification through asymmetric encryption based on encrypted parameters, that is, the caller is required to attach an authentication signed by its own private key when initiating a call, and the service party verifies the request with the public key of the caller after receiving the request to ensure that the request is indeed initiated by the caller. However, at this time, the private key of the caller may be leaked as the key for parameter encryption, so the attacker can implement the attack by simultaneously forging the signature and the encrypted parameter.

[0007] The existing scheme cannot cope with malicious calls to APIs under encrypted parameters, and the methods used are mostly remedies for errors after the risk occurs, and cannot identify security risks in real time. SUMMARY

[0008] To solve the problem that the existing method cannot effectively detect security risks under the condition of API parameter encryption, so that malicious parameters can more easily bypass the system's protection mechanism, the present application proposes an API encrypted parameter tampering real-time detection method based on deep learning, comprising:

[0009] Real-time acquisition of API call records, and extraction of API encrypted parameters in the API call records;

[0010] Digitizing the API encrypted parameters character by character using a dynamic character mapping table to obtain a discrete numerical sequence;

[0011] Inputting the discrete numerical sequence into a pre-trained CNN-LSTM detection model for spatio-temporal fusion feature extraction, and performing real-time detection of API encrypted parameter tampering attacks based on the spatio-temporal fusion features, and outputting a detection result, the detection result including whether the API call record is abnormal and the abnormal probability.

[0012] Optionally, the discrete numerical sequence is inputted into a pre-trained CNN-LSTM detection model for spatio-temporal fusion feature extraction, and real-time detection of API encrypted parameter tampering attacks is performed based on the spatio-temporal fusion features, and a detection result is outputted, comprising:

[0013] inputting the discrete numerical sequence into a pre-trained CNN-LSTM detection model, performing vector representation on the discrete numerical sequence based on a character embedding layer in the CNN-LSTM detection model, denoted as an encrypted parameter vector;

[0014] performing local spatial feature extraction on the encrypted parameter vector based on a convolution layer in the CNN-LSTM detection model, obtaining a local spatial feature, and performing nonlinear activation and maximum pooling on the local spatial feature to obtain an enhanced local spatial feature;

[0015] further performing time sequence feature extraction on the enhanced local spatial feature based on a long short-term memory layer in the CNN-LSTM detection model to obtain a spatio-temporal fusion feature of the encrypted parameter vector;

[0016] performing dimension reduction integration and nonlinear mapping on the spatio-temporal fusion feature based on a fully connected layer in the CNN-LSTM detection model to output a detection result.

[0017] Optionally, the CNN-LSTM detection model is pre-trained in the following manner:

[0018] obtaining a historical API call record set, the API call record set including a plurality of API call record samples and a true label of whether each API call record sample is abnormal;

[0019] digitizing API encryption parameters in each API call record sample to obtain a discrete numerical sequence sample;

[0020] inputting each discrete numerical sequence sample into an initial CNN-LSTM detection model to obtain an output result, and calculating a loss function based on the output result of each discrete numerical sequence sample and the corresponding true label;

[0021] using a gradient descent algorithm to propagate the gradient back layer by layer according to the loss function, dynamically adjusting the optimizable parameters in the initial CNN-LSTM detection model to obtain a CNN-LSTM detection model that has completed learning and training.

[0022] Optionally, before inputting the discrete numerical sequence into the pre-trained CNN-LSTM detection model for spatio-temporal fusion feature extraction, the method further includes:

[0023] dynamically allocating a length threshold of the discrete numerical sequence based on the corresponding API type of the discrete numerical sequence;

[0024] filling or truncating the discrete numerical sequence based on the length threshold to obtain the discrete numerical sequence with a unified dimension.

[0025] Optionally, the real-time acquisition API call record comprises:

[0026] The distributed log collection cluster captures the API call record in real time through the log agent deployed in the API gateway layer.

[0027] Optionally, after the real-time detection of the tampering attack on the API encryption parameter based on the spatio-temporal fusion feature and the output of the detection result, a three-level real-time response mechanism is started based on the detection result:

[0028] When the abnormal probability in the detection result is greater than the freezing threshold, the calling request corresponding to the API call record is immediately blocked and the calling account is frozen;

[0029] When the abnormal probability in the detection result is greater than the review threshold and is not greater than the freezing threshold, the API flow is limited and the API call record is reviewed;

[0030] When the abnormal probability in the detection result is not greater than the review threshold, the API call record is released.

[0031] Optionally, after the real-time detection of the tampering attack on the API encryption parameter based on the spatio-temporal fusion feature and the output of the detection result, the following steps are further included:

[0032] If the abnormal probability in the detection result is greater than the archiving threshold, the API encryption parameter in the API call record, the abnormal probability and the response action are archived to obtain archiving data;

[0033] The archiving data is used as training data to optimize the parameters of the CNN-LSTM detection model.

[0034] Optionally, the following steps are further included:

[0035] Interval pre-set training time period, adopt API call record sample of automatic labeling as training data, train and optimize the CNN-LSTM detection model, and the CNN-LSTM detection model completed training and optimization is used for real-time detection of tampering attack on API encryption parameter next time;

[0036] Interval pre-set reinforcement time period, obtain a large number of completed abnormal call records as adversarial samples, simulate different attack modes through the adversarial samples, and reinforce train the CNN-LSTM detection model, and the CNN-LSTM detection model completed reinforcement training is used for real-time detection of tampering attack on API encryption parameter next time.

[0037] Based on the same inventive concept, the application proposes a deep learning-based API encryption parameter tampering real-time detection system, comprising:

[0038] a data acquisition module, configured to acquire API call records in real time and extract API encryption parameters in the API call records;

[0039] a format conversion module, configured to digitize the API encryption parameters by character using a dynamic character mapping table to obtain a discrete numerical sequence;

[0040] a real-time detection module, configured to input the discrete numerical sequence into a pre-trained CNN-LSTM detection model to perform spatio-temporal fusion feature extraction, perform real-time detection of tampering attacks on the API encryption parameters based on the spatio-temporal fusion features, and output a detection result, the detection result including whether the API call records are abnormal and an abnormal probability.

[0041] Optionally, the real-time detection module is specifically configured to:

[0042] input the discrete numerical sequence into the pre-trained CNN-LSTM detection model, perform vector representation on the discrete numerical sequence based on a character embedding layer in the CNN-LSTM detection model, and denote the vector representation as an encryption parameter vector;

[0043] perform local spatial feature extraction on the encryption parameter vector based on a convolution layer in the CNN-LSTM detection model to obtain local spatial features, and perform nonlinear activation and maximum pooling on the local spatial features to obtain enhanced local spatial features;

[0044] further perform time series feature extraction on the enhanced local spatial features based on a long short-term memory layer in the CNN-LSTM detection model to obtain spatio-temporal fusion features of the encryption parameter vector;

[0045] perform dimension reduction integration and nonlinear mapping on the spatio-temporal fusion features based on a fully connected layer in the CNN-LSTM detection model to output the detection result.

[0046] Optionally, the system further includes a model training module, configured to:

[0047] acquire a historical API call record set, the API call record set including a plurality of API call record samples and real labels of whether each API call record sample is abnormal;

[0048] digitize API encryption parameters in each API call record sample to obtain a discrete numerical sequence sample;

[0049] input each discrete numerical sequence sample into an initial CNN-LSTM detection model to obtain an output result, and calculate a loss function based on the output result of each discrete numerical sequence sample and a corresponding real label;

[0050] The gradient descent algorithm is adopted to propagate the gradient back layer by layer according to a loss function, and the optimizable parameters in the initial CNN-LSTM detection model are dynamically adjusted to obtain a CNN-LSTM detection model after learning and training.

[0051] Optionally, the system further comprises a dimension unification module configured to:

[0052] The length threshold of the discrete numerical sequence is dynamically allocated based on the API type corresponding to the discrete numerical sequence.

[0053] The discrete numerical sequence is adaptively padded or truncated based on the length threshold to obtain the discrete numerical sequence with unified dimensions.

[0054] Optionally, the data acquisition module is specifically configured to:

[0055] The distributed log collection cluster is used to capture API call records in real time through a log agent deployed in the API gateway layer.

[0056] Optionally, the system further comprises a response mechanism module configured to:

[0057] When the anomaly probability in the detection result is greater than a freezing threshold, the calling request corresponding to the API call record is immediately blocked, and the calling party account is frozen;

[0058] When the anomaly probability in the detection result is greater than a review threshold and not greater than the freezing threshold, API flow limiting is triggered, and the API call record is reviewed;

[0059] When the anomaly probability in the detection result is not greater than the review threshold, the API call record is released.

[0060] Optionally, the model training module is further configured to:

[0061] If the anomaly probability in the detection result is greater than an archiving threshold, the API encryption parameter in the API call record, the anomaly probability, and the response action are archived to obtain archiving data;

[0062] The archiving data is used for parameter optimization of the CNN-LSTM detection model.

[0063] Optionally, the model training module is further configured to:

[0064] The CNN-LSTM detection model is trained and optimized by using the API call record samples with automatic labeling as training data at intervals of a preset training period, and the CNN-LSTM detection model after training and optimization is used for real-time detection of tampering attacks on API encryption parameters in the next time.

[0065] The abnormal calling record with completed labeling is obtained as an adversarial sample at a preset reinforcement time interval, the CNN-LSTM detection model is reinforced by simulating different attack modes through the adversarial sample, and the CNN-LSTM detection model after reinforcement is used for real-time detection of tampering attacks on API encryption parameters.

[0066] In another aspect, the application further provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected through a bus;

[0067] The memory is used for storing one or more programs.

[0068] When the one or more programs are executed by the at least one processor, the deep learning-based API encryption parameter tampering real-time detection method is realized.

[0069] In another aspect, the application further provides a computer readable storage medium, which has an execution program stored thereon, and the execution program, when executed, realizes the deep learning-based API encryption parameter tampering real-time detection method.

[0070] Compared with the closest prior art, the application has the following beneficial effects:

[0071] The deep learning-based API encryption parameter tampering real-time detection method and system provided by the application comprises the following steps: acquiring API calling records in real time, and extracting API encryption parameters in the API calling records; using a dynamic character mapping table to digitize the API encryption parameters character by character to obtain a discrete numerical sequence; inputting the discrete numerical sequence into a pre-trained CNN-LSTM detection model to extract spatio-temporal fusion features, and performing real-time detection of tampering attacks on API encryption parameters based on the spatio-temporal fusion features, and outputting a detection result, wherein the detection result comprises whether the API calling record is abnormal and an abnormal probability; in the scheme, the encrypted text is converted into a format that can be processed by the model through digitization, in the CNN-LSTM detection model that has been pre-trained and learned, local spatial features are extracted through a CNN convolution layer, time sequence features are analyzed through an LSTM layer, and a double-path collaborative mechanism of spatio-temporal fusion features can realize deep detection, that is, real-time detection of tampering attacks in the API parameter encryption scenario, and the problems of complete failure of a traditional rule detection method due to loss of parameter semantics and lag of a post-defense mechanism are solved; since the model detects abnormalities by capturing features of API encryption parameters, and does not rely on specific encryption logic, the model has universality for different API encryption and coding methods, and the initiative and accuracy of network interface security protection are improved. BRIEF DESCRIPTION OF DRAWINGS

[0072] Figure 1 A flowchart of the API encryption parameter tampering real-time detection method based on deep learning provided by the present application is shown in the figure.

[0073] Figure 2 A structural diagram of the CNN-LSTM detection model provided by the present application is shown in the figure.

[0074] Figure 3 A structural diagram of the API encryption parameter tampering real-time detection system based on deep learning provided by the present application is shown in the figure.

[0075] Figure 4 A structural diagram of the electronic device provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0076] The specific embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0077] Embodiment 1

[0078] The API encryption parameter tampering real-time detection method based on deep learning provided by the present application is suitable for network interface security protection in parameter encryption scenarios, such as Figure 1 As shown in the figure, it comprises:

[0079] S1, real-time acquisition of API call records, and extraction of API encryption parameters in the API call records;

[0080] S2, using a dynamic character mapping table to digitize the API encryption parameters character by character to obtain a discrete numerical sequence;

[0081] S3, inputting the discrete numerical sequence into a pre-trained CNN-LSTM detection model for spatio-temporal fusion feature extraction, and performing real-time detection of API encryption parameter tampering attacks based on the spatio-temporal fusion features, and outputting a detection result, wherein the detection result comprises whether the API call record is abnormal and an abnormal probability.

[0082] In step S1, S1-1, using a distributed log collection cluster to capture API call records in real time through a log agent deployed in the API gateway layer.

[0083] The distributed log collection cluster uses Fluentd+Kafka, Fluentd is an open source log collector responsible for real-time log data collection from the API gateway, supports multiple input and output plugins, Kafka is a high-throughput distributed message queue, as a log transfer storage, provides buffering and asynchronous processing capabilities, ensures that massive logs are not lost and can be consumed by downstream systems on demand. Through the distributed log collection cluster (Fluentd+Kafka), real-time API traffic, i.e., API call records, is captured. The distributed architecture supports horizontal expansion, allowing efficient collection of massive API call records, supporting 120,000 requests per second, meeting the real-time needs of high-throughput scenarios, and avoiding data backlog.

[0084] S1-2, in this embodiment, it is assumed that only the parameter part in the API call record is encrypted, i.e., the URL and parameter name are still in plaintext, therefore, the parameter part involved in the API call is first extracted. Because the API design follows the corresponding rules, although the parameter part is a string without semantics, different parameters and parameter names can still be separated by rule matching.

[0085] For example, in voltage=ENC(xaZSx++GC...), the encrypted parameter is extracted using the field extraction technique according to the API design rules, where voltage is the parameter name, ENC(xaZSx++GC...) is the parameter value, ENC() indicates that the content has been encrypted, and xaZSx++GC... is the encrypted ciphertext string, i.e., the API encrypted parameter in the API call record, avoiding key management risks.

[0086] In step S2, the API encrypted parameter is digitized character by character using a dynamic character mapping table to obtain a discrete numerical sequence.

[0087] Because the neural network cannot directly process text data, all discrete strings in the set need to be digitized and converted, i.e., any character that may appear is converted to a unique number through a mapping table, such as converting a to 1, b to 2, and c to 3.

[0088] In this embodiment, a 128-dimensional dynamic character mapping table is used to digitize the API encrypted parameter (Base64 / AES ciphertext, Base64 / AES ciphertext refers to first encrypting the original data using the AES algorithm, and then encoding the encrypted binary data as a Base64 string) character by character (e.g., xaZ=→[24,1,52,28], where xaZ represents the encrypted parameter), forming a numerical sequence that the model can process.

[0089] In step S3, the discrete numerical sequence is input into a pre-trained CNN-LSTM detection model for spatio-temporal fusion feature extraction, and based on the spatio-temporal fusion features, real-time detection of tampering attacks on API encryption parameters is performed, and a detection result is output.

[0090] Before performing real-time detection of tampering attacks, a CNN-LSTM (Convolutional Neural Network-Long Short-Term Memory) detection model is pre-trained.

[0091] The CNN-LSTM detection model is a supervised learning model that can realize end-to-end feature extraction and feature learning of a large number of malicious parameters and normal parameters. In a neural network model, the optimization process is divided into two stages: a forward propagation stage, in which the neural network model calculates the predicted value forwardly, and a loss function is calculated based on the predicted value and the target value; and a backward propagation stage, in which the idea of gradient descent is adopted, the gradient of each optimizable parameter is calculated through the loss function, and the learning rate is used for parameter updating, so as to achieve the purpose of optimizing the model. In the optimization process of the neural network model, appropriate initial values, learning rates, and iteration numbers are selected to further adjust the prediction ability of the model. At the same time, attention should also be paid to the influence of the overfitting problem on the prediction ability of the model - when the model enters the overfitting state, the expression ability of the model will be limited in the training data, which is not conducive to the generalization prediction ability of the model. The model will determine whether the current parameter is a malicious parameter according to the distribution difference between the normal parameters and the abnormal parameters learned in advance.

[0092] Therefore, the CNN-LSTM detection model is pre-trained in the following manner:

[0093] (1) Obtain a historical API call record set, the API call record set including a plurality of API call record samples and a true label of whether each API call record sample is abnormal;

[0094] Among them, for the obtained historical API call record set, first, all parameter names and encryption parameter parts are extracted from complete API call record samples including URLs, parameter names and encryption parameters, and the parameter names and encryption parameter parts are grouped and stored according to the URLs.

[0095] Then according to the decrypted parameter information and the corresponding relationship with the URL, the type label of each record sample is manually continued, which is labeled as normal call and abnormal call. After the labeling is completed, each data can describe the corresponding relationship between the access record generated by the current call and whether it is an abnormal call, that is, the real label of whether each API call record sample is abnormal is obtained.

[0096] In order to model multiple APIs in one detection model, after labeling, all data is mixed together and randomly shuffled to obtain an encrypted access record set, that is, the final historical API call record set.

[0097] (2) digitizing the API encryption parameters in each API call record sample to obtain a discrete numerical sequence sample;

[0098] (3) inputting each discrete numerical sequence sample into the initial CNN-LSTM detection model to obtain an output result, and calculating a loss function based on the output result of each discrete numerical sequence sample and the corresponding real label;

[0099] Before the discrete numerical sequence sample is input into the detection model, it further includes: batch processing the data, so that the data in the same batch has the same length, and the too short input will be increased in length by filling special characters, while the too long input will be truncated. Using batch data processing will increase the learning stability and learning efficiency of the network, which can better avoid the optimization of the network falling into a local optimum, so that the complete network has better generalization ability, which can better identify the data outside the training set in actual deployment.

[0100] (4) using a gradient descent algorithm to propagate the gradient back layer by layer according to the loss function, dynamically adjusting the optimizable parameters in the initial CNN-LSTM detection model to obtain a CNN-LSTM detection model that has completed learning and training.

[0101] The iteration step can be changed each time, and the gradient descent algorithm can make the model quickly converge to a better local minimum, so that the empirical risk on the data distribution is minimized, thereby realizing accurate classification of data.

[0102] Wherein, the above gradient descent algorithm is based on the following observation: if the real-valued function F(a) is differentiable and defined at point a, then the function F(a) at point a along the opposite direction of the gradient drops at most.

[0103] Therefore, if For γ>0, it is true when a is a small enough value, then F(a)≥F(b), where F(b) represents the function value of the real-valued function at point b, and γ represents the learning rate, represents the gradient of the function at point a.

[0104] In view of this, we can start from the initial estimate x0 of the local minimum of the function F, and consider the following sequence (x0, c1, x2…) such that the following formula is established.

[0105]

[0106] where n represents the total number of parameters in the sequence, and γ n represents the nth parameter x n corresponding to the learning rate, represents the gradient of the nth parameter, x n+1 represents the nth+1 parameter in the sequence, so the following formula can be obtained.

[0107] F(x0)≥F(x1)≥F(x2)≥···

[0108] If the sequence (x0, x1, x2…) converges to the desired local minimum successfully, F(x0), F(x1), and F(x2) represent the function values corresponding to each parameter in the sequence, respectively.

[0109] The above-mentioned optimizable parameters include the convolution kernel weights of the convolution layer, the weights of the input gate, the forget gate, and the output gate in the LSTM layer, and the parameter weights in the output layer of the fully connected layer. Figure 2

[0110] S3-1, before inputting the discrete numerical sequence into the pre-trained CNN-LSTM detection model for spatio-temporal fusion feature extraction, further comprising:

[0111] Based on the API type corresponding to the discrete numerical sequence, dynamically allocating the length threshold of the discrete numerical sequence;

[0112] Based on the length threshold, adaptively padding or truncating the discrete numerical sequence to obtain the discrete numerical sequence of uniform dimension.

[0113] Among them, the system dynamically sets the parameter length threshold according to the API type: the device control interface adopts a 512-character threshold, and the metering and charging interface adopts a 256-character threshold. Adaptive processing is implemented for parameters of different lengths: zero padding is performed at the end of parameters that are less than the threshold (such as padding to 512 bits for 256-character parameters), and the front effective data sequence is retained by truncating the long parameter (such as truncating the first 512 characters).

[0114] ​S3-2, after completing the adaptive batch processing, input the discrete numerical sequence into the pre-trained CNN-LSTM detection model for spatio-temporal fusion feature extraction, and perform real-time detection of tampering attacks on API encryption parameters based on the spatio-temporal fusion features, and output the detection results, as shown in Figure 2

[0115] (a) input the discrete numerical sequence into the pre-trained CNN-LSTM detection model, and based on the character embedding layer in the CNN-LSTM detection model, perform vector representation on the discrete numerical sequence, denoted as an encryption parameter vector.

[0116] The input data is a discrete numerical representation after processing, but traditional neural network models for processing continuous data cannot be directly used in this research problem. Therefore, the input data needs to be vectorized in the data processing step, converting discrete input into differentiable continuous input, and then using traditional neural network calculation and optimization methods to adjust and learn network parameters.

[0117] Because the encrypted API parameters do not contain obvious semantic information, i.e., the text cannot be segmented into words and there is no context relationship, in this research, the characters appearing in the access data are regarded as the smallest processing unit, and each character is vectorized, i.e., a Char-CNN-LSTM (character-level convolutional neural network-long short-term memory network) model is constructed.

[0118] (b) based on the convolution layer in the CNN-LSTM detection model, perform local spatial feature extraction on the encryption parameter vector to obtain local spatial features, and perform nonlinear activation and max pooling on the local spatial features to obtain enhanced local spatial features.

[0119] In this embodiment, a 5x5 convolution kernel is configured to scan the local features of the parameter sequence and accurately capture abnormal character combination patterns, such as the continuous sequence [63, 63, 33] corresponding to the encryption features of SQL (a common network security attack method) injection attacks.

[0120] The convolution unit in the convolution layer can capture the general features of a large range of data within its receptive field, thereby accurately capturing the data distribution. Because the input data in this research is a semantic-free encrypted string, it is more difficult to learn useful information than conventional word-based text forms, so it is necessary to enlarge the receptive field of the network through the convolution unit to enable the network to focus on the encrypted text features in a larger range of input data, thereby achieving more accurate feature learning.

[0121] ​The use of convolutional layers can effectively reduce the impact of human-selected features, which improves the correlation between encrypted text parameters through local perception, weight parameter sharing, data pooling, and other mechanisms, thereby improving the performance of the network. Convolutional neural networks include the following important components: convolutional layers, linear rectification layers, and pooling layers. The convolutional layer is a set of parallel feature maps that are formed by sliding different convolutional kernels over the continuous encrypted parameter feature vectors and performing certain operations. In addition, at each sliding position, the convolutional kernel and the encrypted parameter feature vector perform an element-wise multiplication and summation operation to project the information in the receptive field to an element in the feature map. This sliding process is called stride, which is a factor that controls the size of the output feature map. The size of the convolutional kernel is much smaller than the input image, and it acts on the input image in overlapping or parallel manner. All elements in a feature map are calculated by a convolutional kernel, i.e., a feature map shares the same weights and bias terms. Through convolutional operations, the model can focus on a larger range of encrypted parameter vectors at the same time, thereby extracting more accurate and effective features. The convolutional kernel has the advantages of weight sharing and translation invariance, and it only focuses on local features, with the degree of locality depending on the size of the convolutional kernel. The convolutional kernel should not be too large or too small. If the convolutional kernel is too large, it is not conducive to the increase of model depth, and the computational performance will also be reduced. If the convolutional kernel is too small, the receptive field is smaller, and effective local features may not be extracted.

[0122] The linear rectification layer (Rectified Linear Units layer, ReLU layer) uses the linear rectification function f(x) = max(0, x) as the activation function of this layer of neurons, which represents the output value of the linear rectification function, and represents the value input to the linear rectification function. It can enhance the non-linear characteristics of the decision function and the entire neural network, and itself does not change the convolutional layer. Compared with other functions, the ReLU function is more widely used because it can improve the training speed of the neural network by several times without significantly affecting the accuracy of the model. By using the linear rectification layer, the model can achieve faster training and classification on the basis of having stronger fitting and learning ability, Figure 2 The linear rectification layer is not shown in FIG. 1, and it is between the convolutional layer and the max pooling layer step.

[0123] Pooling is another important module in the convolutional layer, which is actually a kind of non-linear form of down-sampling. In the past, researchers have developed various non-linear pooling functions, and among them, the max pooling is the most common, and the pooling layer in the present model also uses the max pooling mechanism.

[0124] The max pooling unit can divide the input encrypted parameter vector into several rectangular regions, output the maximum value of each sub-region, thereby capturing the relationship of the features in the sub-region relative to other features, and reducing the attention to the features themselves, so that the features learned by the model can more accurately express the association between the encrypted text features. At the same time, the pooling layer will continuously reduce the spatial size of the data, so the number of parameters and the amount of calculation will also decrease, which to some extent also controls the overfitting. Because the convolution kernel is a feature finder, we can easily find various key features in the encrypted parameter vector through the convolution layer, but the features discovered by the convolution layer are often too accurate, so through the pooling layer we can reduce the sensitivity of the convolution layer to key features.

[0125] That is, the key character combination in the encrypted parameter is captured by sliding the convolution kernel to generate local features; significant features are screened: noise is suppressed by ReLU, and the strongest activation of each region is retained by max pooling to highlight important patterns and reduce data dimensionality; the final output is compressed high-information-content features for further analysis of global associations between parameters by the subsequent network (LSTM).

[0126] (c) Based on the long short-term memory layer in the CNN-LSTM detection model, further time sequence feature extraction is performed on the enhanced local spatial features to obtain the spatio-temporal fusion features of the encrypted parameter vector.

[0127] The long short-term memory layer in this embodiment is provided with 128 memory units to analyze long-distance sequence dependency relationships and effectively identify complex overflow attack fragmentation features such as buffer overflow attacks with more than 400 characters.

[0128] Since the convolution unit in the model cannot well capture the features of long character sequences, and the length of the API encrypted parameter often increases greatly, the originally short sequence with semantics will be converted into a long sequence without semantics, so in the model we further use the long short-term memory (LSTM) layer which can capture long text features.

[0129] The long short-term memory unit is from a recurrent neural network (RNN), which has achieved a breakthrough in processing and predicting sequence data, and has played a good role in speech recognition, language models, machine translation, etc. RNN uses state values to save historical information during iterative calculation, and uses time sequence information to assist current decision-making. However, simple RNN has a long-term dependency problem, because the previous memory will gradually disappear as the RNN model grows over time. The long short-term memory network (LSTM) can perform forward propagation and forget historical information, and update the state of the input information, effectively solving the long-term dependency problem, which meets the problem of difficulty in feature learning caused by the lack of semantics and long sequence of encrypted strings in the present research.

[0130] The long short-term memory unit increases the memory unit in the hidden layer neuron, so that the information that needs to be remembered and forgotten at each time of the time sequence feature can be effectively selected. The hidden layer memory unit is composed of several controllable gates, including a forgetting gate, an input gate, a candidate gate, and an output gate. Their combined effect is to control the memory and forgetting degree of the previous time feature information and the current time feature information, thereby improving the RNN network to have a long-term memory function.

[0131] (d) performing dimension reduction integration and non-linear mapping on the spatio-temporal fusion feature based on a full connection layer in the CNN-LSTM detection model, and outputting a detection result.

[0132] The detection result includes whether the API call record is abnormal and an abnormal probability.

[0133] The encrypted API parameters are meaningless strings, and traditional methods cannot filter malicious parameters through rule matching. Moreover, general risk identification methods based on plaintext semantics will also fail. Although the encrypted meaningless string cannot be identified by its meaning, the relationship of the string distribution provides a new breakthrough for risk identification. The proposed CNN-LSTM model uses both the convolution layer in the convolutional neural network and the long short-term memory layer in the long short-term memory network, so that the model can well capture the distribution relationship of the string, avoid the high false positive rate of the rule-based judgment method, and realize efficient and accurate encrypted parameter risk identification detection.

[0134] The convolutional layer in the above model can obtain the spatial features of the encrypted parameter vector, and the long short-term memory layer can obtain the time sequence features of the encrypted parameter vector. The combination of the two can take into account the relationship between space and time, obtain more accurate encrypted parameter features, and after obtaining the encrypted parameter features, realize the mapping of the features from high dimension to low dimension through the fully connected layer, further complete the classification of the features with less loss of feature information. And in order to better prevent the overfitting of the model, the Dropout mechanism (LSTM layer is added) is added to the model, which will stop the activation value of a certain neuron from working with a certain probability. This can make the model more general, because it will not rely too much on some local features, so that each neuron can have stronger representation ability.

[0135] S3-3, after outputting the detection result, further comprising starting a three-level real-time response mechanism based on the detection result:

[0136] When the abnormal probability in the detection result is greater than the freezing threshold, the calling request corresponding to the API calling record is immediately blocked, and the calling account is frozen;

[0137] When the abnormal probability in the detection result is greater than the review threshold and not greater than the freezing threshold, the API flow is limited, and the API calling record is reviewed;

[0138] When the abnormal probability in the detection result is not greater than the review threshold, the API calling record is released, and the complete parameters are recorded for subsequent audit.

[0139] In this embodiment, the freezing threshold is set to 0.98, and the review threshold is set to 0.95.

[0140] At the same time, if the abnormal probability in the detection result is greater than the archiving threshold (set to 0.991 in this embodiment), that is, the abnormal probability is too large, in addition to intercepting the API calling record, the API encryption parameter in the API calling record, the abnormal probability and the response action are also archived to obtain the archiving data; the archiving data is used as training data to optimize the parameters of the CNN-LSTM detection model.

[0141] That is, in the real-time interception process, the system synchronously performs attack feature archiving: complete recording of original encryption parameters, model prediction probability and handling actions, for example, marking the attack type as SQL injection, while associating the attack source IP address with the specific API interface path, such as the device control interface ( / api / device / control, a device control interface path), to form a traceable attack event closed loop. Taking a typical attack dG4vJmKXz7... (an encrypted attack string, which corresponds to admin'OR 1=1;DROP TABLE sensors (a SQL injection attack) after decryption) as an example, the CNN convolution layer identifies the abnormal fragment z7 / LPq in the character position 107-112 interval through a 5x5 convolution kernel, the LSTM layer analyzes the syntax structure abnormality of the 418-character super-long sequence, and detects the abnormal probability as 0.991 to trigger real-time blocking. The archived data will be used for model iteration and defense strategy optimization.

[0142] To ensure long-term stable operation of the system, the present scheme is improved at the model evolution level. That is, at intervals of a preset training time period, API call record samples labeled automatically are used as training data to train and optimize the CNN-LSTM detection model, and the CNN-LSTM detection model that has completed training and optimization is used for real-time detection of tampering attacks on API encryption parameters in the next time;

[0143] At intervals of a preset reinforcement time period, a large number of labeled abnormal call records are obtained as adversarial samples, and the CNN-LSTM detection model is reinforced by simulating different attack modes through the adversarial samples. The CNN-LSTM detection model that has completed reinforcement training is used for real-time detection of tampering attacks on API encryption parameters in the next time.

[0144] Specifically, in the model evolution level of the present embodiment, 100,000 pieces of newly added request data are automatically labeled every day to input incremental training process, and the false positive rate is reduced by 0.1 percentage points on average every week; 50,000 pieces of adversarial samples (simulating 0-day attack modes such as SQL injection and data theft (security vulnerabilities that have been discovered but have not yet been patched)) are injected every quarter to strengthen the defense capability of the model against unknown threats.

[0145] To ensure long-term stable operation of the system, the present scheme is improved at the fault handling level.

[0146] Specifically, a three-level fuse strategy is deployed: when the server CPU usage rate continuously exceeds 90%, it is automatically switched to a backup computing node; when the model prediction response time exceeds 50 milliseconds, a lightweight CNN single-mode detector (retaining a 5x5 convolution kernel architecture) is enabled; in a complete down state, all traffic is temporarily released and real-time alerts are pushed to the operation and maintenance terminal, ensuring that the power dispatching business realizes zero interruption.

[0147] In summary, the present scheme converts the encrypted parameters into a discrete numerical sequence by character-based digitalization through a 128-dimensional dynamic mapping table, directly processing encrypted strings without semantics and word segmentation. This mechanism dynamically sets length thresholds according to API types, forming a unified dimension input tensor, combining with the requirements of business scenarios. This method breaks through the limitations of traditional detection relying on parameter semantic analysis, achieving lossless extraction of encrypted traffic features.

[0148] A dual-path collaborative model is designed through a CNN-LSTM spatio-temporal fusion feature fusion architecture: local spatial features are extracted through convolutional layers; at the same time, the LSTM layer is used to analyze the long sequence time dependence of more than 400 characters, relying on the dynamic gating mechanism of the forget gate, input gate and output gate to solve the feature attenuation problem caused by the explosive growth of encrypted parameter length. The spatial features and time sequence features are deeply fused through the full connection layer to form the collaborative perception ability of local anomaly patterns and long-range attack logic, which significantly improves the detection accuracy by 2% compared with the pure LSTM model, effectively defending against fragmentation injection attacks and complex overflow attacks.

[0149] In the present scheme, a dynamic threshold grading response mechanism is also provided, based on the output probability of the CNN-LSTM fusion model, a three-level real-time decision system is constructed: when the abnormal probability output by the model is greater than the freezing threshold, the system immediately blocks the request and freezes the account of the calling party, accurately intercepting high-risk attacks such as SQL injection and data theft; when the probability is in the interval between the review threshold and the freezing threshold, automatically trigger the traffic speed limit to 10% bandwidth and start the manual review mechanism, while ensuring the continuity of key business, complete the depth security verification; when it is not greater than the review threshold, the request is released and the parameters are recorded in full for post-audit, avoiding false positives that interfere with core power business. This mechanism establishes a precise balance between real-time identification of encryption attacks and business continuity through differentiated action strategies, completely solving the business interruption risk caused by the "one-size-fits-all" blocking of traditional solutions, and reducing the power grid system downtime to zero.

[0150] Embodiment 2

[0151] To prove the effectiveness of the above-mentioned deep learning-based API encryption parameter tampering real-time detection method, this embodiment provides relevant comparative experiments. First, the experimental environment adopted is explained, and then the precision of the proposed detection method in API encryption parameter risk detection is compared with that of the traditional method. The software and hardware list required to implement the API parameter tampering attack detection method is shown in Table 1.

[0152] Table 1 Software and hardware list

[0153]

[0154] The experiment adopts the HTTP DATASET CSIC 2010 (a classic data set in the field of network security, commonly used for network attack detection research) data set after the parameters are completely encrypted as the experimental data set. Specifically, the data set originally contains 36000 normal requests and more than 25000 abnormal requests, and after screening, it contains the access situation of 8 APIs. The original plaintext API parameters are encrypted using the AES encryption algorithm (a symmetric block encryption algorithm), such as a certain API access record originally:

[0155] http: / / localhost:8080 / tienda1 / publico / anadir.jsp?cantidad=%27%3B+DROP+TABLE+usu arios%3B+SELECT+*+FROM+datos+WHERE+nombre+LIKE+%27%25

[0156] After encryption, it is:

[0157] http: / / localhost:8080 / tienda1 / publico / anadir.jsp?cantidad=xaZSx++GCSoVeSq5N / wlxIls UMOHlRDm / N83X+rJ / nug01geDC04SDGgZqQxHBvexP3sj6Mz / cVnXL / hfde9iA+wIchLRq5OzKhJOeJYY0sTxyxd5yu9rMTVyThcpjkLX3ZDgR0+i2+4PEjUF5U1Wg==

[0158] As can be seen, it is impossible to directly determine from the encrypted API access record whether the parameter is a malicious parameter.

[0159] Table 2 gives some typical normal and abnormal access (calls) of some APIs in the data set.

[0160] Table 2 Some typical normal and abnormal access of some APIs

[0161]

[0162]

[0163] As can be seen from Table 2, the data set is unbalanced, and the ratio of positive samples to negative samples (i.e. normal access and abnormal access) is about 4:1, so accuracy cannot be used to measure the experimental results, because in the extreme case, if the model identifies all classes as positive samples, the accuracy of the model can still be as high as about 80%.

[0164] Therefore, in this embodiment, the precision, recall, and F1 score (harmonic mean of precision and recall) will be used to measure the performance of the model.

[0165] (1) The performance of the present scheme and the traditional detection method is compared, as shown in Table 3.

[0166] Table 3: Comparison of detection method performance

[0167] Method Precision Recall F1 Decision tree+Char Embedding 0.94 0.91 0.91 LSTM 0.95 0.96 0.95 Our Method 0.97 0.97 0.97

[0168] When using Modsecurity (an open source Web Application Firewall engine) + CRS (Core Rule Set) for detection, i.e., using a rule-based matching method for detection, because the API parameters are completely encrypted, such a method will completely fail. Decision tree + Char Embedding (decision tree + character-level embedding) means using a character-level parameter vector to represent the API, and further using a decision tree model to classify the high-dimensional API vector representation. The detection performance of this method is much better than the rule-based detection method. LSTM refers to the result obtained by removing the convolutional layer from the proposed model. It can be seen that the deep learning-based method can have better performance than the rule-based and machine learning-based detection methods, with an F1 value of 0.95. The F1 value of the proposed method is 0.97, which is better than all the comparison methods, indicating the effectiveness of the proposed method. The comparison of our method with the LSTM method shows that the convolutional layer introduced in our model can well capture the distribution relationship of the string, thereby improving the overall performance of the network.

[0169] (2) Performance with different encryption algorithms

[0170] The proposed model can learn the distribution relationship of the encrypted characters, so it can not only be used in a certain specific encryption method, but also can be used in hash algorithm and base64 encoding method to identify malicious parameters without obvious semantics. The performance is shown in Table 4. From the results, it can be found that even if the processed API parameters have no obvious semantics, our method can still learn the corresponding relationship between the distribution of characters and whether they are malicious parameters, which shows the effectiveness of our method.

[0171] Table 4: Comparison of detection performance under different encryption / encoding methods

[0172] Encryption / Encoding Method Precision Recall F1 AES 0.9706 0.9704 0.9705 BASE64 0.9717 0.9709 0.9713 SHA-256 0.9690 0.9696 0.9693 SHA-1 0.9721 0.9711 0.9716

[0173] According to the experimental data, the scheme breaks through the detection bottleneck of API encryption parameters, and can realize high-precision attack recognition. In the scene of complete encryption of API parameters, the application solves the problem that the traditional rule detection method is completely invalid due to the loss of parameter semantics by using a Char-CNN-LSTM (character-level CNN-LSTM model) model. In the experiment, the F1 value is 0.97 (Table 3), which is significantly better than the decision tree (F1=0.91) and the pure LSTM model (F1=0.95).

[0174] Moreover, the scheme can adapt to various encryption algorithms and has strong generalization. The model captures the distribution rule of encrypted characters rather than relying on specific encryption logic. The F1 value is stable above 0.96 under four algorithms of AES (Advanced Encryption Standard), Base64 (a common data encoding method), SHA-1 (Secure Hash Algorithm 1), and SHA-256 (Secure Hash Algorithm 256-bit version), proving its universality for different encryption / coding methods.

[0175] At the same time, it supports real-time online detection and replaces the lagging defense mechanism. Based on the end-to-end architecture, the model can be deployed on industrial-grade hardware (Intel Xeon CPU + 128GB memory, Table 1) to realize real-time classification of new API call parameters and avoid business interruption caused by switching keys in traditional schemes.

[0176] The CNN convolution layer in the above detection model effectively extracts the local spatial features of encrypted strings, and the LSTM layer solves the long sequence dependency problem. The fusion of the two improves the F1 value by 2% compared to the pure LSTM. The Dropout mechanism in the detection model suppresses overfitting and enhances the model's generalization ability.

[0177] Embodiment 3

[0178] The State Grid provincial power dispatching cloud platform is a core business carrier that carries key businesses such as provincial power grid equipment monitoring and real-time electricity settlement. The platform contains 87 sensitive API interfaces, such as device control interface ( / api / device / control) and electricity calculation interface ( / api / billing / calculate). These interfaces use AES-256 encryption protocol to transmit business parameters (such as voltage value, user ID (user identifier), etc.). The traditional regular expression-based rule detection system is completely invalid because it cannot parse encrypted strings. Historical operation and maintenance data show that malicious calls caused by key leakage trigger business interruption several times a year. Single fault repair requires manual key switching and service restart, with an average time consumption of 6 hours.

[0179] The scheme in Example 1 is deployed in the API gateway layer of the provincial power dispatching cloud platform of the State Grid, as a pre-filtering module to realize deep detection of encrypted traffic, which can completely solve the above problems.

[0180] Example 4

[0181] Based on the same inventive concept, the application also provides a deep learning-based API encryption parameter tampering real-time detection system, as shown in Figure 3 The system comprises:

[0182] A data acquisition module is configured to acquire API call records in real time and extract API encryption parameters in the API call records.

[0183] A format conversion module is configured to digitize the API encryption parameters by character using a dynamic character mapping table to obtain a discrete numerical sequence.

[0184] A real-time detection module is configured to input the discrete numerical sequence into a pre-trained CNN-LSTM detection model to extract spatio-temporal fusion features, perform real-time detection of tampering attacks on the API encryption parameters based on the spatio-temporal fusion features, and output a detection result, wherein the detection result comprises whether the API call record is abnormal and an abnormal probability.

[0185] In a possible implementation, the real-time detection module is specifically configured to:

[0186] Input the discrete numerical sequence into the pre-trained CNN-LSTM detection model, perform vector representation on the discrete numerical sequence based on a character embedding layer in the CNN-LSTM detection model, and denote the vector representation as an encryption parameter vector.

[0187] Perform local spatial feature extraction on the encryption parameter vector based on a convolution layer in the CNN-LSTM detection model to obtain a local spatial feature, and perform nonlinear activation and maximum pooling on the local spatial feature to obtain an enhanced local spatial feature.

[0188] Further perform time series feature extraction on the enhanced local spatial feature based on a long short-term memory layer in the CNN-LSTM detection model to obtain spatio-temporal fusion features of the encryption parameter vector.

[0189] Perform dimension reduction integration and nonlinear mapping on the spatio-temporal fusion features based on a fully connected layer in the CNN-LSTM detection model to output a detection result.

[0190] In a possible implementation, the system further comprises a model training module configured to:

[0191] obtain a set of historical API call records, the set of API call records comprising a plurality of API call record samples and a true label indicating whether each API call record sample is abnormal or not;

[0192] digitize an API encryption parameter in each of the API call record samples to obtain a discrete numerical sequence sample;

[0193] input each of the discrete numerical sequence samples into an initial CNN-LSTM detection model to obtain an output result, and calculate a loss function based on the output result of each of the discrete numerical sequence samples and the corresponding true label;

[0194] adopt a gradient descent algorithm, propagate the gradient back layer by layer according to the loss function, and dynamically adjust the optimizable parameters in the initial CNN-LSTM detection model to obtain a CNN-LSTM detection model that has completed learning and training.

[0195] In a possible implementation, the system further comprises a dimension unification module, configured to:

[0196] dynamically allocate a length threshold of the discrete numerical sequence based on the API type corresponding to the discrete numerical sequence;

[0197] adaptively pad or truncate the discrete numerical sequence based on the length threshold to obtain the discrete numerical sequence with a unified dimension.

[0198] In a possible implementation, the data obtaining module is specifically configured to:

[0199] use a distributed log collection cluster to capture API call records in real time through a log agent deployed in an API gateway layer.

[0200] In a possible implementation, the system further comprises a response mechanism module, configured to:

[0201] when the abnormal probability in the detection result is greater than a freezing threshold, immediately block a calling request corresponding to the API call record and freeze an account of a calling party;

[0202] when the abnormal probability in the detection result is greater than a review threshold and is not greater than the freezing threshold, trigger API flow rate limiting and review the API call record;

[0203] when the abnormal probability in the detection result is not greater than the review threshold, release the API call record.

[0204] In a possible implementation, the model training module is further configured to:

[0205] If the anomaly probability in the detection result is greater than an archiving threshold, an API encryption parameter in the API call record, the anomaly probability and a response action are archived to obtain archiving data;

[0206] The archiving data is used for parameter optimization of the CNN-LSTM detection model.

[0207] In a possible implementation, the model training module is further configured to:

[0208] The API call record samples labeled automatically are used as training data to train and optimize the CNN-LSTM detection model at a preset training time interval, and the CNN-LSTM detection model that has completed the training and optimization is used for real-time detection of tampering attacks on API encryption parameters in the next round.

[0209] At a preset reinforcement time interval, a large number of labeled abnormal call records are obtained as adversarial samples, the CNN-LSTM detection model is reinforced by simulating different attack modes through the adversarial samples, and the CNN-LSTM detection model that has completed the reinforcement is used for real-time detection of tampering attacks on API encryption parameters in the next round.

[0210] Embodiment 4

[0211] As shown in Figure 4 The electronic device in this embodiment can include a processor, a memory, a transceiver component and the like. The memory, the processor and the transceiver component are connected through a bus; the memory can be used to store an execution program, and the example execution program can include instructions; the processor is used to execute the instructions stored in the memory. The memory can also be used to store data, which can be called and / or modified when the instructions are executed.

[0212] The processor can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, and the like, which are a computing core and a control core of the terminal, and are suitable for implementing one or more instructions, and are specifically suitable for loading and executing one or more instructions in the storage medium to implement a corresponding method flow or a corresponding function, so as to implement the steps of the API encryption parameter tampering real-time detection method based on deep learning in the above embodiment.

[0213] Embodiment 5

[0214] Based on the same inventive concept, the application further provides a readable storage medium, specifically an electronic device readable storage medium (Memory). The electronic device readable storage medium is a memory device in the electronic device, and is used to store programs and data. It can be understood that the storage medium herein can include a built-in storage medium in the electronic device, and of course can also include an expansion storage medium supported by the electronic device. The storage medium provides a storage space, and the storage space stores an operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and the instructions can be one or more execution programs (including program codes). It should be noted that the storage medium herein can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium, and the steps of the API encryption parameter tampering real-time detection method based on deep learning in the above embodiment can be implemented.

[0215] Those skilled in the art should understand that the embodiments of the application can be provided as a method, a system, or a computer program product. Therefore, the application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the application can adopt the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.

[0216] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart Figure 1 one or more functions specified in the flowchart or multiple flows and / or blocks. Figure 1 one or more functions specified in the flowchart or multiple flows and / or blocks.

[0217] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart Figure 1 one or more functions specified in the flowchart or multiple flows and / or blocks. Figure 1 one or more functions specified in the flowchart or multiple flows and / or blocks.

[0218] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart Figure 1 one or more functions specified in the flowchart or multiple flows and / or blocks. Figure 1 one or more functions specified in the flowchart or multiple flows and / or blocks.

[0219] Finally, it should be noted that the above embodiments are merely used to illustrate the technical solutions of the present application, but not to limit the scope of protection of the present application. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that: after reading the present application, those skilled in the art can make various changes, modifications or equivalent replacements to the specific embodiments of the application, but these changes, modifications or equivalent replacements are all within the scope of protection of the claims of the application.

Claims

1. A real-time detection method for API encryption parameter tampering based on deep learning, characterized in that, include: Get API call records in real time and extract the encrypted API parameters from the API call records; The API encryption parameters are digitized character by character using a dynamic character mapping table to obtain a discrete numerical sequence. The discrete numerical sequence is input into a pre-trained CNN-LSTM detection model for spatiotemporal fusion feature extraction. Based on the spatiotemporal fusion features, API encryption parameter tampering attacks are detected in real time, and the detection results are output. The detection results include whether the API call record is abnormal and the probability of abnormality.

2. The method as described in claim 1, characterized in that, The process involves inputting the discrete numerical sequence into a pre-trained CNN-LSTM detection model for spatiotemporal fusion feature extraction, and then performing real-time detection of API encryption parameter tampering attacks based on the spatiotemporal fusion features, outputting the detection results, including: The discrete numerical sequence is input into a pre-trained CNN-LSTM detection model. Based on the character embedding layer in the CNN-LSTM detection model, the discrete numerical sequence is represented as a vector, denoted as the encryption parameter vector. Based on the convolutional layers in the CNN-LSTM detection model, local spatial features are extracted from the encryption parameter vector to obtain local spatial features. Then, nonlinear activation and max pooling are applied to the local spatial features to obtain enhanced local spatial features. Based on the long short-term memory layer in the CNN-LSTM detection model, the enhanced local spatial features are further subjected to temporal feature extraction to obtain the spatiotemporal fusion features of the encryption parameter vector; The spatiotemporal fusion features are reduced in dimension and integrated and nonlinearly mapped using the fully connected layer in the CNN-LSTM detection model to output the detection results.

3. The method as described in claim 1, characterized in that, The CNN-LSTM detection model is pre-trained in the following manner: Obtain a set of historical API call records, which includes multiple API call record samples and a true label indicating whether each API call record sample is abnormal; The API encryption parameters in each API call record sample are digitized to obtain discrete numerical sequence samples; Each discrete numerical sequence sample is input into the initial CNN-LSTM detection model to obtain the output result, and the loss function is calculated based on the output result of each discrete numerical sequence sample and the corresponding true label; The gradient descent algorithm is used to backpropagate the gradient layer by layer according to the loss function, and the optimizable parameters in the initial CNN-LSTM detection model are dynamically adjusted to obtain the CNN-LSTM detection model that has completed learning and training.

4. The method as described in claim 1 or 2, characterized in that, Before inputting the discrete numerical sequence into the pre-trained CNN-LSTM detection model for spatiotemporal fusion feature extraction, the method further includes: Based on the API type corresponding to the discrete numerical sequence, dynamically allocate the length threshold of the discrete numerical sequence; The discrete numerical sequence is adaptively filled or truncated based on the length threshold to obtain a discrete numerical sequence of uniform dimension.

5. The method as described in claim 1 or 2, characterized in that, The real-time acquisition of API call records includes: By leveraging a distributed log collection cluster and deploying a log proxy at the API management layer, API call records can be captured in real time.

6. The method as described in claim 1 or 2, characterized in that, The real-time detection of API encryption parameter tampering attacks based on the spatiotemporal fusion features, after outputting the detection results, also includes initiating a three-level real-time response mechanism based on the detection results: When the probability of an anomaly in the detection result is greater than the freezing threshold, the call request corresponding to the API call record is immediately blocked and the caller's account is frozen. When the probability of anomalies in the detection results is greater than the review threshold but not greater than the freeze threshold, API traffic rate limiting is triggered and the API call records are reviewed. When the probability of anomalies in the detection results is not greater than the review threshold, the API call record is allowed.

7. The method as described in claim 1 or 6, characterized in that, After the real-time detection of API encryption parameter tampering attacks based on the spatiotemporal fusion features is performed and the detection results are output, the method further includes: If the probability of an anomaly in the detection result is greater than the archiving threshold, then the API encryption parameters, the probability of an anomaly, and the response action in the API call record are archived to obtain archived data. The archived data is used to optimize the parameters of the CNN-LSTM detection model.

8. The method as described in claim 1, characterized in that, Also includes: At preset training intervals, automatically labeled API call record samples are used as training data to train and optimize the CNN-LSTM detection model. The trained and optimized CNN-LSTM detection model is then used for real-time detection of API encryption parameter tampering attacks. At preset reinforcement time intervals, a large number of labeled abnormal call records are obtained as adversarial samples. The CNN-LSTM detection model is reinforced and trained by simulating different attack modes using the adversarial samples. The reinforced CNN-LSTM detection model is then used for real-time detection of API encryption parameter tampering attacks.

9. A real-time detection system for API encryption parameter tampering based on deep learning, characterized in that, include: The data acquisition module is used to acquire API call records in real time and extract the encrypted API parameters from the API call records; The format conversion module is used to digitize the API encryption parameters character by character using a dynamic character mapping table to obtain a discrete numerical sequence. The real-time detection module is used to input the discrete numerical sequence into a pre-trained CNN-LSTM detection model for spatiotemporal fusion feature extraction, and to perform real-time detection of API encryption parameter tampering attacks based on the spatiotemporal fusion features, and output detection results, including whether the API call record is abnormal and the probability of abnormality.

10. The system as described in claim 9, characterized in that, The real-time detection module is specifically used for: The discrete numerical sequence is input into a pre-trained CNN-LSTM detection model. Based on the character embedding layer in the CNN-LSTM detection model, the discrete numerical sequence is represented as a vector, denoted as the encryption parameter vector. Based on the convolutional layers in the CNN-LSTM detection model, local spatial features are extracted from the encryption parameter vector to obtain local spatial features. Then, nonlinear activation and max pooling are applied to the local spatial features to obtain enhanced local spatial features. Based on the long short-term memory layer in the CNN-LSTM detection model, the enhanced local spatial features are further subjected to temporal feature extraction to obtain the spatiotemporal fusion features of the encryption parameter vector; The spatiotemporal fusion features are reduced in dimension and integrated and nonlinearly mapped using the fully connected layer in the CNN-LSTM detection model to output the detection results.

Images