Communication risk processing method and device, electronic equipment and nonvolatile storage medium

Abstract

The invention discloses a communication risk processing method and device, electronic equipment and a nonvolatile storage medium. The method comprises the following steps: acquiring a request data packet sent by a client, and determining a target fingerprint vector corresponding to the request data packet; obtaining a response data packet returned by the server in response to the request data packet, and decoding the response data packet to obtain plaintext response data; determining a sensitive information vector corresponding to the plaintext response data; and determining a risk parameter according to the target fingerprint vector and the sensitive information vector, and determining a first processing strategy for communication connection between the client and the server according to the risk parameter. According to the method and the device, the technical problem of insufficient network attack detection precision caused by sensitive data detection only based on a fixed rule or keyword matching in an API transmission process in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and more specifically, to a communication risk handling method, apparatus, electronic device, and non-volatile storage medium. Background Technology

[0002] With the widespread adoption of cloud computing and microservice architectures, API gateways (Application Programming Interfaces) serve as core hubs for inter-system communication, handling the transmission of large amounts of sensitive data. However, data security during API transmission faces severe challenges. Existing sensitive data detection methods are increasingly revealing their limitations in combating modern attack techniques. For example, the fact that these methods rely solely on fixed rules or keyword matching for sensitive data detection during API transmission leads to insufficient accuracy in detecting network attacks.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a communication risk handling method, apparatus, electronic device, and non-volatile storage medium to at least solve the technical problem of insufficient detection accuracy of network attacks caused by related technologies that only rely on fixed rules or keyword matching for sensitive data detection during API transmission.

[0005] According to one aspect of the embodiments of this application, a communication risk handling method is provided, comprising: acquiring a request data packet sent by a client and determining a target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral characteristics and identity information of the client request; acquiring a response data packet returned by a server in response to the request data packet and decoding the response data packet to obtain plaintext response data; determining a sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the type and quantity of sensitive data contained in the plaintext response data; determining risk parameters based on the target fingerprint vector and the sensitive information vector, and determining a first handling strategy for the communication connection between the client and the server based on the risk parameters, wherein the risk parameters are used to characterize the risk level of the communication connection between the client and the server.

[0006] Optionally, determining the target fingerprint vector corresponding to the request data packet includes: extracting a network fingerprint from the request data packet, wherein the network fingerprint contains key parameters in the transport layer security handshake protocol, and the key parameters include at least: application layer protocol negotiation information; determining the weight coefficients corresponding to the request data packets obtained at different time points, wherein the weight coefficients corresponding to the more recent time points are, the larger the weight coefficients are; and determining the target fingerprint vector based on the network fingerprints and weight coefficients corresponding to different time points.

[0007] Optionally, decoding the response data packet to obtain plaintext response data includes: performing a first-level decoding process on the response data packet to obtain a first decoding result, wherein the first-level decoding process includes at least one of the following: Uniform Resource Locator (URI) decoding, Base64 decoding, and hexadecimal decoding; determining the entropy value corresponding to the first decoding result, and determining the increase ratio of the entropy value compared to the entropy value of the response data packet before decoding, wherein the entropy value is used to characterize the randomness or disorder of the data; if the increase ratio exceeds a preset threshold, performing a second-level decoding process on the first decoding result to obtain plaintext response data; if the increase ratio does not exceed the preset threshold, determining the first decoding result as plaintext response data.

[0008] Optionally, determining the sensitive information vector corresponding to the plaintext response data includes: using a preset regular expression database to perform sensitive information matching on the plaintext response data to obtain matching results, wherein the preset regular expression database contains regular expressions for various categories of sensitive information, and the matching results are used to characterize the number of different categories of sensitive information matched by the plaintext response data, as well as the entropy value of the sensitive information; and determining the sensitive information vector based on the number of different categories of sensitive information matched by the plaintext response data and the entropy value of the sensitive information.

[0009] Optionally, determining the first handling strategy for the communication connection between the client and the server based on risk parameters includes: determining a fusion weight based on the client's request frequency within a historical time window, and fusing the target fingerprint vector and the sensitive information vector based on the fusion weight to obtain a fused feature vector, wherein the higher the request frequency, the higher the weight of the target fingerprint vector, and the lower the weight of the sensitive information vector; analyzing the fused feature vector using a risk prediction model to obtain risk parameters, wherein the risk prediction model is trained using historical communication data and known risk samples; determining the risk level corresponding to the risk parameters, and determining the handling strategy corresponding to the risk level as the first handling strategy, wherein the first handling strategy includes at least one of the following: immediately blocking the communication connection between the client and the server, limiting the client's rate and restricting the client's request time interval, or directly allowing the client's request data packets.

[0010] Optionally, a network security analysis model is used to analyze the interactive data packets and fused feature vectors to obtain the threat level parameters corresponding to the communication connection. The network security analysis model is obtained by fine-tuning a large language model. The interactive data packets include request packets and response packets. The threat level parameters characterize the security threat level of the communication connection. Based on the threat level parameters and risk parameters, a target risk score is determined. If the risk score is greater than a preset score threshold, a second handling strategy is executed, which includes blocking the Internet Protocol address corresponding to the client. If the risk score is not greater than the preset score threshold, the executed first handling strategy is adjusted to a handling strategy corresponding to a lower risk level.

[0011] Optionally, determining the target risk score based on the threat level parameter and the risk parameter includes: determining the first confidence level corresponding to the risk parameter based on the distance between the risk parameter output by the risk prediction model and the preset decision boundary parameter value; obtaining the second confidence level corresponding to the threat level parameter output by the network security analysis model; and using the first confidence level and the second confidence level as weighting coefficients for the risk parameter and the threat level parameter, respectively, to perform weighted fusion of the risk parameter and the threat level parameter to obtain the target risk score.

[0012] According to another aspect of the embodiments of this application, a communication risk processing apparatus is also provided, comprising: a first feature extraction module, configured to acquire a request data packet sent by a client and determine a target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral characteristics and identity information of the client request; a data packet decoding module, configured to acquire a response data packet returned by a server in response to the request data packet and decode the response data packet to obtain plaintext response data; a second feature extraction module, configured to determine a sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the type and quantity of sensitive data contained in the plaintext response data; and a risk judgment processing module, configured to determine risk parameters based on the target fingerprint vector and the sensitive information vector, and determine a first handling strategy for the communication connection between the client and the server based on the risk parameters, wherein the risk parameters are used to characterize the risk level of the communication connection between the client and the server.

[0013] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the program executes a communication risk handling method during runtime.

[0014] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes a communication risk handling method by running the computer program.

[0015] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of a communication risk handling method.

[0016] In this embodiment, the following methods are employed: acquiring the request data packet sent by the client and determining the target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral characteristics and identity information of the client's request; acquiring the response data packet returned by the server in response to the request data packet and decoding the response data packet to obtain plaintext response data; determining the sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the sensitive data types and quantities contained in the plaintext response data; determining risk parameters based on the target fingerprint vector and the sensitive information vector, and determining a first handling strategy for the communication connection between the client and the server based on the risk parameters, wherein the risk parameters are used to characterize the risk level of the communication connection between the client and the server; and achieving high-precision, low-latency sensitive data leakage interception through dynamically optimized JA4+ fingerprint hashing and multimodal response decoding technology. While ensuring normal API communication, it can also effectively identify malicious behaviors such as script attacks and data crawling, thereby solving the technical problem of insufficient detection accuracy of network attacks caused by related technologies that only rely on fixed rules or keyword matching for sensitive data detection during API transmission. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a hardware structure block diagram of a computer terminal (or electronic device) for implementing a method for handling communication risks, according to an embodiment of this application.

[0019] Figure 2 This is a schematic diagram of a communication risk handling method provided according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of an overall design framework for sensitive data detection of an API gateway based on optimized JA4+ fingerprinting and LightGBM, according to an embodiment of this application.

[0021] Figure 4 This is a schematic diagram of a real-time detection process according to an embodiment of this application;

[0022] Figure 5This is a schematic diagram of a communication risk processing device provided according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] To facilitate a better understanding of the embodiments of this application by those skilled in the art, some technical terms or nouns involved in the embodiments of this application are explained as follows:

[0026] Large Language Models (LLMs): These models are trained using larger datasets and parameters, and their advantage lies in improving the understanding and generation of natural language. They can achieve better results in natural language processing tasks such as text generation, dialogue systems, and translation.

[0027] JA4+ Fingerprinting: This refers to JA4+ network fingerprinting technology, which uses key parameters from the TLS handshake protocol to generate standardized fingerprint identifiers. Its advantage lies in its ability to accurately identify and classify client or application types within network traffic. It can quickly identify malware, crawlers, or abnormal behavior in scenarios such as network security analysis, threat detection, and traffic monitoring, improving detection efficiency and accuracy.

[0028] LightGBM (Light Gradient Boosting Machine) is a highly efficient gradient boosting framework based on decision tree algorithms. Its advantages lie in significantly improving training speed and memory efficiency through techniques such as histogram-based optimization and gradient-based one-side sampling (GOSS). It supports parallel learning and sparse data optimization, making it suitable for large-scale data scenarios. It performs exceptionally well in machine learning tasks such as classification, regression, and ranking, and is particularly well-suited for industrial applications requiring high-dimensional features and low latency.

[0029] In related technologies, sensitive data detection methods have limitations in dealing with modern attack techniques, mainly including:

[0030] 1) Insufficient detection accuracy: Methods based on fixed rules or keyword matching are difficult to deal with attackers using encoding, obfuscation and other means to bypass detection, which easily leads to a high false positive rate and false negative rate.

[0031] 2) Poor real-time performance: Traditional deep packet inspection or some complex machine learning models may introduce significant latency when handling high-traffic API requests, affecting the normal response time of the business.

[0032] 3) Weak adaptability: As attack methods and the forms of sensitive data continue to evolve, traditional methods rely on manually updating rules, which cannot effectively identify new attack patterns and variant scripts, and are also difficult to adapt to the sensitive data types customized within the enterprise.

[0033] 4) Limited decoding capability: Attackers often use multi-layer encoding (such as Base64 embedded URL encoding) to hide malicious payloads or stolen data. Traditional decoding mechanisms usually only support single-layer decoding, which is insufficient for identification.

[0034] Furthermore, while client identification methods based on JA3 fingerprints exist, the limited fields in JA3 fingerprints make them vulnerable to forgery and bypass by attackers who can modify TLS client library parameters. Additionally, these methods primarily focus on request-side characteristics and lack deep detection capabilities for sensitive data in API response packets. Therefore, they suffer from low detection accuracy, high response latency, poor adaptability, and weak resistance to bypassing.

[0035] To address the aforementioned issues, this application provides a solution that enables high-precision, low-latency real-time detection and interception of sensitive data hidden by multiple layers of encoding in high-concurrency traffic scenarios of API gateways. It also possesses strong adaptability to new attack patterns and resistance to bypassing, as detailed below.

[0036] According to an embodiment of this application, a method embodiment for handling communication risks is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0037] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware structure block diagram of a computer terminal (or electronic device) for implementing a communication risk handling method is shown. Figure 1 As shown, the computer terminal 10 (or electronic device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0038] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or electronic device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0039] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the communication risk handling method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the communication risk handling method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0040] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0041] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or electronic device).

[0042] Under the above operating environment, this application provides a method for handling communication risks. Figure 2 This is a schematic diagram of a communication risk handling method provided according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0043] Step S202: Obtain the request data packet sent by the client and determine the target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral features and identity information of the client request;

[0044] Step S204: Obtain the response data packet returned by the server in response to the request data packet, and decode the response data packet to obtain plaintext response data;

[0045] Step S206: Determine the sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the types and quantities of sensitive data contained in the plaintext response data;

[0046] Step S208: Based on the target fingerprint vector and the sensitive information vector, determine the risk parameters, and based on the risk parameters, determine the first handling strategy for the communication connection between the client and the server. The risk parameters are used to characterize the risk level of the communication connection between the client and the server.

[0047] Through the above steps, by using dynamically optimized JA4+ fingerprint hashing and multimodal response decoding technology, combined with the improved LightGBM model, high-precision and low-latency sensitive data leakage interception is achieved. While ensuring normal API communication, it can also effectively identify malicious behaviors such as script attacks and data crawling. It also supports real-time updates of enterprise-defined sensitive rules, thereby solving the technical problems of low detection accuracy, high response latency, poor adaptability, and weak anti-bypass ability of traditional sensitive data detection methods when dealing with modern attack methods during API transmission.

[0048] The communication risk handling method in steps S202 to S208 of the embodiments of this application will be further described below.

[0049] Figure 3 This is a schematic diagram of an overall design framework for sensitive data detection in an API gateway based on optimized JA4+ fingerprinting and LightGBM, according to an embodiment of this application. Figure 3 As shown, the detection in this embodiment includes two parts: real-time detection and post-detection. The specific process of the real-time detection part is as follows: Figure 4 As shown, the following is a detailed explanation.

[0050] First, the API gateway can obtain the request data packets sent by the client and extract their target fingerprint vector. The specific steps are as follows.

[0051] In some embodiments of this application, determining the target fingerprint vector corresponding to the request data packet includes: extracting a network fingerprint from the request data packet, wherein the network fingerprint contains key parameters in the transport layer security handshake protocol, and the key parameters include at least: application layer protocol negotiation information; determining the weight coefficients corresponding to the request data packets obtained at different time points, wherein the weight coefficients corresponding to the more recent time points are are larger; and determining the target fingerprint vector based on the network fingerprints and weight coefficients corresponding to different time points.

[0052] Specifically, the request packets initiated by the client (i.e., the aforementioned request data packets) can be intercepted at the API gateway, and the network fingerprint can be extracted. In this embodiment, the network fingerprint can be a JA4+ fingerprint. Compared with the traditional JA3 fingerprint, the JA4+ fingerprint contains richer TLS (Transport Layer Security) negotiation information, such as ALPN (Application Layer Protocol Negotiation), and is not sensitive to the order of extended fields, thus having better stability and resistance to randomization.

[0053] To further enhance the ability to identify automated script attacks, this application embodiment can also employ a time-weighted rolling hash algorithm to optimize the fingerprint of a client's continuous requests over a period of time, generating a fingerprint vector (and the aforementioned target fingerprint vector) that reflects the temporal characteristics of its behavior. This algorithm gives fingerprints of recent requests a higher weight coefficient, effectively identifying script attacks with fixed behavioral patterns over a short period of time. The specific calculation formula is as follows:

[0054]

[0055] In the formula, The optimized fingerprint vector (i.e., the target fingerprint vector mentioned above). This is a time decay constant used to control the weight of historical requests. The default value is 300 seconds, meaning that requests within 5 minutes have a greater impact. This refers to the k-th request data packet within the time window; For the current time, This is the timestamp (time point) of the k-th request.

[0056] In addition, to counter attackers who use multi-layered encoding to hide sensitive data, this application embodiment can also perform multi-level decoding on the response data packets returned by the server, with the specific steps as follows.

[0057] In some embodiments of this application, decoding the response data packet to obtain plaintext response data includes: performing a first-level decoding process on the response data packet to obtain a first decoding result, wherein the first-level decoding process includes at least one of the following: Uniform Resource Locator (URL) decoding, Base64 decoding, and hexadecimal decoding; determining the entropy value corresponding to the first decoding result, and determining the increase ratio of the entropy value compared to the entropy value of the response data packet before decoding, wherein the entropy value is used to characterize the randomness or disorder of the data; if the increase ratio exceeds a preset ratio threshold, performing a second-level decoding process on the first decoding result to obtain plaintext response data; if the increase ratio does not exceed the preset ratio threshold, determining the first decoding result as plaintext response data.

[0058] Specifically, the original response data packet can be first decoded. For example, different types of decoding processes can be tried sequentially, including but not limited to URL decoding, Base64 decoding, and HEX decoding. Furthermore, after each step of the first-level decoding, the Shannon entropy (i.e., the entropy value) of the decoded data (i.e., the first decoding result mentioned above) can be calculated. The entropy calculation formula is as follows:

[0059]

[0060] In the formula, For characters The probability of something appearing in the data.

[0061] If the entropy value of the decoded data increases by more than a threshold compared to the data before decoding, i.e., the increase ratio exceeds the preset ratio threshold, then the data is considered to be deeply encoded, triggering secondary decoding. The result of the primary decoding is then URL decoded again to parse the nested encoding and obtain the plaintext response data. If the increase ratio does not exceed the preset ratio threshold, then the first decoding result can be determined as the plaintext response data.

[0062] By performing multi-level decoding on the service packet returned by the server (i.e. the response data packet mentioned above) using the entropy-driven decoding mechanism described above, the performance overhead caused by blind decoding is avoided, and accurate and in-depth analysis of suspicious encoded data is achieved.

[0063] After obtaining the decoded plaintext response data, the sensitive information vector corresponding to the plaintext response data can be further determined. The specific steps are as follows.

[0064] In some embodiments of this application, determining the sensitive information vector corresponding to plaintext response data includes: using a preset regular expression database to perform sensitive information matching on the plaintext response data to obtain matching results, wherein the preset regular expression database contains regular expressions for various categories of sensitive information, and the matching results are used to characterize the number of different categories of sensitive information matched by the plaintext response data and the entropy value of the sensitive information; and determining the sensitive information vector based on the number of different categories of sensitive information matched by the plaintext response data and the entropy value of the sensitive information.

[0065] Specifically, a preset regular expression library is used to match sensitive information in the decoded plaintext response data. In this embodiment, the regular expression library not only includes regular expressions for sensitive information of common sensitive information categories such as ID card number, mobile phone number, email address, and bank card number, but also supports enterprises to hot update custom sensitive field rules (such as internal employee number, project code, etc.) in real time according to their own business needs.

[0066] To accurately measure the sensitivity of response data packets, embodiments of this application can use an entropy-enhanced sensitivity score calculation method to calculate sensitive information scores and construct a sensitive information vector, as shown in the following formula:

[0067]

[0068] In the formula, The final sensitive information score (which forms the sensitive information vector) is calculated. The number of the i-th type of sensitive information matched; The Shannon entropy (i.e. the entropy value mentioned above) measures the randomness of this type of sensitive information (such as a string consisting of all matched phone numbers); The maximum entropy value pre-calculated across all categories of sensitive information (sensitive information vectors) is used for normalization.

[0069] This method considers not only the quantity of sensitive information but also the degree of disorder in its distribution, enabling it to better distinguish between normal business data and sensitive data leaked in batches.

[0070] Furthermore, embodiments of this application can also be based on the target fingerprint vector. and sensitive information vector A fusion feature vector is determined, and a risk prediction model is used to execute a preset graded handling strategy based on the risk probability output by the fusion feature vector, as detailed below. In some embodiments of this application, determining the first handling strategy for the communication connection between the client and the server based on risk parameters includes: determining the fusion weight based on the client's request frequency within a historical time window, and fusing the target fingerprint vector and the sensitive information vector based on the fusion weight to obtain a fusion feature vector, wherein the higher the request frequency, the higher the weight corresponding to the target fingerprint vector, and the lower the weight corresponding to the sensitive information vector; analyzing the fusion feature vector using a risk prediction model to obtain risk parameters, wherein the risk prediction model is trained using historical communication data and known risk samples; determining the risk level corresponding to the risk parameters, and determining the handling strategy corresponding to the risk level as the first handling strategy, wherein the first handling strategy includes at least one of the following: immediately blocking the communication connection between the client and the server, limiting the client's rate, restricting the client's request time interval, or directly allowing the client's request data packets.

[0071] Specifically, in order for the model to comprehensively consider client behavior and response content, this embodiment can use the aforementioned target fingerprint vector. With the aforementioned sensitive information vector Dynamic fusion is performed, and the specific formula is as follows:

[0072]

[0073] in It is the fused feature vector that is ultimately input into the risk prediction model. The fusion weight can be based on the request frequency of the client IP within a historical time window (e.g., the past 60 seconds). Dynamically adjust. This applies when the request frequency... At lower levels, When the value is close to 1, the model focuses more on sensitive information (sensitive information vector) in the response content; when the request frequency is close to 1, the model focuses more on sensitive information (sensitive information vector). When the level is very high (suspected scanning or crawling behavior), When the value is close to 0, the model focuses more on the fingerprint features of the client (target fingerprint vector).

[0074] In this embodiment, the aforementioned risk prediction model can take the LightGBM model as an example. The LightGBM model has the advantages of fast training speed and low memory consumption, making it very suitable for deployment in scenarios requiring low latency, such as API gateways. To address the data imbalance problem in real-world scenarios where normal requests (negative samples) far outnumber malicious requests (positive samples), this embodiment optimizes the loss function of the LightGBM model (i.e., the risk prediction model), as shown in the following formula:

[0075]

[0076] In the formula, Let i be the weight of the i-th class of samples. The total number of samples, Let be the number of samples in class i. By assigning higher weights to the minority class (positive samples), the model focuses more on correctly classifying malicious requests during training, effectively reducing the false negative rate. The risk prediction model receives a fused vector. As input, output a probability value between 0 and 1. (i.e., the risk parameters mentioned above) indicates that there is a risk of sensitive data leakage in this API interaction.

[0077] The risk probability (risk parameter) output by the risk prediction model is obtained. Then, the preset hierarchical handling strategy (i.e., the first handling strategy mentioned above) can be executed accordingly. The specific handling strategy is as follows.

[0078] In this embodiment, the risk levels corresponding to the risk parameters include: high risk level, medium risk level, and low risk level, wherein the high risk level ( The first response strategy for attacks ≥ 0.8 is as follows: If determined to be a malicious attack, immediately block the TCP (Transmission Control Protocol) connection and add the client IP to a temporary blacklist. Simultaneously trigger a high-priority security alert to notify the security operations team; for medium-risk international attacks (≤ 0.8), the strategy is as follows: < 0.8) The first response strategy is as follows: If the behavior is deemed suspicious, dynamically limit the client IP to 10 requests / minute and record detailed logs for further analysis; Low-risk level ( The first handling strategy for requests with a value of < 0.5 is as follows: if the request is deemed normal, it should be allowed directly.

[0079] This tiered handling mechanism ensures security while minimizing the impact on normal business operations.

[0080] On the other hand, embodiments of this application can also employ a network security analysis model to perform post-analysis (i.e., the aforementioned post-detection) on API interaction data packets and generated fusion feature vectors during the real-time detection phase to obtain threat level parameters. The specific steps are as follows.

[0081] In some embodiments of this application, a network security analysis model is used to analyze interactive data packets and fused feature vectors to obtain threat level parameters corresponding to the communication connection. The network security analysis model is obtained by fine-tuning and training a large language model. The interactive data packets include request data packets and response data packets. The threat level parameters are used to characterize the degree of security threat to the communication connection.

[0082] Specifically, the API interaction data packets (including original request data packets and original response data packets) from the real-time detection phase, along with the generated fused feature vectors, can be submitted together to a large language model dedicated to network security analysis (i.e., the aforementioned network security analysis model) for analysis. In this embodiment, the prompt words for the network security analysis model can be set as follows:

[0083] "Role setting: You are a top API security analysis expert, proficient in OWASP API Security Top 10, and skilled at identifying various attacks from traffic data, including but not limited to SQL injection, cross-site scripting (XSS), data leakage, business logic abuse and zero-day attacks."

[0084] Context information: I will provide you with detailed data from an API interaction, consisting of three parts:

[0085] 1. Original request packet: {REQUEST_PACKET}

[0086] 2. Original response packet: {RESPONSE_PACKET}

[0087] 3. Preliminary analysis of eigenvectors = [ , ]:{FUSED_VECTOR}

[0088] in, It is a client behavior credibility score calculated based on JA4+ fingerprint (range 0-1, the closer to 1, the more suspicious). It is a response content sensitivity score calculated based on regular expressions and information entropy (the higher the value, the more sensitive).

[0089] Analysis Task: Based on all the information above, please comprehensively analyze whether this API interaction poses a security threat. Your analysis should focus on:

[0090] Attack signature identification: Does the request contain known attack payloads or malicious patterns?

[0091] Data breach assessment: Does the response contain an unusual amount or type of sensitive data that does not match the intent of the request?

[0092] Behavioral anomaly analysis: Client behavior (by...) Does the response (reflection) and the request content / frequency constitute an abnormal combination?

[0093] Intent inference: By combining requests and responses, infer the client's true intent (e.g., normal business, data crawling, vulnerability scanning, malicious attack).

[0094] Output format requirements: Please strictly adhere to the following JSON format when returning your analysis conclusions, and do not add any additional explanatory text:

[0095] {

[0096] "threat_level": <an integer from 0 to 10, where 0 represents no threat and 10 represents extremely high threat>.

[0097] "confidence": <a floating-point number between 0.0 and 1.0 representing your confidence level>.

[0098] "threat_type": "<threat type, such as 'No Threat', 'Data Exfiltration', 'SQLInjection', 'Business Logic Abuse', 'Unknown Anomaly'>",

[0099] "reasoning": "<A detailed analysis and logical basis for judgment must be provided, concisely and clearly explaining how you reached your conclusion>"

[0100] }”

[0101] After analyzing and processing the input content, the cybersecurity analysis model outputs a JSON object (JavaScript Object Notation) containing the threat level (threat_level) and confidence level (confidence). The threat level output by the cybersecurity analysis model is then normalized to obtain the threat level parameter. The specific formula is as follows.

[0102]

[0103] After obtaining the risk parameters output by real-time monitoring and the threat level parameters output by post-analysis, the target risk score can be further determined. The specific steps are as follows.

[0104] In some embodiments of this application, determining the target risk score based on threat level parameters and risk parameters includes: determining a first confidence level corresponding to the risk parameter based on the distance between the risk parameter output by the risk prediction model and the preset decision boundary parameter value; obtaining a second confidence level corresponding to the threat level parameter output by the network security analysis model; and using the first confidence level and the second confidence level as weighting coefficients for the risk parameter and the threat level parameter, respectively, to perform weighted fusion of the risk parameter and the threat level parameter to obtain the target risk score.

[0105] Specifically, in order to integrate the results of real-time detection and post-analysis (post-detection), this application abandons the simple weighted average method and adopts a more intelligent confidence-aware dynamic fusion decision-making method. The core idea of ​​this method is that the final decision should give more weight to the opinion of the model that has more confidence in its own judgment, as follows.

[0106] On the one hand, determine the first confidence level corresponding to the risk parameters output by the LightGBM model (risk prediction model) during the real-time detection phase. Specifically, this can be achieved through its output probability (i.e., risk parameter). The confidence level is measured by the distance from the decision boundary (0.5). Predictions farther from 0.5 are considered more confident than those closer to 0.5. The specific formula is as follows:

[0107]

[0108] On the other hand, the second confidence level corresponding to the threat level parameter output in the post-detection phase. The confidence field value output by the large language model (network security analysis model) can be used directly.

[0109] Final target risk score The result is calculated by dynamically weighting the outputs of the two models (i.e., the risk prediction model and the cybersecurity analysis model mentioned above) and their corresponding confidence levels. The specific formula is as follows:

[0110]

[0111] This formula ensures that the model with higher confidence level has a greater weight in the final score. If the denominator is 0 (neither model has confidence level), a default strategy can be set, such as labeling it as medium risk.

[0112] After obtaining the target risk score, the final action and closed-loop feedback can be carried out by comparing the target risk with the preset score threshold, as follows.

[0113] In some embodiments of this application, if the target risk score is greater than a preset score threshold, a second handling strategy is executed, wherein the second handling strategy includes: blocking the Internet Protocol address corresponding to the client; if the target risk score is not greater than the preset score threshold, the first handling strategy already executed is adjusted to the handling strategy corresponding to a lower risk level.

[0114] Specifically, the final target risk score can be... Compare with a preset rating threshold (0.8 for example): If If the value is ≥ 0.8, then high-intensity actions will be taken, such as permanently blocking the IP address and sending a detailed alert (including LLM reasoning) to the security operations center. If If the value is less than 0.8, it is considered a false alarm or low risk, and the case will be downgraded or released directly.

[0115] In addition, all cases that have undergone LLM analysis (including their features, model outputs, and final disposal results) will be recorded in the security log for continuous model optimization and iteration, forming a closed-loop feedback system.

[0116] This application's solution, by introducing richer JA4+ fingerprints and combining them with time-weighted optimization, can more accurately identify automated tools and malicious scripts. The entropy-driven multi-level decoding mechanism effectively counters encoding bypass techniques, and combined with entropy-enhanced sensitivity scores, the detection accuracy is improved to over 95%. Employing the lightweight LightGBM model and optimizing feature engineering and the model itself, the average detection response time on the API gateway is controlled within 5 milliseconds, meeting the performance requirements of high-concurrency business scenarios. It allows enterprises to customize sensitive data rules in real time by updating regular expressions without retraining the model. The model itself can also continuously learn and adapt to new attack patterns; the time-weighted hash algorithm ensures that even if attackers frequently change IP or TLS fingerprint parameters, their behavioral patterns in the time series can still be captured. The dynamic vector fusion mechanism enables the model to intelligently respond to different types of attacks.

[0117] According to an embodiment of this application, an embodiment of a communication risk processing device is also provided. Figure 5 This is a schematic diagram of a communication risk processing device provided according to an embodiment of this application. Figure 5 As shown, the device includes:

[0118] The first feature extraction module 50 is used to obtain the request data packet sent by the client and determine the target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral features and identity information of the client request;

[0119] The data packet decoding module 52 is used to obtain the response data packet returned by the server in response to the request data packet, and to decode the response data packet to obtain plaintext response data;

[0120] The second feature extraction module 54 is used to determine the sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the type and quantity of sensitive data contained in the plaintext response data;

[0121] The risk assessment and processing module 56 is used to determine risk parameters based on the target fingerprint vector and sensitive information vector, and to determine the first handling strategy for the communication connection between the client and the server based on the risk parameters. The risk parameters are used to characterize the risk level of the communication connection between the client and the server.

[0122] Optionally, determining the target fingerprint vector corresponding to the request data packet includes: extracting the network fingerprint from the request data packet, wherein the network fingerprint contains key parameters in the transport layer security handshake protocol, and the key parameters include at least: application layer protocol negotiation information; determining the weight coefficients corresponding to the request data packets obtained at different time points, wherein the weight coefficients corresponding to the more recent time points are, the larger the weight coefficients are; and determining the target fingerprint vector based on the network fingerprints and weight coefficients corresponding to different time points.

[0123] Optionally, decoding the response data packet to obtain plaintext response data includes: performing a first-level decoding process on the response data packet to obtain a first decoding result, wherein the first-level decoding process includes at least one of the following: Uniform Resource Locator (URI) decoding, Base64 decoding, and hexadecimal decoding; determining the entropy value corresponding to the first decoding result, and determining the increase ratio of the entropy value compared to the entropy value of the response data packet before decoding, wherein the entropy value is used to characterize the randomness or disorder of the data; if the increase ratio exceeds a preset threshold, performing a second-level decoding process on the first decoding result to obtain plaintext response data; if the increase ratio does not exceed the preset threshold, determining the first decoding result as plaintext response data.

[0124] Optionally, determining the sensitive information vector corresponding to the plaintext response data includes: using a preset regular expression database to perform sensitive information matching on the plaintext response data to obtain matching results, wherein the preset regular expression database contains regular expressions for various categories of sensitive information, and the matching results are used to characterize the number of different categories of sensitive information matched by the plaintext response data, as well as the entropy value of the sensitive information; and determining the sensitive information vector based on the number of different categories of sensitive information matched by the plaintext response data and the entropy value of the sensitive information.

[0125] Optionally, determining the first handling strategy for the communication connection between the client and the server based on risk parameters includes: determining a fusion weight based on the client's request frequency within a historical time window, and fusing the target fingerprint vector and the sensitive information vector based on the fusion weight to obtain a fused feature vector, wherein the higher the request frequency, the higher the weight of the target fingerprint vector, and the lower the weight of the sensitive information vector; analyzing the fused feature vector using a risk prediction model to obtain risk parameters, wherein the risk prediction model is trained using historical communication data and known risk samples; determining the risk level corresponding to the risk parameters, and determining the handling strategy corresponding to the risk level as the first handling strategy, wherein the first handling strategy includes at least one of the following: immediately blocking the communication connection between the client and the server, limiting the client's rate and restricting the client's request time interval, or directly allowing the client's request data packets.

[0126] Optionally, a network security analysis model is used to analyze the interactive data packets and fused feature vectors to obtain the threat level parameters corresponding to the communication connection. The network security analysis model is obtained by fine-tuning a large language model. The interactive data packets include request packets and response packets. The threat level parameters characterize the security threat level of the communication connection. Based on the threat level parameters and risk parameters, a target risk score is determined. If the risk score is greater than a preset score threshold, a second handling strategy is executed, which includes blocking the Internet Protocol address corresponding to the client. If the risk score is not greater than the preset score threshold, the executed first handling strategy is adjusted to a handling strategy corresponding to a lower risk level.

[0127] Optionally, determining the target risk score based on the threat level parameter and the risk parameter includes: determining the first confidence level corresponding to the risk parameter based on the distance between the risk parameter output by the risk prediction model and the preset decision boundary parameter value; obtaining the second confidence level corresponding to the threat level parameter output by the network security analysis model; and using the first confidence level and the second confidence level as weighting coefficients for the risk parameter and the threat level parameter, respectively, to perform weighted fusion of the risk parameter and the threat level parameter to obtain the target risk score.

[0128] It should be noted that each module in the above-mentioned communication risk processing device can be a program module (for example, a set of program instructions to implement a certain function) or a hardware module. For the latter, it can be manifested in the following forms, but is not limited to them: each of the above modules is manifested as a processor, or the functions of each of the above modules are implemented by a processor.

[0129] It should be noted that the communication risk processing device provided in this embodiment can be used to perform... Figure 2 The communication risk handling method shown above is also applicable to the embodiments of this application, and will not be repeated here.

[0130] This application embodiment also provides a non-volatile storage medium, which includes a stored computer program. The device containing the non-volatile storage medium executes the following communication risk handling method by running the computer program: acquiring a request data packet sent by a client and determining a target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral characteristics and identity information of the client's request; acquiring a response data packet returned by the server in response to the request data packet and decoding the response data packet to obtain plaintext response data; determining a sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the type and quantity of sensitive data contained in the plaintext response data; determining risk parameters based on the target fingerprint vector and the sensitive information vector, and determining a first handling strategy for the communication connection between the client and the server based on the risk parameters, wherein the risk parameters are used to characterize the risk level of the communication connection between the client and the server.

[0131] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the communication risk handling method in various embodiments of this application: obtaining a request data packet sent by a client and determining a target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral characteristics and identity information of the client's request; obtaining a response data packet returned by the server in response to the request data packet and decoding the response data packet to obtain plaintext response data; determining a sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the type and quantity of sensitive data contained in the plaintext response data; determining risk parameters based on the target fingerprint vector and the sensitive information vector, and determining a first handling strategy for the communication connection between the client and the server based on the risk parameters, wherein the risk parameters are used to characterize the risk level of the communication connection between the client and the server.

[0132] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0133] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0134] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0135] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0136] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0137] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0138] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for handling communication risks, characterized in that, include: Obtain the request data packet sent by the client and determine the target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral features and identity information of the client request; Obtain the response data packet returned by the server in response to the request data packet, and decode the response data packet to obtain plaintext response data; Determine the sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the type and quantity of sensitive data contained in the plaintext response data; Based on the target fingerprint vector and the sensitive information vector, risk parameters are determined, and based on the risk parameters, a first handling strategy for the communication connection between the client and the server is determined, wherein the risk parameters are used to characterize the risk level of the communication connection between the client and the server.

2. The communication risk handling method according to claim 1, characterized in that, Determining the target fingerprint vector corresponding to the request data packet includes: The network fingerprint is extracted from the request data packet, wherein the network fingerprint contains key parameters of the transport layer security handshake protocol, and the key parameters include at least: application layer protocol negotiation information; Determine the weight coefficients corresponding to the request data packets obtained at different time points, wherein the weight coefficients corresponding to the time points closer to the current time are larger; The target fingerprint vector is determined based on the network fingerprint and the weight coefficients corresponding to different time points.

3. The communication risk handling method according to claim 1, characterized in that, Decoding the response data packet yields plaintext response data, including: The response data packet is subjected to a first-level decoding process to obtain a first decoding result, wherein the first-level decoding process includes at least one of the following: Uniform Resource Locator (URL) decoding, Base64 decoding, and hexadecimal decoding; Determine the entropy value corresponding to the first decoding result, and determine the increase ratio of the entropy value compared with the entropy value of the response data packet before decoding, wherein the entropy value is used to characterize the randomness or disorder of the data; If the enhancement ratio exceeds a preset ratio threshold, the first decoding result is subjected to secondary decoding processing to obtain the plaintext response data; If the increase ratio does not exceed the preset ratio threshold, the first decoding result is determined as the plaintext response data.

4. The communication risk handling method according to claim 1, characterized in that, Determining the sensitive information vector corresponding to the plaintext response data includes: A preset regular expression database is used to match sensitive information in the plaintext response data to obtain matching results. The preset regular expression database contains regular expressions for various categories of sensitive information. The matching results are used to characterize the number of different categories of sensitive information matched by the plaintext response data and the entropy value of the sensitive information. The sensitive information vector is determined based on the number of different categories of sensitive information matched with the plaintext response data and the entropy value of the sensitive information.

5. The communication risk handling method according to claim 1, characterized in that, Based on the risk parameters, the first handling strategy for the communication connection between the client and the server includes: Based on the client's request frequency within a historical time window, a fusion weight is determined, and based on the fusion weight, the target fingerprint vector and the sensitive information vector are fused to obtain a fused feature vector. The higher the request frequency, the higher the weight of the target fingerprint vector, and the lower the weight of the sensitive information vector. The risk parameters are obtained by analyzing the fused feature vector using a risk prediction model, wherein the risk prediction model is trained using historical communication data and known risk samples. The risk level corresponding to the risk parameter is determined, and the handling strategy corresponding to the risk level is determined as the first handling strategy, wherein the first handling strategy includes at least one of the following: immediately blocking the communication connection between the client and the server, limiting the client's rate, limiting the client's request time interval, or directly allowing the client's request data packets.

6. The communication risk handling method according to claim 5, characterized in that, The method further includes: A network security analysis model is used to analyze the interactive data packets and the fused feature vector to obtain the threat level parameter corresponding to the communication connection. The network security analysis model is obtained by fine-tuning and training a large language model. The interactive data packets include the request data packets and the response data packets. The threat level parameter is used to characterize the security threat level of the communication connection. Based on the threat level parameters and the risk parameters, a target risk score is determined; If the target risk score is greater than a preset score threshold, a second handling strategy is executed, wherein the second handling strategy includes: blocking the Internet Protocol address corresponding to the client; If the target risk score is not greater than the preset score threshold, the first handling strategy that has been executed will be adjusted to the handling strategy corresponding to the lower risk level.

7. The communication risk handling method according to claim 6, characterized in that, Based on the threat level parameters and the risk parameters, the target risk score is determined as follows: Based on the distance between the risk parameter output by the risk prediction model and the preset decision boundary parameter value, determine the first confidence level corresponding to the risk parameter; Obtain the second confidence level corresponding to the threat level parameter output by the network security analysis model; The first confidence level and the second confidence level are used as weighting coefficients for the risk parameter and the threat level parameter, respectively. The risk parameter and the threat level parameter are then weighted and fused to obtain the target risk score.

8. A communication risk processing device, characterized in that, include: The first feature extraction module is used to obtain the request data packet sent by the client and determine the target fingerprint vector corresponding to the request data packet, wherein the target fingerprint vector is used to characterize the behavioral features and identity information of the client request; The data packet decoding module is used to obtain the response data packet returned by the server in response to the request data packet, and to decode the response data packet to obtain plaintext response data; The second feature extraction module is used to determine the sensitive information vector corresponding to the plaintext response data, wherein the sensitive information vector is used to characterize the sensitive data types and quantities contained in the plaintext response data; The risk assessment and processing module is used to determine risk parameters based on the target fingerprint vector and the sensitive information vector, and to determine a first handling strategy for the communication connection between the client and the server based on the risk parameters, wherein the risk parameters are used to characterize the risk level of the communication connection between the client and the server.

9. An electronic device, characterized in that, include: A memory and a processor, the processor being configured to run a program stored in the memory, wherein the program, when running, executes the communication risk handling method according to any one of claims 1 to 7.

10. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored computer program, wherein the device containing the non-volatile storage medium executes the communication risk handling method according to any one of claims 1 to 7 by running the computer program.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the communication risk handling method according to any one of claims 1 to 7.

Images