Interface identification method and storage medium

Abstract

The embodiment of the invention discloses an interface identification method and a storage medium. The method comprises the following steps: in response to network traffic, aiming at a target uniform resource locator in the network traffic, extracting a target keyword from the target uniform resource locator, and taking the target keyword as a head entity to obtain a head entity vector; a pre-obtained tail entity vector and a map matrix are obtained, a tail entity represented by the tail entity vector is obtained by analyzing a plurality of first uniform resource locators pointing to the interface, and the map matrix is obtained according to a pre-constructed knowledge map; the knowledge graph represents whether a graph keyword in the knowledge graph is a keyword pointing to an interface; and then, transforming the head entity vector according to the atlas matrix to obtain a transformed vector, and obtaining an interface identification result according to the transformed vector and the tail entity vector. According to the technical scheme provided by the embodiment of the invention, the interface can be accurately identified.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an interface identification method and storage medium. Background Technology

[0002] Interface identification helps enterprises quickly integrate the Application Programming Interfaces (APIs) of new and old systems, shortening the business integration cycle. Simultaneously, it can recommend reusable interfaces based on semantic similarity, avoiding redundant interface development and effectively saving enterprise development costs. Therefore, interface identification is of great significance.

[0003] Currently, interface identification is mainly based on traffic capture and analysis. Specifically, Hypertext Transfer Protocol (HTTP) traffic (i.e., network traffic) is essentially a plaintext or encrypted exchange between clients (such as browsers and mobile applications) and servers. Therefore, by capturing the client's network traffic, the Uniform Resource Locator (URL) can be extracted from it. Then, by analyzing the URL, it can be determined whether it is a URL pointing to an interface, thus achieving interface identification.

[0004] In the process of realizing this invention, the inventors discovered the following technical problems in the prior art: the accuracy of interface recognition is not high, which leads to the need for a large amount of manual review of the interface recognition results, resulting in a large amount of manual work, which urgently needs to be solved. Summary of the Invention

[0005] This invention provides an interface identification method and storage medium to achieve accurate interface identification.

[0006] According to one aspect of the present invention, an interface identification method is provided, which may include:

[0007] In response to network traffic, for the target Uniform Resource Locator in the network traffic, the target keyword is extracted from the target Uniform Resource Locator, and the target keyword is used as the head entity to obtain the head entity vector;

[0008] Obtain the pre-obtained tail entity vector and graph matrix. The tail entity vector represents the tail entity by analyzing multiple first unified resource locators pointing to the interface. The graph matrix is ​​obtained based on the pre-constructed knowledge graph. The knowledge graph indicates whether the graph keywords in the knowledge graph are keywords pointing to the interface.

[0009] The head entity vector is transformed based on the graph matrix to obtain the transformed vector. The interface identification result is obtained by comparing the transformed vector with the tail entity vector. The interface identification result indicates whether the target Uniform Resource Locator is a Uniform Resource Locator pointing to an interface.

[0010] According to another aspect of the present invention, an interface identification device is provided, which may include:

[0011] The Header Entity Vector Result Module is used to respond to network traffic. It extracts target keywords from the target Uniform Resource Locator (URL) in the network traffic and uses the target keywords as header entities to obtain the header entity vector.

[0012] The graph matrix acquisition module is used to acquire the pre-obtained tail entity vector and graph matrix. The tail entity vector represents the tail entity by analyzing multiple first unified resource locators pointing to the interface. The graph matrix is ​​obtained based on the pre-constructed knowledge graph. The knowledge graph indicates whether the graph keywords in the knowledge graph are keywords pointing to the interface.

[0013] The interface recognition module is used to transform the head entity vector according to the graph matrix to obtain the transformed vector, and obtain the interface recognition result based on the transformed vector and the tail entity vector. The interface recognition result indicates whether the target Uniform Resource Locator is a Uniform Resource Locator pointing to the interface.

[0014] According to another aspect of the present invention, an electronic device is provided, which may include:

[0015] At least one processor; and

[0016] A memory that is communicatively connected to at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by at least one processor, such that when the at least one processor executes the program, it implements the interface identification method provided in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided having computer instructions stored thereon for causing a processor to execute and implement the interface identification method provided in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer program product is provided, on which a computer program is stored, which, when executed by a processor, implements the interface identification method provided in any embodiment of the present invention.

[0020] The technical solution of this invention, in response to network traffic, extracts target keywords from the target Uniform Resource Locator (URL) in the network traffic and uses the target keywords as header entities to obtain a header entity vector. It then acquires a pre-obtained tail entity vector and a knowledge graph matrix. The tail entity vector represents tail entities obtained by analyzing multiple first URLs pointing to an interface. The knowledge graph matrix is ​​obtained based on a pre-constructed knowledge graph, which indicates whether the graph keywords in the knowledge graph are keywords pointing to an interface. The header entity vector is then transformed according to the knowledge graph matrix to obtain a transformed vector. Finally, the interface identification result is obtained based on the transformed vector and the tail entity vector, indicating whether the target URL is a URL pointing to an interface. This technical solution, based on knowledge graph technology for interface identification, can improve the accuracy of interface identification, eliminating the need for extensive manual review of interface identification results and effectively reducing the workload of manual intervention.

[0021] It should be understood that the description in this section is not intended to identify key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of an interface identification method provided according to an embodiment of the present invention;

[0024] Figure 2 This is a schematic diagram illustrating an example of reasoning based on first-order predicate logic in an interface recognition method provided by an embodiment of the present invention;

[0025] Figure 3a This is a schematic diagram illustrating the formal representation of a knowledge graph in an interface identification method provided by an embodiment of the present invention;

[0026] Figure 3b This is a schematic diagram illustrating the storage method of the knowledge graph after it is entered into the database in an interface identification method provided by an embodiment of the present invention;

[0027] Figure 4a This is a schematic diagram of the original knowledge graph in an interface identification method provided according to an embodiment of the present invention;

[0028] Figure 4b This is a schematic diagram of the knowledge graph after path mining in an interface recognition method provided according to an embodiment of the present invention;

[0029] Figure 5 This is a flowchart of another interface identification method provided according to an embodiment of the present invention;

[0030] Figure 6 This is a schematic diagram of a scoring example based on semantic similarity in another interface recognition method provided according to an embodiment of the present invention;

[0031] Figure 7a This is a first schematic diagram of a rule reasoning example in another interface recognition method provided according to an embodiment of the present invention;

[0032] Figure 7b This is a second schematic diagram of a rule reasoning example in another interface recognition method provided according to an embodiment of the present invention;

[0033] Figure 8 This is a flowchart of another interface identification method provided according to an embodiment of the present invention;

[0034] Figure 9a This is a schematic diagram illustrating an example of entity recognition in another interface recognition method provided according to an embodiment of the present invention;

[0035] Figure 9b This is a first schematic diagram of a relation extraction example in another interface identification method provided by an embodiment of the present invention;

[0036] Figure 9c This is a second schematic diagram of an example of relation extraction in another interface identification method provided by an embodiment of the present invention;

[0037] Figure 10 This is a structural block diagram of an interface identification device provided according to an embodiment of the present invention;

[0038] Figure 11 This is a schematic diagram of the structure of an electronic device that implements the interface recognition method of this invention. Detailed Implementation

[0039] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0040] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. The same applies to "target," "original," etc., and will not be repeated here. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0041] It should be noted that the collection, gathering, updating, analysis, processing, use, transmission, and storage of user personal information involved in the technical solution of this invention all comply with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to user personal information data and to maintain the security of user personal information and network security.

[0042] Figure 1 This is a flowchart of an interface identification method provided by an embodiment of the present invention. This embodiment is applicable to interface identification, especially to identifying whether a Uniform Resource Locator (URL) points to an interface. This method can be executed by the interface identification device provided by this embodiment of the present invention. This device can be implemented in software and / or hardware, and can be integrated into an electronic device, which can be various user terminals or servers.

[0043] See Figure 1 The method of this invention specifically includes the following steps:

[0044] S110. In response to network traffic, for the target Uniform Resource Locator in the network traffic, extract the target keyword from the target Uniform Resource Locator, and use the target keyword as the head entity to obtain the head entity vector.

[0045] In this embodiment of the invention, network traffic can be understood as network traffic between a client and a server, and more particularly as network traffic sent from a client to a server. In response to the intercepted network traffic, a URL is extracted from the network traffic; this URL is a component of the network traffic. It should be noted that, to distinguish it from other URLs described later, the URL extracted in this step is referred to as the target URL.

[0046] Target keywords can be understood as keywords extracted from the target URL, which to some extent indicates whether the target URL points to an API. It's important to note that these keywords are not narrowly defined, but rather broadly defined. They can be any single keyword, a keyword and its relationships (such as the frequency of occurrence), or at least two keywords and their relationships (such as AND / OR relationships between keywords and / or the frequency of occurrence of each keyword). This can be set according to actual needs and is not specifically limited here. The above interpretation also applies to keywords mentioned later, which will not be elaborated upon further. Using the target keyword as a header entity, we obtain the vector of this header entity. Similarly, to distinguish it from the other vectors discussed later, this vector is referred to here as the header entity vector.

[0047] Based on this, and in conjunction with the application scenarios that may be involved in the embodiments of the present invention, optionally, the header entity vector can be obtained in the following way: obtain pre-determined predicate keywords, wherein the predicate keywords are keywords pointing to interfaces or non-interfaces; determine the target keywords located in the target Uniform Resource Locator from all predicate keywords, and then use the target keywords as header entities; input the header entities into the vector extractor to obtain the header entity vector.

[0048] The above process can be considered as a reasoning process based on first-order predicate logic. Specifically, the definition of a predicate is as follows: assuming D is the domain of discourse, P: Dn->{T,F} is a mapping, where Dn={(x1,x2,…,xn)|x1,x2,…,xn∈D}, then P is called an n-ary predicate, denoted as P(x1,x2,…,xn). After determining the truth value (x,y∈[1,2]) of the predicate formula P(x,y)^Q(x,y), the truth values ​​in other cases can be deduced. In the embodiments of this invention, optionally, see [link to relevant documentation]. Figure 2 When the URL contains "sign" and "token", it can be identified as an interface, and "sign+token" can be considered as a predicate (i.e., predicate keyword); when the URL contains "key" twice and "restful" once, it can be identified as an interface, and "keyx2+restfulx1" can be considered as a predicate (i.e., predicate keyword).

[0049] Therefore, the predicate keyword located in the target URL can be determined from all predicate keywords, and this predicate keyword is used as the target keyword. Then, the target keyword (i.e., the header entity) is input into the vector extractor to obtain the header entity vector. In this embodiment of the invention, optionally, the vector extractor can be implemented based on a recurrent neural network (RNN) or an autoencoder, etc., which can be set according to actual needs and is not specifically limited here.

[0050] The above technical solution achieves accurate extraction of target keywords through predicate keywords, and on this basis, it combines a vector extractor to achieve accurate extraction of head entity vectors, which helps to improve the accuracy of interface recognition.

[0051] S120. Obtain the pre-obtained tail entity vector and graph matrix. The tail entity vector represents the tail entity obtained by analyzing multiple first unified resource locators pointing to the interface. The graph matrix is ​​obtained based on the pre-constructed knowledge graph. The knowledge graph represents whether the graph keywords in the knowledge graph are keywords pointing to the interface.

[0052] Here, the first Uniform Resource Locator (i.e., the first URL) can be understood as the URL pointing to the interface. Multiple first URLs are analyzed to obtain tail entities. For example, by statistically analyzing the common characteristics of multiple first URLs, keywords that frequently appear in URLs pointing to the interface (i.e., first URLs) are obtained, such as 90% containing "api" and 50% containing "token". Then, these statistical results are normalized / standardized to obtain tail entities, and thus the corresponding tail entity vector.

[0053] The knowledge graph is pre-constructed and can characterize whether the graph keywords within it (i.e., the knowledge graph itself) are keywords pointing to interfaces. That is, a keyword may or may not point to an interface; in the latter case, it could be a keyword pointing to a non-interface or a suspected interface. This depends on the specific circumstances and is not specifically limited here. For an example, see [link to example]. Figure 3aThe knowledge graph is formalized as G={E,R,F}, where E is the entity (representing interface feature words, i.e., the graph keywords described above), R is the relation (representing the positive or negative value of the feature value, but this is just an example; it could also be an AND / OR relation or the frequency of occurrence, as described above), and F is the fact (representing the opportunism of interface judgment, i.e., whether it points to an interface). The Semantic Web, by extending the existing Internet and adding content representing the meaning of information, can improve the automation and intelligence of computers. Based on experience with keywords, three keywords—api, css, and token—are extracted (i.e., the graph keywords described above), where api and token are positive feature values, and css is a negative feature value. Knowledge modeling is based on this. The main data models for knowledge graphs are Resource Description Framework (RDF) graphs and attribute graphs. In this embodiment of the invention, optionally, RDF graphs can be used to implement knowledge modeling, and a corresponding language can be used to query the model. Practice has shown that when the data volume is relatively small, there is little difference between relational databases and RDF databases. However, when the data volume reaches a certain level, especially with multi-hop queries, the performance of RDF databases is tens of thousands or even hundreds of thousands of times faster than that of relational databases. The storage method after data is inserted is as follows: Figure 3b As shown: api+token indicates an API; api+css indicates a non-API.

[0054] A graph matrix is ​​pre-constructed based on the knowledge graph. This graph matrix can be considered as a transformation matrix corresponding to the relationships in the knowledge graph. In this embodiment of the invention, optionally, the graph matrix can be pre-constructed as follows: A pre-set path ranking algorithm is obtained, and path mining is performed in the knowledge graph using the path ranking algorithm to obtain multiple paths and their corresponding weights. The weights are related to the frequency of occurrence of the corresponding path in multiple second unified resource locators pointing to the interface. The graph matrix is ​​then constructed based on the multiple paths and their corresponding weights.

[0055] The above process can be considered a knowledge reasoning process based on a random walk algorithm. For example, the Path Ranking Algorithm (PRA) is a reasoning execution algorithm, and its specific implementation process is as follows: First, find a set of potentially valuable path types to link entity pairs, (1-2-3, 1-2-4); Second, calculate the eigenvalues ​​in the feature matrix by calculating the random walk probability, (1-2-3, 1-2-4, 1-2-5); Third, train each relation using a logistic regression algorithm to obtain the weight corresponding to each path. This weight is related to the frequency of the corresponding path in multiple second Uniform Resource Locators (i.e., second URLs) pointing to the interface, (1-2-3, 1-2-4, 1-2-5, 1-4-3, 1-4-5). See also [example]. Figure 4a api + token + sign = API, api + image + css = non-API. After path mining, the following is obtained: Figure 4b The final learning results shown are: api+token+sign = interface, api+token+image = non-interface, api+css+sign = interface, api+css+image = non-interface, api+token+image = suspected interface, api+css+image = suspected interface. After obtaining multiple paths and their corresponding weights, a graph matrix can be constructed based on these paths and their weights. This graph matrix can be considered as a weight mapping rule, such as mapping to interfaces, non-interfaces, or suspected interfaces.

[0056] The above technical solution utilizes a path ranking algorithm to mine paths in a knowledge graph, obtaining multiple paths and their corresponding weights. Then, a graph matrix can be constructed based on these paths and weights, achieving accurate construction of the graph matrix.

[0057] S130. Transform the head entity vector according to the graph matrix to obtain the transformed vector, and obtain the interface recognition result according to the transformed vector and the tail entity vector. The interface recognition result indicates whether the target Uniform Resource Locator is a Uniform Resource Locator pointing to the interface.

[0058] As explained above, the graph matrix can be considered a transformation matrix corresponding to the relationships in the knowledge graph. Therefore, the header entity vector can be transformed using the graph matrix, such as through linear transformations like rotation and stretching, to obtain a transformed vector. This transformed vector can be represented by hTMr, where h represents the header entity vector, T represents the transpose, and Mr represents the graph matrix. Furthermore, assuming the tail entity vector is represented by t, when the target URL is a URL pointing to an interface, hTMr should be approximately equal to the transpose of the tail entity vector, i.e., hTMr≈tT. Therefore, the interface identification result can be obtained from the transformed vector and the tail entity vector, which can characterize whether the target URL is a URL pointing to an interface.

[0059] In this embodiment of the invention, optionally, the above three steps can be implemented based on a pre-built interface recognition model (or interface judgment model), that is, the target URL is input into the interface recognition model to obtain the interface recognition result.

[0060] Optionally, after obtaining the interface identification result, the following steps can also be performed: If the interface identification result indicates that the target Uniform Resource Locator (URL) points to a suspected interface, obtain the manual review result of the interface identification result; if the manual review result indicates that the target URL points to an interface, add the target keyword as a new graph keyword pointing to the interface to the knowledge graph. In other words, for suspected interfaces, a manual review process is added. If feature values ​​(such as confidence level or second score as described below) are involved in the interface identification process, the feature values ​​of the corresponding keywords can be dynamically adjusted based on the manual review result. If it is determined to be an interface, its keyword feature value increases; if it is determined not to be an interface, its keyword feature value decreases.

[0061] Using the interface identification process described above (or the knowledge graph-based HTTP data sharing interface identification process), the following comprehensive test was conducted:

[0062] By crawling network traffic and reconstructing the traffic, 10,000 URLs (the target URLs mentioned above) were extracted and processed by an API identification model. Analysis revealed 5,013 APIs (i.e., 5,013 URLs pointing to APIs), 4,901 non-APIs, and 86 suspected APIs. The total identification time was approximately 50 seconds. 130 URLs matched the keyword ".ashx" (feature value 50), and 931 URLs matched the keyword "api" (feature value 20). Of these, 510 matched the full word " / api / " and received an automatic weight increase; 104 matched the partial word " / mapi / " and received a slightly reduced weight. 53 URLs matched the keywords "api+v / d+".

[0063] First interface recognition:

[0064] Example of an API URL (i.e., a URL pointing to an API):

[0065] / api / ybouboyresource.ashx;

[0066] / mapi / manager / product / list;

[0067] / rest / nebula / photo / earncoin;

[0068] / ajax / main / getroom.ashx;

[0069] / api / v1 / users / feeds / notify;

[0070] Example of a non-interface URL (i.e., a URL that points to a non-interface):

[0071] / invogue / default.html;

[0072] / wangwang / batchqueryuserimage.htm;

[0073] / haozip / index.php;

[0074] / haozip / css / main.css;

[0075] / scripts / easyui / plugins / jquery;

[0076] Example of a suspected API URL (i.e., a URL pointing to a suspected API):

[0077] / invogue / map?x=102.3&y=33.2;

[0078] / hao1 / li?g=34.

[0079] After manual review, the first URL (i.e., / invogue / map?x=102.3&y=33.2) was identified as an interface, and the second URL (i.e., / hao1 / li?g=34) was identified as a non-interface. Therefore, "map" can be automatically added to the knowledge graph as a new graph keyword pointing to the interface.

[0080] Second interface identification:

[0081] Example of an API URL:

[0082] / api / ybouboyresource.ashx;

[0083] / mapi / manager / product / list;

[0084] / rest / nebula / photo / earncoin;

[0085] / ajax / main / getroom.ashx;

[0086] / api / v1 / users / feeds / notify;

[0087] / invogue / map?x=102.3&y=33.2;

[0088] Example of a non-interface URL:

[0089] / invogue / default.html;

[0090] / wangwang / batchqueryuserimage.htm;

[0091] / haozip / index.php;

[0092] / haozip / css / main.css;

[0093] / scripts / easyui / plugins / jquery;

[0094] / hao1 / li?g=34.

[0095] Compared to related interface identification schemes, this method identified 1113 interfaces, 6480 non-interfaces, and 1407 suspected interfaces. The total identification time was approximately 80 seconds. Compared to related interface identification schemes, the accuracy rate was improved by 40%, and the efficiency was improved by at least 60%. In other words, the interface identification scheme described in this embodiment only requires a certain amount of manual review initially; as the system operates, the number of manual reviews required decreases significantly, thereby greatly reducing the workload of manual intervention.

[0096] The technical solution of this invention, in response to network traffic, extracts target keywords from the target Uniform Resource Locator (URL) in the network traffic and uses the target keywords as header entities to obtain a header entity vector. It then acquires a pre-obtained tail entity vector and a knowledge graph matrix. The tail entity vector represents tail entities obtained by analyzing multiple first URLs pointing to an interface. The knowledge graph matrix is ​​obtained based on a pre-constructed knowledge graph, which indicates whether the graph keywords in the knowledge graph are keywords pointing to an interface. The header entity vector is then transformed according to the knowledge graph matrix to obtain a transformed vector. Finally, the interface identification result is obtained based on the transformed vector and the tail entity vector, indicating whether the target URL is a URL pointing to an interface. This technical solution, based on knowledge graph technology for interface identification, can improve the accuracy of interface identification, eliminating the need for extensive manual review of interface identification results and effectively reducing the workload of manual intervention.

[0097] Figure 5 This is a flowchart of another interface recognition method provided by an embodiment of the present invention. This embodiment is based on and optimized from the above-described technical solutions. In this embodiment, optionally, obtaining the interface recognition result based on the transformed vector and the tail entity vector includes: determining the semantic similarity between the transformed vector and the tail entity vector, so as to obtain a first score based on the semantic similarity; and obtaining the interface recognition result based on the first score. The explanations of terms that are the same as or corresponding to those in the above embodiments will not be repeated here.

[0098] See Figure 5 The method in this embodiment may specifically include the following steps:

[0099] S210. In response to network traffic, for the target Uniform Resource Locator in the network traffic, extract the target keyword from the target Uniform Resource Locator, and use the target keyword as the head entity to obtain the head entity vector.

[0100] S220. Obtain the pre-obtained tail entity vector and graph matrix, wherein the tail entity vector represents the tail entity obtained by analyzing multiple first unified resource locators pointing to the interface, and the graph matrix is ​​obtained based on the pre-constructed knowledge graph, and the knowledge graph represents whether the graph keywords in the knowledge graph are keywords pointing to the interface.

[0101] S230. Transform the head entity vector according to the graph matrix to obtain the transformed vector.

[0102] S240. Determine the semantic similarity between the transformed vector and the tail entity vector to obtain a first score based on the semantic similarity.

[0103] In this embodiment of the invention, the semantic similarity between the transformed vector and the tail entity vector is determined. Optionally, this semantic similarity is mainly reflected in the closeness between the two vectors hTMr and tT, and can therefore be measured by cosine similarity or Euclidean distance. Furthermore, a first score is obtained based on the semantic similarity; for example, see [link to example]. Figure 6 The first score can be obtained by using a pre-set scoring function fr(h,t) based on semantic similarity and combining it with semantic similarity.

[0104] S250. Based on the first score, obtain the interface identification result, wherein the interface identification result indicates whether the target Uniform Resource Locator is a Uniform Resource Locator pointing to the interface.

[0105] The interface identification result is obtained based on the first score. In this embodiment of the invention, optionally, scores exceeding a preset score threshold can be identified as interfaces, and scores within a preset score range can be identified as suspected interfaces. For example, a first score >= 5 can be mapped to an interface, a first score between 1 and 5 to a suspected interface, and a first score < 1 to a non-interface. The following is a judgment example:

[0106]

[0107] The technical solution of this invention improves the accuracy of interface recognition by using semantic similarity scoring.

[0108] An optional technical solution, the above interface identification method, further includes:

[0109] Retrieve multiple predefined rule data, where the rule data includes rule keywords and data, and the data represents the confidence level or second score of the interface pointed to by the rule keywords;

[0110] Based on the target keywords, target rule data is determined from multiple rule data, where the rule keywords in the target rule data match the target keywords;

[0111] Based on the first score, the interface recognition results are obtained, including:

[0112] Based on the data in the target rule data and the first score, the interface recognition result is obtained.

[0113] The above technical solution combines rule data with the first score (i.e. semantic similarity score) to perform interface recognition, which further improves the accuracy of interface recognition.

[0114] Based on this, optionally, the multiple rule data includes multiple first rule data and second rule data. The second rule data can be obtained by inputting multiple first rule data into the inference predictor for inference, and obtaining the second rule data based on the output of the inference predictor.

[0115] For example, this section uses rule-based reasoning to obtain the second rule data as an example. The process of solving a problem using rules based on facts is called forward rule reasoning. The process of deriving a conclusion from rule premises is called forward rule reasoning, while the process of finding rule premises from rule conclusions is called backward rule reasoning. Specifically, first, a set of rules needs to be generated, and then a reasoning predictor with logical rules needs to be generated. Given a query, the rule generator uses an RNN to generate a set of rules, which are then used as input to the reasoning predictor to obtain predicted values. After a certain number of learning iterations, highly efficient reasoning predictions can be obtained. For example, see... Figure 7a Rule 1 states that URLs containing "api" and "sign" have an 80% probability of being an API; Rule 2 states that URLs containing "api" and "token" have a 70% probability of being an API; and Rule 3 states that URLs containing "sign" and "token" have an 85% probability of being an API. After further study, we can conclude that URLs containing "api" and "token" have a 90% probability of being an API. This is Rule 4, which is the second rule mentioned above. Here, "api" and "token" are the rule keywords, and "90%" represents the confidence level.

[0116] For example, this section uses entity-based reasoning to obtain the second rule data. Based on the triple information, a dictionary is formed, containing identifiers (IDs). This is fed into the model, and a scoring function is used to calculate a relation vector file, the size of which is "number of relations x vector dimension". The obtained relation vector file is then trained, the trained vectors are loaded, and the scoring function is used again to calculate the corresponding entity ID and its second score. Finally, the corresponding entity can be retrieved based on the ID mapping relationship. For example, see... Figure 7b Rule 1 is defined as 1 API call + 1 RESTful API call, which is worth 8 points; Rule 2 is defined as 1 API call + 2 sign calls, which is worth 10 points; therefore, the deduced Rule 3 is defined as 1 API call + 2 sign calls, which is worth 9 points. This is the second rule data described above, where 1 API call + 2 sign calls are the rule keywords and 9 points is the second score.

[0117] The two examples given above demonstrate how the second rule data can be accurately inferred from multiple first rule data points.

[0118] Figure 8This is a flowchart of another interface identification method provided by an embodiment of the present invention. This embodiment is based on and optimized from the above-mentioned technical solutions. In this embodiment, optionally, the knowledge graph can be pre-constructed in the following way: acquiring multiple pieces of knowledge, wherein the knowledge represents whether the keywords of the graph are keywords pointing to the interface; fusing the multiple pieces of knowledge to construct the knowledge graph. The explanations of terms that are the same as or corresponding to those in the above embodiments will not be repeated here.

[0119] See Figure 8 The method in this embodiment may specifically include the following steps:

[0120] S310. Obtain multiple pieces of knowledge, where each piece of knowledge indicates whether a graph keyword is a keyword pointing to an interface.

[0121] This involves acquiring multiple pieces of knowledge, which can characterize whether the graph keywords within them point to keywords related to an interface. For example, the past process of this knowledge is given below:

[0122] The summarized interface features (i.e., graph keywords) are converted into graph data, which can include structured data, semi-structured data, knowledge indexing, and knowledge reasoning. This step can be divided into the following two steps:

[0123] 1) Entity recognition

[0124] Related graph keyword phrases are extracted as entities and tagged (e.g., API, non-API, and suspected API). Graph keyword phrases that are related but not strongly related can also be extracted as entities. Based on practical experience, URLs containing "api" are likely APIs, while URLs containing "css" are likely non-APIs. URLs containing "version" require further manual identification, thus forming... Figure 9a The entity shown.

[0125] 2) Relation Extraction

[0126] Identify the relationships between entities and other entities. Here, relationships are defined as "AND / OR" and "number of occurrences," i.e., AND logic, OR logic, and the number of occurrences. URLs containing "api" twice are definitely APIs, URLs containing "image" twice are definitely not APIs, and URLs containing "sign" three times require further manual identification, thus forming... Figure 9b The relationships shown; and the fact that URLs containing two instances of v{d+} (regular expression) and three instances of sign are definitely interfaces, thus forming Figure 9c The relationship shown.

[0127] Knowledge was obtained based on the entity recognition and relation extraction results described above.

[0128] S320. Integrate multiple pieces of knowledge to construct a knowledge graph.

[0129] Since the graph keywords in the summarized knowledge may be repeated or overlapping, meaning that the same entity may appear repeatedly, this step merges entities (i.e., graph keywords) that represent the same meaning (or the same concept) through knowledge fusion, integrates knowledge from different sources into a knowledge base, and constructs a knowledge graph based on this.

[0130] For example, multiple knowledge graph keywords with different names but the same meaning are fused to construct a knowledge graph based on the fusion result. Considering the application scenarios that may be involved in this invention embodiment, optionally, the main tasks of knowledge fusion include entity disambiguation and pronoun resolution. Entity disambiguation solves the problem of ambiguity between entities with the same name, while pronoun resolution solves the problem of unclear pronoun references. Generally, knowledge fusion can be achieved through regular expressions. Here are two examples of entity disambiguation: api / v1 and api / v2 can be summarized as api / v{\d+}, and version?1 and version?2 can be summarized as version?{\d+}. This solves the version compatibility problem, that is, different version interfaces under the same path (such as / api / v1 and / api / v2) may be incorrectly clustered, thus causing logical confusion. Here are two more examples of referential resolution: othertoken and token are equivalent, so othertoken can be used as token. Similarly, f1a2=123 and user_id=123 are equivalent, so f1a2=123 can be used as user_id=123. This solves the data obfuscation problem, namely, the difficulty of manual parsing due to randomized field names (e.g., f1a2=123 replacing user_id=123). It also solves the dynamic adaptability problem, namely, dynamically generated parameters in the interface (such as session ID, timestamp, and random token) cause requests with the same logic to appear in different forms in the URL or request body. Interface identification tools may mistakenly identify two requests as independent interfaces, rather than different instances of the same interface.

[0131] The above example demonstrates how fusing different but identically named graph keywords from multiple knowledge sources ensures the accuracy of the constructed knowledge graph, thereby further improving the accuracy of interface recognition.

[0132] S330. In response to network traffic, for the target Uniform Resource Locator in the network traffic, extract the target keyword from the target Uniform Resource Locator, and use the target keyword as the head entity to obtain the head entity vector.

[0133] S340. Obtain the pre-obtained tail entity vector and graph matrix, wherein the tail entity vector represents the tail entity obtained by analyzing multiple first unified resource locators pointing to the interface, and the graph matrix is ​​obtained based on the knowledge graph.

[0134] S350. Transform the head entity vector according to the graph matrix to obtain the transformed vector, and obtain the interface recognition result based on the transformed vector and the tail entity vector. The interface recognition result indicates whether the target Uniform Resource Locator is a Uniform Resource Locator pointing to the interface.

[0135] The technical solution of this invention involves acquiring multiple pieces of knowledge and fusing them to construct a knowledge graph, which is the key to accurate interface recognition in the future.

[0136] Figure 10 This is a structural block diagram of an interface identification device provided in an embodiment of the present invention. This device is used to execute the interface identification method provided in any of the above embodiments. This device and the interface identification methods of the above embodiments belong to the same inventive concept. Details not described in detail in the embodiments of the interface identification device can be found in the embodiments of the above interface identification methods. See also... Figure 10 The device may specifically include: a head entity vector acquisition module 410, a map matrix acquisition module 420, and an interface recognition module 430.

[0137] Among them, the header entity vector acquisition module 410 is used to respond to network traffic, extract target keywords from the target Uniform Resource Locator in the network traffic, and use the target keywords as header entities to obtain header entity vectors.

[0138] The graph matrix acquisition module 420 is used to acquire the pre-obtained tail entity vector and graph matrix. The tail entity vector represents the tail entity by analyzing multiple first unified resource locators pointing to the interface. The graph matrix is ​​obtained based on the pre-constructed knowledge graph. The knowledge graph represents whether the graph keywords in the knowledge graph are keywords pointing to the interface.

[0139] The interface recognition module 430 is used to transform the head entity vector according to the graph matrix to obtain the transformed vector, and obtain the interface recognition result according to the transformed vector and the tail entity vector. The interface recognition result indicates whether the target Uniform Resource Locator is a Uniform Resource Locator pointing to the interface.

[0140] Optionally, the interface identification module 430 may include:

[0141] The first scoring submodule is used to determine the semantic similarity between the transformed vector and the tail entity vector, so as to obtain the first score based on the semantic similarity.

[0142] The interface recognition submodule is used to obtain the interface recognition result based on the first score.

[0143] Optionally, the aforementioned interface identification device may further include:

[0144] The rule data acquisition module is used to acquire multiple predefined rule data, which includes rule keywords and data. The data represents the confidence level or second score of the interface pointed to by the rule keywords.

[0145] The target rule data determination module is used to determine target rule data from multiple rule data based on target keywords, wherein the rule keywords in the target rule data match the target keywords;

[0146] The interface identification submodule may include:

[0147] The interface recognition unit is used to obtain the interface recognition result based on the data in the target rule data and the first score.

[0148] Based on this, optionally, multiple rule data include multiple first rule data and second rule data, with the second rule data obtained through the following module:

[0149] The second rule data acquisition module is used to input multiple first rule data into the inference predictor for inference, and obtain the second rule data based on the output of the inference predictor.

[0150] Optionally, the head entity vector acquisition module 410 may include:

[0151] The predicate keyword acquisition unit is used to acquire predefined predicate keywords, where the predicate keywords are keywords that point to interfaces or non-interfaces;

[0152] The header entity is a unit used to determine the target keyword located in the target Uniform Resource Locator from all predicate keywords and to use the target keyword as the header entity.

[0153] The head entity vector acquisition unit is used to input the head entity into the vector extractor to obtain the head entity vector.

[0154] Optionally, the knowledge graph is pre-built using the following modules:

[0155] The knowledge acquisition module is used to acquire multiple pieces of knowledge, including whether the keywords in the knowledge representation graph are keywords that point to the interface;

[0156] The knowledge graph construction module is used to merge multiple pieces of knowledge to build a knowledge graph.

[0157] Optionally, the knowledge graph construction module may include:

[0158] The knowledge graph construction unit is used to fuse graph keywords with different names but the same meaning from multiple knowledge points, so as to construct a knowledge graph based on the fusion results.

[0159] Optionally, the spectral matrix can be pre-constructed using the following modules:

[0160] The weight acquisition module is used to obtain a pre-set path ranking algorithm and use the path ranking algorithm to perform path mining in the knowledge graph to obtain multiple paths and the weights corresponding to each path. The weights are related to the frequency of occurrence of the corresponding path in multiple second uniform resource locators pointing to the interface.

[0161] The graph matrix construction module is used to construct a graph matrix based on multiple paths and the weights corresponding to each path.

[0162] Optionally, the interface recognition module described above may further include:

[0163] The manual review result acquisition module is used to acquire the manual review result of the interface identification result when the interface identification result indicates that the target Uniform Resource Locator points to the suspected interface.

[0164] The graph keyword addition module is used to add target keywords as new graph keywords pointing to interfaces when the manual review results indicate that the target Uniform Resource Locator (URL) is a URL pointing to an interface.

[0165] The interface recognition device provided in this embodiment of the invention, through a header entity vector acquisition module, responds to network traffic by extracting target keywords from target Uniform Resource Locators (URLs) in the network traffic and using the target keywords as header entities to obtain a header entity vector. Through a graph matrix acquisition module, it acquires a pre-obtained tail entity vector and a graph matrix. The tail entity vector represents tail entities obtained by analyzing multiple first URLs pointing to the interface. The graph matrix is ​​obtained based on a pre-constructed knowledge graph, which indicates whether the graph keywords in the knowledge graph are keywords pointing to the interface. Further, through an interface recognition module, the header entity vector is transformed according to the graph matrix to obtain a transformed vector. Then, the interface recognition result is obtained based on the transformed vector and the tail entity vector, indicating whether the target URL is a URL pointing to the interface. This device, based on knowledge graph technology for interface recognition, can improve the accuracy of interface recognition, eliminating the need for extensive manual review of interface recognition results and effectively reducing the workload of manual intervention.

[0166] The interface identification device provided in the embodiments of the present invention can execute the interface identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0167] It is worth noting that in the embodiments of the above-mentioned interface identification device, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0168] Figure 11 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0169] like Figure 11As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0170] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0171] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as interface identification methods.

[0172] In some embodiments, the interface identification method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the interface identification method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the interface identification method by any other suitable means (e.g., by means of firmware).

[0173] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-chips or system-on-a-chips (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0174] Computer programs used to implement the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0175] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0176] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0177] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0178] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0179] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0180] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0181] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An interface identification method, characterized in that, include: In response to network traffic, for the target Uniform Resource Locator in the network traffic, target keywords are extracted from the target Uniform Resource Locator, and the target keywords are used as header entities to obtain a header entity vector; Obtain a pre-obtained tail entity vector and graph matrix, wherein the tail entity vector represents the tail entity obtained by analyzing multiple first Uniform Resource Locators pointing to the interface, and the graph matrix is ​​obtained based on a pre-constructed knowledge graph, wherein the knowledge graph indicates whether the graph keywords in the knowledge graph are keywords pointing to the interface; The head entity vector is transformed according to the graph matrix to obtain the transformed vector, and the interface identification result is obtained according to the transformed vector and the tail entity vector. The interface identification result indicates whether the target Uniform Resource Locator is a Uniform Resource Locator pointing to an interface.

2. The method according to claim 1, characterized in that, The step of obtaining the interface recognition result based on the transformed vector and the tail entity vector includes: Determine the semantic similarity between the transformed vector and the tail entity vector, and obtain a first score based on the semantic similarity; Based on the first score, the interface recognition result is obtained.

3. The method according to claim 2, characterized in that, Also includes: Obtain multiple predefined rule data, wherein the rule data includes rule keywords and data, and the data represents the confidence level or second score of the interface pointed to by the rule keywords; Based on the target keyword, target rule data is determined from multiple sets of rule data, wherein the rule keywords in the target rule data match the target keyword; The step of obtaining the interface identification result based on the first score includes: Based on the data in the target rule data and the first score, the interface identification result is obtained.

4. The method according to claim 3, characterized in that, The multiple sets of rule data include multiple sets of first rule data and second rule data, wherein the second rule data is obtained in the following manner: Multiple sets of the first rule data are input into the inference predictor for inference, and the second rule data is obtained based on the output of the inference predictor.

5. The method according to claim 1, characterized in that, The step of extracting target keywords from the target Uniform Resource Locator (URL) and using the target keywords as header entities to obtain a header entity vector includes: Obtain predefined predicate keywords, wherein the predicate keywords are keywords that point to interfaces or non-interfaces; From all the predicate keywords, determine the target keyword located in the target Uniform Resource Locator, and use the target keyword as the head entity; The head entity is input into the vector extractor to obtain the head entity vector.

6. The method according to claim 1, characterized in that, The knowledge graph is pre-constructed in the following manner: Multiple pieces of knowledge are acquired, wherein the knowledge indicates whether the graph keywords are keywords pointing to an interface; Multiple pieces of knowledge are fused together to construct the knowledge graph.

7. The method according to claim 6, characterized in that, The process of fusing multiple pieces of knowledge to construct the knowledge graph includes: Multiple knowledge graph keywords with different names but the same meaning are fused together to construct the knowledge graph based on the fusion result.

8. The method according to claim 1, characterized in that, The atlas matrix is ​​pre-constructed in the following manner: A pre-set path sorting algorithm is obtained, and the path sorting algorithm is used to perform path mining in the knowledge graph to obtain multiple paths and the weights corresponding to each path. The weights are related to the frequency of occurrence of the corresponding path in multiple second uniform resource locators pointing to the interface. The graph matrix is ​​constructed based on the multiple paths and the weights corresponding to each path.

9. The method according to claim 1, characterized in that, Also includes: If the interface identification result indicates that the target Uniform Resource Locator (URL) is a URL pointing to a suspected interface, obtain the manual review result of the interface identification result. If the manual review result indicates that the target Uniform Resource Locator (URL) is a URL pointing to an interface, the target keyword is added to the knowledge graph as a new graph keyword pointing to the interface.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the interface identification method as described in any one of claims 1-9.

Images