API (Application Program Interface) data security protection method and device and electronic equipment

Abstract

The embodiment of the invention provides an API (Application Program Interface) data security protection method and device and electronic equipment. The method comprises the following steps: standardizing a real-time API data stream to obtain standardized data; performing sensitive data identification on the standardized data by adopting a heterogeneous fusion identification method to obtain a sensitive data identification result; performing sensitivity scoring on the API data stream according to the sensitive data identification result to obtain a sensitivity score of the API data stream; determining a threat level of the API data flow according to the sensitivity score; and executing a target protection measure corresponding to the threat level on the API data stream. According to the application, the purposes of actively identifying the distribution characteristics of the sensitive information in the API data stream and improving the identification precision can be achieved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an API data security protection method, apparatus and electronic device. Background Technology

[0002] Existing API (Application Programming Interface) data security protection technologies mainly suffer from the following problems: Passive protection mode: Traditional WAF (Web Application Firewall) mainly uses signature matching and rule detection, which cannot actively identify and analyze the distribution characteristics of sensitive information in API data streams.

[0003] Inaccurate identification of sensitive APIs: (API usage) Existing technologies use simple keyword matching or regular expressions to detect sensitive data, which is prone to false positives and false negatives and cannot accurately assess the sensitivity level of the data.

[0004] Lack of automated analysis capabilities: Current API security protection mainly relies on manual configuration of rules and policies, which cannot automatically learn and adapt to new data theft crawlers and attack patterns. In particular, there is a lack of effective automatic discovery mechanisms for hidden attack surfaces such as shadow APIs and abandoned APIs.

[0005] The protection strategies lack specificity: Existing protection measures mostly adopt fixed and differentiated protection strategies, and do not formulate protection plans based on data sensitivity levels. They cannot dynamically adapt the protection intensity according to data sensitivity, resulting in insufficient protection specificity. Summary of the Invention

[0006] To address the aforementioned technical problems, this application provides an API data security protection method, apparatus, electronic device, and storage medium.

[0007] In a first aspect, embodiments of this application provide an API data security protection method, the method comprising: Standardize the real-time collected API data stream to obtain standardized data; The standardized data is identified using a heterogeneous fusion identification method to obtain the sensitive data identification results. The sensitivity score of the API data stream is obtained by performing a sensitivity score on the API data stream based on the sensitive data identification results. The threat level of the API data stream is determined based on the sensitivity score. Perform targeted protection measures on the API data stream that correspond to the threat level.

[0008] Secondly, embodiments of this application provide an API data security protection device, the device comprising: The standardized data acquisition module is used to standardize the real-time collected API data stream to obtain standardized data; The identification result acquisition module is used to perform sensitive data identification on the standardized data using a heterogeneous fusion identification method to obtain sensitive data identification results. The sensitivity score acquisition module is used to perform sensitivity scoring on the API data stream based on the sensitive data identification results, and obtain the sensitivity score of the API data stream. The threat level determination module is used to determine the threat level of the API data stream based on the sensitivity score. The protection measures execution module is used to execute target protection measures corresponding to the threat level on the API data stream.

[0009] Thirdly, embodiments of this application provide an electronic device, including: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the API data security protection method described above.

[0010] Fourthly, embodiments of this application provide a computer-readable storage medium that, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to perform the API data security protection method described in any of the preceding claims.

[0011] Compared with the prior art, the embodiments of this application have the following advantages: In this embodiment, by first standardizing the real-time collected API data stream, and then using a heterogeneous fusion identification method to replace the signature matching and rule detection of traditional WAFs, the distribution characteristics of sensitive information in the API data stream can be proactively identified and the identification accuracy improved. This solves the problems of passive protection, false positives and false negatives in sensitive API identification, and inaccurate sensitivity level assessment. By calculating sensitivity scores and determining threat levels, and executing corresponding target protection measures, the reliance on manually configured rules can be eliminated to adapt to new attack patterns. At the same time, differentiated protection based on sensitivity levels can solve the problems of lack of automated analysis capabilities and insufficient targeting of protection strategies.

[0012] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0013] Figure 1 A flowchart illustrating the steps of an API data security protection method provided in this application embodiment; Figure 2 A flowchart illustrating the steps of a method for obtaining sensitive data identification results provided in this application embodiment; Figure 3 A flowchart illustrating the steps of another method for obtaining sensitive data identification results provided in this application embodiment; Figure 4 A flowchart illustrating the steps of a sensitivity scoring method provided in this application embodiment; Figure 5 A flowchart illustrating the steps of a target protection measure implementation method provided in this application embodiment; Figure 6 A schematic diagram of the structure of a system provided in this application embodiment; Figure 7 A schematic diagram of a data processing flow provided in an embodiment of this application; Figure 8 A schematic diagram of the structure of an API data security protection device provided in this application embodiment; Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0014] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0015] Reference Figure 1 The diagram illustrates a flowchart of the steps of an API data security protection method provided in an embodiment of this application. Figure 1 As shown, the API data security protection method may include steps 101 to 105.

[0016] Step 101: Standardize the real-time collected API data stream to obtain standardized data.

[0017] In this embodiment, API data stream refers to the collection of various types of data transmitted through the API interface, including request data, response data, metadata, and network environment-related data.

[0018] When performing security monitoring of API data, it's possible to capture the inbound and outbound data streams (i.e., API data streams) of all target API interfaces, including complete information such as request headers, request parameters, response bodies, IP addresses, and access times. Then, the API data streams can be standardized to obtain standardized data. Specific standardization processes may include, but are not limited to: JSON format standardization, XML-to-JSON conversion, form data processing, and binary data processing.

[0019] After obtaining the standardized data, proceed to step 102.

[0020] Step 102: Use the heterogeneous fusion identification method to identify sensitive data in the standardized data and obtain the sensitive data identification results.

[0021] Heterogeneous fusion recognition method refers to a sensitive data recognition method that integrates three heterogeneous technologies: regular expression recognition, machine learning recognition, and deep learning recognition. It improves recognition accuracy through the fusion of multi-dimensional results.

[0022] Sensitive data identification results refer to the identification conclusions output by heterogeneous fusion identification methods, which include information such as sensitive data category, location, confidence level, and fine-grained labels.

[0023] After obtaining standardized data, a heterogeneous fusion identification method can be used to identify sensitive data within the standardized data to obtain the sensitive data identification result. Specifically, the regularization identification layer can match field values ​​through a sensitive data regularization rule base and output the regularization identification result. The machine learning layer inputs feature vectors into models such as random forests and support vector machines and outputs machine learning identification results. The deep learning layer preprocesses the standardized data through text serialization, lexicalization, etc., and then outputs deep learning identification results through models such as BERT and CNN. Finally, the target weight can be determined based on the historical accuracy of each identification layer, and the predicted category and confidence of the three types of identification results can be weighted and fused to obtain the sensitive data identification result containing the final category and confidence. This implementation process will be combined with the following embodiments. Figure 2 A detailed description will not be repeated here.

[0024] Step 103: Perform a sensitivity score on the API data stream based on the sensitive data identification results to obtain the sensitivity score of the API data stream.

[0025] After obtaining the sensitive data identification results, the API data stream can be scored for sensitivity based on these results. The scoring dimensions for the API data stream are pre-defined core dimensions used to assess its sensitivity, including data type sensitivity, data volume, access frequency, abnormal user behavior, and API risk attributes. The sensitivity score is a quantified value obtained by weighting the scores of each dimension based on their weights, thus characterizing the sensitivity of the API data stream. The processing of scoring each dimension and the weighting of multi-dimensional scores will be discussed in the following embodiments. Figure 4 A detailed description will not be repeated here.

[0026] Step 104: Determine the threat level of the API data stream based on the sensitivity score.

[0027] After obtaining the sensitivity score, the system can determine the threat level of the API data stream based on the sensitivity score. The threat level refers to the security risk level of the API data stream as classified according to the sensitivity score, typically divided into five levels: extremely high risk, high risk, medium risk, low risk, and information level. By pre-setting the sensitivity score range corresponding to each threat level and matching the calculated sensitivity score with the preset range, the corresponding threat level can be determined.

[0028] Specifically, the system can pre-set the sensitivity score range corresponding to each threat level. For example, 90-100 points corresponds to extremely high risk, 70-89 points corresponds to high risk, 50-69 points corresponds to medium risk, 30-49 points corresponds to low risk, and 0-29 points corresponds to warning level.

[0029] In this embodiment, the threat level is divided into five levels, each corresponding to a different sensitivity score range, data category, response time requirement, and typical scenario. The extremely high risk level (L5) has a score range of 90-100 points, involving top-secret or confidential data, such as serious data breaches like the leakage of combinations of ID card numbers, mobile phone numbers, and bank card numbers. The high risk level (L4) has a score range of 70-89 points, involving confidential or secret data, such as bulk access to single confidential or secret data fields. The medium risk level (L3) has a score range of 50-69 points, involving secret or general data, such as abnormal access to verification codes or order information. The low risk level (L2) has a score range of 30-49 points, involving general or public data, such as frequent queries of business data. The warning level (L1) has a score range of 0-29 points, involving public data, such as abnormal access to public information.

[0030] By establishing a correlation between sensitivity scores and threat levels, the system can quickly and accurately identify API data streams with different risk levels.

[0031] Step 105: Perform target protection measures on the API data stream corresponding to the threat level.

[0032] Target protection measures refer to the protection methods selected from the graded response strategy that match the threat level of the API data flow, including blocking, rate limiting, de-identification, account management, and alerts.

[0033] After obtaining the threat level, the corresponding target protection measures can be determined and implemented on the API data stream. Specifically, a set of candidate protection measures corresponding to the current threat level can be selected from the tiered response strategy (e.g., blocking + account locking + alerting for extremely high threat level, and rate limiting + data masking for medium threat level). The target protection measures are determined from the candidate set based on the current business scenario (e.g., prioritizing availability in payment scenarios) and execution priority. Then, preset interfaces can be called to execute the protection measures (e.g., blocking via the API gateway, or calling the data masking service to handle sensitive fields). During execution, the execution status of the measures can be monitored in real time, and execution logs and the impact on business (e.g., normal request pass rate) can be recorded. The protection process will be discussed in the following embodiments. Figure 5 A detailed description will not be repeated here.

[0034] This application's embodiments first standardize the real-time collected API data streams, then employ a heterogeneous fusion identification method to replace the traditional WAF's signature matching and rule detection. This proactively identifies the distribution characteristics of sensitive information in the API data streams and improves identification accuracy, solving the problems of passive protection, false positives and false negatives in sensitive API identification, and inaccurate sensitivity level assessment. By calculating sensitivity scores and determining threat levels, and executing corresponding target protection measures, it can eliminate the reliance on manually configured rules to adapt to new attack patterns. Furthermore, by using sensitivity levels as the core to achieve differentiated protection, it can address the lack of automated analysis capabilities and insufficient targeting of protection strategies.

[0035] Next, combined Figure 2 The process for obtaining sensitive data identification results is described in detail.

[0036] Reference Figure 2 The diagram illustrates a flowchart of the steps involved in obtaining sensitive data identification results according to an embodiment of this application. Figure 2 As shown, the results of the sensitive data identification may include steps 201 to 205.

[0037] Step 201: Perform multimodal feature extraction on the standardized data to obtain a feature vector containing statistical features, semantic features, contextual features and metadata features.

[0038] In this embodiment, after obtaining standardized data, multimodal feature extraction can be performed on the standardized data to obtain a feature vector containing statistical features, semantic features, contextual features and metadata features.

[0039] In this example, the feature vector has 256 dimensions, including: 1. Statistical characteristics (50 dimensions): number of characters, number of fields, numerical distribution, etc.; 2. Semantic features (100 dimensions): semantic vectors of field names / values ​​based on BERT, etc. 3. Contextual features (100 dimensions): API call chain, user behavior, network environment, etc.; 4. Metadata characteristics (6 dimensions): data freshness, integrity, quality assessment parameters, etc.

[0040] Step 202: Process the standardized data using a regular expression recognition algorithm to obtain the regular expression recognition result.

[0041] In this embodiment, five data sensitivity levels are predefined: 1. PI (Top Secret): Extremely sensitive information. Damage or leakage could pose a significant threat to national security or public interests, or expose the organization to serious financial, legal, or regulatory risks. 2. PII (Confidential): Highly confidential information. Damage or leakage could impact national security or public interests, or expose the organization to financial or legal risks. 3. PIII (Secret): Data that, if damaged or leaked, could negatively impact operations. Damage to this data may have a moderate impact on individual privacy and the company's legitimate interests. 4. PIV (General Data): Data generated and collected during general business operations and management within the company. Damage to this data may have a minor or no impact on individual privacy or the company's legitimate interests. 5. PV (Public Data): Data publicly disclosed after approval.

[0042] In the following embodiments, the technical solution of this embodiment will be described using the above-mentioned sensitivity levels.

[0043] Regular expression algorithms refer to character matching algorithms that use preset sensitive data matching patterns (regular expressions) to accurately match standardized data fields in order to identify sensitive data.

[0044] After obtaining standardized data, regular expression recognition algorithms can be used to process the standardized data and obtain regular expression recognition results. Specifically, a predefined rule base can be used to perform fast pattern matching on the standardized data, traversing all fields and comparing field values ​​with matching patterns one by one, statistically analyzing the sensitive field information of successfully matched fields, calculating category distribution, comprehensive score, predicted category, and layer confidence. This layer has a fast response speed and clear rules, making it particularly suitable for identifying sensitive data with fixed formats.

[0045] Step 203: Process the feature vector using a machine learning model to obtain the machine learning recognition result.

[0046] After obtaining the feature vectors, machine learning models can be used to process them to obtain machine learning recognition results. Specifically, the machine learning model can input the 256-dimensional feature vectors into three models—random forest, support vector machine, and Naive Bayes—for parallel inference. It then uses a fusion strategy combining hard and soft voting to integrate the prediction results, calculate the consistency score and weighted probability distribution, and effectively reduce the prediction bias of a single model.

[0047] Step 204: Process the standardized data using a deep learning model to obtain deep learning recognition results.

[0048] After obtaining standardized data, deep learning models can be used to process the standardized data to obtain deep learning recognition results. Specifically, deep learning models can perform preprocessing on standardized data, such as text serialization, lexicalization, positional encoding, and attention mask generation. The data is then input into four models—BERT, CNN, LSTM, and Transformer—for parallel inference. Preset weights are determined based on historical accuracy and task suitability for attention-weighted fusion, outputting fine-grained label predictions and confidence assessments. This layer excels at capturing semantic features and contextual relationships, significantly improving the recognition accuracy of complex format-sensitive data.

[0049] Step 205: Perform a weighted fusion of the regular expression recognition result, the machine learning recognition result, and the deep learning recognition result to obtain the sensitive data recognition result.

[0050] After obtaining the regular expression recognition results, machine learning recognition results, and deep learning recognition results, a weighted fusion can be performed on these results to obtain the sensitive data recognition result. The weighted fusion process will be described in the following embodiments. Figure 3 Provide a detailed description. The three-layer heterogeneous fusion recognition method adopted in this application's embodiments effectively covers sensitive data scenarios with different formats and complexities by complementing the advantages of three types of technologies: rule-based matching, feature engineering classification, and semantic context capture. This provides accurate and reliable recognition support for API data security protection.

[0051] Next, combined Figure 3 The process of obtaining sensitive data identification results by weighted fusion of three-layer identification results is described in detail.

[0052] Reference Figure 3 The diagram illustrates a flowchart of another method for obtaining sensitive data identification results provided in an embodiment of this application. Figure 3 As shown, the method for obtaining the sensitive data identification result may include steps 301 to 304.

[0053] Step 301: Based on the historical prediction accuracy of the regular expression algorithm, the machine learning model, and the deep learning model, determine the weight adjustment coefficients corresponding to the regular expression algorithm, the machine learning model, and the deep learning model, respectively.

[0054] In this embodiment, historical prediction accuracy refers to the prediction accuracy of regular expression algorithms, machine learning models, and deep learning models when identifying sensitive data in a historical process.

[0055] The weight adjustment coefficient is an adjustment factor calculated based on the historical prediction accuracy of regularization algorithms and machine learning / deep learning models. It is used to correct the basic weights and reflects the deviation between the actual performance of the method and the expectations (the higher the accuracy, the larger the coefficient usually is).

[0056] When fusing multiple prediction results, the historical prediction accuracy of the regular expression algorithm, machine learning model, and deep learning model can be obtained, and the weight adjustment coefficients corresponding to the regular expression algorithm, machine learning model, and deep learning model can be determined based on the historical prediction accuracy of the regular expression algorithm, machine learning model, and deep learning model, respectively.

[0057] Step 302: Determine the adjusted weights of the regular expression algorithm, the machine learning model, and the deep learning model based on their respective base weights and weight adjustment coefficients.

[0058] The base weights refer to the initial weights pre-assigned to the three identification methods.

[0059] The adjusted weight refers to the intermediate weight obtained by multiplying the base weight by the corresponding weight adjustment coefficient. It is a preliminary correction result of the base weight based on actual performance.

[0060] After obtaining the weight adjustment coefficients, the adjusted weights for the regular expression algorithm, machine learning model, and deep learning model can be determined based on the pre-allocated base weights and weight adjustment coefficients.

[0061] The weight coefficients are dynamically adjusted based on the historical prediction accuracy of each recognition layer, so that the model with better performance receives higher weight. The weight adjustment formula is: Adjusted weight = Base weight × (1 + Adjustment coefficient × (Historical accuracy - Baseline accuracy)).

[0062] The adjustment coefficient can be set to 0.2 to control the magnitude of weight adjustment. The baseline accuracy can be set to 0.9 (i.e., 90%) as the dividing point for weight increases or decreases. Historical accuracy can be the statistical prediction accuracy of each recognition layer within the past time window.

[0063] The adjustment rules can be as follows: when the historical accuracy is higher than 90%, the weight increases; when the historical accuracy is lower than 90%, the weight decreases; the adjustment magnitude is proportional to the degree to which the accuracy deviates from the benchmark value.

[0064] Step 303: Normalize the adjusted weights to obtain the target weights corresponding to the regular expression algorithm, the machine learning model, and the deep learning model, respectively.

[0065] The target weight refers to the final weight obtained after the adjusted weights are normalized. It satisfies the condition that the sum of the weights from the three methods is 1, and is the core basis for fusion.

[0066] After obtaining the adjusted weights, the adjusted weights can be normalized to obtain the target weights corresponding to the regular expression algorithm, machine learning model, and deep learning model, respectively.

[0067] Step 304: Based on the target weight, perform weighted fusion of the predicted category and layer confidence of the regularization recognition result, the first predicted category and first fusion confidence of the machine learning recognition result, and the second predicted category and second fusion confidence of the deep learning recognition result to obtain the sensitive data recognition result containing the final predicted category, weighted probability distribution and final confidence.

[0068] The weighted probability distribution refers to the final probability set of each preset category of sensitive data after fusion, which is obtained by summing the category probabilities (or equivalent probabilities) of the three identification methods according to the target weight.

[0069] The final predicted category refers to the final category of sensitive data determined based on the category with the highest probability in the weighted probability distribution.

[0070] The final confidence score is a quantitative index (0-1 range) obtained by weighting the confidence scores of the three identification methods (layer confidence score and first / second fusion confidence score) according to the target weight, reflecting the credibility of the final predicted category.

[0071] Finally, the predicted category and layer confidence of the regular recognition result, the first predicted category and first fusion confidence of the machine learning recognition result, and the second predicted category and second fusion confidence of the deep learning recognition result can be weighted and fused based on the target weight to obtain the sensitive data recognition result containing the final predicted category, weighted probability distribution and final confidence.

[0072] In this embodiment, the three-layer fusion is the core of sensitivity identification. It integrates the results from three levels: regular expression identification, machine learning model identification, and deep learning model identification, and outputs the final comprehensive evaluation result through a dynamic weight fusion algorithm. This mechanism adopts an architecture of multi-strategy fusion + consistency verification + adaptive weight adjustment to ensure the accuracy and reliability of the identification results.

[0073] Next, combined Figure 4 The calculation process for the sensitivity score is described in detail.

[0074] Reference Figure 4 The diagram illustrates a flowchart of a sensitivity scoring method provided in an embodiment of this application. Figure 4 As shown, the sensitivity score acquisition method may include steps 401 to 406.

[0075] Step 401: Determine the data content sensitivity score of the API data stream based on the sensitive data identification results.

[0076] In this embodiment, the data content sensitivity score refers to the quantitative assessment of the risk level of API data stream containing sensitive data based on the sensitive data identification results. The score is usually between 0 and 100 (the higher the score, the stronger the sensitivity).

[0077] After obtaining the sensitive data identification results, the data content sensitivity score of the API data stream can be determined based on the sensitivity identification results. Specifically, the scoring scenario can be determined based on the consistency of the predicted categories of the three-layer results of regular expression identification, machine learning identification, and deep learning identification. In the completely consistent scenario, precise quantification is achieved by combining a preset basic score for the data category with fine-grained label weights and label confidence. In the partially consistent scenario, a disagreement penalty coefficient and a context correction coefficient are introduced to balance the identification of disagreement risks. In the completely inconsistent scenario, a five-dimensional evidence chain analysis is used to collect evidence from five dimensions: format features, statistical features, semantic features, contextual association, and historical behavior, and to calculate the strength of the evidence. Through multiple rounds of iterative correction, the score is gradually optimized by introducing contextual association analysis results, threat intelligence, and business rules until convergence or the maximum number of iterations is reached, thus obtaining the data content sensitivity score.

[0078] Step 402: Determine the access behavior sensitivity score of the API data stream based on the user behavior characteristics in the standardized data.

[0079] Access behavior sensitivity score is a quantitative score (0-100 points) based on whether there are abnormal / high-risk behaviors in user behavior characteristics, reflecting the security risks of the access behavior itself.

[0080] For access behavior sensitivity scoring, the access behavior sensitivity score of API data stream can be determined based on user behavior characteristics in standardized data. Specifically, user behavior characteristics such as access frequency, access time, user permissions, session state, and historical behavior can be extracted from standardized data. Z-Score standardization and normalization are performed on each access behavior factor to eliminate differences in units. The normalized values ​​are then weighted and summed according to preset weights to obtain the access behavior risk score, i.e., the access behavior sensitivity score.

[0081] Step 403: Determine the data flow sensitivity score of the API data flow based on the data flow characteristics in the standardized data.

[0082] Data flow sensitivity score is a score (0-100 points) based on the characteristics of data flow to determine whether there are high-risk transmission paths, reflecting the risk of leakage during data transmission.

[0083] In this example, the data flow sensitivity score of API data flow can be determined based on the data flow characteristics in standardized data. Specifically, data flow characteristics such as cross-border transmission status, third-party sharing status, encrypted transmission status, and de-identification processing status can be extracted. The sum of preset scores corresponding to the triggered risk factors is calculated as the base score, which is then multiplied by the data content sensitivity coefficient corresponding to the final predicted category to achieve a linkage assessment of flow risk and content risk, thus obtaining the data flow sensitivity score.

[0084] Step 404: Determine the business scenario sensitivity score of the API data stream based on the business scenario characteristics in the standardized data.

[0085] Business scenario sensitivity score refers to a score (0-100 points) quantified based on the confidentiality level and risk level of a business scenario, reflecting the sensitivity of the business itself.

[0086] In this example, the business scenario sensitivity score of the API data stream can be determined based on the business scenario characteristics in standardized data. Specifically, a preset scenario base score reflecting inherent business risks can be determined based on business scenario type characteristics, and a business compliance coefficient reflecting compliance execution risks can be determined based on business compliance status characteristics. The two scores are multiplied to obtain the comprehensive business scenario risk score, i.e., the business scenario sensitivity score.

[0087] Step 405: Determine the threat intelligence sensitivity score of the API data stream based on the network environment characteristics in the standardized data and the data source information of the API data stream.

[0088] Network environment characteristics refer to the network attributes of API calls, including network type (public network / internal network), IP address location, and traces of network attacks (such as brute-force attacks and abnormal requests).

[0089] Data source information refers to the data source attributes of API calls, including source IP authorization status, device fingerprint trustworthiness, user identity authentication level, etc.

[0090] Threat intelligence refers to a structured and actionable collection of information about cyber threats, attack behaviors, malicious entities (such as hacker groups and malware developers), and related risks, formed through the collection, aggregation, analysis, and refinement of data from various sources. Its core value lies in helping organizations anticipate potential threats, understand attack intentions and methods, improve the targeting and response efficiency of security protection, and provide data support for cybersecurity decision-making.

[0091] Threat intelligence sensitivity score refers to a score (0-100 points) that quantitatively assesses the external threat risk to API data streams by combining network environment characteristics and data source information.

[0092] In this example, the threat intelligence sensitivity score of an API data stream can be determined based on network environment characteristics in standardized data and data source information. Specifically, the network environment characteristics and data source information can be matched with an external threat intelligence database to obtain the target bonus value corresponding to the hit threat type. The threat confidence level is determined by multiplying the threat intelligence matching degree and the historical attack success rate. The two are then multiplied to obtain the threat intelligence risk score, i.e., the threat intelligence sensitivity score.

[0093] Step 406: Perform a weighted fusion of the data content sensitivity score, the access behavior sensitivity score, the data flow sensitivity score, the business scenario sensitivity score, and the threat intelligence sensitivity score to obtain the sensitivity score of the API data flow.

[0094] After obtaining the data content sensitivity score, access behavior sensitivity score, data flow sensitivity score, business scenario sensitivity score, and threat intelligence sensitivity score, these scores can be weighted and fused to obtain the overall sensitivity score of the API data flow. Specifically, the five dimensions can be weighted and fused according to preset weights: data content (35%), access behavior (25%), data flow (20%), business scenario (12%), and threat intelligence (8%), to obtain the comprehensive sensitivity score of the API data flow.

[0095] In the above implementation, the data type sensitivity dimension assigns different sensitivity scores based on the identified sensitive data types. For example, highly sensitive data such as ID card numbers and bank card numbers have higher weights, while low-sensitivity data such as ordinary nicknames have lower weights. The data volume dimension evaluates the amount of sensitive data returned in the API call; the larger the data volume, the higher the sensitivity score. The access frequency dimension analyzes the degree of anomaly in the API call frequency; an abnormally high frequency may indicate potential data crawling or attack behavior. The user behavior anomaly dimension, combined with UEBA technology, assesses whether the caller's behavior pattern deviates from the normal range, such as abnormal access during abnormal time periods or login from multiple locations. The API risk attribute dimension evaluates the API in conjunction with its security attributes; for example, shadow APIs (unregistered APIs) and deprecated APIs (marked as deprecated but still accessible) have higher risk coefficients.

[0096] In actual calculations, the system can determine data type sensitivity scores based on sensitive data identification results, calculate access behavior dimension scores based on user access frequency and permissions in standardized data, calculate data flow characteristic scores based on cross-border data transmission and encryption status, calculate business scenario dimension scores by combining business scenario types and compliance requirements, and calculate threat intelligence dimension scores by matching network environment characteristics with threat intelligence. The comprehensive sensitivity score is obtained through weighted calculation: S=w1×DT+w2×DV+w3×AF+w4×UB+w5×AR (1) In the above formula (1), DT, DV, AF, UB, and AR represent the scores for data type sensitivity, data volume, access frequency, user behavior abnormality, and API risk attributes, respectively. w1, w2, w3, w4, and w5 are the weight coefficients for each dimension, and the specific weights can be dynamically adjusted according to business needs.

[0097] Based on the comprehensive scoring results, the system classifies API data streams into different threat levels. The low-risk level has a scoring range of [0, 30), indicating a small amount of sensitive data accessed with low risk; the medium-risk level has a scoring range of [30, 59), indicating access involving moderately sensitive data or a large amount of data; the high-risk level has a scoring range of [59, 70), indicating batch access to sensitive data or multiple calls to highly sensitive data; and the severe-risk level has a scoring range of [70, 100], indicating a risk of large-scale leakage of highly sensitive data. Furthermore, the sensitivity scoring and threat level classification can be dynamically optimized based on historical attack data and business needs. For example, machine learning models can be used to adaptively adjust the weights in the scoring formula, further improving the accuracy and real-time performance of the scoring, thereby better adapting to the ever-changing security threat environment.

[0098] This application embodiment comprehensively quantifies the sensitivity score of API data flow from five core dimensions: data content, access behavior, data flow direction, business scenario, and threat intelligence. This score fully reflects the combined impact of the sensitive attributes of the data itself, access behavior risks, transmission path risks, business scenario risks, and external threat risks, providing a scientific and reliable quantitative basis for subsequent threat level determination and graded response strategy formulation.

[0099] Next, combined Figure 5 The implementation process of target protection measures is described in detail.

[0100] Reference Figure 5 The diagram illustrates a flowchart of the steps involved in implementing a target protection measure according to an embodiment of this application. Figure 5 As shown, the method for implementing the target protection measures may include steps 501 to 503.

[0101] Step 501: Select a set of candidate protection measures that match the threat level from the graded response strategy; the graded response strategy refers to a set of mapping strategies that include threat levels and protection measures, including the execution priority of each protection measure and business scenario adaptation rules.

[0102] A tiered response strategy is a set of pre-defined strategies that includes a mapping relationship between "threat level and protection measures" and associates the execution priority of each protection measure with business scenario adaptation rules.

[0103] The candidate set of protective measures refers to the set of all protective measures selected from the graded response strategy that match the current threat level.

[0104] In practice, corresponding protective measures and execution priorities can be pre-set for different threat levels, as shown below: 1. Threat Level: Critically Critical. Automated Measures: Immediately block API calls, force data anonymization (complete masking), temporarily lock user accounts, add IPs to the blacklist (24 hours), and trigger EDR-linked detection. Execution priority is P0 (highest).

[0105] 2. Threat Level: High Risk. Automated Measures: Rate limiting (reduced to 50% of normal frequency), data masking (partial masking), mandatory two-factor authentication, detailed audit logs, and enhanced session monitoring. Execution priority is P1 (high).

[0106] 3. Threat Level: Medium Risk; Automated Measures: Access frequency limit (reduced to 80%), sensitive field masking, enhanced logging, contextual analysis. Execution priority: P2 (medium).

[0107] 4. Threat Level: Low Risk; Automated Measures: Standard logging, behavioral baseline updates, statistical analysis. Execution priority: P3 (low).

[0108] 5. Threat Level: Information Level; Automated Measures: Only record metadata for UEBA training. Execution priority is P4 (lowest).

[0109] After determining the threat level of the API data stream, a set of candidate protective measures matching the threat level can be selected from the tiered response strategy. Specifically, based on the specific threat level corresponding to the previous network threat, a preset tiered response strategy can be retrieved, and all protective measures in the strategy that have a mapping relationship with the threat level can be matched. These protective measures are then summarized to form a set of candidate protective measures.

[0110] Step 502: Based on the execution priority of each measure in the candidate protection measure set and the current business scenario, select the target protection measure from the candidate protection measure set.

[0111] Execution priority refers to the pre-set execution order of protective measures (such as emergency interception > auditing > alarm).

[0112] After obtaining the set of candidate protection measures, the target protection measure can be selected from the set based on the execution priority of each measure and the current business scenario. Specifically, the preset execution priority of each protection measure in the candidate set can be extracted, sorted from high to low priority, and information about the current business scenario (such as business type, data sensitivity, and real-time requirements) can be collected. According to the business scenario adaptation rules, measures that are not suitable for the current scenario (such as high-priority measures that would interrupt core transactions) can be filtered out, and the highest priority measures from 1 to N (where N is a positive integer) among the remaining measures can be selected as the target protection measure.

[0113] Step 503: Perform the target protection measures on the API data stream.

[0114] After identifying the target protection measures, you can apply those measures to the API data stream.

[0115] In one implementation of this application, the target protection measures may include: a multi-level blocking mechanism and a multi-level data desensitization strategy.

[0116] The multi-layered blocking mechanism implements comprehensive protection from four dimensions: network layer, application layer, data layer, and user layer. Network layer blocking, based on network environment characteristics and threat intelligence, blocks access requests from IP addresses that match preset risk conditions or originating from specified geographical locations. Blocking types include IP blacklisting, geographical location restrictions, access frequency restrictions, and connection number restrictions. Application layer blocking, based on the threat level of API data streams and API interface attributes, blocks access requests corresponding to specific API interface user sessions or request parameters. The blocking scope includes all API access requests under a single API interface username and access requests within the current session. Data layer blocking, based on threat level, user permission level, and data type, performs access control operations on access to sensitive data fields. Access control operations include field-level filtering (dynamically filtering sensitive fields), row-level access restrictions (limiting access scope based on data ownership), and time window access control (restricting access to core data outside of working hours). User layer blocking, based on user behavior characteristics and threat level, performs account control operations on users exhibiting abnormal behavior, including temporary account locking, mandatory two-factor authentication, account freezing, and permanent banning. Different control operations correspond to different trigger conditions, release methods, and notification mechanisms. The intelligent blocking decision algorithm uses a decision tree model and a multi-factor comprehensive decision matrix. When the threat level is greater than or equal to 90, it determines whether the IP is in the whitelist. If it is in the whitelist, it forces two-factor authentication; otherwise, it blocks immediately. When the threat level is between 70 and 89, it chooses to force two-factor authentication and limit traffic or only issue an alarm based on the business scenario and the user's historical behavior. When the threat level is between 50 and 69, it performs traffic limiting and data anonymization. When the threat level is less than 50, it allows normal access and records basic logs.

[0117] The multi-level data anonymization strategy dynamically matches the anonymization level based on multi-dimensional decision factors to achieve differentiated and precise anonymization. Anonymization levels range from L1 (complete masking) to L5 (no anonymization), divided into five levels. L1 (complete masking) is suitable for extremely high threats, replacing all characters with asterisks; L2 (strong anonymization) retains only the first and last characters; L3 (standard anonymization) retains the first and last two characters; L4 (weak anonymization) masks only the middle part of the characters; and L5 (no anonymization) displays the data completely. The dynamic anonymization strategy selects four decision factors for weighted calculation: threat level, data sensitivity, user permissions, and business needs. The weight allocation is 40% for threat level, 30% for data sensitivity, 20% for user permissions, and 10% for business needs. A comprehensive score of 90-100 corresponds to L1; 70-89 for complete masking corresponds to L2; 50-69 for strong anonymization corresponds to L3; 30-49 for standard anonymization corresponds to L4; and 0-29 for weak anonymization corresponds to L5 (no anonymization). The data masking process first extracts data categories from the sensitive data identification results and user permission features from the standardized data. Then, it constructs masking level decision factors based on data categories, user permission features, and threat levels. The corresponding masking level is determined based on the weighted calculation results of these decision factors. Finally, masking is performed on sensitive fields in the API data stream based on the masking level. The masking strategy's adaptive optimization mechanism includes over-masking detection and under-masking detection. If the business complaint rate exceeds 5%, the masking level is automatically lowered by one level. If data leakage still occurs after masking, the masking level is automatically raised by one level or even forcibly upgraded to L1 complete masking.

[0118] This application achieves end-to-end security protection from network entry to data use through the coordinated work of multi-layered blocking mechanisms and multi-level data anonymization strategies, as well as a graded response and protection measures execution mechanism. It accurately intercepts malicious behavior while avoiding the impact of excessive protection on normal business through refined management. It maximizes data availability while ensuring data privacy and security, and provides intelligent, automated, and continuously optimized protection capabilities for API data security.

[0119] In this embodiment, an incremental learning mechanism can also be used to update the regular expression recognition algorithm, machine learning model, and deep learning model in the heterogeneous fusion recognition method.

[0120] The triggering conditions for the incremental learning mechanism may include at least one of the following: periodic triggering conditions, event-driven triggering conditions, and performance degradation triggering conditions.

[0121] Periodic triggering: The incremental learning process is automatically started every preset time period (e.g., 24 hours) to ensure that the model continuously adapts to changes in data distribution.

[0122] Event-driven triggering conditions may include at least one of the following: a new type of sensitive data pattern is manually labeled, the cumulative number of samples with confidence levels below the threshold reaches a preset sample size threshold, the number of false positives exceeds the first threshold, and the number of false negatives exceeds the second threshold.

[0123] Performance degradation triggers may include: the F1 score of a machine learning model or deep learning model on the validation set drops by more than a set threshold (such as 5%).

[0124] In another implementation of this application, the step of updating the regular expression recognition algorithm, machine learning model, and deep learning model in the heterogeneous fusion recognition method using an incremental learning mechanism may include: Step S1: Obtain labeled data, which includes at least data field information, prediction results of each recognition algorithm and model, prediction confidence, true labels, and matching correctness indicators.

[0125] In this embodiment, when updating the regular expression recognition algorithm, machine learning model and deep learning model in the heterogeneous fusion recognition method using an incremental learning mechanism, labeled data can be obtained. The labeled data includes at least data field information, prediction results of each recognition algorithm and model, prediction confidence, true labels and matching correctness indicators.

[0126] I. Sources of learning data.

[0127] Data source 1: High-confidence samples from completely identical scenarios.

[0128] Screening criteria: 1. The three-layer recognition results are completely consistent; 2. The overall confidence level is ≥ 0.90; 3. No manual review was triggered.

[0129] Purpose: To serve as high-quality positive samples, enhance the model's ability to identify typical patterns, and update the matching weights of the regularization rule base.

[0130] Data source 2: Manually labeled samples from scenarios that are partially consistent or inconsistent.

[0131] Screening criteria: 1. Samples that trigger the manual review process; 2. Samples annotated by security experts; 3. Annotation confidence level ≥ 0.85.

[0132] Purpose: To serve as difficult samples, improving the model's ability to discriminate boundary conditions. To discover new sensitive data patterns.

[0133] Data source 3: Indirect leakage cases from contextual correlation analysis.

[0134] Screening criteria: 1. Cases where indirect leakage risk was detected; 2. Cases with entity integrity > 0.6; 3. Cases involving ≥ 3 API calls.

[0135] Purpose: To train the context association analysis model and update the combined attack pattern library.

[0136] Data source 4: False alarm / missed alarm feedback.

[0137] Sources: Alarm handling feedback from the Security Operations Center (SOC); false alarm complaints from business departments; cases of missed reporting discovered during security audits.

[0138] Purpose: To correct systematic biases in models; to adjust sensitivity score thresholds.

[0139] Step S2: Perform statistical analysis on the labeled data, determine new weights based on the statistical analysis results and the original weights of the regular expression algorithm, and update the regular expression recognition algorithm based on the new weights.

[0140] After obtaining the labeled data, statistical analysis can be performed on it. Based on the statistical analysis results and the original weights of the regular expression algorithm, new weights are determined, and the regular expression recognition algorithm is updated according to the new weights. Specifically, the total number of matches and the number of correct matches within a preset period for each regular expression rule can be counted, and the matching accuracy can be calculated. Combining the original weights, the matching accuracy, and the preset learning rate, new weights are obtained through a preset weight update formula and pushed to the regular expression recognition layer to complete the update of the regular expression recognition algorithm.

[0141] Step S3: Based on the labeled data, update the parameters of the machine learning model using an online learning method.

[0142] After obtaining the labeled data, the parameters of the machine learning model can be updated using online learning methods. Specifically, based on the labeled data, the probability parameters of the machine learning model can be incrementally updated when the cumulative number of newly labeled samples reaches a preset sample size. The update process uses a preset smoothing strategy to avoid zero probability. When the cumulative number of newly labeled samples reaches another preset sample size, the decision parameters of the machine learning model are fine-tuned. The feature importance ranking of the machine learning model is recalculated every preset period and pushed to the machine learning layer to complete the incremental update of the machine learning model.

[0143] Step S4: Based on the labeled data, update the parameters of the deep learning model using an offline learning method.

[0144] After obtaining the labeled data, the parameters of the deep learning model can be updated using an offline learning approach. Specifically, a hybrid training dataset can be constructed based on the labeled data, combined with high-value difficult samples and historical high-quality samples. The deep learning model can then be fine-tuned or fully retrained using this hybrid training dataset. The performance of the trained deep learning model can be evaluated, and when the evaluation results meet a preset performance threshold, the updated deep learning model can be pushed to the deep learning layer through a canary release process, thus completing the offline optimization and update of the deep learning model.

[0145] Step S5: Select candidate samples from the real-time data stream of the production environment to build a sample pool, calculate the value score based on uncertainty, diversity and representativeness indicators, select target samples according to the value score and push them to the manual annotation platform, receive the annotation results and add annotation data to trigger the next round of incremental learning.

[0146] In this embodiment, an active learning process can also be executed to assist incremental updates. That is, candidate samples are screened from the real-time data stream of the production environment to build a sample pool, value scores are calculated based on uncertainty, diversity and representativeness indicators, target samples are screened according to the value scores and pushed to the manual annotation platform, and annotation results are received and annotation data is added to trigger the next round of incremental learning.

[0147] The calculation process for the value score can be described in detail below with reference to the implementation method.

[0148] In another implementation of this application, step S5 may include: Sub-step M1: Calculate the reciprocal of the maximum predicted probability of the model to obtain the uncertainty score.

[0149] In this embodiment, the model prediction probability refers to the quantitative value of the prediction result of the machine learning model or deep learning model in the heterogeneous fusion identification method for each preset sensitive data category to which the candidate sample belongs (the value ranges from 0 to 1, and the sum of the prediction probabilities of all categories is 1), which reflects the degree of the model's determination of the sample category.

[0150] Uncertainty score is a quantitative indicator calculated based on the model's predicted probability. Specifically, it is the reciprocal of the maximum value in the set of predicted probabilities for each preset sensitive data category output by the machine learning model or deep learning model for the candidate sample.

[0151] When calculating the uncertainty score, the reciprocal of the maximum predicted probability of the model can be calculated to obtain the uncertainty score. Specifically, the predicted probability set of each preset sensitive data category output by the machine learning model or deep learning model of the candidate sample can be obtained, the maximum value in the set can be extracted, and the reciprocal of the maximum value can be calculated to obtain the uncertainty score (the higher the score, the higher the uncertainty of the model in determining the sample category).

[0152] Sub-step M2: Calculate the ratio of the minimum distance to the average distance between the sample and the cluster centers of the labeled samples to obtain the diversity score.

[0153] Cluster centers refer to the core feature vectors of each sample cluster obtained after processing the labeled sample set according to a preset clustering algorithm. They are generated by calculating the mean or other preset aggregation methods from the feature vectors of all samples within the cluster, and are a comprehensive representation of the features of the corresponding sample cluster.

[0154] Diversity score is a quantitative indicator that characterizes the difference in features between a candidate sample and a labeled sample. Specifically, it is the ratio of the minimum distance between the feature vector of the candidate sample and each cluster center of the labeled sample set to the average distance between the candidate sample and all cluster centers. The distance is calculated by a preset distance algorithm.

[0155] When calculating diversity scores, the ratio of the minimum distance to the average distance between a sample and the cluster centers of labeled samples can be calculated to obtain the diversity score. Specifically, the cluster centers of each sample cluster generated after processing the labeled sample set using a preset clustering algorithm can be retrieved. The Euclidean or cosine distance between the feature vector of the candidate sample and each cluster center can be calculated, and the minimum distance can be selected. The average distance between the candidate sample and all cluster centers can then be calculated. The minimum distance is compared with the average distance to obtain the diversity score (a higher score indicates a greater difference in features between the sample and the labeled samples).

[0156] Sub-step M3: Calculate the reciprocal of the sample density to obtain the representativeness score.

[0157] Sample density refers to the quantitative value of the number of existing samples of the same type or samples with similar features within the preset neighborhood of the candidate sample to be evaluated in the preset sample feature space. It is used to characterize the density of the distribution of the candidate sample in the sample space.

[0158] Representativeness score is a quantitative indicator calculated based on the distribution of samples in the feature space. Specifically, it is the reciprocal of the number of labeled samples of the same type or samples with similar features within a preset neighborhood of a candidate sample in the preset sample feature space (i.e., sample density).

[0159] When calculating the representativeness score, the reciprocal of the sample density can be calculated to obtain the representativeness score. Specifically, within a preset sample feature space, a preset neighborhood range of candidate samples can be determined (e.g., based on a feature similarity threshold or a fixed radius). The number of labeled samples of the same type or with similar features within this neighborhood range is counted to obtain the sample density. The reciprocal of this sample density is then calculated to obtain the representativeness score (a higher score indicates a sparser distribution of samples in the feature space, and thus a higher supplementary value).

[0160] Sub-step M4: The uncertainty score, the diversity score, and the representativeness score are weighted and summed to obtain the value score.

[0161] After obtaining the uncertainty score, diversity score, and representativeness score, a weighted sum of these scores can be performed to obtain the value score. Specifically, preset weights for uncertainty, diversity, and representativeness scores (with a total weight of 1) are retrieved, and the three scores are multiplied by their respective weights and then summed to obtain the value score of the candidate sample.

[0162] This application embodiment quantifies the uncertainty of the model's judgment of samples, the feature differences between samples and labeled data, and the sparsity of sample distribution in the feature space. It uses a weighted summation method to comprehensively evaluate the value of candidate samples, which can accurately screen out high-value samples that significantly improve the model optimization, reduce the cost of invalid labeling, improve the efficiency of manual labeling and the targeting of incremental learning, and provide high-quality data support for continuous model optimization.

[0163] To avoid catastrophic forgetting and improve training efficiency during the incremental learning process described above, this application employs a hybrid sample selection strategy for scientific management of training data. Regarding new sample selection, the system extracts high-value samples from the real-time API data stream, prioritizing samples with high model prediction uncertainty (i.e., samples whose entropy exceeds a preset threshold). Simultaneously, it focuses on manually labeled false positives and false negatives, as well as newly emerging API endpoints or data patterns. This selection mechanism ensures that incremental learning focuses on the most valuable data, thereby improving the model's generalization ability and adaptability.

[0164] In the historical sample replay strategy, the system randomly selects representative historical samples from the sample memory, with the proportion set at 30% to 50% of the new samples. To ensure the effective preservation of historical knowledge, the system adopts an importance sampling strategy, prioritizing the retention of boundary samples close to the classification decision boundary, typical attack samples such as confirmed data theft cases, and long-tailed samples such as rare but important sensitive data types. This replay mechanism can effectively consolidate the model's memory of historical patterns while learning new knowledge.

[0165] The sample memory management uses a fixed-capacity circular buffer to store historical samples. When the buffer capacity reaches its limit, the system uses an eviction policy based on time decay and sample importance. The eviction priority is calculated using the following formula: (2) In the above formula (2), As a priority for elimination, The time decay factor, For sample importance, and These are the weighting coefficients.

[0166] Among these, samples that are older and less important are prioritized for elimination. This dynamic management mechanism ensures both the storage efficiency of the memory and the long-term retention of key samples.

[0167] The incremental learning process employs multiple techniques to prevent catastrophic forgetting. Knowledge distillation retains the old model as the teacher model, enabling the new model to learn not only the true labels but also the output distribution of the teacher model during training. The loss function is designed as follows: (3) In the above formula, For the total loss, For the cross-entropy loss of new samples, To the KL divergence with the teacher model output, These are weighting coefficients. This method allows learners to retain historical knowledge while learning new information.

[0168] Elastic weight consolidation technique calculates the importance of model parameters to historical tasks, i.e., the Fisher information matrix, and applies regularization constraints to important parameters when updating them. Its loss function is: (4) In the above formula (4), For loss function, For parameter importance, For the updated model parameters, For old model parameters, This is the balance coefficient.

[0169] To quantify the effectiveness of incremental learning, this application designs the following evaluation metrics: (1) Forward Transfer: measures the model’s ability to learn new data patterns: FT = baseline accuracy from zero training / new task accuracy.

[0170] (2) Backward Transfer: measures whether catastrophic forgetting occurs: BT = accuracy of old task before incremental learning / accuracy of old task after incremental learning.

[0171] (3) Training efficiency improvement ratio: reflects the efficiency advantage of incremental learning: E ​​= time required for incremental learning / time required for training from zero.

[0172] Each incremental learning update of the model can be compared with the above metrics and preset thresholds to determine whether it should be officially launched.

[0173] The embodiments of this application gradually update the relevant algorithms and models based on newly added labeled data, without the need for full retraining and retaining historical recognition capabilities, thereby achieving continuous optimization of model performance.

[0174] Next, combined Figure 6 The system shown and Figure 7 The flowchart shown describes the technical solution of this embodiment.

[0175] The overall process can be executed in four core modules, and the detailed steps are described below: Module 1: Data Flow Standardization and Preprocessing Module.

[0176] The initial stage of the corresponding process: Data Acquisition: Start the process and collect raw log data (denoted as raw_text); Data standardization processing: Standardization operations such as format regularization and redundancy removal are performed on the raw data to convert it into a standardized JSON format, completing the preprocessing of the data stream and providing a unified input for subsequent analysis.

[0177] Module 2, Sensitivity Analysis and Decision Evaluation Module.

[0178] Multi-level identification and decision-making based on preprocessed data: Feature extraction: Perform feature extraction and feature vector calculation on standardized and preprocessed JSON data to extract statistical features, semantic features, contextual features and metadata, forming a feature set for analysis; Multi-level sensitivity recognition: The "multi-level sensitivity recognition engine" is invoked, and recognition is completed through three parallel units: Regular expression recognition unit: reads the rule base configuration, traverses the data fields and completes pattern matching, outputs the matching results and performs statistics; Machine learning model recognition unit: calls three sub-models, random forest, support vector machine and Naive Bayes, and outputs prediction results respectively. Then the results are merged through the "algorithm recognition result fusion unit". Deep learning model recognition unit: First, the data is preprocessed in a multimodal manner, and then inference is performed in parallel by four sub-models: BERT (semantic understanding), CNN (pattern recognition), LSTM (sequence modeling), and Transformer (attention). The results are output after feature fusion, classification decision, and post-processing optimization. Integrating the decision-making level's judgment: Summarizing the results from the above three units, and judging consistency: If the results are completely consistent, proceed directly to the next step; if the results are partially consistent or completely inconsistent, call the "Dynamic Sensitivity Scoring Algorithm" for re-evaluation.

[0179] Module 3, Incremental Learning and Model Optimization Module.

[0180] To address the non-completely consistent results from the fusion decision layer, initiate iterative model optimization: By employing online learning mechanisms (real-time model updates), offline optimization mechanisms (batch training and parameter tuning), and active learning mechanisms (focusing on high-value samples), the sensitivity recognition model is incrementally optimized to improve the accuracy of subsequent recognition.

[0181] Module 4, Intelligent Response and Handling Module.

[0182] Based on the final sensitivity result output by the fusion decision layer, corresponding security operations (such as IP blocking, API access control, data anonymization, account control, etc. in the previous solution) are executed to complete the security handling of the entire process.

[0183] Reference Figure 8 The diagram illustrates a structural schematic of an API data security protection device provided in an embodiment of this application. Figure 8 As shown, the API data security protection device 800 may include the following modules: The standardized data acquisition module 810 is used to standardize the real-time collected API data stream to obtain standardized data; The identification result acquisition module 820 is used to perform sensitive data identification on the standardized data using a heterogeneous fusion identification method to obtain sensitive data identification results. Sensitivity score acquisition module 830 is used to perform sensitivity score on the API data stream based on the sensitive data identification result, and obtain the sensitivity score of the API data stream; Threat level determination module 840 is used to determine the threat level of the API data stream based on the sensitivity score; The protection measure execution module 850 is used to execute target protection measures corresponding to the threat level on the API data stream.

[0184] Optionally, the recognition result acquisition module includes: The feature vector acquisition unit is used to perform multimodal feature extraction on the standardized data to obtain a feature vector containing statistical features, semantic features, context features and metadata features; The regular expression recognition result acquisition unit is used to process the standardized data using a regular expression recognition algorithm to obtain the regular expression recognition result; The machine recognition result acquisition unit is used to process the feature vector using a machine learning model to obtain machine learning recognition results; The deep recognition result acquisition unit is used to process the standardized data using a deep learning model to obtain deep learning recognition results; The recognition result acquisition unit is used to perform weighted fusion of the regular expression recognition result, the machine learning recognition result and the deep learning recognition result to obtain the sensitive data recognition result.

[0185] Optionally, the recognition result acquisition unit includes: The adjustment coefficient determination subunit is used to determine the weight adjustment coefficients corresponding to the regular expression algorithm, the machine learning model, and the deep learning model respectively, based on the historical prediction accuracy of the regular expression algorithm, the machine learning model, and the deep learning model. The weight adjustment determination subunit is used to determine the adjusted weights of the regular expression algorithm, the machine learning model, and the deep learning model based on the base weights corresponding to the regular expression algorithm, the machine learning model, and the deep learning model, respectively, and the weight adjustment coefficient. The target weight acquisition subunit is used to normalize the adjusted weights to obtain the target weights corresponding to the regular expression algorithm, the machine learning model, and the deep learning model, respectively. The identification result acquisition subunit is used to perform weighted fusion of the predicted category and layer confidence of the regularized identification result, the first predicted category and first fusion confidence of the machine learning identification result, and the second predicted category and second fusion confidence of the deep learning identification result based on the target weight, so as to obtain the sensitive data identification result including the final predicted category, weighted probability distribution and final confidence.

[0186] Optionally, the sensitivity scoring acquisition module includes: The first scoring determination unit is used to determine the data content sensitivity score of the API data stream based on the sensitive data identification result. The second scoring determination unit is used to determine the access behavior sensitivity score of the API data stream based on the user behavior characteristics in the standardized data. The third scoring unit is used to determine the data flow sensitivity score of the API data flow based on the data flow characteristics in the standardized data. The fourth scoring unit is used to determine the business scenario sensitivity score of the API data stream based on the business scenario characteristics in the standardized data. The fifth scoring unit is used to determine the threat intelligence sensitivity score of the API data stream based on the network environment characteristics in the standardized data and the data source information of the API data stream. The sensitivity score acquisition unit is used to perform weighted fusion of the data content sensitivity score, the access behavior sensitivity score, the data flow sensitivity score, the business scenario sensitivity score, and the threat intelligence sensitivity score to obtain the sensitivity score of the API data flow.

[0187] Optionally, the protective measure execution module includes: The measure set filtering unit is used to filter out a set of candidate protection measures that match the threat level from the hierarchical response strategy; the hierarchical response strategy refers to a set of mapping strategies that include threat levels and protection measures, including the execution priority of each protection measure and business scenario adaptation rules. The target protection measure filtering unit is used to filter the target protection measure from the candidate protection measure set based on the execution priority of each measure in the candidate protection measure set and the current business scenario; The target measure execution unit is used to execute the target protection measures on the API data stream.

[0188] Optionally, the device further includes: The update module is used to update the regular expression recognition algorithm, machine learning model and deep learning model in the heterogeneous fusion recognition method using an incremental learning mechanism. The triggering conditions for the incremental learning mechanism include at least one of the following: periodic triggering conditions, event-driven triggering conditions, and performance degradation triggering conditions. The event-driven triggering conditions include at least one of the following: a new type of sensitive data pattern is manually labeled, the cumulative number of samples with confidence levels below the threshold reaches a preset sample size threshold, the number of false alarms exceeds the first threshold, and the number of missed alarms exceeds the second threshold. The performance degradation triggering conditions include: the F1 score of the machine learning model or deep learning model on the validation set drops by more than a set threshold.

[0189] Optionally, the update module includes: The annotation data acquisition unit is used to acquire annotation data, which includes at least data field information, prediction results of each recognition algorithm and model, prediction confidence, true labels and matching correctness indicators; The first update unit is used to perform statistical analysis on the labeled data, determine new weights based on the statistical analysis results and the original weights of the regular expression algorithm, and update the regular expression recognition algorithm based on the new weights. The second update unit is used to update the parameters of the machine learning model based on the labeled data using an online learning method; The third update unit is used to update the parameters of the deep learning model based on the labeled data using an offline learning method; The incremental learning unit is used to filter candidate samples from the real-time data stream of the production environment to build a sample pool, calculate value scores based on uncertainty, diversity and representativeness indicators, select target samples based on value scores and push them to the manual annotation platform, receive annotation results and add annotation data to trigger the next round of incremental learning.

[0190] Optionally, the incremental learning unit includes: The first score acquisition sub-unit is used to calculate the reciprocal of the maximum value of the model's predicted probability to obtain the uncertainty score; The second scoring sub-unit is used to calculate the ratio of the minimum distance to the average distance between the sample and the cluster centers of the labeled samples, and to obtain the diversity score. The third scoring sub-unit is used to calculate the reciprocal of the sample density to obtain the representative score; The value score acquisition subunit is used to perform a weighted summation of the uncertainty score, the diversity score, and the representativeness score to obtain the value score.

[0191] The API data security protection device provided in this application standardizes the real-time collected API data stream and then uses a heterogeneous fusion identification method to replace the signature matching and rule detection of traditional WAFs. This proactively identifies the distribution characteristics of sensitive information in the API data stream and improves identification accuracy, solving the problems of passive protection, false positives and false negatives in sensitive API identification, and inaccurate sensitivity level assessment. By calculating sensitivity scores and determining threat levels, and executing corresponding target protection measures, it can eliminate the reliance on manually configured rules to adapt to new attack patterns. At the same time, it achieves differentiated protection based on sensitivity levels, solving the problems of lack of automated analysis capabilities and insufficient targeting of protection strategies.

[0192] This application also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the above-described API data security protection method.

[0193] Figure 9 A schematic diagram of the structure of an electronic device 900 according to an embodiment of this application is shown. Figure 9 As shown, the electronic device 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 902 or loaded from storage unit 908 into random access memory (RAM) 903. The RAM 903 can also store various programs and data required for the operation of the electronic device 900. The CPU 901, ROM 902, and RAM 903 are interconnected via bus 904. An input / output (I / O) interface 905 is also connected to bus 904.

[0194] Multiple components in electronic device 900 are connected to I / O interface 905, including: input unit 906, such as keyboard, mouse, microphone, etc.; output unit 907, such as various types of monitors, speakers, etc.; storage unit 908, such as disk, optical disk, etc.; and communication unit 909, such as network card, modem, wireless transceiver, etc. Communication unit 909 allows electronic device 900 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0195] The various processes and handling described above can be executed by processing unit 901. For example, the methods of any of the above embodiments can be implemented as computer software programs, which are tangibly contained in a computer-readable medium, such as storage unit 908. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 900 via ROM 902 and / or communication unit 909. When the computer program is loaded into RAM 903 and executed by CPU 901, one or more actions of the methods described above can be performed.

[0196] Additionally, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned API data security protection method.

[0197] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0198] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal that includes said element.

[0199] The present application has been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present application. Therefore, the content of this specification should not be construed as a limitation of the present application.

Claims

1. An API data security protection method, characterized in that, The method comprises: standardizing the real-time collected API data stream to obtain standardized data; using a heterogeneous fusion identification method to identify sensitive data from the standardized data to obtain a sensitive data identification result; scoring the sensitivity of the API data stream according to the sensitive data identification result to obtain a sensitivity score of the API data stream; determining the threat level of the API data stream according to the sensitivity score; performing a target protection measure corresponding to the threat level on the API data stream.

2. The method of claim 1, wherein, The method comprises: extracting multi-modal features from the standardized data to obtain a feature vector containing statistical features, semantic features, context features, and metadata features; processing the standardized data using a regular expression identification algorithm to obtain a regular identification result; processing the feature vector using a machine learning model to obtain a machine learning identification result; processing the standardized data using a deep learning model to obtain a deep learning identification result; weighting and fusing the regular identification result, the machine learning identification result, and the deep learning identification result to obtain the sensitive data identification result.

3. The method of claim 2, wherein, The method comprises: determining weight adjustment coefficients corresponding to the regular expression algorithm, the machine learning model, and the deep learning model according to the historical prediction accuracy of the regular expression algorithm, the machine learning model, and the deep learning model; determining adjusted weights corresponding to the regular expression algorithm, the machine learning model, and the deep learning model according to the base weights corresponding to the regular expression algorithm, the machine learning model, and the deep learning model, and the weight adjustment coefficients; normalizing the adjusted weights to obtain target weights corresponding to the regular expression algorithm, the machine learning model, and the deep learning model; weighting and fusing the prediction categories and layer confidence of the regular identification result, the first prediction category and first fusion confidence of the machine learning identification result, and the second prediction category and second fusion confidence of the deep learning identification result based on the target weights to obtain the sensitive data identification result containing the final prediction category, weighted probability distribution, and final confidence.

4. The method of claim 1, wherein, The method comprises: determining a data content sensitivity score of the API data stream according to the sensitive data identification result; determining an access behavior sensitivity score of the API data stream according to user behavior features in the standardized data; determining a data flow direction sensitivity score of the API data stream according to data flow direction features in the standardized data; determine a service scenario sensitivity score of the API data flow according to a service scenario feature in the standardized data; determine a threat intelligence sensitivity score of the API data flow according to a network environment feature in the standardized data and data source information of the API data flow; perform weighting fusion on the data content sensitivity score, the access behavior sensitivity score, the data flow direction sensitivity score, the service scenario sensitivity score and the threat intelligence sensitivity score to obtain a sensitivity score of the API data flow.

5. The method of claim 1, wherein, The performing of the target protection measure corresponding to the threat level on the API data flow includes: filtering a candidate protection measure set matched with the threat level from a hierarchical response strategy; the hierarchical response strategy refers to a mapping strategy set containing threat levels and protection measures, containing an execution priority of each protection measure and a business scenario adaptation rule; filtering the target protection measure from the candidate protection measure set based on the execution priority of each measure in the candidate protection measure set and a current business scenario; performing the target protection measure on the API data flow.

6. The method of claim 1, wherein, After the sensitive data identification is performed on the standardized data by using the heterogeneous fusion identification method to obtain a sensitive data identification result, the method further includes: updating the regular expression identification algorithm, the machine learning model and the deep learning model in the heterogeneous fusion identification method by using an incremental learning mechanism; wherein, the trigger conditions of the incremental learning mechanism include at least one of a periodic trigger condition, an event-driven trigger condition and a performance degradation trigger condition; the event-driven trigger condition includes at least one of a new type of sensitive data pattern being manually labeled, an accumulated number of samples with a confidence lower than a threshold reaching a preset sample amount threshold, a number of false positives exceeding a first threshold, and a number of false negatives exceeding a second threshold; the performance degradation trigger condition includes a F1 score of the machine learning model or the deep learning model on a validation set falling by more than a set amplitude threshold.

7. The method of claim 6, wherein, The updating of the regular expression identification algorithm, the machine learning model and the deep learning model in the heterogeneous fusion identification method by using the incremental learning mechanism includes: obtaining labeled data, the labeled data at least containing data field information, a prediction result, a prediction confidence, a true label and a matching correctness identifier of each identification algorithm and model; statistically analyzing the labeled data, and determining a new weight according to a statistical analysis result and an original weight of the regular expression algorithm, and updating the regular expression identification algorithm according to the new weight; updating parameters of the machine learning model by using an online learning method based on the labeled data; updating parameters of the deep learning model by using an offline learning method based on the labeled data; filtering candidate samples from real-time data streams of a production environment to construct a sample pool, calculating a value score based on uncertainty, diversity and representativeness indexes, filtering target samples according to the value score and pushing the target samples to a manual labeling platform, receiving labeling results and adding the labeling results to labeled data to trigger the next round of incremental learning.

8. The method of claim 7, wherein, The value score is calculated based on uncertainty, diversity and representativeness indexes, comprising: calculating the reciprocal of the maximum value of the prediction probability of the model to obtain an uncertainty score; calculating the ratio of the minimum distance and the average distance between the sample and the cluster center of the labeled sample to obtain a diversity score; calculating the reciprocal of the sample density to obtain a representativeness score; weighting and summing the uncertainty score, the diversity score and the representativeness score to obtain the value score.

9. An API data security protection apparatus, characterized by, The device comprises: a standardized data acquisition module for standardizing the real-time collected API data stream to obtain standardized data; an identification result acquisition module for identifying sensitive data in the standardized data by using a heterogeneous fusion identification method to obtain a sensitive data identification result; a sensitivity score acquisition module for scoring the sensitivity of the API data stream according to the sensitive data identification result to obtain a sensitivity score of the API data stream; a threat level determination module for determining the threat level of the API data stream according to the sensitivity score; a protective measure execution module for executing a target protective measure corresponding to the threat level on the API data stream.

10. An electronic device, comprising: comprising: a processor, a memory, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the API data security protection method of any one of claims 1 to 8.

Images