API monitoring security audit model based on government affair system

Abstract

The invention discloses an API (Application Program Interface) monitoring security audit model based on a government affair system, which relates to the technical field of network security, and comprises the following steps: collecting and converging network traffic of each collection point; analyzing the distribution condition of APIs in the collected flow, identifying and displaying key information, meanwhile, realizing data real-time processing, data stream splitting, data reading and writing and offline data analysis, and detecting risk behaviors by utilizing a rule strategy library; aPI asset weaknesses are identified and marked, state management is supported, and an attacker portrait, security study and judgment and attack traceability model is constructed; and pushing and displaying risk model early warning, realizing multi-dimensional data source real-time association analysis based on a big data framework, automatically converging alarms to form an event file, and linking with automatic arrangement to complete event response and report generation. According to the method, the problem of insufficient security and stability of the government affair system is solved, and complex attacks and advanced persistent threats can be identified more accurately.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a model for security auditing of API monitoring in government systems. Background Technology

[0002] With the development of big data and artificial intelligence, government business systems are accelerating their digital transformation. However, the core elements of digital transformation include users, data, and resources—that is, "user-centric, data-driven, and connecting internal and external resources." Based on this core foundation, most government business processes require APIs to connect users, interact with data, and exchange internal and external resources during digital transformation, thereby improving efficiency and controlling costs. Therefore, APIs will be a fundamental and crucial asset in the entire digital transformation process, and using APIs for data interaction and business logic implementation has become a common technical approach. APIs generated during the current digitalization and informatization of government business require security management, providing government business systems with a four-step closed-loop management process for APIs: "discovery and analysis, sensitivity identification, risk monitoring, and early warning analysis."

[0003] Shortcomings of existing technology: In existing API monitoring and security analysis, the lack of in-depth correlation and analysis of government asset categories, the lack of risk mining and analysis models for government scenarios, the inability to discover and sort out government assets by category, the insufficient identification of sensitive government assets, and the lack of monitoring and early warning analysis of government risk scenarios affect the security and stability of government systems and pose security risks in the operation of important government business systems.

[0004] To address the above problems, this invention proposes a solution. Summary of the Invention

[0005] To overcome the aforementioned deficiencies in the prior art, embodiments of the present invention provide a model for API monitoring and security auditing based on government systems. This model addresses the problems mentioned in the background by deeply correlating and analyzing government asset categories and conducting risk mining analysis of government scenarios.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A model for API monitoring and security auditing based on government systems includes the following steps: By configuring mirrored traffic of the core network system within the government network area, the network traffic of each collection point in the business VPC is collected in a 1:1 mirror and aggregated to the API monitoring security audit traffic storage and parsing service module. We analyze the existing government web applications and API assets, statistically analyze the distribution of APIs in the collected traffic, parse and identify web application assets and display key information, and realize real-time data processing through streaming processing component interfaces. We split the data stream by second-level time slices to separate data reading and writing from offline data analysis, and use a rule and strategy library to detect various risk behaviors. It identifies and tags API assets for vulnerability and supports state management, analyzes attack behavior of assets and business systems, conducts asset vulnerability analysis, builds attacker profiles, security assessments and attack tracing models, and realizes attack identification, intent judgment and attack process reconstruction. Push and display risk model warnings, support the confirmation of warning messages, false alarm labeling and detailed viewing, provide an overview of the overall security operation of the API and audit and analyze risk event traffic logs, realize real-time correlation analysis of multi-dimensional data sources based on big data framework, automatically aggregate alarms to form event dossiers and link automated orchestration to complete event response and report generation.

[0007] In a preferred embodiment, the statistical analysis of the distribution of APIs includes: API asset statistics, API risk statistics, distribution of risk event handling, distribution of risk warnings, top 10 API sensitive data tags, distribution of API sensitivity levels, API risk warning trends, distribution of API weaknesses, and top 10 API access popularity.

[0008] In a preferred embodiment, the displayed information includes: application IP, application port, number of APIs, number of sensitive APIs, sensitive tags, number of accounts, to which the government business system belongs, and to which the government department belongs.

[0009] In a preferred embodiment, the risk behavior detection types included in the rule policy base are: Denial-of-service malicious scripts, SQL injection attacks, special character URL access, suspicious HTTP request access, Nginx file parsing vulnerabilities, file inclusion vulnerabilities, remote code execution vulnerabilities, cross-site scripting attacks, IIS server attacks, vulnerability attack detection, suspicious file access, SQL blind injection attack detection, sensitive file detection, abnormal HTTP request detection, sensitive directory access, high-risk database sensitive operations, abnormal business interactions, abnormal host network access, abnormal data transmission, abnormal slow response attacks, VPN account leakage.

[0010] In a preferred embodiment, the analysis of asset and business system attack behaviors includes: The detection system identifies traffic log clearing behavior by reviewing the type, ID, and keywords of traffic logs, and statistically analyzes log destruction behavior by time and asset dimensions. By specifying traffic log types, IDs, and keywords, we can detect and identify privilege escalation operations that modify permissions, and perform statistical analysis by time and asset dimensions. Filter and identify erroneous traffic log events and perform statistical analysis by dimension; identify high-risk operations such as deletion and modification of sensitive files and perform statistical analysis by time and asset dimensions.

[0011] In a preferred embodiment, the asset vulnerability analysis includes: Risk vulnerability exploitation analysis and configuration compliance analysis are included. Risk vulnerability exploitation analysis analyzes the system vulnerability and asset correlation by linking the vulnerability scan results of related assets with the detection results of security devices. It analyzes the vulnerability detection results of host operating systems, databases, and network device operating systems, and statistically analyzes relevant asset data by time, business system, and vulnerability level.

[0012] In a preferred embodiment, the attacker profiling process is as follows: Collect and organize attacker information, attack counts, and behavioral characteristics to enable the creation, modification, deletion, and querying of attacker profiles; Manage attacker information and attack characteristics, and display information such as attacker's geographical location, attack tools, attack methods, and attack details; The system displays matching information related to threat intelligence, maps attacker attack paths, and shows the attack sequence and scope by time dimension.

[0013] In a preferred embodiment, the security assessment and analysis process is as follows: Filter, aggregate, and analyze attack events to determine their success / failure / undetermined status; After manual analysis, alarm events are labeled as false alarms, real attacks, or non-compliant business operations. Based on the perspective of business assets, the assets are assessed as being in a state of no loss, suspected loss, confirmed loss, or false alarm. It supports flexible querying and filtering of analysis results based on attacker monitoring perspective and protection asset monitoring perspective.

[0014] In a preferred embodiment, the attack attribution analysis includes: visual attribution, attack process attribution, attack source and attacker attribution, and honeypot-based attack attribution. The attack process attribution classifies security events into attack processes such as information gathering, network intrusion, command and control, lateral movement, target achievement, and trace cleanup through an attack chain model, and combines manual analysis to locate the real attack source.

[0015] In a preferred embodiment, the process of providing an overview of the overall security operation of the API is as follows: The system uses bar charts and pie charts to display information such as API asset statistics, distribution of sensitive interface types, statistics of sensitive data, percentage of sensitive types, access volume of sensitive assets, abnormal risk trends, and risk warning events. It also allows for audit analysis of detailed network traffic message logs for risk events.

[0016] The technical effects and advantages of the present invention, which is a model for API monitoring and security auditing of government systems: 1. This invention focuses on the risks of government data leakage, personal information and important sensitive data security, and the trends of risk attacks and threats. It combines big data intelligent analysis, including streaming data governance, correlation analysis, threat analysis, audit mining analysis, anomaly detection analysis, and potential security analysis, to discover abnormal patterns and potential security threats. It not only analyzes the streaming data itself but also the relationships and trends between data points, revealing possible attack patterns or abnormal behaviors. It not only focuses on individual security events but also uses correlation analysis to understand the security trends of the entire business environment, linking isolated events to form a complete attack scenario, which helps to more accurately identify complex attacks and advanced persistent threats.

[0017] 2. This invention records data operation-related traffic log fields to understand data operation behavior, preventing risks of data leakage, theft, tampering, or misuse. In the event of a data security incident, it enables tracing and tracking of the source, ensuring traceability of data operation behavior. Data analysis operations are recorded according to data analysis security strategies and operating procedures for data traceability to ensure the quality and reliability of analysis results. Configuration management of government business systems is implemented, automatically associating identified APIs with their respective government business systems and departments via IP address association, facilitating quick identification of risky APIs and incident reporting by security operations personnel. Attacker information, including attack counts and behavioral characteristics, is collected and organized from raw alarm data to identify attackers, their attack methods, technical levels, and targets, assisting security personnel in taking appropriate protective and countermeasure measures. Attacker profiling management enables attacker information management and attack characteristic management, including but not limited to: geographical location, attack tools, attack methods, attack statistical trends, occurrence time, event name, event type, initiating IP, initiating region, victim asset IP, victim region, attack method, and quantity. Attached Figure Description

[0018] Figure 1 This is an implementation architecture diagram of a model method for API monitoring and security auditing based on government systems according to the present invention.

[0019] Figure 2 This is a flowchart illustrating the implementation of a security audit model for API monitoring based on government systems, as described in this invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0021] This solution, compared to existing API monitoring and security analysis methods, provides a management approach that integrates "asset discovery, sensitivity identification, risk monitoring, and incident handling" within government business scenarios. This approach is based on traffic data collection, government data storage, a middleware analysis engine, and government application scenarios. It monitors and analyzes various API interfaces between government business systems and between government systems and user operations, enabling timely closed-loop security management of risks and vulnerabilities. This strengthens data security monitoring and supervision, improves data security situational awareness and risk monitoring and early warning capabilities, and safeguards the construction of digital government, in conjunction with practical network and data security monitoring and supervision work.

[0022] Example 1, Figure 1 The present invention provides an implementation of a model method for API monitoring and security auditing of government systems.

[0023] The proposed API monitoring and security audit architecture is divided into four layers, mainly including: traffic data collection layer, data collection and storage, middleware analysis engine, and scenario application; among which: Traffic data collection: Primarily responsible for collecting traffic within the business VPC; Data Acquisition and Storage Layer: Primarily responsible for storing the raw data parsed and restored from aggregated business network traffic in the database. It also provides services such as data governance, correlation, analysis, classification, and auditing classification. Through session parsing, it analyzes potential security issues from massive logs and stores and manages related data. It provides basic data support for the middle platform engine's analysis and data log auditing queries. The middle platform analysis engine layer is mainly responsible for sorting out, analyzing, and modeling government business data, providing technical engine support for upper-layer applications. Application Scenario Layer: Primarily responsible for the front-end application of API requirements, supporting functions such as API assets, API asset list viewing, API vulnerability configuration, API risk warning, and API security operation.

[0024] Example 2, Figure 2This invention presents an implementation of a model system for API monitoring and security auditing based on a government system. This includes: configuring mirrored traffic of the core network system within the government network area to mirror and aggregate network traffic from each collection point within the business VPC to the API monitoring and security audit traffic storage and parsing service module on a 1:1 basis. We analyze the existing government web applications and API assets, statistically analyze the distribution of APIs in the collected traffic, parse and identify web application assets and display key information, and realize real-time data processing through streaming processing component interfaces. We split the data stream by second-level time slices to separate data reading and writing from offline data analysis, and use a rule and strategy library to detect various risk behaviors. It identifies and tags API assets for vulnerability and supports state management, analyzes attack behavior of assets and business systems, conducts asset vulnerability analysis, builds attacker profiles, security assessments and attack tracing models, and realizes attack identification, intent judgment and attack process reconstruction. Push and display risk model warnings, support the confirmation of warning messages, false alarm labeling and detailed viewing, provide an overview of the overall security operation of the API and audit and analyze risk event traffic logs, realize real-time correlation analysis of multi-dimensional data sources based on big data framework, automatically aggregate alarms to form event dossiers and link automated orchestration to complete event response and report generation.

[0025] Step 1: By configuring mirrored traffic of the core network system within the government network area, the network traffic of each collection point in the business VPC is mirrored 1:1 and aggregated to the API monitoring security audit traffic storage and parsing service module. The core prerequisite for API monitoring and security auditing of government systems is the accurate and complete collection of network traffic within the business VPC. This article implements the principle of mirror configuration, adapts the deployment logic to government scenarios, ensures end-to-end transmission, and establishes an aggregation and verification mechanism to achieve 1:1 lossless collection and aggregation of traffic to the API monitoring and security audit traffic storage and parsing service module.

[0026] At the level of mirroring configuration principles, port mirroring technology is used to achieve lossless traffic replication. On core network systems such as core switches and aggregation switches in the government network, SPAN (Switching Port Analyzer) sessions are configured to set the service ports of each collection point as mirroring source ports, and the access port of the API monitoring security audit traffic storage and parsing service module as the destination port. Based on the TCP / IP protocol stack traffic forwarding mechanism, while the source port forwards normal service traffic, it copies and forwards all inbound and outbound data packets to the destination port at a 1:1 ratio, ensuring that the collected traffic is completely consistent with the original service traffic and does not affect the normal operation of government services—this design adapts to the core requirements of government systems of "uninterrupted business and no data loss," avoiding interference with critical services such as social security and government services caused by collection operations.

[0027] The data collection and deployment logic adopts a distributed deployment adapted to the government network architecture. Addressing the deployment characteristics of multiple regions and multiple business systems within the government VPC, local mirror collection points are deployed on the core switches of each business partition, covering the network areas where key APIs such as office automation systems, government data sharing platforms, and public service interfaces are located. For cross-regional government cloud VPCs, Remote Mirroring (RSPAN) technology is used to transmit traffic from different regions to local collection nodes through dedicated tunnels, achieving unified collection of traffic across the entire domain. The deployment process strictly adheres to government network security standards; collection nodes only obtain traffic mirroring permissions, without business data modification or forwarding permissions, and all collection devices are connected to the government security management platform, subject to security audits, and meet the requirements of Level 3 Information Security Protection.

[0028] Traffic transmission assurance focuses on both stability and security. The transmission link employs a redundant design, binding multiple physical links through link aggregation technology to prevent traffic loss due to single-link failures. For encrypted traffic (HTTPS) from API calls in government networks, the collection nodes support SSL / TLS decryption and forwarding, with decryption keys stored and managed through a hardware security module (HSM) to ensure key confidentiality. Traffic priority marking is used during transmission, assigning high priority to collected traffic to prevent it from being discarded during network congestion, ensuring the complete collection of traffic from core government APIs (such as electronic certificate inquiries and approval process interfaces).

[0029] A convergence verification mechanism ensures traffic integrity and accuracy. After traffic converges to the storage and resolution service module, it first verifies the integrity of data packets using CRC32 checksum, comparing the number of data packets and bytes between the mirrored source port and destination port to ensure no packet loss or errors. Simultaneously, a traffic fingerprint database is established, extracting the five-tuple (source IP, destination IP, source port, destination port, protocol type) and timestamp of each traffic entry to generate a unique fingerprint. Fingerprint deduplication avoids duplicate data collection—a mechanism adapted to high-concurrency API calls in government systems, preventing traffic duplication due to network loops. When verification anomalies occur, the system automatically triggers alarms and records anomaly logs, supporting maintenance personnel in tracing and troubleshooting, ensuring reliable raw data support for subsequent API asset identification and risk detection.

[0030] Step 2: Organize the existing government web applications and API assets, statistically analyze the distribution of APIs in the collected traffic, parse and identify web application assets and display key information, and at the same time realize real-time data processing through the streaming processing component interface, split the data stream by second-level time slice to separate data reading and writing and offline data analysis, and use the rule and strategy library to detect various risk behaviors; This system primarily focuses on the discovery of existing government web applications and API assets, analyzing the overall distribution of APIs within the accessed network traffic. Key metrics include: API asset statistics, API risk statistics, distribution of risk event handling status, distribution of risk warnings, top 10 APIs with sensitive data tags, API sensitivity level distribution, API risk warning trends, API vulnerability distribution, and top 10 API access popularity. This provides security operations personnel with an easy-to-use entry point to comprehensively understand API asset status. It also provides information on web application assets identified through parsing mirrored traffic, specifically displaying information such as application IP, application port, number of APIs, number of sensitive APIs, sensitive tags, number of accounts, affiliated government business system, and affiliated government department.

[0031] Real-time data processing is achieved by manipulating the interfaces provided by the streaming components. This enhances the data processing capabilities and scenario matching abilities of real-time computing.

[0032] The data stream is split into time slices (second-level) to separate data reading and writing from offline data analysis; it fully utilizes a rich rule and policy library and real-time rule and policy, including but not limited to: denial-of-service malicious scripts, SQL injection attacks, special character URL access, suspicious HTTP request access, Nginx file parsing vulnerabilities, file inclusion vulnerabilities, remote code execution vulnerabilities, cross-site scripting attacks, IIS server attacks, vulnerability attack detection, suspicious file access, SQL blind injection attack detection, sensitive file detection, abnormal HTTP request detection, sensitive directory access, high-risk database sensitive operations, abnormal business interactions, abnormal host network access, abnormal data transmission, abnormal slow response attacks, VPN account leakage, etc.

[0033] Step 3: Identify and tag API asset vulnerabilities and support state management; analyze attack behavior of assets and business systems; conduct asset vulnerability analysis; build attacker profiles, security assessments, and attack tracing models to achieve attack identification, intent judgment, and attack process reconstruction. (1) Identify and tag the vulnerabilities of the API assets after they have been identified and sorted out, so that security operations personnel can understand the distribution of risk points in the current API list; at the same time, the vulnerabilities can be started, closed and added.

[0034] (2) API Asset and Business System Attack Analysis The collected traffic data is analyzed, including but not limited to asset and system damage detection, privilege escalation detection, and error log detection. The specific process is as follows: Traffic log clearing behavior is identified by detecting the type, ID, and keywords of the system's audit traffic logs; log destruction behavior is statistically analyzed by time, asset, and other dimensions. By specifying traffic log types, IDs, and keywords, we can identify operations that modify permissions; and we can statistically analyze system privilege escalation behaviors by time, assets, and other dimensions. Error traffic log events can be identified by filtering criteria, and statistical analysis of error log events can be performed by time, asset, and other dimensions.

[0035] Identify high-risk operations on sensitive files, such as deletion or modification. Support statistical analysis of high-risk events involving sensitive files by time, asset, and other dimensions.

[0036] (3) Asset vulnerability analysis Asset vulnerability analysis, including but not limited to risk exploitation analysis, configuration compliance analysis, attack risk analysis, and data leakage risk analysis, is required. Specific requirements are as follows: Risk Vulnerability Exploitation Analysis: By correlating asset vulnerability scan results with security device detection results, vulnerability exploitation analysis is achieved, including system vulnerability analysis and asset correlation analysis; analysis is performed on vulnerability detection results of commonly used host operating systems, databases, network device operating systems, conventional Internet applications, common application development middleware, network security clients, and commonly used application software; and asset data with vulnerability exploitation risks are statistically analyzed by time, business system, vulnerability level, and other dimensions.

[0037] Configuration compliance analysis: Analyzes the configuration compliance detection results of operating systems, databases, network devices, middleware, DNS, etc.; statistically analyzes the exploitation of non-compliant configuration items, and supports the analysis of risk trends of attackers using non-compliant configuration items to attack assets; statistically analyzes asset data with non-compliant configurations by time, business system, violation category, and other dimensions.

[0038] (4) Risk modeling - attacker profiling analysis Attacker profiling analysis collects and organizes attacker information, attack counts, and behavioral characteristics from raw alert data to identify attackers, their attack methods, technical levels, and attack targets, thus assisting security personnel in taking corresponding protective and countermeasure measures.

[0039] Utilizing attacker profiling management, users can add, modify, delete, and query attacker profiles, enabling attacker information and attack characteristic management. This includes analyzing attacker origins, attack objectives, frequent users, network proxies, attack methods, and characteristics. Attacker information is displayed, including but not limited to: geographic location, attack tools, attack methods, and attack statistics trends. Attack details are displayed, including but not limited to: time of occurrence, event name, event type, initiating IP, initiating region, victim asset IP, victim region, attack method, and quantity. Drill-down viewing of raw logs is also supported. Among them, the associated threat intelligence displays detailed threat matching information, including associated domains, associated samples, related events, open ports, associated URLs, and related alarms; the attacker attack path drawing draws the attack path starting from the attacker, showing the sequence and scope of the attacker's attack path in a time dimension, reconstructing the attack process, and identifying the attack intent.

[0040] (5) Risk modeling – security assessment and analysis The events output by attack identification and other models are filtered and aggregated for analysis. For some high-risk events, the analysis can determine whether the attack was successful.

[0041] The attack results are assessed based on the attacker's perspective, determining whether the attack was successful, failed, or is indeterminate. After manual analysis of some alarm events, further analysis of the attack events is conducted, and labels such as false alarms, real attacks, and non-standard business practices are applied. From the perspective of business assets, we analyze and assess the attack status of assets in related attack events, and determine the asset status as "not compromised", "suspected compromised", "confirmed compromised", "false alarm" etc. Based on the attacker's monitoring perspective, the results of attack analysis can be flexibly queried and filtered, such as "attack successful"; From the perspective of asset protection monitoring, the results of attack analysis can be flexibly queried and filtered, such as "suspected compromise".

[0042] (6) Risk modeling - attack attribution analysis When an attack occurs, the attack attribution analysis model proactively tracks the attacker and locates the source of the attack. By combining network forensics and threat intelligence, it can mitigate or counter the attack in a targeted manner, eliminating potential threats before they cause damage.

[0043] Visual Attribution: Enables personnel with certain attack attribution capabilities to perform efficient attribution analysis on relevant data, drill down to the original data of attack events for analysis and evidence collection, and verify the traced attack source using threat information; Attack process attribution: The attack chain model performs attribution analysis on attack events by classifying security events according to the attack process, including but not limited to information gathering, network intrusion, command and control, lateral movement, target achievement, and trace cleanup. It provides the ability to identify the true source of an attack after it has occurred, combining the attack chain model with manual analysis. Attack source and attacker attribution: Attacker information is analyzed based on threat intelligence, including but not limited to attacker information, methods, and resources; Honeypot-based attack attribution: The intelligent analysis platform should combine honeypot detection data to analyze attacker information, methods, and resources.

[0044] Step 4: Push and display risk model warnings, support confirmation of warning messages, false alarm labeling and details viewing, provide an overview of the overall security operation of the API and audit and analyze risk event traffic logs, realize real-time correlation analysis of multi-dimensional data sources based on big data framework, automatically aggregate alarms to form event dossiers and link automated orchestration to complete event response and report generation.

[0045] The system pushes and displays risk model warnings, and supports confirmation, false alarm, and detailed operations for warning messages; Confirmation: After detailed analysis, the risk warning event is confirmed to be real and valid. Click "Confirm" to proceed with subsequent event handling. False Alarm: After detailed analysis, the risk warning event is confirmed to be a false alarm. Click on the false alarm to ignore the event warning. Details: Provides detailed viewing of risk warning events, allowing users to view warning messages and risk information for risk events.

[0046] The overall security operation status of the API is summarized in bar charts, pie charts, etc., which mainly display API asset statistics, sensitive interface type distribution statistics, sensitive data statistics, sensitive type percentage statistics, sensitive access volume of assets, risk anomaly trend charts, risk warning events, etc. It can audit and analyze detailed network traffic packet logs of current risk events, which makes it easier for security operations personnel to intuitively and accurately judge the risk events and trace the source of the events.

[0047] Designed based on a big data processing framework, this system enables real-time correlation analysis of multi-dimensional data sources across networks, endpoints, clouds, and applications, even at massive data volumes. It uncovers deeper and more valuable complex threat events while keeping the scale of these events within a manually manageable range. Backtracking analysis of rule analysis results helps security operations personnel continuously optimize rule models and improve the effectiveness of rule detection. The correlation analysis engine possesses horizontal distributed scalability, covering systems, databases, applications, and identities, providing multi-dimensional global threat visibility to ensure comprehensive monitoring and analysis without blind spots.

[0048] Related alarms are automatically aggregated to form a complete event file, mapping attacker tactics and techniques, automatically interpreting attacker intent, automatically identifying key attack traces, automatically assessing the impact and calculating the targets for action, automatically linking with operational events to automate event orchestration to complete event response, automatically generating event reports, and quickly completing event investigation and response.

[0049] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0050] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0051] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0052] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0053] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0054] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A model for API monitoring and security auditing based on government systems, characterized in that, Includes the following steps: By configuring mirrored traffic of the core network system within the government network area, the network traffic of each collection point in the business VPC is collected in a 1:1 mirror and aggregated to the API monitoring security audit traffic storage and parsing service module. We analyze the existing government web applications and API assets, statistically analyze the distribution of APIs in the collected traffic, parse and identify web application assets and display key information, and realize real-time data processing through streaming processing component interfaces. We split the data stream by second-level time slices to separate data reading and writing from offline data analysis, and use a rule and strategy library to detect various risk behaviors. It identifies and tags API assets for vulnerability and supports state management, analyzes attack behavior of assets and business systems, conducts asset vulnerability analysis, builds attacker profiles, security assessments and attack tracing models, and realizes attack identification, intent judgment and attack process reconstruction. Push and display risk model warnings, support the confirmation of warning messages, false alarm labeling and detailed viewing, provide an overview of the overall security operation of the API and audit and analyze risk event traffic logs, realize real-time correlation analysis of multi-dimensional data sources based on big data framework, automatically aggregate alarms to form event dossiers and link automated orchestration to complete event response and report generation.

2. The model for API monitoring and security auditing based on government systems according to claim 1, characterized in that, The statistical analysis of API distribution includes: API asset statistics, API risk statistics, distribution of risk event handling, distribution of risk warnings, top 10 API sensitive data tags, distribution of API sensitivity levels, API risk warning trends, distribution of API weaknesses, and top 10 API access popularity.

3. The model for API monitoring and security auditing based on government systems according to claim 2, characterized in that, The displayed information includes: application IP, application port, number of APIs, number of sensitive APIs, sensitive tags, number of accounts, the government business system to which it belongs, and the government department to which it belongs.

4. The model for API monitoring and security auditing based on government systems according to claim 3, characterized in that, The risk behavior detection types included in the rule policy base are: Denial-of-service malicious scripts, SQL injection attacks, special character URL access, suspicious HTTP request access, Nginx file parsing vulnerabilities, file inclusion vulnerabilities, remote code execution vulnerabilities, cross-site scripting attacks, IIS server attacks, vulnerability attack detection, suspicious file access, SQL blind injection attack detection, sensitive file detection, abnormal HTTP request detection, sensitive directory access, high-risk database sensitive operations, abnormal business interactions, abnormal host network access, abnormal data transmission, abnormal slow response attacks, VPN account leakage.

5. A model for API monitoring and security auditing based on government systems according to claim 4, characterized in that, The analyzed attacks on assets and business systems include: The detection system identifies traffic log clearing behavior by reviewing the type, ID, and keywords of traffic logs, and statistically analyzes log destruction behavior by time and asset dimensions. By specifying traffic log types, IDs, and keywords, we can detect and identify privilege escalation operations that modify permissions, and perform statistical analysis by time and asset dimensions. Filter and identify erroneous traffic log events and perform statistical analysis by dimension; identify high-risk operations such as deletion and modification of sensitive files and perform statistical analysis by time and asset dimensions.

6. The model for API monitoring and security auditing based on government systems according to claim 5, characterized in that, The asset vulnerability analysis includes: Risk vulnerability exploitation analysis and configuration compliance analysis are included. Risk vulnerability exploitation analysis analyzes the system vulnerability and asset correlation by linking the vulnerability scan results of related assets with the detection results of security devices. It analyzes the vulnerability detection results of host operating systems, databases, and network device operating systems, and statistically analyzes relevant asset data by time, business system, and vulnerability level.

7. A model for API monitoring and security auditing based on government systems according to claim 6, characterized in that, The attacker profiling analysis process is as follows: Collect and organize attacker information, attack counts, and behavioral characteristics to enable the creation, modification, deletion, and querying of attacker profiles; Manage attacker information and attack characteristics, and display information such as attacker's geographical location, attack tools, attack methods, and attack details; The system displays matching information related to threat intelligence, maps attacker attack paths, and shows the attack sequence and scope by time dimension.

8. A model for API monitoring and security auditing based on government systems according to claim 7, characterized in that, The security assessment and analysis process is as follows: Filter, aggregate, and analyze attack events to determine their success / failure / undetermined status; After manual analysis, alarm events are labeled as false alarms, real attacks, or non-compliant business operations. Based on the perspective of business assets, the assets are assessed as being in a state of no loss, suspected loss, confirmed loss, or false alarm. It supports flexible querying and filtering of analysis results based on attacker monitoring perspective and protection asset monitoring perspective.

9. A model for API monitoring and security auditing based on government systems according to claim 8, characterized in that, The attack attribution analysis includes: visual attribution, attack process attribution, attack source and attacker attribution, and honeypot-based attack attribution. Among them, the attack process attribution classifies security events into attack processes such as information collection, network intrusion, command and control, lateral penetration, target achievement, and trace cleanup through the attack chain model, and combines manual analysis to locate the real attack source.

10. A model for API monitoring and security auditing based on government systems according to claim 9, characterized in that, The overall API security operation overview process is as follows: The system uses bar charts and pie charts to display information such as API asset statistics, distribution of sensitive interface types, statistics of sensitive data, percentage of sensitive types, access volume of sensitive assets, abnormal risk trends, and risk warning events. It also allows for audit analysis of detailed network traffic message logs for risk events.

Images