Interface function identification method and device based on large model, equipment and storage medium

Abstract

The invention discloses an interface function identification method and device based on a large model, equipment and a storage medium, and the method comprises the steps: obtaining to-be-identified target interface data, and extracting interface feature information from the target interface data; searching a similar interface template which is semantically similar to the interface feature information of the target interface data in a preset knowledge base; if the similar interface template is retrieved, reasoning by utilizing a large reasoning model based on the interface feature information of the target interface data and the similar interface template at the same time to obtain a function recognition result of the target interface data; if the similar interface template is not retrieved, only based on the interface feature information of the target interface data, performing reasoning by using the reasoning large model to obtain a function recognition result of the target interface data; according to the invention, high-precision and high-efficiency API function and purpose intelligent identification is realized.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, apparatus, device, and storage medium for identifying interface functions based on a large model. Background Technology

[0002] Current API interface identification technologies primarily rely on static feature matching and rule base comparison, which are insufficient for handling novel API interfaces and API interfaces with unknown purposes. On the one hand, they lack semantic understanding capabilities, only able to identify surface features without comprehending the true function and business purpose of the API interface. On the other hand, their identification capabilities are inadequate and coverage is limited when facing unknown types of API interfaces. Existing interface identification methods suffer from low accuracy, high false positive rates, and inability to respond in real time. Therefore, how to accurately and efficiently identify the function and purpose of API interfaces has become a pressing technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0003] The purpose of this invention is to provide an interface function identification method, device, equipment, and storage medium based on a large model, which realizes high-precision and high-efficiency intelligent identification of API functions and uses.

[0004] According to one aspect of the present invention, an interface function identification method based on a large model is provided, the method comprising: Obtain the target interface data to be identified, and extract interface feature information from the target interface data; Retrieve similar interface templates with semantically similar interface feature information to the target interface data from a preset knowledge base; wherein, the knowledge base includes multiple interface templates with known functions; If a similar interface template is found, then based on the interface feature information of the target interface data and the similar interface template, the large inference model is used to perform inference to obtain the functional identification result of the target interface data. If no similar interface template is found, the function identification result of the target interface data is obtained by using the inference model based solely on the interface feature information of the target interface data.

[0005] Optionally, obtaining the target interface data to be identified specifically includes: Target interface data is determined from the collected network traffic data according to preset filtering criteria; wherein the filtering criteria include at least one of the following: Set the network traffic data containing the preset interface identifier in the request path as the target interface data; Set the network traffic data containing the preset data format identifier in the request header and / or the corresponding response header as the target interface data; Set network traffic data in the target interface format as the request body and / or the corresponding response body in the preset data format.

[0006] Optionally, if a similar interface template is found, then based on the interface feature information of the target interface data and the similar interface template, a large-scale inference model is used to perform inference to obtain the functional identification result of the target interface data, specifically including: The interface feature information and interface function information are parsed from each retrieved similar interface template; The interface feature information of the target interface data, as well as the interface feature information and interface function information of all similar interface templates retrieved, are combined to form enhanced reasoning prompt information; The enhanced reasoning prompt information is input into the large-scale reasoning model, so that the large-scale reasoning model performs enhanced reasoning on the target interface data based on the similar interface template; The output of the inference model is obtained as the function identification result; wherein, the function identification result includes: the function label, usage classification and confidence score corresponding to the target interface data.

[0007] Optionally, if no similar interface template is found, the function identification result of the target interface data is obtained by using the inference model based solely on the interface feature information of the target interface data, specifically including: Based on the interface feature information of the target interface data, independent reasoning prompt information is generated; The independent reasoning prompt information is input into the large reasoning model so that the large reasoning model can perform independent reasoning on the target interface data without relying on the interface template. The output of the inference model is obtained as the function identification result; wherein, the function identification result includes: the function label, usage classification and confidence score corresponding to the target interface data.

[0008] Optionally, the interface feature information includes at least one of the following: Request path; Request operation type; Header feature information parsed from the request header and the corresponding response header; Content body feature information parsed from the request body and the corresponding response body; The header feature information includes: data format information and / or authorization authentication information; The content body feature information includes: field name, field nesting level and / or field data type.

[0009] To achieve the above objectives, the present invention also provides an interface function recognition device based on a large model, the device comprising: The data acquisition module is used to acquire the target interface data to be identified and extract interface feature information from the target interface data. The template retrieval module is used to retrieve similar interface templates that are semantically similar to the interface feature information of the target interface data from a preset knowledge base; wherein, the knowledge base includes multiple interface templates with known functions; An enhanced reasoning module is used to, if a similar interface template is found, simultaneously use a large reasoning model to reason based on the interface feature information of the target interface data and the similar interface template to obtain the functional identification result of the target interface data. An independent reasoning module is used to, if no similar interface template is found, reason based solely on the interface feature information of the target interface data using the large reasoning model to obtain the functional identification result of the target interface data.

[0010] Optionally, the enhanced inference module is specifically used for: The interface feature information and interface function information are parsed from each retrieved similar interface template; The interface feature information of the target interface data, as well as the interface feature information and interface function information of all similar interface templates retrieved, are combined to form enhanced reasoning prompt information; The enhanced reasoning prompt information is input into the large-scale reasoning model, so that the large-scale reasoning model performs enhanced reasoning on the target interface data based on the similar interface template; The output of the inference model is obtained as the function identification result; wherein, the function identification result includes: the function label, usage classification and confidence score corresponding to the target interface data.

[0011] Optionally, the independent inference module is specifically used for: Based on the interface feature information of the target interface data, independent reasoning prompt information is generated; The independent reasoning prompt information is input into the large reasoning model so that the large reasoning model can perform independent reasoning on the target interface data without relying on the interface template. The output of the inference model is obtained as the function identification result; wherein, the function identification result includes: the function label, usage classification and confidence score corresponding to the target interface data.

[0012] To achieve the above objectives, the present invention also provides a computer device, which specifically includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the interface function recognition method based on the large model described above.

[0013] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the interface function recognition method based on a large model described above.

[0014] This invention provides a method, apparatus, device, and storage medium for interface function identification based on a large model. It intelligently identifies the functions and uses of API interfaces based on a large inference model. By automatically analyzing the characteristics, business logic relationships, and functional semantics of the API interface's input / output data, it achieves accurate identification of the API interface's functions and uses. Furthermore, through a dual-path inference architecture, it significantly improves the accuracy and coverage of API function identification, achieving high-precision, high-efficiency, and high-coverage intelligent identification of API functions and uses. Attached Figure Description

[0015] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a schematic diagram of an optional process for the interface function identification method based on a large model provided in Embodiment 1. Figure 2 This is a schematic diagram of another optional component structure for the interface function identification method based on a large model provided in Embodiment 1; Figure 3 This is a schematic diagram of an optional component structure of the interface function recognition device based on a large model provided in Embodiment 2. Figure 4 This is a schematic diagram of an optional hardware structure for the computer device provided in Embodiment 3. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0017] Example 1 This invention provides an interface function identification method based on a large model, such as... Figure 1 As shown, the method specifically includes the following steps: Step S101: Obtain the target interface data to be identified, and extract the interface feature information from the target interface data.

[0018] The target interface data is data directly related to interface interaction behavior, filtered from network traffic data. Essentially, it's a collection of request and response data generated during communication, distinct from non-interface data in ordinary network traffic (such as plain text transmission data or invalid data packets). Interface feature information is multi-dimensional data extracted from the target interface data, reflecting interface functional attributes, interaction logic, or business relationships. Its core function is to provide semantic feature data for subsequent large-scale inference models to identify interface functions. In practical applications, the target interface data can be parsed using preset rules, knowledge bases, and parsing tools, and feature information of each dimension can be extracted according to predefined rules.

[0019] It should also be noted that the "interface" in this embodiment, namely the application programming interface (API), has the same meaning as the well-known definition in the relevant technical field. It refers to a set of predefined rules or protocols that allow different software systems or components to interact with data or functions in a standardized way, such as RESTful API, GraphQL, etc.

[0020] Step S102: Retrieve similar interface templates that are semantically similar to the interface feature information of the target interface data in a preset knowledge base; wherein, the knowledge base includes multiple interface templates with known functions.

[0021] The knowledge base is a domain-specific structured data repository built for interface function identification tasks. Its core function is to provide reference data for interface functions in large-scale reasoning models. This knowledge base is scalable and updatable, and its data sources include manually annotated historical interface interaction data, industry-standard interface documents, and pre-defined interface function specifications from business systems. Preferably, the knowledge base is a retrieval-enhanced generative API (RAG) knowledge base, containing preprocessed and vectorized API sample data (i.e., interface templates), enabling efficient similarity retrieval and semantic matching. Interface templates are the basic building blocks of the knowledge base; each interface template represents an API sample with a known function, and each interface template includes at least interface feature information and interface function information.

[0022] In practical applications, similar interface templates can be retrieved from a knowledge base by calculating the similarity of semantic vectors. For example, the interface feature information of each interface template in the knowledge base is first converted into structured text, and then the structured text is converted into fixed-dimensional semantic vectors using a pre-trained text embedding model. Then, the interface feature information of the target interface data is converted into corresponding semantic vectors in the same way. Finally, the cosine similarity algorithm is used to calculate the similarity value between the semantic vector of the target interface data and the semantic vectors of all interface templates in the knowledge base, and interface templates with similarity values ​​greater than a preset threshold are identified as similar interface templates. Alternatively, if multiple interface templates meet the criteria, they can be sorted from highest to lowest similarity value, and the top N (e.g., the top 3) can be selected as similar interface templates. Alternatively, preset matching rules can be used to determine similar interface templates, which are not specifically limited here.

[0023] Step S103: If a similar interface template is found, then based on the interface feature information of the target interface data and the similar interface template, reasoning is performed using a large inference model to obtain the functional identification result of the target interface data.

[0024] The reasoning model used in this embodiment is a large-scale language model built based on deep learning technology. This model possesses powerful semantic understanding, logical reasoning, and pattern recognition capabilities. Its core architecture can adopt a Decoder-only (such as the GPT series, LLaMA series) or Encoder-Decoder (such as T5, Flan-T5) architecture. It can receive multi-dimensional feature information from API interfaces as input and perform deep analysis through its complex multi-layer neural networks and attention mechanisms to understand the business semantics and functional meaning of the API, ultimately outputting the functional identification results for the API interface. Furthermore, functional identification refers to automatically analyzing and determining the specific business functions implemented by the API interface through technical means, such as user authentication, data query, and file upload, which is a core aspect of API asset management.

[0025] In this embodiment, when a similar interface template is found in the knowledge base, the "enhanced reasoning" mode is entered. The core of this mode is to fuse the retrieved external knowledge (similar interface templates) with the characteristics of the current target interface data, using both as input to the large-scale reasoning model, thereby performing more accurate and interpretable function recognition reasoning. For example, when a similar interface template is retrieved, the attention mechanism of the large-scale reasoning model will prioritize the features related to the function in the similar model, and perform adaptive analysis based on the feature differences of the target interface, ultimately outputting accurate function recognition results.

[0026] Step S104: If no similar interface template is found, the function identification result of the target interface data is obtained by using the inference big model based solely on the interface feature information of the target interface data.

[0027] In this embodiment, when no similar interface template is found in the knowledge base, the system enters the "independent reasoning" mode. The core of this mode is to ensure that even in the absence of prior knowledge or reference cases, basic functional identification of a completely new and unknown API interface can still be performed. For example, when no similar interface template is found, a multi-layer Transformer neural network and a self-attention mechanism are used to prioritize the functional orientation features in the target interface's feature information, and reasoning is performed based on pre-trained API domain semantic knowledge to obtain the functional identification result of the target interface data.

[0028] In this embodiment, a complete dual-path reasoning closed loop is constructed by employing both "enhanced reasoning" and "independent reasoning" modes, effectively solving the problem of balancing coverage and accuracy in existing API function identification methods. When a similar template is found in the knowledge base, the system enters the knowledge-enhanced reasoning path, significantly improving the accuracy and reliability of function identification by utilizing external reference knowledge. When the search fails, it automatically switches to the fault-tolerant independent reasoning path, relying solely on the model's own semantic understanding capabilities to ensure basic identification of novel or unknown APIs. This embodiment achieves accurate and reliable identification when prior knowledge is available, while maintaining necessary identification coverage when references are lacking. Therefore, it comprehensively realizes higher precision, broader scope, and more intelligent semantic understanding and automated management of API asset functions.

[0029] Specifically, the target interface data and the interface feature information in the interface template include at least one of the following: (1) Request path; The request path is the Uniform Resource Locator URL for interface access during the interface interaction process. It can intuitively reflect the business affiliation and functional direction of the interface, such as / api / v1 / users / {id} / orders. (2) Request operation type; Among them, the request operation type is the core action type used when making an interface request, which corresponds to the request method in the HTTP protocol (such as GET corresponding to the "data query" operation, POST corresponding to the "data submit" operation, PUT corresponding to the "data update" operation, and DELETE corresponding to the "data delete" operation). (3) Header feature information parsed from the request header and the corresponding response header; Among them, the header feature information is the key information parsed from the request header and response header, including data format information (such as "Content-Type: application / json" in the request header) and authorization information (such as "Authorization" in the request header). (4) Content body feature information parsed from the request content body and the corresponding response content body; Among them, the content body feature information is the structured information parsed from the request content body and the response content body, including field names (such as the "username" and "password" fields in the request content body, and the "user_id" and "token" fields in the response content body), field nesting level (such as the three-level nesting structure of "user.info.address" in the request body), and field data type (such as the "age" field being an integer and the "create_time" field being a timestamp).

[0030] In this embodiment, the request path can directly point to the business domain, the request operation type can define the action type, the header features can reflect the interface's permissions and communication attributes, and the content feature body can reflect the business data logic. Each dimension of information corresponds to different judgment dimensions for function identification, forming complementary judgment criteria and avoiding identification bias caused by single-dimensional features. Preferably, the interface feature information includes the request path, request operation type, header feature information, and content feature information simultaneously. By systematically combining and synergistically utilizing these four highly complementary information dimensions in terms of functional semantics, a machine-understandable feature model that can completely and unambiguously characterize the API interface's business intent and data contract is constructed. This fundamentally ensures that the subsequent dual-path reasoning mechanism (whether it is enhanced reasoning based on similar templates or independent zero-shot reasoning) can overcome the dependence of existing technologies on surface rules or one-sided features, achieving accurate penetration and reliable identification of API functions from form to semantics, and significantly improving the accuracy, coverage, and automation level of identification.

[0031] Furthermore, the acquisition of the target interface data to be identified in step S101 specifically includes: Target interface data is determined from the collected network traffic data according to preset filtering criteria; wherein the filtering criteria include at least one of the following: (1) Set the network traffic data containing the preset interface identifier in the request path as the target interface data; The preset interface identifier is a pre-configured characteristic string used to identify interface communication traffic. The interface identifier can distinguish between interface traffic and non-interface traffic. For example, the preset interface identifier is a general interface path specification (such as / api / ) or an interface version identifier (such as v1, v2). In practical applications, the collected network traffic is traversed and parsed to extract the request path corresponding to each traffic. Fuzzy matching and / or exact matching methods are used to match the request path with the preset interface identifier to determine the target interface data.

[0032] (2) Set the network traffic data containing the preset data format identifier in the request header and / or the corresponding response header as the target interface data; Among them, the preset data format identifier is a header field or field value that is pre-set to identify the format of interface communication data. By using the format identifier of the communication layer, interface traffic with interface-based interactive attributes is filtered out, such as Content-Type: application / json.

[0033] (3) Set the network traffic data in the target interface data as the network traffic data in the format of the request body and / or the corresponding response body in the preset data format; The preset data formats are pre-defined, commonly used structured data formats for interface interactions, including JSON, XML, Protocol Buffers, and FormData. Their core function is to filter interface traffic with business data interaction attributes based on the actual format characteristics of the content body. In practical applications, various preset data format parsers (such as JSON parser: Fastjson, XML parser: Dom4j, and Protobuf parser: Protobuf-java) can be used to parse the collected traffic data for format validation.

[0034] In this embodiment, filtering conditions are used to effectively filter irrelevant traffic, focusing on the processing of API access traffic and improving processing efficiency and accuracy. For business systems with clearly defined interface identifiers, only the filtering condition "request path contains preset interface identifier" can be enabled to achieve efficient filtering. For systems without a unified interface path specification, the filtering conditions "header data format identifier" and "content body preset format" can be combined to accurately locate interface traffic through data format characteristics. For scenarios requiring high accuracy, all three filtering conditions can be enabled simultaneously. Only when traffic simultaneously meets the requirements of path identifier, header format, and content body format is it determined to be target interface data, thus minimizing interference traffic.

[0035] Furthermore, step S102, which involves retrieving similar interface templates from a preset knowledge base that are semantically similar to the interface feature information of the target interface data, specifically includes: Step A1: Assign preset weights to each dimension based on its contribution to function recognition according to the different dimensions of interface feature information; For example, the weight of the request operation type is set to 0.2, the weight of the request path is set to 0.4, the weight of the content body feature information is set to 0.3, and the weight of the header feature information is set to 0.1.

[0036] Step A2: Based on the interface feature information of the target interface data, perform preliminary screening in parallel in the knowledge base using three independent dimensions. Interface templates that match successfully in any dimension are included in the candidate set: (1) Request operation type matching: Screen interface templates whose request operation type is consistent with the target interface; (2) Request path keyword matching: Screen interface templates whose core business keywords contained in the request path are the same as those in the target interface; (3) Content body key field matching: Screen interface templates whose core business fields contained in the content body are the same as those in the target interface or have similar semantics.

[0037] Step A3: Calculate the matching degree between the candidate interface template and the target interface data in each dimension according to the preset weight, and perform weighted fusion according to the preset weight to obtain the comprehensive matching degree of each candidate interface template; For candidate interface templates, the matching scores of each dimension feature are calculated according to preset weights: 0.4 for complete matching of business keywords in the request path and 0.2 for partial matching; 0.3 for the content key field matching ratio in the content body feature information > 80% and 0.15 for the ratio between 50% and 80%; 0.1 for matching header feature information; and finally, the comprehensive matching score of each candidate template is obtained by summing them up.

[0038] Step A4: The candidate interface templates with a comprehensive matching degree greater than the preset matching threshold are determined as the similar interface templates.

[0039] This retrieval scheme achieves differentiated consideration of feature importance through hierarchical weighting. Compared with single vector similarity retrieval, it is more in line with the business logic of interface function recognition and improves the accuracy and reliability of similar template retrieval.

[0040] Furthermore, in step S103, if a similar interface template is found, then based on the interface feature information of the target interface data and the similar interface template, inference is performed using a large inference model to obtain the functional identification result of the target interface data, specifically including: Step B1: Parse the interface feature information and interface function information from each retrieved similar interface template; The interface feature information includes: request path, request operation type, header feature information, and content body feature information; the interface function information includes: function tags, usage classification, and other descriptions.

[0041] Step B2: Combine the interface feature information of the target interface data with the interface feature information and interface function information of all similar interface templates retrieved to form enhanced reasoning prompt information; The enhanced reasoning prompts are structured text instructions designed to guide the large-scale reasoning model in knowledge-based deep analysis. Examples include: {Target Interface Data: {Target Interface ID, Request Path, Request Method, Request Header Features, Request Content}, Similar Interface Template 1: {Request Path, Request Method, Request Header Features, Request Content, Interface Description}, Similar Interface Template 2: {Request Path, Request Method, Request Header Features, Request Content, Interface Description}}. Furthermore, the enhanced reasoning prompts may also include task instructions to clarify the reasoning objectives of the large-scale reasoning model and output constraint instructions to limit the presentation dimensions of the functional identification results.

[0042] Preferably, step B2 specifically includes: Step B21: Obtain a predefined structured enhancement prompt template, which includes: an instruction segment for setting the reasoning role and task requirements, a knowledge segment for inserting reference case features and functions, a target segment for describing the features of the interface to be analyzed, and a constraint segment for indicating the output format; Step B22: Extract the interface feature information and interface function information from each retrieved similar interface template, and use the two as a pair of related knowledge units to fill the knowledge segment; and fill the target interface data's interface feature information into the target segment. Step B23: Perform text coherence processing on the completed instruction segment, knowledge segment, target segment, and constraint segment to generate semantically and structurally complete enhanced reasoning prompts.

[0043] Step B3: Input the enhanced reasoning prompt information into the inference model so that the inference model performs enhanced reasoning on the target interface data based on the similar interface template; The main logical steps of the large-scale inference model for enhanced inference are as follows: First, the embedding layer transforms the target interface feature information and the feature and functional knowledge of similar interface templates in the enhanced inference prompts into semantic vectors of a unified dimension. Second, the attention layer focuses on the two types of semantic vectors, strengthens the association weight between the target interface features and the template features and functional knowledge, and filters out the core association information with consistent functional orientation. Next, the encoding layer deeply fuses the associated semantic vectors with the feature and functional association knowledge of the template to generate a fused semantic representation containing external domain knowledge. Subsequently, the logic verification layer evaluates the feature differences between the target interface and the template, determines whether the differences affect the functional association, and adjusts the confidence weight of the inference conclusion. Finally, the output layer, based on the fused semantic representation and the verification results, directionally derives the target interface function and generates a structured result.

[0044] Step B4: Obtain the output of the inference model as the function identification result; wherein, the function identification result includes: the function label, usage classification, and confidence score corresponding to the target interface data; The function identification result is a structured data object designed to fully describe the functional assessment conclusion of the target interface. Functional tags represent the specific business operations performed by the interface, usage classification represents the business domain to which the interface belongs, and confidence score represents the reliability estimate of the inference. Additionally, the function identification result may include an inference description, a short text summarizing the key basis for the model's conclusion, used to enhance the interpretability of the results. For example, {Target Interface ID, Functional Tag, Usage Classification, Confidence Score, Inference Description}.

[0045] Through the above steps, this embodiment organically integrates the retrieved external knowledge, the characteristics of the target interface, and the deep semantic capabilities of the reasoning model, significantly improving the accuracy of function recognition.

[0046] Furthermore, in step S104, if no similar interface template is found, the function identification result of the target interface data is obtained by using the inference model based solely on the interface feature information of the target interface data. This specifically includes: Step C1: Based on the interface feature information of the target interface data, generate independent reasoning prompt information; In addition, the independent reasoning prompts may also include task instructions for clarifying the reasoning objectives of the large reasoning model and output constraint instructions for limiting the presentation dimensions of the functional recognition results.

[0047] Preferably, step C1 specifically includes: first, obtaining a predefined structured independent prompt template, the independent prompt template including: an instruction segment for setting the independent reasoning role and task requirements, a feature segment for filling in the target interface feature information, and a constraint segment for indicating the output format; then, completely and structurally filling the interface feature information of the target interface data into the feature segment, the filling content covering all relevant dimensions; finally, performing text coherence processing on the filled instruction segment, feature segment and constraint segment to generate semantically complete and formatted independent reasoning prompt information.

[0048] Step C2: Input the independent reasoning prompt information into the reasoning model so that the reasoning model can perform independent reasoning on the target interface data without relying on the interface template; The main logical steps of the large-scale reasoning model for independent reasoning are as follows: First, the embedding layer only converts the target interface feature information in the independent reasoning prompts into semantic vectors of a unified dimension, without the involvement of features and functional knowledge of similar interface templates in the transcoding; second, the attention layer only focuses on the functional orientation dimension of the target interface features themselves, strengthening the weight of core features without capturing the association with external templates; next, the encoding layer only encodes the target feature semantic vectors by combining the general domain knowledge pre-trained by the model, without integrating any domain-specific knowledge of external templates; subsequently, the logic construction layer autonomously constructs the functional association chain between target interface features, without the evaluation step of template feature differences, which is different from the difference verification of augmented reasoning; finally, the output layer evaluates the confidence weights based on the completeness and semantic orientation of the target features, autonomously derives the interface functions, and generates structured results.

[0049] Step C3: Obtain the output of the inference model as the function identification result; wherein, the function identification result includes: the function label, usage classification, and confidence score corresponding to the target interface data; In addition, the functional recognition results may also include inference descriptions.

[0050] In this embodiment, when no similar interface template is found, the fault-tolerant independent reasoning mode is entered, and the analysis is performed solely based on the original features and information of the target interface data itself. This mode is suitable for functional identification scenarios of new APIs and specially named interfaces.

[0051] Furthermore, a complete API function tagging system and usage classification standards have been established, supporting the automatic identification of common function categories such as user management, data operation, file processing, and identity authentication. Function tags are high-level and broad-coverage tags, describing broad categories such as file upload, file download, account registration, login authentication, biometric authentication, password modification, and account cancellation. Usage classification provides a more refined description based on function tags, accurately expressing the specific behavioral meaning of the API, such as user management, data operation, identity authentication, system monitoring, and configuration management. By establishing a standardized API function classification system, complete identification results including function tags, usage classifications, and confidence scores are output, providing accurate functional semantic information support for API asset management and business applications.

[0052] like Figure 2 As shown, a specific example of using the above method is presented. First, the target interface data is filtered from network traffic data through the data preprocessing module. Then, interface feature information is extracted from the target interface data and quantified into interface feature vectors. Next, the RAG retrieval module searches the RAG database (i.e., the knowledge base) to determine whether a similar interface template with semantically similar interface feature vectors to the target interface data is found. If the retrieval is successful, enhanced reasoning is performed based on the target interface data and similar interface templates, using a large-scale reasoning model to obtain the function identification result. If the retrieval fails, feature analysis is performed on the target interface data using the large-scale reasoning model for independent reasoning, thereby obtaining the function identification result. In this embodiment, two processing paths are designed: successful retrieval and failed retrieval. Knowledge-enhanced reasoning is used when the retrieval is successful, and independent reasoning is used when the retrieval fails, ensuring recognition coverage and accuracy. This embodiment not only significantly improves the accuracy and reliability of function identification for common interfaces but also ensures basic recognition capabilities for new and unknown interfaces. This fundamentally achieves higher precision, wider coverage, and more intelligent semantic understanding and automated management of API assets, providing reliable technical support for data security and business governance.

[0053] Example 2 This invention provides an interface function recognition device based on a large model, such as... Figure 3 As shown, the device specifically includes the following components: The data acquisition module 301 is used to acquire the target interface data to be identified and extract interface feature information from the target interface data; The template retrieval module 302 is used to retrieve similar interface templates that are semantically similar to the interface feature information of the target interface data from a preset knowledge base; wherein, the knowledge base includes multiple interface templates with known functions; The enhanced reasoning module 303 is used to, if a similar interface template is found, simultaneously use the large reasoning model to reason based on the interface feature information of the target interface data and the similar interface template to obtain the functional identification result of the target interface data. The independent reasoning module 304 is used to, if no similar interface template is found, reason based solely on the interface feature information of the target interface data using the large reasoning model to obtain the functional identification result of the target interface data.

[0054] Specifically, the data acquisition module 301 is used for: Target interface data is determined from the collected network traffic data according to preset filtering criteria; wherein the filtering criteria include at least one of the following: Set the network traffic data containing the preset interface identifier in the request path as the target interface data; Set the network traffic data containing the preset data format identifier in the request header and / or the corresponding response header as the target interface data; Set network traffic data in the target interface format as the request body and / or the corresponding response body in the preset data format.

[0055] Furthermore, the enhanced inference module 303 is specifically used for: The interface feature information and interface function information are parsed from each retrieved similar interface template; The interface feature information of the target interface data, as well as the interface feature information and interface function information of all similar interface templates retrieved, are combined to form enhanced reasoning prompt information; The enhanced reasoning prompt information is input into the large-scale reasoning model, so that the large-scale reasoning model performs enhanced reasoning on the target interface data based on the similar interface template; The output of the inference model is obtained as the function identification result; wherein, the function identification result includes: the function label, usage classification and confidence score corresponding to the target interface data.

[0056] Furthermore, the independent inference module 304 is specifically used for: Based on the interface feature information of the target interface data, independent reasoning prompt information is generated; The independent reasoning prompt information is input into the large reasoning model so that the large reasoning model can perform independent reasoning on the target interface data without relying on the interface template. The output of the inference model is obtained as the function identification result; wherein, the function identification result includes: the function label, usage classification and confidence score corresponding to the target interface data.

[0057] Furthermore, the interface feature information includes at least one of the following: Request path; Request operation type; Header feature information parsed from the request header and the corresponding response header; Content body feature information parsed from the request body and the corresponding response body; The header feature information includes: data format information and / or authorization authentication information; The content body feature information includes: field name, field nesting level and / or field data type.

[0058] Example 3 This embodiment also provides a computer device, such as a smartphone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server, or cabinet server (including a standalone server or a server cluster composed of multiple servers), etc., capable of executing programs. Figure 4 As shown, the computer device 40 in this embodiment includes, but is not limited to, a memory 401 and a processor 402 that are communicatively connected to each other via a system bus. It should be noted that... Figure 4 Only a computer device 40 with components 401-402 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0059] In this embodiment, the memory 401 (i.e., the readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 401 may be an internal storage unit of the computer device 40, such as the hard disk or memory of the computer device 40. In other embodiments, the memory 401 may also be an external storage device of the computer device 40, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 40. Of course, the memory 401 may include both the internal storage unit and its external storage device of the computer device 40. In this embodiment, the memory 401 is typically used to store the operating system and various application software installed on the computer device 40. In addition, the memory 401 may also be used to temporarily store various types of data that have been output or will be output.

[0060] In some embodiments, processor 402 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. This processor 402 is typically used to control the overall operation of computer device 40.

[0061] Specifically, in this embodiment, the processor 402 is used to execute the program of the interface function identification method based on the large model stored in the memory 401. When the program of the interface function identification method based on the large model is executed, it performs the following steps: Obtain the target interface data to be identified, and extract interface feature information from the target interface data; Retrieve similar interface templates with semantically similar interface feature information to the target interface data from a preset knowledge base; wherein, the knowledge base includes multiple interface templates with known functions; If a similar interface template is found, then based on the interface feature information of the target interface data and the similar interface template, the large inference model is used to perform inference to obtain the functional identification result of the target interface data. If no similar interface template is found, the function identification result of the target interface data is obtained by using the inference model based solely on the interface feature information of the target interface data.

[0062] For a detailed description of the above method steps, please refer to Example 1. This example will not be repeated here.

[0063] Example 4 This embodiment also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, app store, etc., which stores a computer program. When the computer program is executed by a processor, it implements the following method steps: Obtain the target interface data to be identified, and extract interface feature information from the target interface data; Retrieve similar interface templates with semantically similar interface feature information to the target interface data from a preset knowledge base; wherein, the knowledge base includes multiple interface templates with known functions; If a similar interface template is found, then based on the interface feature information of the target interface data and the similar interface template, the large inference model is used to perform inference to obtain the functional identification result of the target interface data. If no similar interface template is found, the function identification result of the target interface data is obtained by using the inference model based solely on the interface feature information of the target interface data.

[0064] For a detailed description of the above method steps, please refer to the first embodiment. This embodiment will not repeat the details here.

[0065] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0066] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0067] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0068] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for identifying an interface function based on a large model, characterized by, The method comprises: acquiring target interface data to be identified, and extracting interface feature information from the target interface data; retrieving a similar interface template with similar semantics of the interface feature information of the target interface data in a preset knowledge base; wherein the knowledge base comprises a plurality of interface templates of known functions; if a similar interface template is retrieved, then simultaneously based on the interface feature information of the target interface data and the similar interface template, reasoning by using a large inference model to obtain a function recognition result of the target interface data; if no similar interface template is retrieved, then only based on the interface feature information of the target interface data, reasoning by using the large inference model to obtain the function recognition result of the target interface data. 2.The large model-based interface function identification method according to claim 1, characterized in that, The acquisition of the target interface data to be identified specifically comprises: determining the target interface data from the collected network traffic data according to a preset screening condition; wherein the screening condition at least comprises one of the following: setting the network traffic data containing a preset interface identifier in the request path as the target interface data; setting the network traffic data containing a preset data format identifier in the request header and / or the corresponding response header as the target interface data; setting the network traffic data with a format of a preset data format in the request content body and / or the corresponding response content body as the target interface data. 3.The large model-based interface function identification method of claim 1, wherein, If a similar interface template is retrieved, then simultaneously based on the interface feature information of the target interface data and the similar interface template, reasoning by using a large inference model to obtain a function recognition result of the target interface data, specifically comprising: respectively parsing the interface feature information and the interface function information from each similar interface template retrieved; combining the interface feature information of the target interface data, and the interface feature information and the interface function information in all similar interface templates retrieved to form enhanced inference prompt information; inputting the enhanced inference prompt information into the large inference model, so that the large inference model performs enhanced reasoning on the target interface data based on the similar interface template; acquiring the output of the large inference model as the function recognition result; wherein the function recognition result comprises a function label corresponding to the target interface data, a use classification, and a confidence score. 4.The large model-based interface function identification method according to claim 1, characterized in that, If no similar interface template is retrieved, then only based on the interface feature information of the target interface data, reasoning by using the large inference model to obtain the function recognition result of the target interface data, specifically comprising: based on the interface feature information of the target interface data, forming independent inference prompt information; inputting the independent inference prompt information into the large inference model, so that the large inference model performs independent reasoning on the target interface data without relying on an interface template; acquiring the output of the large inference model as the function recognition result; wherein the function recognition result comprises a function label corresponding to the target interface data, a use classification, and a confidence score.

5. The large model-based interface function identification method according to any one of claims 1 to 4, characterized in that, The interface feature information at least comprises one of the following: a request path; a request operation type; header feature information parsed from the request header and the corresponding response header; Content body feature information parsed from the request content body and the corresponding response content body; The header feature information includes data format information and / or permission authentication information. The content body feature information includes a field name, a field nesting level, and / or a field data type.

6. A large model-based interface function recognition apparatus, characterized by, The apparatus comprises: A data acquisition module configured to acquire target interface data to be identified and extract interface feature information from the target interface data; A template retrieval module configured to retrieve similar interface templates with similar semantics to the interface feature information of the target interface data from a preset knowledge base; the knowledge base comprises a plurality of known functional interface templates; An enhanced inference module configured to, if a similar interface template is retrieved, simultaneously perform inference based on the interface feature information of the target interface data and the similar interface template by using a large inference model to obtain a functional identification result of the target interface data; An independent inference module configured to, if no similar interface template is retrieved, perform inference based on only the interface feature information of the target interface data by using the large inference model to obtain the functional identification result of the target interface data.

7. The large model-based interface function recognition apparatus according to claim 6, characterized by, The enhanced inference module is specifically configured to: Parse interface feature information and interface function information from each retrieved similar interface template respectively; Combine the interface feature information of the target interface data and the interface feature information and interface function information in all the retrieved similar interface templates to form enhanced inference prompt information; Input the enhanced inference prompt information into the large inference model to enable the large inference model to perform enhanced inference on the target interface data based on the similar interface templates; Obtain an output of the large inference model as the functional identification result; the functional identification result comprises a function label, a use classification, and a confidence score corresponding to the target interface data.

8. The large model-based interface function recognition apparatus according to claim 6, characterized by, The independent inference module is specifically configured to: Form independent inference prompt information based on the interface feature information of the target interface data; Input the independent inference prompt information into the large inference model to enable the large inference model to perform independent inference on the target interface data without relying on an interface template; Obtain an output of the large inference model as the functional identification result; the functional identification result comprises a function label, a use classification, and a confidence score corresponding to the target interface data.

9. A computer device comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the method in any one of claims 1 to 5 when executing the computer program.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

Images