Risk prediction method for service exposure surface and related device

Abstract

The invention discloses a risk prediction method for a service exposure surface and a related device, and relates to the field of artificial intelligence, network security or finance, and the method comprises the steps: firstly, obtaining a plurality of endpoint access sequences corresponding to an application program; secondly, acquiring four characteristics, including traffic statistical characteristics, request structure and semantic characteristics, response content characteristics and access control characteristics, corresponding to the interactive interfaces, inputting the four characteristics into a pre-constructed risk prediction model, and acquiring suspected problem interface probabilities corresponding to the interactive interfaces through the risk prediction model; according to the method, traditional qualitative judgment depending on expert experience is converted into computable and sortable numerical risk scoring, and the purpose of risk assessment of the interactive interface is achieved.

Description

Technical Field

[0001] This application relates to the technical field of network security, and in particular to a method and related apparatus for predicting the risk of business exposure surfaces. Background Technology

[0002] With the widespread adoption of cloud computing, microservice architecture, and distributed systems, the architectural complexity of applications is increasing exponentially. The surge in data interaction demands within applications and with external systems has led to an explosive growth in the number of interaction interfaces used for business logic triggering and data exchange. These massive numbers of exposed interaction interfaces pose potential security risks and have become key entry points for cyberattacks.

[0003] Traditional security measures often focus on passive defense against known threats, lacking a systematic understanding and quantitative assessment of the dynamic changes in the business exposure surface, making it difficult to cope with increasingly sophisticated attack methods. The business exposure surface refers to the dynamic set of all interactive interfaces in an application that are exposed to the external network environment and could be exploited by unauthorized entities to extract sensitive data or bypass security control policies.

[0004] Therefore, there is an urgent need for a technical solution for predicting the risks of business exposure. Summary of the Invention

[0005] In view of the above problems, this application provides a method and related apparatus for predicting the risk of business exposure surfaces, so as to achieve the purpose of risk assessment of interaction interfaces. The specific solution is as follows:

[0006] The first aspect of this application provides a method for predicting the risk of business exposure surfaces, including:

[0007] Obtain multiple endpoint access sequences corresponding to the application, wherein the endpoint access sequences include business request messages belonging to the same user identity within the same session period;

[0008] Based on the multiple endpoint access sequences, traffic statistics features corresponding to each interaction interface are obtained. The traffic statistics features of the interaction interface include: the first total number of times the interaction interface is accessed within an analysis period, the second total number of times the interaction interface is accessed by different user identities within an analysis period, the third total number of times the interaction interface is accessed by different IP addresses within an analysis period, the ratio of the second total number to the first total number, and the ratio of the number of automated task types in the business request messages that access the interaction interface to the first total number.

[0009] Based on the multiple endpoint access sequences, the request structure and semantic features corresponding to each interaction interface are obtained respectively. The request structure and semantic features of the interaction interface include: the Uniform Resource Locator (URL) path depth of the business request message accessing the interaction interface and the number of preset sensitive keywords contained in the business request message.

[0010] Based on the multiple endpoint access sequences, the response content features corresponding to each interaction interface are obtained. The response content features of the interaction interface include: the Content-Type field value in the response message of the business request message of the interaction interface; the ratio of the number of preset sensitive keywords contained in the response message to the number of all parameters contained in the response message; and the ratio of the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes of the response message.

[0011] Based on the multiple endpoint access sequences, access control features corresponding to each interaction interface are obtained. The access control features of the interaction interface include: the ratio of the number of business request messages carrying a preset authentication credential identifier in the business request messages that access the interaction interface to the total number of all business request messages that access the interaction interface; and the ratio of the number of response messages carrying a status code indicating authentication failure in the response messages of the business request messages that access the interaction interface to the total number of all response messages of the business request messages that access the interaction interface.

[0012] The feature sets corresponding to each interaction interface are input into a pre-built risk prediction model. The probability of a suspected problem interface corresponding to each interaction interface is obtained through the risk prediction model. The feature set corresponding to each interaction interface includes the traffic statistics feature, the request structure and semantic feature, the response content feature, and the access control feature.

[0013] In one possible implementation, the step of obtaining the multiple endpoint access sequences corresponding to the application includes:

[0014] Obtain the original full traffic data of the application, which includes all interactive interfaces within the risk prediction period;

[0015] Obtain multiple business request messages carrying business logic from the original full business traffic data;

[0016] For each of the aforementioned service request messages, the parameters in the service request message are sorted according to a set rule to obtain a standardized request message;

[0017] Obtain the unique identifier corresponding to each of the multiple business request messages. The unique identifier of the business request message represents the interaction interface, HTTP method and various parameters to be accessed by the business request message.

[0018] One of the multiple consecutive service request messages with the same unique identifier within the same preset time window is retained;

[0019] The URL path of the business request message is normalized to obtain the target business request message. Each specific instance identifier in the URL path of the target business request message is replaced by the preset general type to which the specific instance identifier belongs.

[0020] The target service request messages that have the same session identifier and belong to the same session period are grouped into the same endpoint access sequence; the session identifier represents the user identity.

[0021] In one possible implementation, the step of obtaining multiple business request messages carrying business logic from the original full business traffic data includes:

[0022] Delete static resource request messages from the original full traffic data. The URL path of the static resource request message includes a first preset identifier, and the header of the response message to the static resource request message includes a second preset identifier.

[0023] Non-business request messages are deleted from the original full business traffic data.

[0024] In one possible implementation, the step of normalizing the URL path of the business request message to obtain the target business request message includes:

[0025] The preset symbols in the service request message are used as delimiters to obtain multiple path segments;

[0026] For each path segment, a preset general type matching the path segment is queried from a preset hierarchical rule base, and the path segment in the business request message is replaced. The preset hierarchical rule base includes multiple preset general types.

[0027] One possible implementation also includes:

[0028] If the absolute value of the difference between the timestamps of two adjacent target service request messages in the endpoint access sequence is greater than or equal to a preset time threshold, the position between the two adjacent target service request messages is determined as the split point.

[0029] The endpoint access sequence is split at the split point to obtain two endpoint access sequences.

[0030] One possible implementation also includes:

[0031] If the probability of a suspected problematic interface of the target interaction interface among the various interaction interfaces is lower than a preset filtering threshold, the target interaction interface will be deleted from the various interaction interfaces after the next risk detection cycle.

[0032] A second aspect of this application provides a risk prediction device for business exposure surfaces, comprising:

[0033] The first acquisition module is used to acquire multiple endpoint access sequences corresponding to the application, wherein the endpoint access sequence includes business request messages belonging to the same user identity within the same session period;

[0034] The second acquisition module is used to acquire traffic statistics features corresponding to each interaction interface based on the multiple endpoint access sequences. The traffic statistics features of the interaction interface include: the first total number of times the interaction interface is accessed within an analysis period, the second total number of times the interaction interface is accessed by different user identities within an analysis period, the third total number of times the interaction interface is accessed by different IP addresses within an analysis period, the ratio of the second total number to the first total number, and the ratio of the number of automated task types in the business request messages that access the interaction interface to the first total number.

[0035] The third acquisition module is used to acquire the request structure and semantic features corresponding to each interaction interface based on the multiple endpoint access sequences. The request structure and semantic features of the interaction interface include: the Uniform Resource Locator (URL) path depth of the business request message accessing the interaction interface and the number of preset sensitive keywords contained in the business request message.

[0036] The fourth acquisition module is used to acquire the response content features corresponding to each interaction interface based on the multiple endpoint access sequences. The response content features of the interaction interface include: the Content-Type field value in the response message of the business request message of the interaction interface; the ratio of the number of preset sensitive keywords contained in the response message to the number of all parameters contained in the response message; and the ratio of the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes of the response message.

[0037] The fifth acquisition module is used to acquire access control features corresponding to each interaction interface based on the multiple endpoint access sequences. The access control features of the interaction interface include: the ratio of the number of business request messages carrying a preset authentication credential identifier in the business request messages that access the interaction interface to the total number of all business request messages that access the interaction interface; and the ratio of the number of response messages carrying a status code indicating authentication failure in the response messages of the business request messages that access the interaction interface to the total number of all response messages of the business request messages that access the interaction interface.

[0038] The sixth acquisition module is used to input the feature set corresponding to each interaction interface into the pre-built risk prediction model, and obtain the probability of the suspected problem interface corresponding to each interaction interface through the risk prediction model. The feature set corresponding to the interaction interface includes the traffic statistics feature, the request structure and semantic feature, the response content feature, and the access control feature.

[0039] A third aspect of this application provides a computer program product including computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the risk prediction method for the business exposure surface described in the first aspect or any implementation thereof.

[0040] A fourth aspect of this application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0041] The memory is used to store computer programs;

[0042] The processor is used to execute the computer program to enable the electronic device to implement the risk prediction method for the business exposure surface of the first aspect or any implementation thereof.

[0043] The fifth aspect of this application provides a computer storage medium carrying one or more computer programs, which, when executed by an electronic device, enable the electronic device to perform a risk prediction method for the service exposure surface of the first aspect or any implementation thereof.

[0044] By employing the above technical solution, this application provides a risk prediction method for business exposure surfaces. First, it obtains access sequences from multiple endpoints corresponding to the application. Second, it obtains four key features corresponding to the interaction interfaces: traffic statistics, request structure and semantic features, response content features, and access control features. These features are then input into a pre-built risk prediction model. The model then obtains the probability of suspected problematic interfaces for each interaction interface. This application transforms traditional qualitative judgments relying on expert experience into calculable and rankable numerical risk scores, thus achieving the goal of risk assessment for interaction interfaces. Attached Figure Description

[0045] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0046] Figure 1 A schematic diagram of a system architecture is provided for this application;

[0047] Figure 2 A flowchart illustrating a risk prediction method for a business exposure surface provided in an embodiment of this application;

[0048] Figure 3 A schematic diagram of the structure of a risk prediction device for a business exposure surface provided in an embodiment of this application;

[0049] Figure 4 This is a structural diagram of an electronic device provided in this application. Detailed Implementation

[0050] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is for explaining specific embodiments only and is not intended to limit the scope of this application.

[0051] The embodiments of this application will now be described with reference to the accompanying drawings. Those skilled in the art will recognize that, with technological advancements and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are equally applicable to similar technical problems.

[0052] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0053] As enterprises deepen their digital transformation, (interaction interfaces) have become the core hub for data exchange between business systems. However, the explosive growth of interaction interfaces has also brought serious security challenges, specifically as follows:

[0054] Security Challenge 1: Opaque Attack Surface. Traditional security scanning tools rely on web crawlers or documentation, which cannot cover dynamically generated, undocumented, or hidden interactive interfaces, resulting in inherent blind spots in the attack surface.

[0055] Security Challenge 2: Access Control Flaws Are Difficult to Identify. Vertical privilege escalation and other access control vulnerabilities are highly concealed. Traditional detection methods based on rules or single-dimensional features have high false alarm rates and low coverage, and rely heavily on manual penetration testing.

[0056] Security Challenge 3: Severe interference from noisy data requests: Noisy requests such as static resource request messages, heartbeat packets, and pre-inspection requests account for more than 90%, directly drowning out business request messages that carry real business logic, resulting in low analysis efficiency and insufficient model confidence.

[0057] Therefore, there is an urgent need for a technical solution that can directly, accurately, and comprehensively identify all interaction interfaces from the original full traffic data of business operations, and automatically and quantitatively assess their permission sensitivity risks, so as to achieve complete mapping of the attack surface and accurate deployment of security resources.

[0058] The following is a detailed explanation.

[0059] See Figure 1 , Figure 1 A schematic diagram of a system architecture is shown. The system may include one or more terminals 100, an application server 200, a traffic acquisition device 300, and electronic devices 400.

[0060] The terminal 100 may have one or more applications installed. These applications can provide an interface. The terminal 100 can generate a request message based on the relevant parameters entered by the user on the interface and send the request message to the application server 200. The application server 200 can obtain a response message based on the received request message and return the response message to the terminal 100.

[0061] It is understood that for each application, the user can interact with the application server 200 corresponding to that application through the terminal 100. For example, in this embodiment of the application, the raw full traffic data of the application can be obtained from the application server 200 through the traffic collection device 300.

[0062] For example, traffic acquisition device 300 can send raw full traffic data of each application to electronic device 400, thereby enabling electronic device 400 to perform the risk prediction method of the service exposure surface provided in the embodiments of this application.

[0063] It is understood that the traffic acquisition device 300 sends the original full traffic data of the service within the risk prediction period to the electronic device 400 every risk prediction period, so that the electronic device 400 can execute the risk prediction method of the service exposure surface provided in the embodiments of this application.

[0064] The following description Figure 1 The product form of the mid-terminal 100.

[0065] The terminal 100 in this application embodiment can be a mobile phone, tablet computer, wearable device, vehicle device, augmented reality (AR) / virtual reality (VR) device, laptop computer, ultra-mobile personal computer (UMPC), netbook, personal digital assistant (PDA), etc., and this application embodiment does not impose any restrictions on it.

[0066] Terminal 100 may include a radio frequency unit, memory, input unit, display unit, camera (optional), audio circuitry (optional), speaker (optional), microphone (optional), headphone jack (optional), processor, external interface, power supply, and other components. Those skilled in the art will understand that the above-mentioned components are merely examples and do not constitute a limitation on the terminal or multifunctional device; it may include more or fewer components, or a combination of certain components, or different components.

[0067] The input unit can be used to receive input numeric or character information, and to generate key signal inputs related to user settings and function control of the portable multi-functional device. Specifically, the input unit may include a touchscreen (optional) and / or other input devices. Other input devices may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0068] Among them, the input device can receive input data, etc.

[0069] This display unit can be used to display information input by the user or information provided to the user, various menus of the terminal, interactive interfaces, file display, and / or playback of any multimedia file.

[0070] This radio frequency unit (optional) can be used to receive and send signals during information transmission or calls.

[0071] In this embodiment of the application, the radio frequency unit can send data to the server 200 and receive the processing results sent by the server 200.

[0072] It should be understood that this radio frequency unit is optional and can be replaced with other communication interfaces, such as a network port.

[0073] Terminal 100 also includes a power source (such as a battery) for supplying power to the various components.

[0074] Terminal 100 also includes an external interface, which can be a standard Micro USB interface or a multi-pin connector, which can be used to connect terminal 100 to other devices for communication or to connect a charger to charge terminal 100.

[0075] Application server 200 includes a bus, processor, communication interface, and memory. The processor, memory, and communication interface communicate with each other via the bus.

[0076] For example, traffic acquisition devices include, but are not limited to: Network TAP, Switch Port Mirroring (SPAN / RSPAN), Reverse Proxy Server (Nginx / HAProxy), and API Gateway (Kong / API SIX).

[0077] For example, the electronic device can be a terminal or a server.

[0078] The following is combined Figure 1 The hardware architecture described herein illustrates a risk prediction method for a service exposure surface provided in an embodiment of this application.

[0079] For example, the business exposure surface is a dynamic set consisting of multiple interaction interfaces.

[0080] The business exposure surface refers to the set of all interactive interfaces in an application that are exposed to the external network environment and may be used by unauthorized entities to extract sensitive data or bypass security control policies.

[0081] Business exposure surfaces include explicit business exposure surfaces, implicit business exposure surfaces, and legacy business exposure surfaces.

[0082] Explicit business exposure surfaces refer to known interaction interfaces that are clearly documented in the development documentation. These exposure surfaces are typically managed by standard security policies.

[0083] Hidden business exposure surfaces refer to shadow interaction interfaces that have not undergone security review or registration, but are observed to be actively interacting in actual business traffic. Such exposure surfaces typically represent high-risk, unknown assets.

[0084] In this context, legacy service exposure surfaces refer to zombie interfaces that should be obsolete or decommissioned at the business logic level, but still maintain network reachability and respond to requests at the technical implementation level. Such exposure surfaces may contain unpatched historical vulnerabilities.

[0085] Reference Figure 2 , Figure 2 A flowchart illustrating a risk prediction method for a business exposure surface provided in this application embodiment is shown below. Figure 2 As shown in the figure, the risk prediction method for a business exposure surface provided in this application embodiment may include steps S201 to S206, which are described in detail below.

[0086] Step S201: Obtain multiple endpoint access sequences corresponding to the application, wherein the endpoint access sequences include service request messages belonging to the same user identity within the same session period.

[0087] Endpoint access sequence refers to a logically related request chain formed by reassembling discrete business request messages in chronological order, representing the complete operation trajectory of the same user identity in a specific business scenario.

[0088] A session period refers to the continuous interactive time period maintained by a user from logging into the system to logging out or timeout, usually divided by a timeout threshold (such as 30 minutes).

[0089] User identity refers to a unique credential identifying the caller. For example, it can be represented by a session ID in a cookie or a token in the Authorization header, or by a source IP address (Internet Protocol Address) and User-Agent. The User-Agent is a standard field in the HTTP request header of a request message, used to identify the client software initiating the request; it is an important identifier distinguishing different client types and versions. The source IP address refers to the address of the device on which the client that generated the request message resides.

[0090] The following is the complete operation trajectory of the shopping process of user "Alice" within the same session period, that is, the endpoint access sequence of user "Alice" is: [POST / auth / login]→[GET / interaction interface / products]→[GET / interaction interface / products / {intId}]→[POST / interaction interface / cart / {intId} / add]→[GET / interaction interface / cart]→[POST / interaction interface / orders]→[GET / interaction interface / orders / {uuid}].

[0091] This application transforms multiple unordered business request messages into a structured endpoint access sequence through session clustering, providing contextual integrity for subsequent feature extraction, ensuring that permission analysis is based on real business scenarios rather than isolated requests, and avoiding misjudgments of unauthorized behavior caused by session fragmentation. This is the accurate attribution basis that traditional traffic analysis cannot achieve.

[0092] Step S202: Obtain the traffic statistics features corresponding to each interaction interface based on the multiple endpoint access sequences.

[0093] The traffic statistics features of the interaction interface include: the first total number of times the interaction interface is accessed within an analysis period, the second total number of times the interaction interface is accessed by different user identities within an analysis period, the third total number of times the interaction interface is accessed by different IP addresses within an analysis period, the ratio of the second total number to the first total number, and the ratio of the number of automated task types in the business request messages accessing the interaction interface to the first total number.

[0094] Understandably, if the first, second, and third total counts for an interactive interface are all high, it indicates that the interactive interface may be a public interface, such as the interactive interface of a news list or the resource interface of a website homepage. This type of interactive interface has a wide range of visitors, a huge number of visitors, and low sensitivity.

[0095] If the first, second, and third total visits for an interactive interface are all low, it indicates that the interface may be sensitive, a strong signal of a sensitive interactive interface. For example, the "delete user" function in an administrator's backend might only be accessed a few times by one or two administrators per day. Similarly, a user's "change password" interface might only be accessed by that user. This type of interactive interface is considered relatively sensitive.

[0096] The ratio of the second total number of visits to the first total number of visits reflects whether the user's access behavior is "broad and shallow" or "deep and narrow". If the ratio of the second total number of visits to the first total number of visits is close to 1, it means that each user accesses the interaction interface only once on average; if the ratio of the second total number of visits to the first total number of visits is very low, it means that a few users are repeatedly accessing the interaction interface.

[0097] Understandably, if the ratio of the second total count to the first total count is very low, it indicates a sensitive functional scenario requiring continuous operation or monitoring. For example, in a backend management application scenario, an administrator might repeatedly refresh a data report page to view real-time data. In other words, the lower the ratio of the second total count to the first total count, the higher the sensitivity of the interaction interface.

[0098] Automated task types refer to highly regular interactive interface calls initiated automatically by non-human users or programs. For example, a scheduled task script will repeatedly call a certain interactive interface to perform the same task with a fixed identity. Another example is that users may perform multiple operations on their order page or account settings page. In contrast, publicly accessible browsing pages are typically viewed and then left, resulting in a low repeat visit rate.

[0099] The following examples illustrate the various terms mentioned above, as shown in Table 1.

[0100] Table 1 Interaction Interface First total number of times Second total number of times Third total number The ratio of the second total number to the first total number The ratio of the number of automated task types in the business request messages that access the interactive interface to the total number of requests. GET / interactive interface / news 1,000,000 850,000 800,000 0.85 0 DELETE / interaction_interface / users / {intId} 5 1 1 0.2 0 GET / interactive / internal / sync 10,000 2 2 0.0002 50%

[0101] This application brings hidden sensitive interaction interfaces to the surface. Specifically, the ratio of the number of automated task types in the business request messages that access the interaction interface to the first total number of times (low first total number of times, low second total number of times, low third total number of times, and low first total number of times) constitutes a strong signal of a sensitive interface. The ratio of the number of automated task types in the business request messages that access the interaction interface to the first total number of times distinguishes between human and machine behavior, avoids misjudging operation and maintenance scripts as attack traffic, and enables the risk prediction model to focus on real user permission risks.

[0102] Step S203: Obtain the request structure and semantic features corresponding to each interaction interface based on the multiple endpoint access sequences.

[0103] The request structure and semantic features of the interactive interface include: the Uniform Resource Locator (URL) path depth of the business request message accessing the interactive interface and the number of preset sensitive keywords contained in the business request message.

[0104] The URL path depth of a business request message refers to the number of path segments separated by " / ". For example, the URL path depth of / interactive interface / v1 / admin / users is 4.

[0105] Understandably, URL path depth often logically maps to the application's functional tree. If the URL path depth is shallow (e.g., / login / products), the interface is usually the top-level entry point or a large functional category of the application, with high public visibility. If the URL path depth is deep (e.g., / interaction_interface / admin / system / config / database), the interface usually points to a very specific and refined functional point, and its access control is often stricter and more sensitive.

[0106] The preset sensitive keywords contained in the business request message refer to keywords in the URL path and parameter names of the business request message that are the same as words in the preset sensitive keyword library.

[0107] For example, the preset sensitive keyword library includes the following four types of words:

[0108] The first type: permission-related terms, such as admin, manage, setting, config, root. Permission-related terms represent backend management or system configuration functions and often appear in application scenarios involving vertical privilege escalation.

[0109] For example, a request message named POST / interactive / internal / admin / permission / grant-role contains the pre-defined sensitive keyword "admin". This indicates that the request message directly participates in the system's permission management and access control.

[0110] The second type: personal information terms, such as user, profile, account, password, phone, email. Personal information terms indicate the viewing or modification of sensitive personal information.

[0111] For example, the request message is: GET / interaction interface / v2 / user / profile?fields=phone,email,address, which contains the preset sensitive keywords user, profile, user, indicating that the interaction interface is used to process the user's personal identity information.

[0112] The third type: core business terms, such as order, payment, wallet, cart, and trade. These terms represent core business operations related to transactions and finance, and involve the highest level of sensitive operations.

[0113] For example, a request message like POST / payment / v3 / wallet / transfer?to_account=...&amount=... contains the pre-defined sensitive keywords "payment" and "wallet," indicating that this interface is directly related to the company's core business logic, especially financial transactions. This interface may be used to perform functions such as placing orders, making payments, transferring funds, and managing shopping carts or wallet balances.

[0114] The fourth type: Identifier-type words, such as id, uid, no: Identifier-type words represent operations performed on a specific resource instance.

[0115] For example, a request message might be: GET / interaction_interface / v1 / orders / {order_no} / items / {item_id}, containing the pre-defined sensitive keywords 'id' and 'no'. This indicates that the interaction interface is operating on a specific, unique resource instance. For instance, the request message might be, "Can I use my identity to request an order_no or item_id that belongs to someone else?".

[0116] In this application, sensitive keywords directly expose the semantics of permissions granted by the developer, enabling the risk prediction model to identify high-risk areas for unauthorized access without prior knowledge. This explicitly links the URL structure with permission risks, thus solving the second security challenge.

[0117] Step S204: Obtain the response content features corresponding to each interaction interface based on the multiple endpoint access sequences.

[0118] The response content features of the interaction interface include: the Content-Type field value in the response message of the business request message of the interaction interface; the ratio of the number of preset sensitive keywords contained in the response message to the number of all parameters contained in the response message; and the ratio of the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes of the response message.

[0119] For example, if the Content-Type field value is application / json or application / xml, it indicates that the content in the response message comes from a data interface. Interactive interfaces rarely use HTML format when returning sensitive data. Therefore, interactive interfaces that return structured data such as JSON / XML are far more sensitive than those that return HTML structured data.

[0120] If the Content-Type field value is text / html, it means that the content in the response message comes from the interactive interface of the corresponding presentation page. Although it may also contain sensitive information, the data is usually mixed with a large number of presentation tags, and the sensitivity of this interactive interface is moderate.

[0121] If the Content-Type field value is image / or text / css, it means that the content in the response message comes from the interaction interface of the corresponding static resource, and this interaction interface has low sensitivity.

[0122] For example, regular expressions can be used to scan the content of the response body in the response message to calculate the number of pre-defined sensitive keywords that are matched.

[0123] For example, a regular expression can contain patterns such as mobile phone number, ID card number, bank card number, and email address.

[0124] The following explains the "number of preset sensitive keywords contained in the response message." It's understandable that a response message containing 100 phone numbers and a response message containing only one phone number have completely different risk levels and business scenarios. The former response message might correspond to a dangerous interactive interface that allows "exporting all user contact lists."

[0125] The following explains the ratios of "the number of preset sensitive keywords in the response message to the number of all parameters in the response message" and "the ratio of the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes in the response message." These ratios effectively distinguish between "interaction interfaces specifically designed to leak sensitive data" and "interaction interfaces that occasionally contain sporadic sensitive information." The larger the ratio of "the number of preset sensitive keywords in the response message to the number of all parameters in the response message," and / or the larger the ratio of "the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes in the response message," the greater the risk of the interaction interface, i.e., the higher its sensitivity.

[0126] This application assesses risks from the perspective of data breach consequences, such as identifying data interfaces, interactive interfaces of display pages, and interactive interfaces of static resources through the Content-Type field value. This application effectively distinguishes between "ordinary interfaces that accidentally contain sensitive fields" and "dangerous interfaces that leak data in bulk" by using the ratio of "the number of preset sensitive keywords contained in the response message to the number of all parameters contained in the response message" and "the ratio of the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes of the response message," preventing the risks on the response side from being masked by the URL structure.

[0127] Step S205: Obtain the access control features corresponding to each interaction interface based on the multiple endpoint access sequences.

[0128] The access control features of the interactive interface include: the ratio of the number of business request messages carrying a preset authentication credential identifier to the total number of all business request messages accessing the interactive interface, and the ratio of the number of response messages carrying a status code indicating authentication failure to the total number of all response messages of the business request messages accessing the interactive interface.

[0129] For example, the preset authentication credential identifiers include, but are not limited to: Token and Cookie.

[0130] Understandably, if a business request message carries a preset authentication credential identifier representing identity authentication, it indicates that the interactive interface accessed by the business request message does not accept anonymous access. This suggests that the developer believes this interactive interface can only be used after the user logs in, and that there must be resources or functions behind this interactive interface that need to be protected, meaning that this interactive interface is highly sensitive.

[0131] If the ratio of "the number of business request messages carrying a preset authentication credential identifier in the business request messages accessing the interaction interface to the total number of all business request messages accessing the interaction interface" is 0%, it indicates that the interaction interface is a completely public interaction interface.

[0132] If the ratio of "the number of business request messages carrying a preset authentication credential identifier in the business request messages that access the interaction interface to the total number of all business request messages that access the interaction interface" is in the middle, it indicates that this is an interaction interface with optional login, or that there is some kind of access control defect.

[0133] For example, when a logged-in user views the same post, additional features will be displayed on the page, such as "favorite" and "comment" buttons. If the user clicks the "favorite" or "comment" button, they will need to log in; if the user is only browsing the page, they will not need to log in.

[0134] For example, the status code that indicates authentication failure refers to the HTTP status code that the application server explicitly refuses access, including but not limited to: 401 status code (unauthenticated) and 403 status code (no permission).

[0135] Understandably, the higher the ratio of "the number of response messages carrying a status code indicating authentication failure in the response messages of business request messages to the total number of response messages for business request messages to the interaction interface," the more stringent the access control of that interaction interface. For example, if an interaction interface frequently denies access, it indicates that many users (or scripts) are attempting to access the interaction interface they shouldn't be able to access, making the interface more sensitive.

[0136] The lower the ratio of "the number of response messages carrying a status code indicating authentication failure in the response messages of the business request messages to the interaction interface to the total number of response messages of the business request messages to the interaction interface", the more likely the interaction interface is a public interface, and the lower its sensitivity.

[0137] This application directly quantifies access control strength, namely, the sensitivity of interfaces exposed by high authentication dependency, and the pressure of actual unauthorized attacks revealed by high authentication failure rate. This enables the risk prediction model to identify vulnerable interaction interfaces that should theoretically be protected but are frequently breached in practice, and transforms access control logs into risk warning signals.

[0138] Step S206: Input the feature set corresponding to each interaction interface into the pre-built risk prediction model, and obtain the probability of the suspected problem interface corresponding to each interaction interface through the risk prediction model.

[0139] The feature set corresponding to the interaction interface includes the traffic statistics feature, the request structure and semantic feature, the response content feature, and the access control feature.

[0140] For example, a risk prediction model could be a gradient boosting decision tree (GBDT) model. GBDT automatically learns the non-linear interactions between features to quantify risk in probabilistic form.

[0141] For example, the risk prediction model outputs a probability value between 0 and 1 for each interaction interface. This probability value intuitively represents the likelihood that the interaction interface belongs to a "sensitive target requiring focused auditing".

[0142] In this application embodiment, "probability of suspected problematic interface" refers to the probability of a high probability of access control defects or sensitive data leakage risk.

[0143] Understandably, once an interactive interface with a probability of suspected problematic behavior exceeding a preset threshold is detected, resources for penetration testing, code auditing, and incident response can be prioritized to reduce the probability of privilege vulnerabilities being exploited.

[0144] This application provides a method for predicting risks on the business exposure surface. First, it obtains access sequences from multiple endpoints corresponding to an application. Second, it acquires four key features corresponding to the interaction interface: traffic statistics, request structure and semantic features, response content features, and access control features. These features are then input into a pre-built risk prediction model. The model then obtains the probability of suspected problematic interfaces for each interaction interface. This application transforms traditional qualitative judgments relying on expert experience into calculable and sortable numerical risk scores, thus achieving the goal of risk assessment for interaction interfaces.

[0145] In an optional implementation, the method further includes storing the probability of the suspected problem interface corresponding to each interaction interface in a context information database.

[0146] Understandably, the user identity and preset authentication credential identifier of the interactive interface can also be stored in the context information database.

[0147] In one optional implementation, to improve efficiency in ultra-large-scale environments, a "preset filtering threshold" can be set. Interaction interfaces with a suspected problematic interface probability lower than the preset filtering threshold can be considered as explicit "low-value targets" and safely excluded from subsequent highest-priority detection tasks. That is, after the next risk detection cycle, the probability of a suspected problematic interface for that interaction interface will no longer be detected. Based on this, this application also provides the following method: if the probability of a target interaction interface among the various interaction interfaces is lower than the preset filtering threshold, and after the next risk detection cycle, the target interaction interface is deleted from the various interaction interfaces.

[0148] In one alternative implementation, this application can continuously optimize feature selection and model parameters in the risk prediction model based on historical data in the context information database, thereby improving the accuracy and efficiency of identification.

[0149] It is understood that, in order to address security challenges one and two, the embodiments of this application also provide the following. Step S201 specifically includes steps A1 to A7.

[0150] Step A1: Obtain the original full traffic data of the application, which includes all interaction interfaces within the risk prediction period.

[0151] Raw full-traffic data refers to all application-layer communication data related to the business system, reconstructed from the network protocol stack, captured during the risk prediction period. This primarily includes HTTP / HTTPS request and response messages. Raw full-traffic data covers every interaction between the user and the application server through all entry points, such as browsers, mobile apps, mini-programs, or interactive interface clients.

[0152] For example, the risk prediction period can be determined based on the actual situation, and this application does not limit it. For example, the risk prediction period can be 24 hours or 7 days.

[0153] This application establishes a blind-spot-free attack surface data source, without relying on interactive interface documentation or active crawlers, to ensure that all dynamically generated, undocumented hidden interfaces, especially administrator interfaces that are only exposed after specific business logic is triggered or identity authentication, are included in the analysis scope.

[0154] Step A2: Obtain multiple business request messages carrying business logic from the original full business traffic data.

[0155] Understandably, the original full business traffic data includes static resource request messages, non-business request messages (such as heartbeat packets), and business request messages. It is necessary to remove request noise such as static resource request messages and non-business request messages, and retain business request messages.

[0156] A business request message refers to a functional interface call request that carries core business logic and involves permission determination or access to sensitive data.

[0157] Bearing business logic refers to operations that trigger business rule verification, database read / write, and state changes on the application server.

[0158] Step A3: For each of the aforementioned service request messages, sort the parameters in the service request message according to the set rules to obtain a standardized request message.

[0159] For example, the parameters carried in the business request message refer to the key-value pair data transmitted, including URL query parameters (such as ?page=1&size=10) and request body parameters.

[0160] For example, the rule can be set to sort the key names in ascending order of their ASCII codes, ignoring parameter values ​​and the original order.

[0161] For example, a normalized request message includes the interactive interface to be accessed, the HTTP (Hypertext Transfer Protocol) method, and the sorted parameters carried.

[0162] For example, sorting the parameters in a business request message according to a set rule means sorting them alphabetically by their key names. See Table 2 for an example below.

[0163] Table 2 Business request message Parameter key-value extraction Standardized request message GET / interactive_interface / products?order=desc&page=2&category=electronics order, page, category GET: / interaction interface / products:category,order,page GET / interactive_interface / products?category=electronics&page=2&order=desc category, page, order GET: / interaction interface / products:category,order,page POST / interaction / users / 123{"phone":"1380000","name":"Alice","age":30} phone, name, age POST: / interaction_interface / users / {intId}:age,name,phone POST / interaction / users / 456{"age":25,"name":"Bob","phone":"1390000"} age, name, phone POST: / interaction_interface / users / {intId}:age,name,phone POST / interactive_interface / orders?priority=high_ify=true{"productId":"p1001","quantity":2,"address":"Shanghai"} priority,notify,productId,quantity,address POST: / interaction interface / orders:address,notify,priority,productId,quantity GET / interactive interface / health none GET: / interaction interface / health

[0164] This application can eliminate the ambiguity of unique identifiers caused by differences in parameter order, and ensure that request messages for the same business operation (even if the parameter order is different) generate the same unique identifier.

[0165] Step A4: Obtain the unique identifier corresponding to each of the multiple business request messages. The unique identifier of the business request message represents the interaction interface, HTTP method, and various parameters to be accessed by the business request message.

[0166] For example, a unique identifier can be a hash value. This hash value can be referred to as the fingerprint of the business request message.

[0167] As shown in Table 2, multiple business request messages will receive the same unique identifier as long as they access the same interactive interface, HTTP method, and carry the same parameter key-value pairs, regardless of the order of the parameters in the business request message.

[0168] This application achieves semantic-level deduplication, aggregating different business request messages that operate on the same type of resources under the same unique identifier, accurately identifying repetitive behavior patterns, and providing a foundation for high-frequency repetitive compression and access frequency statistics.

[0169] Step A5: Retain one of the multiple consecutive service request messages with the same unique identifier within the same preset time window.

[0170] For example, the preset time window can be determined based on the actual situation, and this application embodiment does not limit it. For example, the preset time window can be 5 minutes.

[0171] In many scenarios, users or systems may send a large number of identical business request messages to the same interactive interface within a short period of time. These business request messages share the same unique identifier. These duplicate business request messages offer no additional value for discovering new attack surfaces or permission patterns; instead, they interfere with statistical features.

[0172] The following describes a method for detecting duplicate business request messages, which includes the following steps A51 to A53.

[0173] Step A51: Traverse the business request messages that have been sorted by global time and have been calculated with unique identifiers.

[0174] Step A52: Perform the following operations within a preset time window: If multiple consecutive business request messages are detected to have the exact same unique identifier, only one normalized request message is retained. For example, the first business request message is retained. For example, a metadata field of "repetition count" can also be attached to record the total number of consecutive repetitions.

[0175] For example, if a user quickly clicks the "Check Balance" button (5 words), five uniquely identified business request messages are generated, as follows: 09:00:01 GET / interaction interface / balance; 09:00:02 GET / interaction interface / balance; 09:00:03 GET / interaction interface / balance; 09:00:04 GET / interaction interface / balance; 09:00:05 GET / interaction interface / balance. Only the 09:00:01 GET / interaction interface / balance message will be retained, along with metadata field 5.

[0176] Step A53: If multiple service request packets with the same unique identifier are detected to be interrupted in time by one or more service request packets with different unique identifiers, all of them shall be retained.

[0177] In summary, multiple consecutive service request messages refer to a sequence of adjacent request messages that share the same unique identifier in the time sequence and have no other unique identifiers inserted into the sequence.

[0178] This application can reduce invalid and duplicate business request messages, prevent statistical characteristics (such as total visits) from being distorted by user misoperation or front-end debouncing mechanisms, and ensure that indicators such as traffic statistics and access control characteristics truly reflect business intent rather than technical noise.

[0179] The service request messages after steps A1 to A5 have session identifiers, timestamps, and unique identifiers, as illustrated in Table 3.

[0180] Table 3 Timestamp Session identifier Unique Identifier Business request message (simplified) 9:05:10 sid=AdminCookie FP_AUTH_ADMIN POST / auth (admin) 9:06:25 sid=AdminCookie FP_GET_USERS_P1 GET / interaction_interface / v1 / users?page=1 9:08:00 sid=CarlCookie FP_AUTH_CARL POST / auth (carl) 9:09:15 sid=AdminCookie FP_DELETE_USER_BOB DELETE / interaction interface / v1 / users / bob 9:10:30 sid=CarlCookie FP_GET_PROFILE_CARL GET / interaction interface / v1 / users / carl / profile 9:11:45 sid=CarlCookie FP_UPDATE_PROFILE_CARL PUT / interaction / v1 / users / carl / profile

[0181] Step A6: Normalize the URL path of the business request message to obtain the target business request message.

[0182] Each specific instance identifier in the URL path of the target business request message is replaced by the preset general type to which the specific instance identifier belongs.

[0183] The process of normalizing the URL path of the business request message is described below, which includes the following steps A61 to A62.

[0184] Step A61: Use the preset symbols in the business request message as delimiters to obtain multiple path segments.

[0185] For example, the default symbol is " / ".

[0186] Step A62: For each path segment, query the preset general type that matches the path segment from the preset hierarchical rule base, and replace the path segment in the business request message. The preset hierarchical rule base includes multiple preset general types.

[0187] For example, regular expressions can be used for matching.

[0188] For example, the preset hierarchical rule base includes multiple rule bases, which are arranged in priority order from most specific to most general, for example:

[0189] The high-priority rule base includes pre-defined common types with distinct formats, such as UUID, Email, and mobile phone number.

[0190] The medium-priority rule base includes more common preset general types, such as pure numeric ID {intId}.

[0191] The low-priority rule base includes the most common preset general types, such as alphanumeric mixed IDs {alphaNumId}.

[0192] This application's embodiments employ a "short-circuit priority" matching logic: it starts by attempting to match each path segment from the highest priority rule base. Once the first preset general type that can be successfully matched is found, it is immediately replaced using that preset general type, such as {uuid} or {email}, and subsequent matching of that path segment is stopped.

[0193] The following example illustrates this. Assume the business request message is as follows:

[0194] If the URL is / interaction interface / v1 / users / test@example.com / orders / 550e8400-e29b-41d4-a716-446655440000, then the multiple path segments obtained are: test@example.com, 550e8400-e29b-41d4-a716-446655440000.

[0195] For a given path segment, if the preset hierarchical rule base does not contain a preset general type that matches it, the path segment is retained. For test@example.com, it matches the preset general type {email} in the preset hierarchical rule base, and subsequent matching stops. For 550e8400-e29b-41d4-a716-446655440000, it matches the preset general type {uuid} in the preset hierarchical rule base, and subsequent matching stops. The final target business request message is / interaction interface / v1 / users / {email} / orders / {uuid}.

[0196] The following examples illustrate this further, as shown in Table 4.

[0197] Table 4 Business request message Target business request message Matching rules / interaction interface / users / test@example.com / interaction interface / users / {email} High-priority rule base: Email format / interactive interface / orders / 550e8400-e29b-... / interaction interface / orders / {uuid} High-priority rule base: UUID format / interaction interface / products / 12345 / interaction interface / products / {intId} Medium priority rule base: Pure numeric ID / interactive interface / goods / abc_789 / interactive interface / goods / {alphaNumId} Low-priority rule base: Alphanumeric mix

[0198] Step A7: Assign the target service request messages that have the same session identifier and belong to the same session period to the same endpoint access sequence; the session identifier represents the user identity.

[0199] This application can restore the user's real operation context, reconstruct discrete target business request messages into an ordered chain of behaviors, enabling subsequent unauthorized access detection to identify the complete attack path of "query first, then delete", avoiding false alarms caused by the mixing of target business request messages across sessions, and providing clean and time-correct input data for anomaly detection based on behavior sequences.

[0200] For example, multiple target service request messages in an endpoint access sequence can be ordered sequentially from earliest to latest according to their timestamps.

[0201] For example, the timestamp of the target service request message is the time when the target service request message is accessed.

[0202] For example, for each endpoint access sequence, if the absolute value of the difference between the timestamps of two adjacent target service request messages in the endpoint access sequence is greater than or equal to a preset time threshold, the position between the two adjacent target service request messages is determined as a split point; the endpoint access sequence is split at the split point to obtain two endpoint access sequences.

[0203] Understandably, after steps A1 to A7, the original full business traffic data is transformed into multiple endpoint access sequences that are "high-quality, have clear session boundaries, and are strictly ordered in time".

[0204] In one optional implementation, there are multiple ways to implement step A2. The embodiments of this application provide, but do not include, the following method, which includes the following steps B1 to B2 during implementation.

[0205] Step B1: Delete static resource request messages from the original full traffic data. The URL path of the static resource request message includes a first preset identifier, and the header of the response message to the static resource request message includes a second preset identifier.

[0206] For example, the first preset identifier is a feature of a static resource in the URL path, which is usually a file extension, such as .css or .png.

[0207] For example, the second preset identifier can be a MIME type field in the header of the response message that confirms the resource type, such as text / css or image / png in the Content-Type field value.

[0208] This application uses cross-validation based on the URL structure of the request message and the Content-Type field value of the response message to accurately filter out static resource request messages. This avoids the error of misclassifying static resource request messages as business request messages due to the presence of sensitive words such as "admin" in the URL structure.

[0209] The following example illustrates this, assuming the request message is as follows:

[0210] The URL https: / / shop.example.com / assets / themes / admin / css / dashboard.css, despite containing "admin" in its URL path, is correctly identified as a static resource request and discarded by the system because its extension is ".css" and the Content-Type field of the response message is "text / css".

[0211] Step B2: Delete non-business request packets from the original full business traffic data.

[0212] Non-business request messages refer to requests that are automatically initiated by the browser or front-end framework and do not carry core business logic, such as cross-domain preflight requests (HTTP OPTIONS), heartbeat packets used to maintain the session, and status polling requests.

[0213] Understandably, non-business request messages neither carry permission judgment logic nor expose sensitive interfaces, yet they occupy the vast majority of traffic, dragging all subsequent security analysis algorithms into a "sea of ​​noise."

[0214] Understandably, before performing a core business operation (such as "deleting a user"), a browser often needs to initiate a cross-domain preflight request (HTTP OPTIONS) to obtain permission from the application server. Furthermore, browsers may also include mechanisms such as periodic heartbeats or state polling to maintain sessions or synchronize data. These browser-initiated requests, which do not carry core business logic, if not accurately filtered out, can amplify a single user action into several API calls, severely interfering with subsequent unauthorized access detection models and lowering their confidence level.

[0215] The above describes a risk prediction method for service exposure surfaces provided by embodiments of this application. The following describes the apparatus for performing the above-described risk prediction method for service exposure surfaces.

[0216] Please see Figure 3 , Figure 3 This is a schematic diagram of a risk prediction device for a business exposure surface provided in an embodiment of this application. Figure 3 As shown, the risk prediction device for this business exposure surface includes:

[0217] The first acquisition module 301 is used to acquire multiple endpoint access sequences corresponding to the application, wherein the endpoint access sequence includes business request messages belonging to the same user identity within the same session period;

[0218] The second acquisition module 302 is used to acquire traffic statistics features corresponding to each interaction interface based on the multiple endpoint access sequences. The traffic statistics features of the interaction interface include: the first total number of times the interaction interface is accessed within an analysis period, the second total number of times the interaction interface is accessed by different user identities within an analysis period, the third total number of times the interaction interface is accessed by different IP addresses within an analysis period, the ratio of the second total number to the first total number, and the ratio of the number of automated task types in the business request messages that access the interaction interface to the first total number.

[0219] The third acquisition module 303 is used to acquire the request structure and semantic features corresponding to each interaction interface based on the multiple endpoint access sequences. The request structure and semantic features of the interaction interface include: the Uniform Resource Locator (URL) path depth of the business request message accessing the interaction interface and the number of preset sensitive keywords contained in the business request message.

[0220] The fourth acquisition module 304 is used to acquire the response content features corresponding to each interaction interface based on the multiple endpoint access sequences. The response content features of the interaction interface include: the Content-Type field value in the response message of the business request message of the interaction interface; the ratio of the number of preset sensitive keywords contained in the response message to the number of all parameters contained in the response message; and the ratio of the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes of the response message.

[0221] The fifth acquisition module 305 is used to acquire access control features corresponding to each interaction interface based on the multiple endpoint access sequences. The access control features of the interaction interface include: the ratio of the number of business request messages carrying a preset authentication credential identifier in the business request messages that access the interaction interface to the total number of all business request messages that access the interaction interface; and the ratio of the number of response messages carrying a status code indicating authentication failure in the response messages of the business request messages that access the interaction interface to the total number of all response messages of the business request messages that access the interaction interface.

[0222] The sixth acquisition module 306 is used to input the feature set corresponding to each interaction interface into the pre-built risk prediction model, and obtain the probability of the suspected problem interface corresponding to each interaction interface through the risk prediction model. The feature set corresponding to the interaction interface includes the traffic statistics feature, the request structure and semantic feature, the response content feature, and the access control feature.

[0223] In one optional implementation, the first acquisition module includes:

[0224] The first acquisition unit is used to acquire the original full traffic data of the application, which includes all interactive interfaces within the risk prediction period.

[0225] The second acquisition unit is used to acquire multiple business request messages carrying business logic from the original full business traffic data;

[0226] The sorting unit is used to sort the parameters in each of the service request messages according to a set rule to obtain a standardized request message.

[0227] The third acquisition unit is used to acquire the unique identifiers corresponding to the multiple business request messages respectively. The unique identifier of the business request message represents the interaction interface, HTTP method and various parameters to be accessed by the business request message.

[0228] The reservation unit is used to reserve one of multiple consecutive service request messages with the same unique identifier within the same preset time window;

[0229] The normalization unit is used to normalize the URL path of the business request message to obtain the target business request message, wherein each specific instance identifier in the URL path of the target business request message is replaced by a preset general type to which the specific instance identifier belongs.

[0230] A partitioning unit is used to partition target service request messages that have the same session identifier and belong to the same session period into the same endpoint access sequence; the session identifier represents the user identity.

[0231] In one optional implementation, the second acquisition unit includes:

[0232] The first deletion subunit is used to delete static resource request messages from the original full traffic data of the business. The URL path of the static resource request message includes a first preset identifier and the header of the response message to the static resource request message includes a second preset identifier.

[0233] The second deletion subunit is used to delete non-business request messages from the original full business traffic data.

[0234] In one alternative implementation, the normalization unit includes:

[0235] The first acquisition subunit is used to use a preset symbol in the service request message as a delimiter to obtain multiple path segments;

[0236] The query subunit is used to query a preset general type that matches the path segment from a preset hierarchical rule base for each path segment, and replace the path segment in the business request message. The preset hierarchical rule base includes multiple preset general types.

[0237] In one alternative implementation, it also includes:

[0238] The first determining module is used to determine the position between the two adjacent target service request messages as a split point if the absolute value of the difference between the timestamps of two adjacent target service request messages in the endpoint access sequence is greater than or equal to a preset time threshold.

[0239] The segmentation module is used to segment the endpoint access sequence at the segmentation point to obtain two endpoint access sequences.

[0240] In one alternative implementation, it also includes:

[0241] The deletion module is used to delete the target interaction interface from the various interaction interfaces if the probability of the target interaction interface being a suspected problematic interface is lower than a preset filtering threshold, and after the next risk detection cycle is reached.

[0242] This application also provides an electronic device in its embodiments. (See reference...) Figure 4 The diagram illustrates a structural schematic suitable for implementing the electronic device in the embodiments of this application. The electronic device in the embodiments of this application may include, but is not limited to, fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 4 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0243] like Figure 4 As shown, the electronic device may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage device 408 into a random access memory (RAM) 403. When the electronic device is powered on, the RAM 403 also stores various programs and data required for the operation of the electronic device. The processing unit 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0244] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 408 including, for example, memory cards, hard drives, etc.; and communication devices 409. Communication device 409 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0245] This application also provides a computer program product including computer-readable instructions, which, when executed on an electronic device, cause the electronic device to implement any of the risk prediction methods for business exposure surfaces provided in this application.

[0246] This application also provides a computer-readable storage medium that carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any of the risk prediction methods for business exposure surfaces provided in this application.

[0247] It should be noted that the risk prediction method and related apparatus for business exposure surfaces provided by this invention can be used in the fields of artificial intelligence, cybersecurity, or finance. The above are merely examples and do not limit the application areas of the risk prediction method and related apparatus for business exposure surfaces provided by this invention.

[0248] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0249] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0250] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0251] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A method for predicting the risk of business exposure, characterized in that, include: Obtain multiple endpoint access sequences corresponding to the application, wherein the endpoint access sequences include business request messages belonging to the same user identity within the same session period; Based on the multiple endpoint access sequences, traffic statistics features corresponding to each interaction interface are obtained. The traffic statistics features of the interaction interface include: the first total number of times the interaction interface is accessed within an analysis period, the second total number of times the interaction interface is accessed by different user identities within an analysis period, the third total number of times the interaction interface is accessed by different IP addresses within an analysis period, the ratio of the second total number to the first total number, and the ratio of the number of automated task types in the business request messages that access the interaction interface to the first total number. Based on the multiple endpoint access sequences, the request structure and semantic features corresponding to each interaction interface are obtained respectively. The request structure and semantic features of the interaction interface include: the Uniform Resource Locator (URL) path depth of the business request message accessing the interaction interface and the number of preset sensitive keywords contained in the business request message. Based on the multiple endpoint access sequences, the response content features corresponding to each interaction interface are obtained. The response content features of the interaction interface include: the Content-Type field value in the response message of the business request message of the interaction interface; the ratio of the number of preset sensitive keywords contained in the response message to the number of all parameters contained in the response message; and the ratio of the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes of the response message. Based on the multiple endpoint access sequences, access control features corresponding to each interaction interface are obtained. The access control features of the interaction interface include: the ratio of the number of business request messages carrying a preset authentication credential identifier in the business request messages that access the interaction interface to the total number of all business request messages that access the interaction interface; and the ratio of the number of response messages carrying a status code indicating authentication failure in the response messages of the business request messages that access the interaction interface to the total number of all response messages of the business request messages that access the interaction interface. The feature sets corresponding to each interaction interface are input into a pre-built risk prediction model. The probability of a suspected problem interface corresponding to each interaction interface is obtained through the risk prediction model. The feature set corresponding to each interaction interface includes the traffic statistics feature, the request structure and semantic feature, the response content feature, and the access control feature.

2. The risk prediction method for business exposure surfaces according to claim 1, characterized in that, The step of obtaining the multiple endpoint access sequences corresponding to the application includes: Obtain the original full traffic data of the application, which includes all interactive interfaces within the risk prediction period; Obtain multiple business request messages carrying business logic from the original full business traffic data; For each of the aforementioned service request messages, the parameters in the service request message are sorted according to a set rule to obtain a standardized request message; Obtain the unique identifier corresponding to each of the multiple business request messages. The unique identifier of the business request message represents the interaction interface, HTTP method and various parameters to be accessed by the business request message. One of the multiple consecutive service request messages with the same unique identifier within the same preset time window is retained; The URL path of the business request message is normalized to obtain the target business request message. Each specific instance identifier in the URL path of the target business request message is replaced by the preset general type to which the specific instance identifier belongs. The target service request messages that have the same session identifier and belong to the same session period are grouped into the same endpoint access sequence; the session identifier represents the user identity.

3. The risk prediction method for business exposure surfaces according to claim 2, characterized in that, The step of obtaining multiple business request messages carrying business logic from the original full business traffic data includes: Delete static resource request messages from the original full traffic data. The URL path of the static resource request message includes a first preset identifier, and the header of the response message to the static resource request message includes a second preset identifier. Non-business request messages are deleted from the original full business traffic data.

4. The risk prediction method for business exposure surfaces according to claim 2, characterized in that, The step of normalizing the URL path of the business request message to obtain the target business request message includes: The preset symbols in the service request message are used as delimiters to obtain multiple path segments; For each path segment, a preset general type matching the path segment is queried from a preset hierarchical rule base, and the path segment in the business request message is replaced. The preset hierarchical rule base includes multiple preset general types.

5. The risk prediction method for business exposure surfaces according to claim 2, characterized in that, Also includes: If the absolute value of the difference between the timestamps of two adjacent target service request messages in the endpoint access sequence is greater than or equal to a preset time threshold, the position between the two adjacent target service request messages is determined as the split point. The endpoint access sequence is split at the split point to obtain two endpoint access sequences.

6. The risk prediction method for business exposure surfaces according to any one of claims 1 to 5, characterized in that, Also includes: If the probability of a suspected problematic interface of the target interaction interface among the various interaction interfaces is lower than a preset filtering threshold, the target interaction interface will be deleted from the various interaction interfaces after the next risk detection cycle.

7. A risk prediction device for business exposure, characterized in that, include: The first acquisition module is used to acquire multiple endpoint access sequences corresponding to the application, wherein the endpoint access sequence includes business request messages belonging to the same user identity within the same session period; The second acquisition module is used to acquire traffic statistics features corresponding to each interaction interface based on the multiple endpoint access sequences. The traffic statistics features of the interaction interface include: the first total number of times the interaction interface is accessed within an analysis period, the second total number of times the interaction interface is accessed by different user identities within an analysis period, the third total number of times the interaction interface is accessed by different IP addresses within an analysis period, the ratio of the second total number to the first total number, and the ratio of the number of automated task types in the business request messages that access the interaction interface to the first total number. The third acquisition module is used to acquire the request structure and semantic features corresponding to each interaction interface based on the multiple endpoint access sequences. The request structure and semantic features of the interaction interface include: the Uniform Resource Locator (URL) path depth of the business request message accessing the interaction interface and the number of preset sensitive keywords contained in the business request message. The fourth acquisition module is used to acquire the response content features corresponding to each interaction interface based on the multiple endpoint access sequences. The response content features of the interaction interface include: the Content-Type field value in the response message of the business request message of the interaction interface; the ratio of the number of preset sensitive keywords contained in the response message to the number of all parameters contained in the response message; and the ratio of the total number of bytes of the string containing preset sensitive keywords in the response message to the total number of bytes of the response message. The fifth acquisition module is used to acquire access control features corresponding to each interaction interface based on the multiple endpoint access sequences. The access control features of the interaction interface include: the ratio of the number of business request messages carrying a preset authentication credential identifier in the business request messages that access the interaction interface to the total number of all business request messages that access the interaction interface; and the ratio of the number of response messages carrying a status code indicating authentication failure in the response messages of the business request messages that access the interaction interface to the total number of all response messages of the business request messages that access the interaction interface. The sixth acquisition module is used to input the feature set corresponding to each interaction interface into the pre-built risk prediction model, and obtain the probability of the suspected problem interface corresponding to each interaction interface through the risk prediction model. The feature set corresponding to the interaction interface includes the traffic statistics feature, the request structure and semantic feature, the response content feature, and the access control feature.

8. A computer program product, characterized in that, It includes computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the risk prediction method for the business exposure surface as described in any one of claims 1 to 6.

9. An electronic device, characterized in that, It includes at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program to enable the electronic device to implement the risk prediction method for the business exposure surface as described in any one of claims 1 to 6.

10. A computer storage medium, characterized in that, The storage medium carries one or more computer programs that, when executed by an electronic device, enable the electronic device to implement the risk prediction method for the business exposure surface as described in any one of claims 1 to 6.

Images