Interface calling risk identification method and device, electronic equipment and storage medium

Abstract

The invention discloses an interface calling risk identification method and device, electronic equipment and a storage medium, and relates to the field of financial science and technology or other related technical fields, and the method comprises the steps: obtaining an interface calling record and a preset service sensitive interface list; dividing the interface calling record to obtain a sensitive interface calling record and a normal interface calling record; constructing a sensitive feature vector for each sensitive calling interface based on the sensitive interface calling record, and constructing a normal feature vector for each normal calling interface based on the normal interface calling record; and calculating a similarity value between the sensitive calling interface and the normal calling interface based on the sensitive feature vector and the normal feature vector, and identifying a risk interface calling behavior based on the similarity value between the sensitive calling interface and the normal calling interface. According to the method and the device, the technical problem of relatively low accuracy of an identification result in interface calling risk identification based on fixed threshold and static rule matching in related technologies is solved.

Description

Technical Field

[0001] This invention relates to the field of financial technology or other related technical fields. Specifically, it relates to an interface call risk identification method, apparatus, electronic device, and storage medium. Background Technology

[0002] In the financial and internet sectors, APIs (Application Programming Interfaces) serve as crucial communication channels between servers and clients, and between different services or systems. Their security directly impacts the stability of the entire system and the security of user data. In recent years, with the booming development of the API economy, the frequency and scenarios of API usage have been continuously increasing, bringing new security challenges as well.

[0003] In related technologies, API call risk identification based on fixed thresholds and static rule matching ignores the temporal distribution characteristics of API calls. This leads to the system incorrectly classifying legitimate traffic surges (such as increased user activity triggered by promotions or news headlines) as attacks, resulting in numerous false positives. On the other hand, as attackers' strategies become increasingly sophisticated, mimicking the call behavior patterns of normal users, static rules struggle to cover these new attack patterns due to a lack of deep understanding and learning of these patterns, leading to missed detections of potential risks and low identification accuracy.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides an interface call risk identification method, apparatus, electronic device, and storage medium to at least solve the technical problem in related technologies where interface call risk identification based on fixed thresholds and static rule matching has low accuracy.

[0006] According to one aspect of the present invention, an interface call risk identification method is provided, comprising: acquiring interface call records and a preset list of business-sensitive interfaces; dividing the interface call records based on the list of business-sensitive interfaces to obtain sensitive interface call records and normal interface call records; constructing sensitive feature vectors for each sensitive call interface based on the sensitive interface call records, and constructing normal feature vectors for each normal call interface based on the normal interface call records; calculating a similarity value between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector, and identifying risky interface call behaviors based on the similarity value between the sensitive call interface and the normal call interface.

[0007] Furthermore, the step of obtaining the preset list of business-sensitive interfaces includes: obtaining the business types corresponding to all business interfaces; selecting business-sensitive interfaces based on the business types; and constructing the list of business-sensitive interfaces based on the business-sensitive interfaces.

[0008] Furthermore, the step of dividing the interface call records based on the business-sensitive interface list includes: extracting the interface identifiers of all the call interfaces; matching the interface identifiers with the interface identifiers of each of the business-sensitive interfaces in the business-sensitive interface list to obtain a matching result; and if the matching result indicates that the interface identifier matches successfully with the interface identifier of any of the business-sensitive interfaces in the business-sensitive interface list, classifying the successfully matched call interface as the sensitive call interface.

[0009] Further, the step of calculating the similarity value between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector includes: calculating the cosine similarity value of successful calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector to obtain a first similarity value; calculating the cosine similarity value of failed calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector to obtain a second similarity value; calculating the Euclidean distance of successful calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector, and performing normalization and weighting processing on the Euclidean distance to obtain a normalized Euclidean distance; and calculating the similarity value between the sensitive call interface and the normal call interface based on the first similarity value, the first weight value corresponding to the first similarity value, the second similarity value, the second weight value corresponding to the second similarity value, the normalized Euclidean distance, and the third weight value corresponding to the normalized Euclidean distance.

[0010] Furthermore, after obtaining the interface call records, the method further includes: performing time-series completion processing on each interface call record; and constructing a time series based on the interface call records after time-series completion processing.

[0011] Furthermore, after obtaining the interface call records, the method further includes: counting the number of calls to each of the calling interfaces based on the interface call records; comparing the number of calls with a preset threshold, and deleting the interface call record of the calling interface if the number of calls to the calling interface is less than or equal to the threshold.

[0012] Furthermore, the step of identifying risky interfaces based on the similarity value between the sensitive calling interface and the normal calling interface includes: comparing the similarity value between the sensitive calling interface and the normal calling interface with a preset similarity threshold; and determining the sensitive calling interface if the similarity value between the sensitive calling interface and the normal calling interface is greater than or equal to the preset similarity threshold.

[0013] According to another aspect of the present invention, an interface call risk identification device is also provided, comprising: an acquisition unit, configured to acquire interface call records and a preset list of business-sensitive interfaces; a division unit, configured to divide the interface call records based on the list of business-sensitive interfaces to obtain sensitive interface call records and normal interface call records; a call unit, configured to construct sensitive feature vectors for each sensitive call interface based on the sensitive interface call records, and construct normal feature vectors for each normal call interface based on the normal interface call records; and an identification unit, configured to calculate a similarity value between the sensitive call interface and the normal call interface based on the sensitive feature vectors and the normal feature vectors, and identify risky interface call behaviors based on the similarity value between the sensitive call interface and the normal call interface.

[0014] Furthermore, the acquisition unit includes: a first acquisition module, used to acquire the business types corresponding to all business interfaces; and a first selection module, used to select business-sensitive interfaces based on the business types, and construct the business-sensitive interface list based on the business-sensitive interfaces.

[0015] Further, the partitioning module includes: a first extraction module, used to extract the interface identifiers of all the calling interfaces; a first matching module, used to match the interface identifiers with the interface identifiers of each of the business-sensitive interfaces in the business-sensitive interface list to obtain a matching result; and a first partitioning module, used to partition the successfully matched calling interface into the sensitive calling interface when the matching result indicates that the interface identifier matches the interface identifier of any of the business-sensitive interfaces in the business-sensitive interface list.

[0016] Further, the identification unit includes: a first calculation module, configured to calculate a first similarity value by calculating a cosine similarity value between a successful call between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector; a second calculation module, configured to calculate a second similarity value by calculating a second similarity value by calculating a third similarity value by calculating a fourth similarity value by calculating a third similarity value by calculating a fourth similarity value by calculating a fifth similarity value by calculating a fifth similarity value by calculating a sixth similarity value by calculating a fifth similarity value by calculating a sixth similarity value by calculating a fifth similarity value by calculating a sixth similarity value by calculating a fifth similarity value by calculating a sixth similarity value by calculating a third similarity value by calculating a fifth similarity value by calculating a sixth ...

[0017] Furthermore, the interface call risk identification device further includes: a first processing module, used to perform time-series completion processing on each interface call record; and a first construction module, used to construct a time series based on the interface call records after time-series completion processing.

[0018] Furthermore, the interface call risk identification device further includes: a first statistics module, used to count the number of calls to each of the calling interfaces based on the interface call records; and a first comparison module, used to compare the number of calls with a preset number threshold, and delete the interface call record of the calling interface if the number of calls to the calling interface is less than or equal to the number threshold.

[0019] Furthermore, the identification unit further includes: a second comparison module, used to compare the similarity value between the sensitive call interface and the normal call interface with a preset similarity threshold; and a first determination module, used to determine that the sensitive call interface and the normal call interface have high-risk call behavior when the similarity value between the sensitive call interface and the normal call interface is greater than or equal to the preset similarity threshold.

[0020] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute any of the above-described interface call risk identification methods.

[0021] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described interface calls to the risk identification method.

[0022] According to another aspect of the present invention, a computer program product is also provided, the computer program product comprising a computer program, wherein the computer program, when executed by a processor, implements any of the above-described interface call risk identification methods.

[0023] In this application, the following steps are taken: obtaining interface call records and a preset list of business-sensitive interfaces; dividing the interface call records based on the list of business-sensitive interfaces to obtain sensitive interface call records and normal interface call records; constructing sensitive feature vectors for each sensitive call interface based on the sensitive interface call records; constructing normal feature vectors for each normal call interface based on the normal interface call records; calculating the similarity value between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector; and identifying risky interface call behaviors based on the similarity value between the sensitive call interface and the normal call interface.

[0024] In this application, a comprehensive assessment of API call risks is conducted based on multi-dimensional and multi-level similarity calculation. This approach not only captures the time trend of API calls but also quantifies the absolute difference in the number of calls between sensitive APIs. Furthermore, it considers the impact of total call volume on similarity assessment, thereby comprehensively improving the sensitivity and accuracy of risk identification. The quantitative results obtained through similarity fusion calculation can intuitively reflect the degree of similarity of API call patterns within factors and intervals, enhancing the accuracy of API risk identification. This solves the technical problem in related technologies where API call risk identification based on fixed thresholds and static rule matching has low accuracy. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0026] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing an interface call risk identification method is shown.

[0027] Figure 2 This is a flowchart of an optional interface call risk identification method according to an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of an optional interface call risk identification process according to an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of an optional interface call risk identification device according to an embodiment of the present invention;

[0030] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) that executes an interface to call a risk identification method according to an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0034] An Application Programming Interface (API) is a set of conventions or interfaces that allow different software programs to communicate and exchange data.

[0035] It should be noted that the interface call risk identification method and apparatus in this application can be used in the fintech field to identify interface call risks based on multi-dimensional time series similarity, and can also be used in any field other than fintech to identify interface call risks based on multi-dimensional time series similarity. This application does not limit the application field of the interface call risk identification method and apparatus.

[0036] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0037] The following embodiments of the present invention can be applied to various interface call risk identification systems / applications / devices. This invention proposes an interface call risk identification method based on multi-dimensional time series similarity calculation. By calculating the similarity of call behaviors between various calling interfaces, it identifies risky call behaviors between calling interfaces, improving the accuracy of interface risk identification. Through time series completion and dynamic normalization processing, the accuracy of the identification results can be improved; through a frequency filtering mechanism, invalid computation can be reduced; and by automatically strengthening the weight of high-frequency interfaces through factor adjustment, important services are avoided from being missed.

[0038] The present invention will now be described in detail with reference to various embodiments.

[0039] Example 1

[0040] According to an embodiment of the present invention, an embodiment of an interface call risk identification method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0041] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing an interface call risk identification method is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0042] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0043] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the interface call risk identification method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned interface call risk identification method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0044] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0045] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0046] Under the aforementioned operating environment, this application provides the following: Figure 2 The interface call risk identification method shown is implemented by the interface call risk identification system.

[0047] Figure 2 This is a flowchart of an optional interface call risk identification method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0048] Step S201: Obtain the interface call records and the preset list of business-sensitive interfaces.

[0049] In step S201 above, the system periodically or in real-time retrieves interface call records from the log system, API gateway, or other data sources, including but not limited to key information such as the interface identifier, call time, call result (success or failure), and call frequency. Simultaneously, the system needs to maintain a pre-defined list of business-sensitive interfaces. This list, determined by security policies or business rules, includes information on all known high-risk interfaces, such as interface identifier, system or service to which it belongs, and sensitivity level. Business-sensitive interfaces typically refer to APIs responsible for handling critical business logic, involving important data operations, or possessing high security risks, such as interfaces related to financial transactions like payments and transfers.

[0050] Furthermore, the steps for obtaining the preset list of business-sensitive interfaces include: obtaining the business types corresponding to all business interfaces; selecting business-sensitive interfaces based on the business types; and constructing a list of business-sensitive interfaces based on the business-sensitive interfaces.

[0051] Specifically, firstly, the system needs to collect business type information for all APIs, which can be obtained from API metadata, business system documentation, or configuration files. Business types are categorized based on the business logic processed by the interface or the data sensitivity involved, such as payment, transfer, and user information query. Therefore, each API is assigned one or more business type tags, serving as the basis for subsequently selecting business-sensitive interfaces.

[0052] Subsequently, based on preset business security policies, the system filters out business types deemed to have high security sensitivity from all collected business types; these are designated as business-sensitive interfaces. The identification of business-sensitive interfaces is determined based on business requirements, historical risk records, and preset security policies. After identifying the business-sensitive interfaces, they are compiled into a list, known as the business-sensitive interface list, which serves as a reference standard for subsequent risk identification and analysis.

[0053] Furthermore, after obtaining the interface call records, the process also includes: performing time-series completion processing on each interface call record; and constructing a time series based on the interface call records after time-series completion processing.

[0054] Specifically, after obtaining the API call records, the system preprocesses these records. For each record, time-series completion is performed to ensure that even if no calls occur during a certain period within an evaluation cycle, a corresponding record still exists. This includes: the system automatically identifying time intervals in the API call records, such as records containing call data per minute, hour, or day; if an API has no call records for certain hours of the day, the system automatically inserts a record with both successful and failed calls set to 0 to fill the gaps in the time series. For example, if an API has call records for only 18 hours out of 24 hours, the system will automatically add records with 0 calls for the remaining 6 hours to ensure the integrity of the time series. Subsequently, the completed call records are sorted to ensure they are arranged in ascending order of the time series, facilitating subsequent time series construction.

[0055] After completing the time series completion process, a time series is constructed based on the completed API call records. This step mainly organizes the API call volume into sequential data according to time order to facilitate subsequent similarity calculations through time series analysis. The specific steps for constructing the time series include: data format conversion, converting each API call record into a time series format data point, where each point contains the number of successful and failed calls at a specific time (usually at the hour level); and time series aggregation, aggregating the data points of the same API at different time points to form a complete periodic time series to characterize the call volume distribution of an API within a period.

[0056] Furthermore, after obtaining the interface call records, the method also includes: counting the number of calls to each interface based on the interface call records; comparing the number of calls with a preset threshold; and deleting the interface call record of the interface if the number of calls to the interface is less than or equal to the threshold.

[0057] Specifically, after acquiring API call records, interfaces with excessively low call volumes are filtered out. This allows risk identification and analysis to focus more on frequently called interfaces. By reducing unnecessary data processing, the allocation of computing resources is optimized, the risk identification process is accelerated, and the sensitivity to risks at critical interfaces is improved, thereby enhancing the overall efficiency and accuracy of API call risk identification. First, the system summarizes and statistically analyzes all collected API call records, calculating the cumulative number of calls for each interface within a specified time period (e.g., 24 hours). Then, the system compares the call count for each interface with its preset call count threshold. The call count threshold filters out interfaces with excessively low call volumes. These interfaces may be less vulnerable to security threats due to low usage frequency, or their call patterns may not significantly impact the overall risk assessment of the system. For interfaces with call counts less than or equal to the preset threshold, the system performs a deletion operation, removing their API call records.

[0058] Step S202: Based on the list of business-sensitive interfaces, the interface call records are divided into sensitive interface call records and normal interface call records.

[0059] In step S202 above, the latest list of business-sensitive interfaces is loaded, and all interface call records are traversed according to this list, checking whether the interface identifier in each record appears in the list. For calls to interfaces that appear in the list, the corresponding call records are marked as sensitive interface call records. For interfaces whose corresponding identifiers are not found in the list, their call records are classified as normal interface call records. This process essentially creates two subsets in the original dataset, corresponding to interface call behaviors with high security sensitivity and low security sensitivity, respectively.

[0060] Furthermore, the steps for classifying interface call records based on the business-sensitive interface list include: extracting the interface identifiers of all called interfaces; matching the interface identifiers with the interface identifiers of each business-sensitive interface in the business-sensitive interface list to obtain the matching results; and classifying the successfully matched called interface as a sensitive called interface if the matching result indicates that the interface identifier matches the interface identifier of any business-sensitive interface in the business-sensitive interface list.

[0061] Specifically, when classifying API call records, the system first extracts the interface identifiers of all called interfaces from the records. By parsing the record data, it ensures that each interface identifier can be accurately read and identified. Then, the system matches each extracted interface identifier against an item in a pre-defined list of sensitive business interfaces. This list contains information on all known high-risk interfaces, identifying which call records match the defined sensitive interfaces. Once an interface identifier successfully matches the identifier of any sensitive business interface in the list, the corresponding interface is marked as a sensitive interface and added to the set of sensitive interface call records.

[0062] By precisely matching interface identifiers with a pre-defined list of business-sensitive interfaces, a fine-grained classification of call records is achieved, effectively separating high-risk interface call behavior from ordinary call behavior.

[0063] Step S203: Construct sensitive feature vectors for each sensitive call interface based on the sensitive interface call records, and construct normal feature vectors for each normal call interface based on the normal interface call records.

[0064] In step S203 above, call data related to each specific sensitive interface is filtered from the sensitive interface call records, including but not limited to call frequency, number of successes and failures, and call time distribution. Key features are extracted from the filtered data, such as the number of calls per hour and the ratio of successful to failed calls. These features reflect the time pattern and state changes of the interface call behavior. These key features are converted into numerical data points, and the system constructs a sensitive feature vector for each sensitive interface. The sensitive feature vector contains multiple dimensions representing the interface call behavior and can clearly reflect the characteristic pattern of the interface over time. Subsequently, for normal interface call records, the same method is used to construct a normal feature vector for normal interface calls.

[0065] By constructing sensitive feature vectors and normal feature vectors, a quantitative data representation is provided for subsequent multidimensional similarity analysis, enabling the system to accurately assess the similarity between different interface call behaviors based on these vectors, thereby effectively distinguishing between normal behavior and potentially risky behavior.

[0066] Step S204: Calculate the similarity value between sensitive call interfaces and normal call interfaces based on sensitive feature vectors and normal feature vectors, and identify risky interface call behaviors based on the similarity value between sensitive call interfaces and normal call interfaces.

[0067] In step S204 above, the similarity value between the constructed sensitive feature vector and normal feature vector is calculated, and based on this similarity, potential risky API call behaviors are assessed and identified, achieving refined management of API call risk identification. This mechanism can effectively identify API call risks that attempt to circumvent detection by mimicking normal call patterns, while reducing false positives and improving the accuracy and efficiency of risk identification. By comparing the similarity between sensitive and normal API call behaviors, the system can promptly warn of potential abnormal behaviors, providing the security team with crucial information to take appropriate defensive measures, thereby strengthening the monitoring and security protection capabilities of API calls.

[0068] Further, the step of calculating the similarity value between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector includes: calculating the cosine similarity value of successful calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector to obtain a first similarity value; calculating the cosine similarity value of failed calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector to obtain a second similarity value; calculating the Euclidean distance of successful calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector, and performing normalization and weighting processing on the Euclidean distance to obtain a normalized Euclidean distance; and calculating the similarity value between the sensitive call interface and the normal call interface based on the first similarity value, the first weight value corresponding to the first similarity value, the second similarity value, the second weight value corresponding to the second similarity value, the normalized Euclidean distance, and the third weight value corresponding to the normalized Euclidean distance.

[0069] Specifically, when calculating similarity, the cosine similarity of successful calls between the sensitive feature vector and the normal feature vector is first calculated for the successful call portions. This metric reflects the consistency of trends in the frequency and time distribution of successful calls between the two vectors, yielding the first similarity value, namely the cosine similarity of successful calls, which will serve as an important component of the subsequent comprehensive evaluation.

[0070] Subsequently, for the failed call portions in both the sensitive and normal feature vectors, the cosine similarity is calculated again to obtain the second similarity value, namely the cosine similarity of the failed call.

[0071] Simultaneously, the Euclidean distance between successfully invoked sensitive feature vectors and normal feature vectors is calculated and normalized to ensure that numerical differences are evaluated within a reasonable range. Subsequently, the system applies weighted processing, dynamically adjusting the weight factors based on the total number of calls to reflect the influence of high-call interfaces. The normalized weighted Euclidean distance obtained from this processing is a key indicator for evaluating absolute numerical differences.

[0072] Finally, the system combines the first similarity value, the second similarity value, and the normalized weighted Euclidean distance, along with their respective weight values, to calculate the final similarity value. The weight values ​​are set considering the relative importance of successful calls, failed calls, and numerical differences in risk identification, ensuring that the calculation results comprehensively reflect the overall characteristics of the interface call behavior.

[0073] By integrating the cosine similarity of successful calls, the cosine similarity of failed calls, and the normalized and weighted Euclidean distance, a multi-dimensional quantitative assessment of the similarity between sensitive and normal call interfaces is achieved. This comprehensive assessment mechanism not only captures the trends and patterns of call behavior but also considers the impact of absolute numerical differences, thus providing a more comprehensive and accurate capability for identifying interface call risks. By accurately calculating similarity values, the system can effectively identify seemingly normal call behaviors that actually harbor hidden risks between sensitive and normal call interfaces, improving the sensitivity and specificity of risk detection and providing strong support for risk warning and intervention.

[0074] Furthermore, the step of identifying risky interfaces based on the similarity value between sensitive and normal calling interfaces includes: comparing the similarity value between the sensitive and normal calling interfaces with a preset similarity threshold; and determining the sensitive calling interface if the similarity value between the sensitive and normal calling interfaces is greater than or equal to the preset similarity threshold.

[0075] Specifically, a preset similarity threshold is defined during risk identification. This threshold can be set based on historical data analysis, business risk tolerance, and the experience of security experts, and is used to distinguish between normal call patterns and potentially risky call patterns. The reasonable setting of the preset threshold directly affects the accuracy and sensitivity of risk identification. The system compares the similarity value between sensitive and normal call interfaces one by one with the preset similarity threshold. If the similarity value is greater than or equal to the preset similarity threshold, the system marks both the sensitive and normal call interfaces as potentially risky interfaces. That is, if there is a high degree of similarity in the call behavior between sensitive and normal call interfaces, this highly similar call pattern indicates that there may be interlocking behavior between the sensitive and normal call interfaces. For example, an attacker might try to mimic the call pattern of a sensitive interface, indirectly accessing or exploiting the functionality of the sensitive interface through calls to ordinary interfaces, thereby circumventing security mechanisms. This imitation behavior may be intended to bypass direct monitoring of sensitive interfaces and operate in a more covert manner; or, some normal interfaces may be frequently called by users in a pattern similar to sensitive business interfaces due to design or configuration vulnerabilities. Such abuse may not only lead to excessive consumption of system resources, but may also be used for attacks such as data theft and service interruption.

[0076] Socket calls, where the call patterns of normal API calls are highly similar to those of sensitive API calls, are considered risky. This is because it may indicate unauthorized access attempts, exploitation of system vulnerabilities, or internal operational errors, requiring timely security response and intervention. By identifying such socket calls, operations and maintenance endpoints can more promptly and accurately locate potential security threats and take appropriate measures to prevent or mitigate possible damage.

[0077] Through the above steps, we obtain interface call records and a preset list of sensitive business interfaces. Based on the list of sensitive business interfaces, we divide the interface call records into sensitive call records and normal call records. Based on the sensitive call records, we construct sensitive feature vectors for each sensitive call interface and normal feature vectors for each normal call interface. Based on the sensitive feature vectors and normal feature vectors, we calculate the similarity value between the sensitive call interfaces and normal call interfaces and identify risky interface call behaviors based on the similarity value between the sensitive call interfaces and normal call interfaces.

[0078] In this embodiment, a comprehensive assessment of interface call risks is conducted based on multi-dimensional and multi-level similarity calculation. This approach not only captures the time trend of interface calls but also quantifies the absolute difference in the number of calls between sensitive interface calls. Furthermore, it considers the impact of total call volume on similarity assessment, thereby comprehensively improving the sensitivity and accuracy of risk identification. The quantitative results obtained through similarity fusion calculation can intuitively reflect the degree of similarity of interface call patterns within factors and intervals, enhancing the accuracy of interface risk identification. This solves the technical problem in related technologies where interface call risk identification based on fixed thresholds and static rule matching has low accuracy.

[0079] The following describes in detail another optional implementation method.

[0080] Figure 3 This is a schematic diagram of an optional interface call risk identification process according to an embodiment of the present invention, such as... Figure 3 As shown, the API call risk identification process includes:

[0081] Step 1, Begin;

[0082] Step 2, data input;

[0083] The source data includes real-time API call records and a pre-defined list of business-sensitive APIs. Each API call record includes at least the following fields: application identifier (appId), resource identifier (resourceId), number of successful calls (succount), number of failed calls (failcount), and timestamp (hourtime). The composite key ({appId}_{resourceId}) is the API identifier and is the core data of each API call record.

[0084] The list of business-sensitive interfaces records the preset business-sensitive interfaces. Business-sensitive interfaces refer to interfaces with high business sensitivity. These interfaces can be defined by the business, such as payment interfaces and transfer interfaces.

[0085] Step 3: Data classification and processing;

[0086] Obtain the resourceId of each called interface from the real-time interface call records, and split the interface call records into two sets based on whether the resourceId is in the list of business sensitive interfaces. The first set is the sensitive interface call records, and the second set is the normal interface call records.

[0087] Step 4: Time series filling;

[0088] Time series completion processing is performed on each call record based on the key combination. If there is no data for a certain hour (0-23:00), an ApiCallDetail is added with a success rate of 0 and a failure rate of 0, ensuring that each record has a complete 24-hour data point, thus completing the 24-hour level call record completion for subsequent time series analysis.

[0089] Finally, the list of API calls is sorted by hourTime to construct a time series.

[0090] Step 5, frequency filtering;

[0091] Set a call volume threshold CALL_FREQUENCY_THRESHOLD to retain only API call records where the total call volume (success + failure) is greater than or equal to the threshold, and do not analyze records with too low a call volume.

[0092] Step 6: Multidimensional similarity calculation;

[0093] Perform multi-dimensional similarity calculations between sensitive API call records and normal API call records. The process is as follows:

[0094] Vectorization processing converts the call records within a cycle into four vectors: the successful call vector of normal interface calls, the failed call vector of normal interface calls, the successful call vector of sensitive interface calls, and the failed call vector of sensitive interface calls.

[0095] The cosine similarity (S_cos) of the number of successful calls to the normal and sensitive calling interfaces is calculated based on the successful call vectors of the normal calling interface and the sensitive calling interface, which measures the trend similarity of the successful call patterns.

[0096] The cosine similarity (F_cos) of the number of failed calls between normal and sensitive call interfaces is calculated based on the failed call vectors of normal and sensitive call interfaces to measure the trend similarity of the failed call patterns.

[0097] Calculate the Euclidean distance (eucDist) between the number of successful calls to normal and sensitive API calls to measure the difference in absolute values.

[0098] Convert eucDist to a value in the range [0,1], i.e., NormEuclidean = 1 - min(eucDist / maxDist(), 1.0)), where NormEuclidean is the normalized and weighted value, and maxDist is the maximum distance, which is dynamically calculated based on the total number of calls to the sensitive API, i.e., maxDist = sqrt(24 100^2) (1 + log(totalCalls)), where totalCalls is the total number of sensitive calls.

[0099] The adjustment factor AdjFactor is calculated based on the total number of calls to the sensitive API. AdjFactor = min(1.0, log(totalCalls) / log(1000)). The more calls, the closer the adjustment factor is to 1.

[0100] Multidimensional similarity fusion calculation: similarity=(0.3×S_cos+0.6×NormEuclidean+0.1×F_cos) ×AdjFactor.

[0101] Step 7: Output the results;

[0102] By comparing the similarity values ​​between sensitive and normal API calls one by one with the aforementioned preset similarity threshold, the system marks both the sensitive and normal API calls as potentially risky interfaces if the similarity value is greater than or equal to the preset threshold. In other words, if there is a significant similarity in the calling behavior between sensitive and normal API calls, this highly similar calling pattern indicates that there may be interlocking behavior between the two. For example, an attacker might attempt to mimic the calling pattern of a sensitive interface, indirectly accessing or exploiting its functionality through calls to a normal interface, thereby circumventing security mechanisms. This mimicry might be intended to bypass direct monitoring of sensitive interfaces and operate in a more covert manner; or, some normal interfaces might be frequently called by users in a pattern similar to sensitive business interfaces due to design or configuration vulnerabilities. This abuse could not only lead to excessive consumption of system resources but could also be used for attacks such as data theft and service interruption.

[0103] Step eight, end.

[0104] This invention proposes an interface call risk identification method based on multi-dimensional time series similarity calculation. By calculating the similarity of call behaviors among various calling interfaces, it identifies risky call behaviors among the calling interfaces, thereby improving the accuracy of interface risk identification. Through time series completion and dynamic normalization processing, the accuracy of the identification results can be improved; through a frequency filtering mechanism, unnecessary computation can be reduced; and by adjusting factors to automatically strengthen the weight of high-frequency interfaces, important services are avoided from being missed.

[0105] The following is a detailed description with reference to another embodiment.

[0106] Example 2

[0107] The interface call risk identification device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in the above embodiment one. The specific implementation method and beneficial effects can be referred to the foregoing method embodiment, and will not be repeated here.

[0108] Figure 4 This is a schematic diagram of an optional interface call risk identification device according to an embodiment of the present invention, such as... Figure 4 As shown, the interface call risk identification device may include: an acquisition unit 41, a division unit 42, a call unit 43, and an identification unit 44, wherein,

[0109] Acquisition unit 41 is used to acquire interface call records and a preset list of business-sensitive interfaces;

[0110] Division unit 42 is used to divide the interface call records based on the list of business sensitive interfaces to obtain sensitive interface call records and normal interface call records;

[0111] Calling unit 43 is used to construct sensitive feature vectors for each sensitive call interface based on the sensitive interface call record, and to construct normal feature vectors for each normal call interface based on the normal interface call record;

[0112] The identification unit 44 is used to calculate the similarity value between sensitive call interfaces and normal call interfaces based on sensitive feature vectors and normal feature vectors, and to identify risky interface call behaviors based on the similarity value between sensitive call interfaces and normal call interfaces.

[0113] The aforementioned interface call risk identification device acquires interface call records and a preset list of sensitive business interfaces through the acquisition unit 41; the segmentation unit 42 segments the interface call records based on the list of sensitive business interfaces to obtain sensitive interface call records and normal interface call records; the call unit 43 constructs sensitive feature vectors for each sensitive call interface based on the sensitive interface call records and constructs normal feature vectors for each normal call interface based on the normal interface call records; and the identification unit 44 calculates the similarity value between the sensitive call interfaces and the normal call interfaces based on the sensitive feature vectors and the normal feature vectors, and identifies risky interface call behaviors based on the similarity value between the sensitive call interfaces and the normal call interfaces.

[0114] In this embodiment, a comprehensive assessment of interface call risks is conducted based on multi-dimensional and multi-level similarity calculation. This approach not only captures the time trend of interface calls but also quantifies the absolute difference in the number of calls between sensitive interface calls. Furthermore, it considers the impact of total call volume on similarity assessment, thereby comprehensively improving the sensitivity and accuracy of risk identification. The quantitative results obtained through similarity fusion calculation can intuitively reflect the degree of similarity of interface call patterns within factors and intervals, enhancing the accuracy of interface risk identification. This solves the technical problem in related technologies where interface call risk identification based on fixed thresholds and static rule matching has low accuracy.

[0115] Furthermore, the acquisition unit includes: a first acquisition module, used to acquire the business types corresponding to all business interfaces; and a first selection module, used to select business-sensitive interfaces based on the business types, and to construct a list of business-sensitive interfaces based on the business-sensitive interfaces.

[0116] Furthermore, the segmentation module includes: a first extraction module, used to extract the interface identifiers of all calling interfaces; a first matching module, used to match the interface identifiers with the interface identifiers of each business-sensitive interface in the business-sensitive interface list to obtain a matching result; and a first segmentation module, used to segment the successfully matched calling interface as a sensitive calling interface when the matching result indicates that the interface identifier matches the interface identifier of any business-sensitive interface in the business-sensitive interface list.

[0117] Furthermore, the identification unit includes: a first calculation module, used to calculate the cosine similarity value of successful calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector, to obtain a first similarity value; a second calculation module, used to calculate the cosine similarity value of failed calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector, to obtain a second similarity value; a third calculation module, used to calculate the Euclidean distance of successful calls between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector, and to normalize and weight the Euclidean distance to obtain a normalized Euclidean distance; and a fourth calculation module, used to calculate the similarity value between the sensitive call interface and the normal call interface based on the first similarity value, the first weight value corresponding to the first similarity value, the second similarity value, the second weight value corresponding to the second similarity value, the normalized Euclidean distance, and the third weight value corresponding to the normalized Euclidean distance.

[0118] Furthermore, the interface call risk identification device also includes: a first processing module for performing time-series completion processing on each interface call record; and a first construction module for constructing a time series based on the interface call records after time-series completion processing.

[0119] Furthermore, the interface call risk identification device also includes: a first statistics module, used to count the number of calls to each interface based on the interface call records; and a first comparison module, used to compare the number of calls with a preset threshold, and delete the interface call record of the interface if the number of calls to the interface is less than or equal to the threshold.

[0120] Furthermore, the identification unit also includes: a second comparison module, used to compare the similarity value between the sensitive call interface and the normal call interface with a preset similarity threshold; and a first determination module, used to determine that the sensitive call interface and the normal call interface have high-risk call behavior when the similarity value between the sensitive call interface and the normal call interface is greater than or equal to the preset similarity threshold.

[0121] It should be noted that the acquisition unit 41, division unit 42, calling unit 43, and identification unit 44 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules or units can also be part of a device and can run in the computer terminal 10 provided in Embodiment 1.

[0122] The invention will now be described in conjunction with another alternative embodiment.

[0123] Example 3

[0124] The present invention can also provide an electronic device. Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) that executes an interface to call a risk identification method according to an embodiment of the present invention, such as... Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0125] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0126] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: obtain interface call records and a preset list of business-sensitive interfaces; divide the interface call records based on the list of business-sensitive interfaces to obtain sensitive interface call records and normal interface call records; construct sensitive feature vectors for each sensitive call interface based on the sensitive interface call records, and construct normal feature vectors for each normal call interface based on the normal interface call records; calculate the similarity value between the sensitive call interfaces and the normal call interfaces based on the sensitive feature vectors and the normal feature vectors, and identify risky interface call behaviors based on the similarity value between the sensitive call interfaces and the normal call interfaces.

[0127] The processor can access information and applications stored in the memory via the transmission device to perform the following steps: obtain the business types corresponding to all business interfaces; select business-sensitive interfaces based on the business types; and construct a list of business-sensitive interfaces based on the business-sensitive interfaces.

[0128] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: extract the interface identifiers of all calling interfaces; match the interface identifiers with the interface identifiers of each business-sensitive interface in the business-sensitive interface list to obtain the matching result; if the matching result indicates that the interface identifier matches the interface identifier of any business-sensitive interface in the business-sensitive interface list, classify the successfully matched calling interface as a sensitive calling interface.

[0129] The processor can access information and applications stored in memory via a transmission device to execute the following steps: Calculate the cosine similarity value of successful calls between the sensitive and normal call interfaces based on sensitive and normal feature vectors to obtain a first similarity value; calculate the cosine similarity value of failed calls between the sensitive and normal call interfaces based on sensitive and normal feature vectors to obtain a second similarity value; calculate the Euclidean distance of successful calls between the sensitive and normal call interfaces based on sensitive and normal feature vectors, and normalize and weight the Euclidean distance to obtain a normalized Euclidean distance; calculate the similarity value between the sensitive and normal call interfaces based on the first similarity value, the first weight value corresponding to the first similarity value, the second similarity value, the second weight value corresponding to the second similarity value, the normalized Euclidean distance, and the third weight value corresponding to the normalized Euclidean distance.

[0130] The processor can access information and applications stored in memory via a transmission device to perform the following steps: perform timing completion processing on each interface call record; and construct a time series based on the timing-completed interface call records.

[0131] The processor can access information and applications stored in memory via a transmission device to perform the following steps: count the number of calls to each calling interface based on the interface call records; compare the number of calls with a preset threshold; and delete the interface call record for an interface if the number of calls to that interface is less than or equal to the threshold.

[0132] The processor can access information and applications stored in memory via a transmission device to perform the following steps: comparing the similarity value between the sensitive call interface and the normal call interface with a preset similarity threshold; and determining the sensitive call interface if the similarity value between the sensitive call interface and the normal call interface is greater than or equal to the preset similarity threshold.

[0133] This invention provides an interface call risk identification scheme. Based on multi-dimensional and multi-level similarity calculation, it comprehensively assesses interface call risks, not only capturing the time trend of interface calls but also quantifying the absolute difference in the number of calls between sensitive interfaces. Furthermore, it considers the impact of total call volume on similarity assessment, comprehensively improving the sensitivity and accuracy of risk identification. The quantitative results obtained through similarity fusion calculation can intuitively reflect the degree of similarity of interface call patterns within factors and intervals, enhancing the accuracy of interface risk identification. This solves the technical problem of low accuracy in interface call risk identification based on fixed thresholds and static rule matching in related technologies.

[0134] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0135] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0136] The invention will now be described in conjunction with another alternative embodiment.

[0137] Example 4

[0138] This invention also provides a computer-readable storage medium. Optionally, in this invention, the computer-readable storage medium can be used to store the program code executed by the interface call risk identification method provided in Embodiment 1.

[0139] Optionally, in this embodiment of the invention, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0140] This invention also provides a computer program product, which, when executed on a data processing device, is suitable for performing the steps of an interface call risk identification method: obtaining interface call records and a preset list of business-sensitive interfaces; dividing the interface call records based on the list of business-sensitive interfaces to obtain sensitive interface call records and normal interface call records; constructing sensitive feature vectors for each sensitive call interface based on the sensitive interface call records, and constructing normal feature vectors for each normal call interface based on the normal interface call records; calculating the similarity value between the sensitive call interfaces and the normal call interfaces based on the sensitive feature vectors and the normal feature vectors, and identifying risky interface call behaviors based on the similarity value between the sensitive call interfaces and the normal call interfaces.

[0141] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0142] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0143] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0144] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0145] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0146] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0147] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for identifying risks associated with API calls, characterized in that, include: Retrieve API call records and a pre-defined list of business-sensitive APIs; Based on the list of business-sensitive interfaces, the interface call records are divided into sensitive interface call records and normal interface call records; Based on the sensitive interface call records, a sensitive feature vector is constructed for each sensitive call interface, and based on the normal interface call records, a normal feature vector is constructed for each normal call interface. The similarity value between the sensitive call interface and the normal call interface is calculated based on the sensitive feature vector and the normal call vector, and risky interface call behavior is identified based on the similarity value between the sensitive call interface and the normal call interface.

2. The method according to claim 1, characterized in that, The steps to obtain the preset list of business-sensitive interfaces include: Get the business type corresponding to all business interfaces; Select business-sensitive interfaces based on the business type, and construct the business-sensitive interface list based on the business-sensitive interfaces.

3. The method according to claim 2, characterized in that, The steps for classifying the interface call records based on the business-sensitive interface list include: Extract the interface identifiers of all the aforementioned called interfaces; The interface identifier is matched with the interface identifiers of each of the business-sensitive interfaces in the business-sensitive interface list to obtain the matching result; If the matching result indicates that the interface identifier matches successfully with the interface identifier of any of the business-sensitive interfaces in the business-sensitive interface list, the successfully matched calling interface is classified as the sensitive calling interface.

4. The method according to claim 1, characterized in that, The steps for calculating the similarity value between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector include: Based on the sensitive feature vector and the normal feature vector, calculate the cosine similarity value of successful calls between the sensitive call interface and the normal call interface to obtain the first similarity value; Based on the sensitive feature vector and the normal feature vector, the cosine similarity value of failed calls between the sensitive call interface and the normal call interface is calculated to obtain a second similarity value; Based on the sensitive feature vector and the normal feature vector, calculate the Euclidean distance between the successful calls between the sensitive call interface and the normal call interface, and perform normalization and weighting processing on the Euclidean distance to obtain the normalized Euclidean distance. The similarity value between the sensitive call interface and the normal call interface is calculated based on the first similarity value, the first weight value corresponding to the first similarity value, the second similarity value, the second weight value corresponding to the second similarity value, the normalized Euclidean distance, and the third weight value corresponding to the normalized Euclidean distance.

5. The method according to claim 1, characterized in that, After obtaining the API call records, the following is also included: Perform time-series completion processing on each of the aforementioned interface call records; A time series is constructed based on the interface call records after time-series completion processing.

6. The method according to claim 1, characterized in that, After obtaining the API call records, the following is also included: The number of times each of the aforementioned interfaces is called is calculated based on the interface call records. The number of calls is compared with a preset threshold. If the number of calls to the calling interface is less than or equal to the threshold, the interface call record of that calling interface is deleted.

7. The method according to claim 1, characterized in that, The steps for identifying risky interfaces based on the similarity value between the sensitive call interfaces and the normal call interfaces include: The similarity value between the sensitive call interface and the normal call interface is compared with a preset similarity threshold; If the similarity value between the sensitive call interface and the normal call interface is greater than or equal to the preset similarity threshold, it is determined that there is a high-risk call behavior between the sensitive call interface and the normal call interface.

8. An interface call risk identification device, characterized in that, include: The acquisition unit is used to retrieve API call records and a preset list of business-sensitive APIs. A partitioning unit is used to partition the interface call records based on the business sensitive interface list to obtain sensitive interface call records and normal interface call records; The calling unit is used to construct a sensitive feature vector for each sensitive calling interface based on the sensitive interface calling record, and to construct a normal feature vector for each normal calling interface based on the normal interface calling record; The identification unit is used to calculate the similarity value between the sensitive call interface and the normal call interface based on the sensitive feature vector and the normal feature vector, and to identify risky interface call behavior based on the similarity value between the sensitive call interface and the normal call interface.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the interface call risk identification method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the interface call risk identification method according to any one of claims 1 to 7.

11. A computer program product, characterized in that, The computer program product includes a computer program, wherein the computer program, when executed by a processor, implements the interface call risk identification method according to any one of claims 1 to 7.

Images