A method, system and device for detecting web API vulnerability attacks
By constructing user behavior sequences using multidimensional session identifiers and combining them with BERT and large language models, the detection method solves the problem of the lack of deterministic features in Web API vulnerability attack detection, and achieves accurate identification and adaptive detection of business logic vulnerabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XIAN UNIV OF POSTS & TELECOMM
- Filing Date
- 2026-03-17
- Publication Date
- 2026-06-09
AI Technical Summary
Existing technologies struggle to effectively detect Web API vulnerability attacks, especially business logic vulnerabilities that lack deterministic attack characteristics. Traditional detection methods cannot understand the semantics of the encoded data, and most solutions cannot adapt to dynamic changes in business scenarios or identify disguised attacks.
By constructing user behavior sequences using multi-dimensional session identifiers and combining traffic semantic detection and behavioral intent detection, deep semantic modeling and intent analysis of HTTP transactions and user behavior sequences are performed using BERT models and large language models to identify vulnerability attack characteristics.
It achieves accurate detection of API vulnerability attacks, adapts to dynamic changes in business scenarios, can identify encoded semantics, avoids model drift and information loss, and provides cross-message business operation trajectory analysis.
Smart Images
Figure FT_1 
Figure FT_2 
Figure FT_3
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network communication technology, and specifically relates to a method, system and device for detecting Web API vulnerability attacks. Background Technology
[0002] Driven by the digital wave, enterprises are experiencing increasingly complex business systems and a growing number of business scenarios that provide API services during their digital transformation. While digital transformation improves business efficiency and user experience, it also brings security challenges. Issues such as insufficient API access permissions and interface verification, and flawed verification logic are becoming increasingly prominent. During network communication, a large amount of network traffic data involving user permission verification and business logic processing is generated. Attackers can exploit security vulnerabilities such as privilege escalation vulnerabilities, unauthorized access vulnerabilities, business logic vulnerabilities, and device or database misconfigurations, combined with techniques such as SQL injection, XSS, and RCE, potentially leading to serious consequences such as sensitive data leakage, direct economic losses, or malicious operations.
[0003] These types of attacks are closely tied to specific API interface business scenarios, and the attack methods and exploitation techniques vary significantly across different business scenarios. There is no uniform, deterministic attack payload. Traditional detection methods primarily rely on pre-defined expert rules, depending on security personnel's summarization and refinement of known vulnerability characteristics. Therefore, when faced with such API vulnerability attacks, traditional detection methods based on pre-defined expert rules lack prior knowledge and cannot pre-define effective detection rules, rendering them ineffective in dealing with these attacks. This has always been a challenging problem in vulnerability attack detection.
[0004] Vulnerability detection and security analysis are core components of Web API protection. When applying traditional detection solutions in real-world business scenarios, the following technical challenges arise:
[0005] 1) Existing technical solutions generally adopt static detection methods based on HTTP protocol layer features. Their core drawback is that they only perform pattern matching on surface features such as URL path, parameter name, and HTTP method, ignoring the business logic relationship between request parameters.
[0006] 2) Most behavioral analysis solutions use static user behavior baseline models trained offline, which are difficult to adapt to dynamic changes in business scenarios. In addition, such solutions assume that attackers have behavioral deviations, making them difficult to effectively identify when faced with attacks that are carefully disguised to simulate legitimate user behavior.
[0007] 3) Existing deep learning or machine learning detection solutions only perform isolated analysis on a single HTTP message, completely severing the business context association between multiple messages.
[0008] 4) Traditional rule-based detection methods rely on keyword matching and cannot understand the encoded semantics.
[0009] Regarding vulnerability detection in the API security field, a review and analysis of numerous domestic and international studies reveals that most existing research optimizes specific aspects or scenarios of API security detection using particular models or algorithms, such as using machine learning models to detect single packets on the traffic side. While these studies provide some solutions for API vulnerability detection, the continuous emergence of vulnerabilities and the increasing complexity of attack methods make single-packet or pre-defined rule-based detection methods inadequate for detecting API business logic vulnerabilities and other vulnerabilities that lack deterministic attack characteristics. Therefore, effectively detecting vulnerabilities that are highly relevant to business operations, lack deterministic attack characteristics, and are difficult to identify semantically in traffic is a critical technical challenge that urgently needs to be addressed. Summary of the Invention
[0010] To overcome the shortcomings of the prior art, the purpose of this invention is to provide a method, system, and device for detecting Web API vulnerability attacks. This not only effectively solves the problem of API vulnerability attack detection, but also addresses the issues of large language models being insensitive to sequential text and input length limitations in traffic detection scenarios, thus exhibiting the characteristic of accurate detection.
[0011] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0012] A method for detecting Web API vulnerability attacks includes the following steps:
[0013] Step S1, Traffic Extraction and Analysis
[0014] The traffic extraction and parsing module receives PCAP traffic packets or network mirror traffic, extracts the TCP stream from the traffic, separates the HTTP request and response messages in the TCP stream, decodes the message payload, and associates the request and response messages to form a structured HTTP transaction.
[0015] Step S2, construct user behavior sequence
[0016] Structured HTTP transactions are used as input to the user behavior sequence construction module. Based on multi-dimensional session identifiers, HTTP transactions are aggregated to construct user behavior sequences that represent continuous user operations.
[0017] Step S3, Language-based service interaction sequence
[0018] The user behavior sequence is used as the input to the service interaction sequence language module, and the structured data in the user behavior sequence is processed into a context sequence that is close to natural language format.
[0019] Step S4: Input the HTTP transaction and the language-processed user behavior sequence into the intelligent detection engine, and perform traffic semantic detection and behavior intent detection in parallel through the intelligent detection engine; the traffic semantic detection is based on the HTTP transaction to identify vulnerability attack features in the message payload; the behavior intent detection is based on the language-processed user behavior sequence to infer the user's operation intent in order to identify vulnerability attacks related to business logic.
[0020] Step S5: Output vulnerability attack alarm information based on the traffic semantic detection and / or vulnerability attack alarm information obtained from the behavioral intent detection.
[0021] In step S2, the aggregation of HTTP transactions based on multi-dimensional session identifiers to construct a user behavior sequence specifically includes:
[0022] Step S201: Extract the five dimensions of source IP address, destination IP address, destination port, User-Agent field, and Cookie field from each HTTP transaction to form the session key of the transaction;
[0023] Step S202: Perform initial aggregation of HTTP transactions based on the session key, and arrange HTTP transactions with the same session key in ascending order of their timestamps to form multiple initial session sets;
[0024] Step S203: Based on the three-dimensional aggregation key consisting of the source IP address, destination IP address, and User-Agent field, perform secondary aggregation on the initial session set to handle session splitting or erroneous aggregation caused by cookie forgery, and obtain the final user session set;
[0025] Step S204: For each HTTP transaction in the user session set, extract its core semantic fields, including the HTTP request method, requested resource path, request parameter set, HTTP response status code, and response body content.
[0026] Step S205: Construct the user behavior sequence based on the core semantic fields sorted by time.
[0027] In step S204, the response body content is processed as follows: only text-type response body content is retained, and binary-type response body content is truncated or ignored.
[0028] In step S3, the process of linguisticizing the structured data in the user behavior sequence specifically includes the following steps:
[0029] Step S301: Perform format validation on the input user behavior sequence to ensure that each behavior unit contains the HTTP request method, requested resource path, request parameter set, HTTP response status code, and response body content fields;
[0030] Step S302: For each action unit, arrange its HTTP request method, requested resource path, request parameter set, and HTTP response status code fields horizontally in a fixed order, and remove the structured format symbols;
[0031] Step S303: Perform summary processing on the response body content of each action unit to generate a response body information summary;
[0032] Step S304: Sort all the behavioral units processed by steps S302 and S303 in ascending order according to the timestamp of their corresponding HTTP transactions, and output them as a language-based context sequence.
[0033] In step S303, the summary processing is as follows: when the length of the response body content exceeds a preset threshold, key business information is extracted through precise keyword matching and prefix fuzzy matching.
[0034] In step S4, the traffic semantic detection involves using a fine-tuned BERT model to perform deep semantic modeling on the payload of the HTTP transaction in order to identify attacks.
[0035] In step S4, the behavioral intent detection involves analyzing the verbalized user behavior sequence using a large language model that has been cue-engineered and / or fine-tuned with LoRA to infer the user's behavioral intent and identify attacks; the base model of the large language model is Qwen2.5-7B-Instruct.
[0036] In step S4, the traffic semantic detection and the behavioral intent detection are performed in parallel and independently; the overall detection rate of the intelligent detection engine satisfies the formula in the disclosure document:
[0037] in:
[0038] Recall_max represents the theoretical maximum detection rate of the intelligent detection engine;
[0039] recall_BERT represents the detection rate of the Traffic Semantic Detection Model (BERT);
[0040] recall_LLM represents the detection rate of the behavioral intent detection model (LLM).
[0041] A Web API vulnerability attack detection system includes:
[0042] The traffic extraction and parsing module is configured to receive network traffic data, extract and parse TCP streams, separate HTTP request and response messages, perform decoding processing, and associate them to generate HTTP transactions.
[0043] The user behavior sequence construction module is configured to aggregate the HTTP transactions based on multi-dimensional session identifiers and construct user behavior sequences.
[0044] A service interaction sequence languageization module is configured to convert structured data in the user behavior sequence into a context sequence in a format close to natural language.
[0045] The intelligent detection engine module is configured to include: a traffic semantic detection unit, used for identifying vulnerability attacks based on the HTTP transaction;
[0046] The behavioral intent detection unit is used to perform user intent reasoning and vulnerability attack identification based on the verbalized user behavior sequence.
[0047] An alarm output module is configured to output the detection results of the intelligent detection engine module.
[0048] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, performs the steps of the method according to any one of claims 1-7.
[0049] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1-7.
[0050] The beneficial effects of this invention are:
[0051] This invention proposes an API vulnerability attack detection scheme that integrates traffic semantics and behavioral features, providing an innovative solution to the challenge of vulnerability attack detection in the API security field, where deterministic attack features are lacking. This scheme not only effectively solves the API vulnerability attack detection problem but also addresses the issues of large language models' insensitivity to sequential text and input length limitations in traffic detection scenarios. By utilizing two detection dimensions—traffic semantic features and user behavioral features—the scheme provides not only a novel detection dimension and extraction method but also a collaborative detection architecture, achieving accurate detection of API vulnerability attacks. At the data processing level, a linguistic approach is proposed to effectively address the issues of LLM's insensitivity to sequential information and input length limitations. It has the following advantages:
[0052] 1) This invention uses cross-message user behavior modeling to restore isolated HTTP messages into complete business operation trajectories, effectively identifying attack behaviors that are "legitimate in a single message but malicious overall".
[0053] 2) This invention can effectively counter various encoding obfuscation techniques used by attackers in HTTP messages and restore the original semantics of the traffic payload.
[0054] 3) This invention does not require offline learning of the normal behavior baseline and operation logs of APIs in the target deployment scenario, and can adapt to the dynamic changes in business scenarios.
[0055] 4) The intelligent detection engine of this invention uses two models to output independent alarms, which can be used by downstream systems as needed, avoiding the risks of model drift and arbitration failure.
[0056] 5) This invention can detect vulnerability attacks without the need to add manually preset rules.
[0057] 6) This invention designs an API vulnerability attack collaborative detection scheme, which integrates network traffic semantic parsing and user behavior intent reasoning to achieve two-dimensional collaborative detection from payload semantic features to operation intent.
[0058] 7) This invention designs a user behavior sequence construction method, called MD-UBeS, which can aggregate user operation behavior and request parameters, and considers the business context association between multiple messages, rather than performing isolated analysis on a single HTTP message.
[0059] 8) This invention designs a context sequence language method, called SIL, which converts continuous HTTP transaction context sequences into a form close to natural language and summarizes the content. On the one hand, it ensures that the model can fully utilize the rich information contained in structured data while preserving key semantic structures and syntactic logic. On the other hand, it avoids information loss and OOM (Out of Memory) problems caused by the sequence length exceeding the model input limit.
[0060] In summary, the Web API vulnerability attack detection scheme designed in this invention, by integrating traffic semantics and behavioral characteristics, demonstrates outstanding value in both technological innovation and practical application, helping to enhance enterprises' API security protection capabilities. It not only makes API vulnerability attacks detectable but also fills the gap in the industry where business logic vulnerabilities are difficult to detect due to the lack of deterministic characteristics. Attached Figure Description
[0061] Figure 1 This is an architecture diagram of the API vulnerability attack detection system of this invention.
[0062] Figure 2 This is a schematic diagram of the MD-UBeS method of the present invention.
[0063] Figure 3 This is a schematic diagram of the SIL method of the present invention.
[0064] Figure 4 This is a schematic diagram of the intelligent detection engine architecture of the present invention.
[0065] Figure 5 This is a schematic diagram of the Prompt template. Detailed Implementation
[0066] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.
[0067] A method for detecting Web API vulnerability attacks includes the following steps:
[0068] Step S1, Traffic Extraction and Analysis
[0069] The traffic extraction and parsing module receives PCAP traffic packets or network mirror traffic, extracts the TCP stream from the traffic, separates the HTTP request and response messages in the TCP stream, decodes the message payload, and associates the request and response messages to form a structured HTTP transaction.
[0070] Step S2, construct user behavior sequence
[0071] Structured HTTP transactions are used as input to the user behavior sequence construction module. Based on multi-dimensional session identifiers, HTTP transactions are aggregated to construct user behavior sequences that represent continuous user operations.
[0072] Step S3, Language-based service interaction sequence
[0073] The user behavior sequence is used as the input to the service interaction sequence language module, and the structured data in the user behavior sequence is processed into a context sequence that is close to natural language format.
[0074] Step S4: Input the HTTP transaction and the language-processed user behavior sequence into the intelligent detection engine, and perform traffic semantic detection and behavior intent detection in parallel through the intelligent detection engine; the traffic semantic detection is based on the HTTP transaction to identify vulnerability attack features in the message payload; the behavior intent detection is based on the language-processed user behavior sequence to infer the user's operation intent in order to identify vulnerability attacks related to business logic.
[0075] Step S5: Output vulnerability attack alarm information based on the traffic semantic detection and / or vulnerability attack alarm information obtained from the behavioral intent detection.
[0076] In step S2, the aggregation of HTTP transactions based on multi-dimensional session identifiers to construct a user behavior sequence specifically includes:
[0077] Step S201: Extract the five dimensions of source IP address, destination IP address, destination port, User-Agent field, and Cookie field from each HTTP transaction to form the session key of the transaction;
[0078] Step S202: Perform initial aggregation of HTTP transactions based on the session key, and arrange HTTP transactions with the same session key in ascending order of their timestamps to form multiple initial session sets;
[0079] Step S203: Based on the three-dimensional aggregation key consisting of the source IP address, destination IP address, and User-Agent field, perform secondary aggregation on the initial session set to handle session splitting or erroneous aggregation caused by cookie forgery, and obtain the final user session set;
[0080] Step S204: For each HTTP transaction in the user session set, extract its core semantic fields, including the HTTP request method, requested resource path, request parameter set, HTTP response status code, and response body content.
[0081] Step S205: Construct the user behavior sequence based on the core semantic fields sorted by time.
[0082] In step S204, the response body content is processed as follows: only text-type response body content is retained, and binary-type response body content is truncated or ignored.
[0083] In step S3, the process of linguisticizing the structured data in the user behavior sequence specifically includes the following steps:
[0084] Step S301: Perform format validation on the input user behavior sequence to ensure that each behavior unit contains the HTTP request method, requested resource path, request parameter set, HTTP response status code, and response body content fields;
[0085] Step S302: For each action unit, arrange its HTTP request method, requested resource path, request parameter set, and HTTP response status code fields horizontally in a fixed order, and remove the structured format symbols;
[0086] Step S303: Perform summary processing on the response body content of each action unit to generate a response body information summary;
[0087] Step S304: Sort all the behavioral units processed by steps S302 and S303 in ascending order according to the timestamp of their corresponding HTTP transactions, and output them as a language-based context sequence.
[0088] In step S303, the summary processing is as follows: when the length of the response body content exceeds a preset threshold, key business information is extracted through precise keyword matching and prefix fuzzy matching.
[0089] In step S4, the traffic semantic detection involves using a fine-tuned BERT model to perform deep semantic modeling on the payload of the HTTP transaction in order to identify attacks.
[0090] In step S4, the behavioral intent detection involves analyzing the verbalized user behavior sequence using a large language model that has been cue-engineered and / or fine-tuned with LoRA to infer the user's behavioral intent and identify attacks; the base model of the large language model is Qwen2.5-7B-Instruct.
[0091] In step S4, the traffic semantic detection and the behavioral intent detection are performed in parallel and independently; the overall detection rate of the intelligent detection engine satisfies the formula in the disclosure document:
[0092] in:
[0093] Recall_max represents the theoretical maximum detection rate of the intelligent detection engine;
[0094] recall_BERT represents the detection rate of the Traffic Semantic Detection Model (BERT);
[0095] recall_LLM represents the detection rate of the behavioral intent detection model (LLM).
[0096] A Web API vulnerability attack detection system includes:
[0097] The traffic extraction and parsing module is configured to receive network traffic data, extract and parse TCP streams, separate HTTP request and response messages, perform decoding processing, and associate them to generate HTTP transactions.
[0098] The user behavior sequence construction module is configured to aggregate the HTTP transactions based on multi-dimensional session identifiers and construct user behavior sequences.
[0099] A service interaction sequence languageization module is configured to convert structured data in the user behavior sequence into a context sequence in a format close to natural language.
[0100] The intelligent detection engine module is configured to include: a traffic semantic detection unit, used for identifying vulnerability attacks based on the HTTP transaction;
[0101] The behavioral intent detection unit is used to perform user intent reasoning and vulnerability attack identification based on the verbalized user behavior sequence.
[0102] An alarm output module is configured to output the detection results of the intelligent detection engine module.
[0103] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, performs the steps of the method according to any one of claims 1-7.
[0104] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1-7.
[0105] Example 2
[0106] The API-TraSeB solution fills a gap in API service security within enterprise network security. Deploying this solution near the firewall where API services are located or at the internet egress point within the enterprise network architecture provides security analysis and vulnerability monitoring for API interface services. The overall architecture of this solution is as follows: Figure 1 As shown, it consists of one data input module, two data processing modules, and one detection output module. The data flow and workflow between the modules are indicated by arrows, as described in detail below:
[0107] Traffic extraction and parsing module (data input, orange box): Receives PCAP traffic packets or network mirror traffic, extracts the TCP stream from the traffic, separates the HTTP request and response messages in the TCP stream, decodes the Body for different data and encoding types, truncates excessively long binary data, and finally associates the request and response messages to form a complete HTTP transaction.
[0108] The user behavior sequence construction module (data processing, green box) takes the structured HTTP transaction information obtained from the traffic extraction and parsing module as input, aggregates user operation behaviors and request parameters according to the MD-UBeS method, and the resulting sequence can intuitively and clearly express the user's operation intention. It can enhance the reasoning and analysis of user behavior intention by the large language model and provide high-quality input for the behavioral dimension detection of API vulnerability attack detection.
[0109] Service Interaction Sequence Language Module (Data Processing, Blue Box): Taking the user behavior operation sequence aggregated by the user behavior sequence construction module as input, it further processes the user behavior sequence according to the SIL method, ensuring that the large language model can make full use of the rich information contained in the structured data while preserving the key semantic structure and syntactic logic, and avoiding information loss and OOM problems caused by the sequence length exceeding the model input limit.
[0110] The intelligent detection engine module (detection output, red box) takes the HTTP transaction information and language-processed user behavior sequences obtained from the data processing and data input modules as input. It focuses on two-dimensional vulnerability attack detection based on traffic semantics and behavioral characteristics. It uses a fine-tuned BERT model to perform deep semantic modeling of traffic payloads, enabling accurate identification of vulnerability attacks with attack payloads. With the help of a large language model to reason and analyze user behavior intent, it can detect vulnerability attacks caused by privilege escalation, unauthorized access, business logic vulnerabilities, or device and database configuration errors.
[0111] API-TraSeB's core innovations include a user behavior sequence construction method based on multi-dimensional identifiers, a service interaction sequence languageization method, and an intelligent detection engine that combines semantics and behavior.
[0112] User behavior sequence construction method
[0113] Detection mechanisms based on pre-defined expert rules exhibit significant blind spots when facing unknown vulnerability attacks highly relevant to business scenarios. This is because such attacks lack obvious traffic payload characteristics and require analysis combining business scenarios and overall user behavior. Therefore, a feature representation method is needed that can reflect the user's behavioral intent, thereby enabling the identification of malicious attacks.
[0114] See Figure 2 The Multidimensional Identifier-Based User Behavior Sequence Construction Method (MD-UBeS) extracts five-dimensional session identifiers from HTTP transaction data and performs aggregation operations to transform isolated, context-fragmented HTTP transaction data into continuous user behavior sequences. The process proceeds as follows:
[0115] Step 1: Identifier Extraction. From the raw HTTP transaction data in the input layer, accurately extract the five dimensions of identifier information: src_ip, dst_ip, dst_port, User-Agent, and Cookie, to form the session key corresponding to this transaction. The technical meanings and functions of each dimension identifier are as follows:
[0116] src_ip (source IP address): Client network layer identifier, representing the network location of the terminal device that initiated the request, and is the basis for determining session ownership;
[0117] dst_ip (destination IP address): Server-side network layer identifier, specifying the server node where the Web API service is deployed;
[0118] dst_port (destination port): The server application port identifier, used to distinguish different Web API service instances deployed on the same server;
[0119] User-Agent (Client Environment Fingerprint): A standard field in the HTTP request header, containing environmental information such as the client's operating system, browser type, and version number. Under the three-dimensional constraints of src_ip, dst_ip, and dst_port, it forms a relatively stable and unique client environment identifier that can distinguish different access subjects under the same network location.
[0120] Cookie (Session State Credentials): Text data sent by the server to the client via the Set-Cookie response header, containing session tokens such as sessionid. It is the core mechanism in the stateless HTTP protocol for maintaining continuous user identification and can accurately associate the behavior of the same user across requests.
[0121] Step 2: Sequence Construction and Aggregation. Using session key S as a unique identifier, all HTTP transactions corresponding to the same session key S are sorted in ascending order according to their initiation timestamps. This achieves time-series aggregation of fragmented transactions, resulting in multiple initial session sets. S i Let i represent the i-th set of sessions with the same session key, where i∈[1,n] and n is the total number of session sets;
[0122] Step 3: Anomaly Handling in Secondary Aggregation. The core objective is to prevent session splitting or erroneous aggregation caused by User-Agent (client environment fingerprint, UA) spoofing, thereby enhancing the authenticity of behavior. For the session set after the initial aggregation, a three-dimensional session aggregation key K is defined. If a small number of cookies with numerous different user agents are detected under the same aggregation key K, a second aggregation is performed based on the uniqueness of the cookie identifier to obtain multiple session sets. ,in Let i represent the i-th session set after secondary aggregation, where i∈[1,m] and m is the total number of session sets after secondary aggregation;
[0123] Step 4: Extraction of Core Semantic Fields. For each session after secondary aggregation, extract the following core semantic fields one by one from its time-sorted HTTP transactions to form the smallest descriptive unit of behavioral features, ensuring feature integrity and standardization:
[0124] Metgod: HTTP request method (GET, POST, PUT, DELETE, PATCH, etc.), representing the type of operation a user performs on a Web API;
[0125] URL: The path to the requested resource. The standardized path after removing query parameters (query string) (e.g., standardizing " / api / user?id=123" to " / api / user") to avoid misjudgment of behavior due to parameter differences;
[0126] Param: A collection of request parameters, including query parameters for GET methods and request body data for POST methods;
[0127] ResponseCode: HTTP response status code (200, 400, 403, 500, etc.), which indicates the result of the Web API's processing of the request;
[0128] ResponseBody: The response content, used for attack result analysis. Binary types, such as videos and files, have low attack differentiation capabilities and are typically large in size, so only text-type responses, such as JSON, HTML, and plain text, are retained.
[0129] Step 5: Construct a complete representation of the user behavior sequence for each session set after secondary aggregation. (i∈[1,m], where m is the total number of sessions after the second aggregation), convert it into a sequence of behaviors. , n represents the number of behavioral feature units contained in the behavioral sequence, and each behavioral feature unit a i (i∈[1,n]) contains core semantic fields such as Method, Url, Param, ResponseCode, and ResponseBody.
[0130] Service interaction sequence language-based approach:
[0131] To address the technical challenges of large language models, such as poor adaptability to complex structured text and limited input sequence length, it is necessary to convert complex structured user behavior sequences into context sequences that approximate natural language, preserving call timing, interface semantics, and key parameter information to form an input representation that the model can understand. Simultaneously, summarization compression is used to control the input length, ensuring that the input context sequence does not exceed the model's input limits and GPU memory limits, thus preventing information loss and OutOfMemoryError (OOM).
[0132] See Figure 3 As shown, the core of the service interaction sequence language-based method aims to achieve decoupling of structured data, semantic preservation transformation, content summarization, and lateral temporal aggregation, specifically addressing the technical pain points of poor adaptability of large models to complex structured data and limited input length. The process proceeds as follows:
[0133] Step 1: Define and validate the structured input sequence. Let the input be a structured user behavior sequence aggregated from multi-dimensional session identifiers, formally expressed as: A = [a1, a2, ..., a...]. n ], where each behavioral feature unit a i (i∈[1,n]) is a structured data entity containing five core fields:
[0134] m i : The HTTP request method;
[0135] u i : The server endpoint path for the i-th request, i.e., the URL after removing request parameters;
[0136] p i : The parameters submitted in the i-th request;
[0137] r i The HTTP response status code for the i-th request;
[0138] b i The original response body data of the i-th request, the complete, unprocessed response content.
[0139] The input user behavior sequence is format-validated to ensure that the core fields of each behavior feature unit are not missing. If any field is missing, it is marked as "unknown".
[0140] Step 2: Following the principles of "preserving original fields, direct sequential arrangement, and removing structural redundancy," based on each behavioral feature unit a after preprocessing in Step 1... i m i u i p i r i Fields are arranged horizontally in a fixed order, while all structured formatting symbols are removed to ensure the text has no complex structure. Example of the arrangement: "GET, / api / user,id=123;type=query,200".
[0141] Step 3: Information Summarization. For each behavioral feature unit a after preprocessing in Step 1... i b i Perform digest processing to obtain the response body information digest. The specific summarization method is as follows: First, determine the length of the response body. Only summarize response bodies longer than 100 words. These response bodies usually carry a large number of static resources. Use keyword exact matching and prefix fuzzy matching to filter key business information. For example, extract the top-level fields such as "code", "msg", and "result" from JSON format response bodies, and extract important results such as "success" and "error" from HTML format response bodies.
[0142] Step 4: Sort the results in ascending order by the HTTP transaction initiation timestamp and output the results.
[0143] Intelligent Detection Engine: Addressing the limitations of pre-defined rule-based detection methods in covering newly emerging zero-day vulnerabilities and business logic vulnerabilities, as well as the issue of isolated single-packet analysis, this embodiment proposes an intelligent detection engine that integrates traffic language and user behavior. This engine architecturally isolates the "traffic side" and the "behavior side," allowing each model to output independent alarm information, thus mitigating the risks of model drift and fusion arbitration failure, and ensuring a maximum detection rate.
[0144] See engine architecture Figure 4 As shown, the intelligent detection engine adopts a parallel collaborative detection mode with two data inputs: HTTP transaction data and user behavior sequences. The user behavior sequences are aggregated using the MD-UBeS method and can clearly represent the user's behavioral intentions.
[0145] The vulnerability attack detection implementation is divided into two dimensions: traffic semantic detection and behavioral intent detection. The traffic semantic detection dimension is responsible for semantic-level vulnerability identification of instantaneous HTTP payloads on the traffic side, using a pre-trained and fine-tuned BERT model. The behavioral intent detection dimension is responsible for the inference and identification of business-related logic vulnerabilities, privilege escalation vulnerabilities, and unauthorized attacks. It takes the SIL-language-based user behavior sequence as input, using a fine-tuned LLM model of "prompt engineering + LoRA," with the base model being Qwen2.5-7B-Instruct. The Prompt template is available here. Figure 5 As shown.
[0146] Prompt employs a prompting engineering approach that combines Role Prompting and AutoPrompt to improve the model's stability and detection performance in behavioral intent reasoning scenarios. Role Prompting is an explicit prompting constraint method that constrains the model's generated behavior by defining the model's analysis role. This method has been widely used in tasks such as information extraction and inference analysis to clarify the model's task boundaries and analytical perspective. AutoPrompt is a method that optimizes prompting effectiveness by automatically searching for trigger words. It is used to optimize existing prompt templates and guide the model to focus more on behavioral features related to attack intent.
[0147] Because this engine employs a dual-dimensional parallel detection mode, it possesses complementary detection spaces. Let traffic-side observations be random variables X, behavior-side observations be random variables Y, and attack events be A. Since business logic attacks satisfy:
[0148] ,
[0149] in:
[0150] This represents the prior probability of attack event A;
[0151] This represents the conditional probability of attack event A occurring given the traffic observation variable X;
[0152] This represents the conditional probability of event A occurring given the observed behavioral variable Y.
[0153] Therefore, using two independent discriminators can approximate the optimal Bayesian classifier:
[0154]
[0155] in:
[0156] This represents the conditional probability of attack event A occurring given the traffic observation variable X and the behavior observation variable Y.
[0157] This represents the conditional probability of observing flow characteristic X given event A;
[0158] This represents the conditional probability of observing behavioral feature Y given event A.
[0159] When the two dimensions are output independently, the upper bound of the system detection rate is:
[0160]
[0161] Wherein:
[0162] Recall_max represents the theoretical maximum detection rate of the intelligent detection engine, that is, the upper bound of the detection rate;
[0163] recall_BERT represents the detection rate of the traffic semantic detection model;
[0164] recall_LLM represents the detection rate of the behavior intention detection model.
[0165] This upper bound is greater than or equal to any single dimension and does not require the introduction of online fusion weights that can cause drift.
[0166] The alarm output adopts a fixed text format, including information such as attack type, attack intention, vulnerability payload, vulnerability point, attack result, potential impact, threat level, etc.
[0167] The intelligent detection engine innovatively integrates two feature dimensions of traffic semantic features and user behavior features to achieve collaborative API vulnerability attack detection from payload features to operation intentions. Using the BERT model to deeply model and understand traffic semantics, it can automatically identify and classify potential vulnerability attacks in network requests without relying on predefined rules. For vulnerability attacks that are highly relevant to business scenarios and difficult to identify in traffic semantics, the Qwen large language model is used to reason and analyze user behavior intention features based on user behavior sequences to achieve the detection and identification of malicious vulnerability attacks.
[0168] List of abbreviations and definitions:
[0169] Web: World Wide Web; Chinese name: World Wide Web
[0170] API: Application Programming Interface; Chinese name: Application Programming Interface
[0171] HTTP: Hypertext Transfer Protocol; Chinese name: Hypertext Transfer Protocol
[0172] XSS: Cross-Site Scripting; Chinese name: Cross-Site Scripting Attack
[0173] RCE: Remote Code Execution; Chinese name: Remote Code Execution
[0174] API-TraSeB: API-Traffic Semantic&Behavior; Chinese name: API Vulnerability Attack Detection Integrating Traffic Semantics and Behavioral Features
[0175] MD-UBeS: Multi-Dimensional Identifier-Based User Behavior Sequence Construction; Chinese name: Construction of User Behavior Sequences Based on Multi-Dimensional Identifiers
[0176] SIL: Service Interaction Linguification; Chinese name: Linguification of Service Interaction Sequences
[0177] OOM: out of memory; Chinese name: Memory Overflow
[0178] BERT: Bidirectional Encoder Representations from Transformers; Chinese name: Bidirectional Encoder Representations Based on Transformers
[0179] LLM: Large Language Model; Chinese name: Large Language Model.
Claims
1. A method for detecting Web API vulnerability attacks, characterized in that, Includes the following steps: Step S1, Traffic Extraction and Analysis The traffic extraction and parsing module receives PCAP traffic packets or network mirror traffic, extracts the TCP stream from the traffic, separates the HTTP request and response messages in the TCP stream, decodes the message payload, and associates the request and response messages to form a structured HTTP transaction. Step S2, construct user behavior sequence Structured HTTP transactions are used as input to the user behavior sequence construction module. Based on multi-dimensional session identifiers, HTTP transactions are aggregated to construct user behavior sequences that represent continuous user operations. Step S3, Language-based service interaction sequence The user behavior sequence is used as the input to the service interaction sequence language module, and the structured data in the user behavior sequence is processed into a context sequence that is close to natural language format. Step S4: Input the HTTP transaction and the user behavior sequence after language processing into the intelligent detection engine, and perform traffic semantic detection and behavior intent detection in parallel through the intelligent detection engine; The traffic semantic detection is based on the HTTP transaction to identify vulnerability attack characteristics in the message payload; The behavioral intent detection is based on the user behavior sequence after language processing, inferring the user's operational intent to identify business logic-related vulnerability attacks. Step S5: Output vulnerability attack alarm information based on the traffic semantic detection and / or vulnerability attack alarm information obtained from the behavioral intent detection.
2. The method for detecting Web API vulnerability attacks according to claim 1, characterized in that, In step S2, the aggregation of HTTP transactions based on multi-dimensional session identifiers to construct a user behavior sequence specifically includes: Step S201: Extract the five dimensions of source IP address, destination IP address, destination port, User-Agent field, and Cookie field from each HTTP transaction to form the session key of the transaction; Step S202: Perform initial aggregation of HTTP transactions based on the session key, and arrange HTTP transactions with the same session key in ascending order of their timestamps to form multiple initial session sets; Step S203: Based on the three-dimensional aggregation key consisting of the source IP address, destination IP address, and User-Agent field, perform secondary aggregation on the initial session set to handle session splitting or erroneous aggregation caused by cookie forgery, and obtain the final user session set; Step S204: For each HTTP transaction in the user session set, extract its core semantic fields, including the HTTP request method, requested resource path, request parameter set, HTTP response status code, and response body content. Step S205: Construct the user behavior sequence based on the core semantic fields sorted by time.
3. The method for detecting Web API vulnerability attacks according to claim 2, characterized in that, In step S204, the response body content is processed as follows: only text-type response body content is retained, and binary-type response body content is truncated or ignored.
4. The method for detecting Web API vulnerability attacks according to claim 1, characterized in that, In step S3, the process of linguisticizing the structured data in the user behavior sequence specifically includes the following steps: Step S301: Perform format validation on the input user behavior sequence to ensure that each behavior unit contains the HTTP request method, requested resource path, request parameter set, HTTP response status code, and response body content fields; Step S302: For each action unit, arrange its HTTP request method, requested resource path, request parameter set, and HTTP response status code fields horizontally in a fixed order, and remove the structured format symbols; Step S303: Perform summary processing on the response body content of each action unit to generate a response body information summary; Step S304: Sort all the behavioral units processed by steps S302 and S303 in ascending order according to the timestamp of their corresponding HTTP transactions, and output them as a language-based context sequence.
5. The method for detecting Web API vulnerability attacks according to claim 4, characterized in that, In step S303, the summary processing is as follows: when the length of the response body content exceeds a preset threshold, key business information is extracted through precise keyword matching and prefix fuzzy matching.
6. The method for detecting Web API vulnerability attacks according to claim 1, characterized in that, In step S4, the traffic semantic detection involves using a fine-tuned BERT model to perform deep semantic modeling on the payload of the HTTP transaction in order to identify attacks. In step S4, the behavioral intent detection involves analyzing the verbalized user behavior sequence using a large language model that has been cue-engineered and / or fine-tuned with LoRA to infer the user's behavioral intent and identify attacks; the base model of the large language model is Qwen2.5-7B-Instruct.
7. The method for detecting Web API vulnerability attacks according to claim 1, characterized in that, In step S4, the traffic semantic detection and the behavioral intent detection are performed in parallel and independently; the overall detection rate of the intelligent detection engine satisfies the formula in the disclosure document: ； in: Recall_max represents the theoretical maximum detection rate of the intelligent detection engine; recall_BERT represents the detection rate of the Traffic Semantic Detection Model (BERT); recall_LLM represents the detection rate of the behavioral intent detection model (LLM).
8. A Web API vulnerability attack detection system, characterized in that, Including: The traffic extraction and parsing module is configured to receive network traffic data, extract and parse TCP streams, separate HTTP request and response messages, perform decoding processing, and associate them to generate HTTP transactions. The user behavior sequence construction module is configured to aggregate the HTTP transactions based on multi-dimensional session identifiers and construct user behavior sequences. A service interaction sequence languageization module is configured to convert structured data in the user behavior sequence into a context sequence in a format close to natural language. The intelligent detection engine module is configured to include: a traffic semantic detection unit, used for identifying vulnerability attacks based on the HTTP transaction; The behavioral intent detection unit is used to perform user intent reasoning and vulnerability attack identification based on the verbalized user behavior sequence. An alarm output module is configured to output the detection results of the intelligent detection engine module.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1-7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.