An API calling method, system, device and medium based on multi-cluster center distribution

Abstract

The application discloses an API calling method and system based on a multi-cluster center distribution, a device and a medium, and belongs to the technical field of API calling processing.The application adopts multi-cluster center modeling, accurately captures the multi-peak distribution characteristics of API calling behavior, thereby improving the accuracy of pattern recognition, dynamically tracks the pattern evolution law through time window division and pattern memory matrix, timely identifies behavior drift and abnormalities, introduces expert knowledge constraints and consistency optimization, ensures the stability of the pattern structure, prevents model drift, and adjusts the feature weight through rule back-annotation feedback, realizes the cycle of self-recognition, self-correction and self-stabilization, and significantly improves the perception and response ability of the system to dynamic abnormal behavior.

Description

Technical Field

[0001] This invention relates to the field of API call processing technology, and specifically to an API call method, system, device, and medium based on the distribution of multiple cluster centers. Background Technology

[0002] With the rapid development of APIs, monitoring and analyzing application interface call behavior is crucial for ensuring the stable operation of the system. Currently, statistical clustering, rule matching, or machine learning methods are commonly used to extract features and identify anomalies in API call logs. Then, by building behavioral models, normal business traffic and potential attack traffic can be distinguished, providing basic support for API security protection.

[0003] However, existing technologies still have some shortcomings when facing complex and ever-changing API call scenarios. Most methods lack the ability to comprehensively model multi-cluster structure features, treating API call features as static samples following a single distribution or single-center structure. This fails to effectively express multimodal distributions and inter-cluster differences, leading to a decline in recognition accuracy and generalization ability. Furthermore, in terms of dynamic evolution modeling of behavioral patterns, most methods assume that the call distribution remains stable, lacking the ability to model cluster center migration and changes in cluster structure. This makes it difficult to capture the temporal dynamic features of behavioral evolution. Once the distribution shifts or the pattern reorganizes, the model cannot adaptively update, resulting in a rapid decline in detection performance. In addition, Regarding the robustness, interpretability, and real-time online update capability of anomaly detection, many detection algorithms rely on a fixed number of clusters, similarity thresholds, or prior feature sets. When unknown calling patterns or data distribution drift occur, the model lacks a self-adjustment and evolution update mechanism, only outputting anomaly labels and lacking semantic interpretation of changes in cluster structure, which is not conducive to subsequent security and policy optimization. In addition, traditional clustering detection models mostly adopt offline training and periodic update methods, which are difficult to adapt to the real-time API behavior monitoring needs of high concurrency and multiple services. When the system structure changes frequently, it is often unable to track incremental changes in calling patterns, resulting in detection lag and model aging problems.

[0004] Given the shortcomings of existing technologies in multi-cluster feature modeling, dynamic evolution perception, robustness and adaptive recognition, interpretability, and cross-scenario transfer, it is difficult to meet the needs of continuous monitoring, dynamic learning, and intelligent evolution modeling of API call patterns in complex systems. Therefore, this paper proposes an API call method to achieve high-precision, robust, and interpretable behavioral pattern analysis in complex scenarios. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention provides an API calling method, system, device and medium based on the distribution of multiple cluster centers.

[0006] Therefore, the technical problem solved by this invention is that existing API call pattern recognition technologies suffer from problems such as simple clustering structure, static pattern expression, lack of dynamic evolution perception, and insufficient adaptive update capability. These problems lead to the inability to effectively characterize multi-peak distribution features, difficulty in capturing the drift and recombination of behavioral patterns over time, poor model interpretability, and difficulty in real-time online updates.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: an API calling method based on the distribution of multiple cluster centers, comprising: The API call logs are subjected to feature normalization processing to obtain a normalized feature matrix; Multicenter clustering is performed based on the standardized feature matrix to generate a set of cluster centers and a membership matrix. Determine the structural similarity between cluster centers in the cluster center set, construct a pattern association graph, and group the cluster centers to form a pattern set; A pattern memory matrix is ​​constructed by combining the call time series with the pattern set, the pattern memory matrix is ​​updated, and pattern re-identification is triggered when the similarity between a new pattern and a historical pattern is lower than a preset threshold. The pattern set is constrained and optimized using an expert knowledge base to obtain the optimized pattern structure. The optimized pattern structure is transformed into a rule template, merged with the expert knowledge base to generate an updated rule base, and the updated rule base is fed back to the feature standardization processing stage.

[0008] As a preferred embodiment of the API call method based on the distribution of multiple cluster centers described in this invention, the step of performing feature standardization processing on the API call logs to obtain a standardized feature matrix includes: Perform numerical mapping on each feature field in the API call log, and convert non-numeric fields into numerical encoding forms; Based on the set of field weights defined by experts, each feature field after mapping is weighted to obtain a weighted feature vector. The weighted feature vectors are normalized to obtain the standardized feature vectors corresponding to each API call log. The standardized feature vectors are used to form the standardized feature matrix; Based on the standardized feature matrix, the correlation coefficients between each feature field are calculated to obtain the field correlation coefficient matrix.

[0009] As a preferred embodiment of the API calling method based on the distribution of multiple cluster centers according to the present invention, the step of performing multi-center clustering based on the standardized feature matrix to generate a set of cluster centers and a membership matrix includes: Determine the actual number of cluster centers within the preset maximum number of cluster centers, and initialize the corresponding number of cluster centers; Based on the field correlation coefficient matrix, calculate the weighted distance between each standardized feature vector and each cluster center; The membership degree of each standardized feature vector to each cluster center is determined based on the weighted distance; With the goal of minimizing the energy within a cluster, the cluster centers and membership degrees are iteratively optimized. The optimized cluster centers form the cluster center set, and the membership degrees form the membership matrix.

[0010] As a preferred embodiment of the API calling method based on the distribution of multiple cluster centers according to the present invention, the step of determining the structural similarity between cluster centers in the cluster center set, constructing a pattern association graph, and grouping the cluster centers to form a pattern set includes: The ratio of the vector dot product of any two cluster centers in the cluster center set to the product of their respective moduli is used as the structural similarity. An association matrix is ​​constructed based on the structural similarity, and a pattern association graph is constructed using the cluster centers as nodes and the structural similarity as edge weights. A Laplacian matrix is ​​constructed based on the correlation matrix and the corresponding degree matrix, and eigenvalues ​​are obtained by eigenvalue decomposition of the Laplacian matrix. The number of groups is determined based on the distribution of the feature values, and the cluster centers are divided into the corresponding number of groups to form the pattern set.

[0011] As a preferred embodiment of the API calling method based on the distribution of multiple cluster centers described in this invention, the step of constructing a pattern memory matrix by combining the calling time series with the pattern set, updating the pattern memory matrix, and triggering pattern re-identification when the similarity between a new pattern and a historical pattern is detected to be lower than a preset threshold includes: The API calls are divided into consecutive time windows based on the call time series. For each sample within a time window, the pattern corresponding to that time window is determined based on the membership relationship of each sample in the pattern set. The frequency and conditional probability of pattern transitions between adjacent time windows are statistically analyzed to construct a pattern memory matrix; The pattern memory matrix is ​​updated with weights based on the pattern memory matrix calculated within the current time window, the pattern memory matrix at the previous time step, and the forgetting factor. When it is detected that the similarity between the current time window and all patterns in the historical pattern set is lower than the preset threshold, the pattern is identified as a new pattern and pattern re-identification is triggered.

[0012] As a preferred embodiment of the API calling method based on the distribution of multiple cluster centers described in this invention, the step of using an expert knowledge base to perform constraint optimization on the pattern set to obtain an optimized pattern structure includes: Based on the coupling strength and corresponding similarity between pattern pairs defined in the expert knowledge base, an expert constraint function is constructed; A joint optimization objective function is constructed, which includes an intra-cluster energy term to ensure cluster stability, a pattern memory matrix symmetry constraint term to maintain evolutionary symmetry, and the expert constraint function term. The optimized pattern structure is obtained by adjusting the structural relationships of each pattern in the pattern set by optimizing the joint optimization objective function.

[0013] As a preferred embodiment of the API calling method based on the distribution of multiple cluster centers described in this invention, the step of converting the optimized pattern structure into a rule template, merging it with the expert knowledge base to generate an updated rule base, and feeding the updated rule base back to the feature standardization processing stage includes: Each pattern in the optimized pattern structure is abstracted into a rule template, and the rule template contains behavioral pattern feature conditions and corresponding processing actions. The rule template is merged with the rules in the expert knowledge base, the original rules in the expert knowledge base are retained, and the unique rule template is added to generate the updated rule base. The updated rule base is fed back to the feature standardization processing stage to adjust the field weights in the feature standardization process.

[0014] This invention provides an API calling system based on the distribution of multiple cluster centers.

[0015] To solve the above-mentioned technical problems, the present invention provides the following technical solution: an API calling system based on the distribution of multiple cluster centers, comprising: The feature standardization processing module is used to perform feature standardization processing on API call logs to obtain a standardized feature matrix; The multi-center clustering module is used to perform multi-center clustering based on the standardized feature matrix, and generate a set of cluster centers and a membership matrix. The pattern recognition and structural association module is used to determine the structural similarity between cluster centers in the cluster center set, construct a pattern association graph, and group the cluster centers to form a pattern set. The pattern evolution module is used to construct a pattern memory matrix by combining the call time series with the pattern set, update the pattern memory matrix, and trigger pattern re-identification when the similarity between a new pattern and a historical pattern is lower than a preset threshold. The expert constraint optimization module is used to perform constraint optimization on the pattern set using an expert knowledge base to obtain the optimized pattern structure. The rule back-injection module is used to convert the optimized pattern structure into a rule template, merge it with the expert knowledge base to generate an updated rule base, and feed the updated rule base back to the feature standardization processing module.

[0016] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, characterized in that the processor executes the computer program to implement the steps of the API calling method based on the distribution of multiple cluster centers.

[0017] The present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of the API calling method based on the distribution of multiple cluster centers.

[0018] The beneficial effects of this invention are as follows: By standardizing the features of API call logs, a standardized feature matrix and a field correlation coefficient matrix are obtained, eliminating interference from dimensions and collinearity. Based on multi-center clustering, a set of cluster centers and a membership matrix are generated, achieving high-precision identification of multi-mode coexistence. Furthermore, by combining call time series to construct a pattern memory matrix and performing weighted updates, the dynamic features of behavior evolution over time are captured, solving the performance degradation caused by distribution offset. By using an expert knowledge base to constrain and optimize the pattern set, the interpretability and stability of the clustering structure are enhanced. The optimized pattern structure is transformed into a rule template and fed back to the feature standardization process, realizing continuous self-evolution and real-time online updates of knowledge. This ensures that the system can maintain efficient and accurate behavior monitoring capabilities in high-concurrency dynamic scenarios. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1The above is a flowchart of an API calling method based on the distribution of multiple cluster centers, provided as an embodiment of the present invention. Detailed Implementation

[0021] To make the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0022] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides an API calling method based on the distribution of multiple cluster centers, including: S1: Perform feature standardization processing on the API call logs to obtain a standardized feature matrix; It should be noted that step S1 mainly serves as an input layer, mapping the original call records into a unified feature space, providing a measurable standardized feature structure for subsequent multi-center clustering stages.

[0023] Furthermore, API call logs are preferably derived from access records at the gateway layer or application layer. All log records constitute the original call log set, specifically represented as follows: , in, This indicates the number of API call samples used in the modeling. This represents the i-th API call record, which contains multiple characteristic fields, such as request fields, response time, status code, and call path.

[0024] In this embodiment, the API call logs are subjected to feature standardization processing to obtain a standardized feature matrix, including the following steps A1-A5: A1: Perform numerical mapping on each feature field in the API call log, converting non-numeric fields into numerical encoding formats; Numerical mapping is preferably performed through a mapping function. To achieve, among which, This represents a mapping function that maps the k-th feature field in the i-th API call record to a numerical form. It's used to uniformly convert fields of different types into computable numerical features. The mapping function varies depending on the feature field type. Numerical mapping can be performed using one of the following two methods: Firstly, for numeric fields, including response time, request size, and call frequency, the mapping function... The original value of the field or the value after normalization is used directly as the mapping result; Specifically, normalization is preferably implemented using the Norm function, which employs Min-Max normalization. Its mathematical expression is as follows: in, This represents the original value of the k-th feature field. and These represent the minimum and maximum values ​​of the field in the current sample set, respectively. Through the above normalization process, each feature field is mapped to a unified numerical range, which can improve the stability and comparability of the subsequent multi-cluster modeling process. Secondly, for non-numerical fields, including discrete text features such as call paths, request parameter names, and combinations of request fields, the mapping function... Numerical processing is performed using discrete coding methods; One-Hot encoding or index encoding based on a field vocabulary is preferred. One-Hot encoding maps a field to an m-dimensional vector if the field has m possible values, where the corresponding value position is 1 and the rest are 0. Index encoding establishes a field vocabulary and maps each value to a unique integer index. Through the above numerical processing, different values ​​are mapped to numerical vectors of fixed dimensions, realizing a unified numerical representation of API call features of different types, and providing computable feature inputs for subsequent weighted processing; For example, for the call path field, different API paths can be mapped to different encoding vectors; for the request field set, a corresponding binary feature vector can be generated based on whether the field appears.

[0025] A2: Based on the set of field weights defined by experts, each feature field after mapping is weighted to obtain a weighted feature vector; Furthermore, the set of field weights defined by the expert is represented as follows: Where k represents the index of the feature field; field weight Used to represent the relative importance of the k-th API call feature field in behavioral pattern recognition; Furthermore, field weights The value range is [0,1], and after normalization, it satisfies: >0 Where K represents the total number of feature fields involved in the current stage of processing; by satisfying the above conditions, the comparability between the weights of different fields is ensured. Field weights can be initially set by experts based on their experience with the business semantics and security risks of the API interface, and then determined after being corrected based on the ability of each field in the historical call logs to distinguish abnormal behavior. This weighting process can be manually configured according to business rules, or adjusted by statistical analysis results of historical data, so as to obtain the final set of field weights.

[0026] A3: Normalize the weighted feature vectors to obtain the standardized feature vectors corresponding to each API call log; Furthermore, based on the set of field weights, each feature field after numerical mapping is weighted and normalized, as specifically expressed as follows: in, This represents the standardized feature vector corresponding to the i-th API call record; This represents the value of the k-th feature field in the i-th record after numerical mapping; The weight of the k-th field is assigned by expert experience to highlight key behavioral features; the Norm function is used to normalize the numerical values ​​of the feature fields to eliminate the influence of differences in the units of measurement of different fields on the clustering results.

[0027] A4: Construct a standardized feature matrix from the standardized feature vectors; Furthermore, the standardized feature vectors corresponding to all API call logs are collected. Assuming there are n API call records in the current analysis window, n standardized feature vectors are obtained. The normalized feature matrix F is composed of the normalized feature vectors F from multiple single API calls. i composition; Furthermore, a standardized feature matrix is ​​constructed, specifically represented as follows: in, This represents the standardized feature vector obtained after feature mapping, weighting, and normalization of the i-th API call record; n represents the number of API call samples participating in the modeling, i.e., the number of call log records collected in the current analysis window; T represents the matrix transpose operation. Furthermore, the dimension of the standardized feature matrix F is expressed as: Where n represents the number of API call samples participating in the modeling, and d represents the number of feature dimensions corresponding to each API call record, that is, the total number of feature fields obtained after feature extraction and numerical mapping. Meanwhile, the standardized feature vector of each individual API call satisfies: That is, each standardized feature vector (correspond All of these are d-dimensional vectors, ensuring that all samples have the same dimension in the feature space, thus forming a standardized feature matrix.

[0028] A5: Calculate the correlation coefficients between each feature field based on the standardized feature matrix to obtain the field correlation coefficient matrix; Furthermore, the field correlation coefficient matrix , is used to describe the correlation between the feature fields in the standardized feature matrix F, is generated by the feature extraction and standardization stages, and is then used for pattern structure constraints; Field correlation coefficient matrix Its elements are defined as: Where p and q represent the indexes of the feature fields, respectively; and Let p and q be the value vectors of the p-th and q-th feature fields in the standardized feature matrix F across all samples, respectively. The correlation coefficient calculation function is represented by the Pearson correlation coefficient, which is preferred. It should be further explained that the correlation coefficients of all feature field pairs are combined to obtain the field correlation coefficient matrix. Field correlation coefficient matrix Each element in The correlation coefficient matrix represents the correlation coefficient between the p-th feature field and the q-th feature field. This will be used as input for the next stage of multi-center clustering modeling to calculate the weighted distance between the standardized feature vector and each cluster center; Furthermore, by introducing [something] when calculating distance As a constraint, it is used to eliminate multicollinearity interference between feature fields and ensure that the clustering results are not affected by the duplication of highly correlated fields.

[0029] S2: Perform multi-center clustering based on the standardized feature matrix to generate a set of cluster centers and a membership matrix; Specifically, step S3 mainly involves clustering modeling based on a multi-center distribution structure in a unified feature space to construct representative centers for different calling modes.

[0030] In this embodiment, multi-center clustering is performed based on the standardized feature matrix to generate a set of cluster centers and a membership matrix, including the following steps B1-B5: B1: Determine the actual number of cluster centers within the preset maximum number of centers, and initialize the corresponding number of cluster centers; Furthermore, a maximum number of centers is preset. Based on the complexity of the actual business scenario and the limitations of system computing resources, a maximum value is preset for the number of cluster centers, denoted as . This value is used to limit the search space of the clustering algorithm to prevent excessive computational complexity or model overfitting due to an excessive number of cluster centers. Furthermore, within the preset maximum number of centers Within a certain range, determine the actual number of cluster centers K used for clustering; the actual number of cluster centers K is not a fixed value, but ranges from 1 to... Within the range, it is automatically determined based on the clustering effect (such as energy convergence within the cluster, silhouette coefficient, and other indicators); Initialize the corresponding number of cluster centers based on the determined actual number of cluster centers K; The cluster center set C is represented as: in, Represents the vector of the j-th cluster center (j=1,...,K); Each cluster center vector Dimensions and standardized feature vectors The dimensions are consistent, and the initialization method can be either random initialization or density-based initialization.

[0031] B2: Based on the field correlation coefficient matrix, calculate the weighted distance between each standardized feature vector and each cluster center; Furthermore, for each standardized feature vector With each cluster center Using the field correlation coefficient matrix As a constraint, calculate the weighted distance between the two. Specifically, it is expressed as: in, This represents the weighted distance between the i-th sample and the j-th cluster center; Represents the normalized feature vector of the i-th API call record; This represents the vector of the j-th cluster center; This represents the correlation coefficient matrix of the fields, used to eliminate multicollinearity interference between feature fields; T represents the matrix transpose operation; By introducing Weighted distance calculation is performed, taking into account the correlation between feature fields in the distance metric. When two feature fields are highly correlated, It will adjust their weights in distance calculation to avoid redundant calculation of related information, so that the clustering results can reflect the actual distribution structure of API call behavior.

[0032] B3: Determine the membership degree of each standardized feature vector to each cluster center based on the weighted distance; Furthermore, based on weighted distance Calculate the membership degree of each standardized feature vector to each cluster center. That is, the similarity distribution between samples and cluster centers, specifically represented as: in, This represents the membership degree or probability of the i-th sample belonging to the j-th cluster center; This represents the weighted distance between the i-th sample and the j-th cluster center; The parameter for controlling cluster compactness is preferably a preset fixed value, which is used to adjust the smoothness of the membership distribution; This indicates that the summation is performed over all cluster centers, where k represents the cluster center index, ranging from 1 to K, and K is the number of cluster centers. Furthermore, the membership degree of all samples to all cluster centers Combining, we obtain the membership matrix. Specifically, it is expressed as: , This represents the element in the i-th row and j-th column of the membership matrix.

[0033] B4: With the goal of minimizing the energy within a cluster, iteratively optimize the cluster centers and membership degrees; Furthermore, construct the energy function within the cluster. Specifically, it is expressed as: in, Used to guide the iterative updates of cluster centers and membership degrees; It should be added that, This indicates summation of the outermost layer. The initial value of the summation variable i is 1, which means that all N samples are summed. i is the sample index, from 1 to N, and N represents the number of API call samples involved in the modeling. This represents the inner summation, which accumulates the summation over all K cluster centers. j is the cluster center index, ranging from 1 to K, where K represents the number of cluster centers. Dynamically determined within the scope; This represents the standardized feature vector corresponding to the i-th sample. Belongs to the j-th cluster center Membership degree; This represents the weighted distance between the i-th sample and the j-th cluster center; Furthermore, to minimize the energy function within clusters To achieve the goal, alternately update the cluster center set C and its membership degree. The specific iterative process includes: fixing the cluster centers C, and updating the membership degrees. ; and fixed membership degree Update cluster centers ; Repeat the above steps until the energy function within the cluster is obtained. Convergence or reaching the preset number of iterations; Furthermore, after iterative convergence, the pattern distribution density function is calculated. As a feature quality assessment after clustering, it is used to measure the effectiveness of the current feature representation for clustering modeling, specifically expressed as: in, This represents the feature quality evaluation function constructed based on the standardized feature matrix F; K represents the number of cluster centers; This represents the standardized feature vector of the i-th sample; This represents the j-th cluster center; Represents the square of the distance metric function; Indicates sample Determining which cluster center it belongs to ; It is used to evaluate the cluster compactness in the feature space during the multi-center clustering modeling stage, and serves as an optimization objective for the clustering process, guiding the adjustment of cluster centers and subsequent pattern recognition and evolutionary modeling processes.

[0034] B5: The optimized cluster centers are combined into a cluster center set, and the membership degrees are combined into a membership matrix; Furthermore, when the energy function within the cluster... The clustering optimization process ends when the convergence condition is met or the preset number of iterations is reached; at this point, each cluster center... and each degree of membership Once a stable state is reached, no further updates are needed; the converged cluster centers will be... Arranged in index order, they form the cluster center set C, specifically represented as follows: Where K represents the actual number of cluster centers; the converged membership degrees Arranged according to sample index i and center index j, forming a membership matrix P, specifically represented as follows: ; Furthermore, the cluster center set C and membership matrix P will serve as inputs for the next step of pattern recognition and structural association, used to calculate inter-cluster structural similarity and construct pattern association graphs.

[0035] S3: Determine the structural similarity between cluster centers in the cluster center set, construct a pattern association graph, and group the cluster centers to form a pattern set; Specifically, in step S3, by analyzing the distribution relationship and similarity between clusters, an API call pattern map is formed, thereby realizing the structured expression of the pattern.

[0036] In this embodiment, the structural similarity between cluster centers in the cluster center set is determined, a pattern association graph is constructed, and the cluster centers are grouped to form a pattern set, including the following steps C1-C4: C1: Calculate the ratio of the vector dot product of any two cluster centers in the cluster center set to the product of their respective moduli, and use it as the structural similarity; By traversing the set of cluster centers C, the values ​​of any two cluster centers can be calculated. and Structural similarity between Specifically, it is expressed as: in, This represents the structural similarity between the a-th cluster center and the b-th cluster center; This represents the a-th cluster center vector; This represents the vector of the b-th cluster center. and Representing vectors respectively and The modulus; a and b are cluster center indices, with values ​​ranging from 1 to K.

[0037] C2: Construct an association matrix based on structural similarity, and build a pattern association graph with cluster centers as nodes and structural similarity as edge weights; Furthermore, the structural similarity calculated pairwise is... The elements are combined to form an association matrix S, which is a K×K symmetric matrix where K is the number of cluster centers. The element in the p-th row and q-th column is denoted as S(p, q), and S(p, q) represents the cluster center C. p With C q The similarity value between them; By calculating the structural similarity between cluster centers, we can quantify the degree of behavioral similarity between different API call patterns. The higher the similarity, the more consistent the two patterns are in the feature space, and there may be a logical connection or evolution. The lower the similarity, the greater the difference between the two patterns. The association matrix S is used as the input matrix for the subsequent spectral clustering grouping stage to further group the cluster center set. Using the cluster center set C as nodes, and based on structural similarity... Construct a pattern association graph for edge weights. Specifically, it is expressed as: in, The set of cluster center nodes, i.e. Each node corresponds to a cluster center vector. This is used to characterize a typical API call pattern; This is a set of edges used to describe the relationships between different cluster centers, and its elements are defined as follows: in, This function represents the similarity calculation between cluster centers, and the result is the structural similarity. ; Indicates the preset association threshold; Furthermore, only when the similarity between two cluster centers meets a threshold condition is an associated edge established between the corresponding nodes and added to the edge set E, i.e. ; in, This represents the weight value of the edge connecting node a and node b. By constructing the association matrix S and the pattern association diagram The abstract clustering center relationship is transformed into a visual graph structure, where nodes represent typical behavioral patterns, and the set of edges E determines the connection relationship of the patterns, i.e., whether an edge exists and its weight. Determines the strength of association between patterns; Pattern association graph It is used to visually demonstrate the dependencies between patterns and provides a structural foundation for evolutionary modeling.

[0038] C3: Construct the Laplacian matrix based on the correlation matrix and the corresponding degree matrix, and perform eigenvalue decomposition on the Laplacian matrix to obtain eigenvalues; Furthermore, a degree matrix D is constructed. The degree matrix is ​​a diagonal matrix, and its diagonal elements are calculated from the row sum or column sum of the association matrix S. It is used to represent the sum of the association strengths between each cluster center and other centers. Furthermore, the Laplace matrix L is constructed as follows: L represents the Laplacian matrix, used in the spectral clustering process; D represents the degree matrix; S represents the correlation matrix. It should be further explained that by performing eigenvalue decomposition on the Laplacian matrix L, its eigenvalue distribution is obtained, which is used to perform eigenvalue decomposition and grouping of the inter-center correlation structure.

[0039] C4: Determine the number of groups based on the distribution of feature values, and divide the cluster centers into the corresponding number of groups to form a pattern set; Furthermore, the distribution of eigenvalues ​​will be used to determine the number m of subsequent high-level patterns. The number m of high-level patterns is not a fixed preset value, but is determined according to the distribution of eigenvalues ​​of the Laplace matrix. When there is a significant gap between adjacent eigenvalues, the number of corresponding eigenvalues ​​is taken as the number m of high-level patterns. For example, if the feature values ​​are arranged from smallest to largest, and the difference between the first m feature values ​​is small, while there is a significant jump or obvious interval between the mth and (m+1)th feature values, then the number of groups is determined to be m. In this way, the number of groups for spectral clustering is adaptively determined, so that the number of high-level patterns m can adapt to the actual data distribution and avoid the inaccurate grouping problem that may be caused by a fixed preset value. Furthermore, based on the determined number of groups m, the cluster center set is... Further grouping involves classifying multiple cluster centers with high similarity into the same high-level pattern, thus forming a high-level pattern set M, specifically represented as follows: Where M represents the set of high-level patterns; This represents the i-th high-level pattern (i=1,…,m); each high-level pattern It consists of one or more cluster centers with similar call behavior distributions; By using spectral clustering, the K cluster centers at the bottom level are abstracted into m high-level patterns. Each high-level pattern represents a cluster of API call behaviors with similar structural characteristics. The pattern set M serves as the input for pattern evolution modeling and memory update stages, and is used to track the transformation patterns of patterns in the time dimension.

[0040] S4: Combine the call time series and pattern set to construct a pattern memory matrix, update the pattern memory matrix, and trigger pattern re-identification when the similarity between the new pattern and the historical pattern is lower than a preset threshold; Specifically, in step S4, a pattern evolution mechanism is established in the time dimension, and the transformation rules and life cycle between patterns are recorded through a memory matrix.

[0041] In this embodiment, a pattern memory matrix is ​​constructed by combining the call time series and the pattern set, the pattern memory matrix is ​​updated, and pattern re-identification is triggered when the similarity between a new pattern and a historical pattern is lower than a preset threshold, including the following steps D1-D5: D1: Divide API calls into consecutive time windows based on the call time sequence; Furthermore, it receives a time series T from the original API call log, which records the timestamp of each API call request, and is used to perform segmented analysis of the call behavior in the time dimension; Furthermore, based on a preset time window The call time series T is divided into multiple consecutive time windows, each corresponding to an independent time period, used to determine the pattern attribution of API call behavior within that time period. The preferred setting is a preset fixed duration; It should be noted that the time window The following two methods can be used: First, the time window It can be pre-configured to a fixed value based on the system call frequency, such as 5 minutes, 10 minutes or 30 minutes, to ensure that there are a sufficient number of call samples in each time period; Secondly, when the system call frequency changes significantly, the time window... It can also be dynamically adjusted based on the number of calls per unit time to maintain the stability of the sample size within each time window; For each divided time window, the distribution of the high-level patterns of each sample within the window is statistically analyzed, and the high-level patterns corresponding to the time window are determined by the majority sample attribution principle. Specifically, for API call data within a given time period, if that time period belongs to high-level mode... If the sample size has the highest percentage, then the pattern corresponding to that time period is determined to be... ; The continuous API call time series T is converted into a discrete time window pattern sequence using the above method, which is used to construct the pattern memory matrix and track the pattern evolution. For time window The API call behavior is segmented and modeled in segments over time, which supports two-layer analysis of short-term bursty behavior and long-term stable behavior. The pattern determination results within each time window will be used to construct an input to the pattern memory matrix to record the conversion frequency and life cycle between patterns.

[0042] D2: For each sample within a time window, determine the corresponding pattern for that time window based on the membership relationship of each sample in the pattern set; Furthermore, based on each time window obtained from the division Obtain all API call samples contained within the window, and statistically analyze the time window based on the pattern set M and sample membership results output from the pattern recognition and structure association stage. The distribution of each sample within the high-level pattern is analyzed, and then, based on the statistically obtained distribution, the majority sample allocation principle is used to determine the time window. Corresponding high-level mode ; Furthermore, by using the above method, continuous time windows are mapped to discrete pattern sequences, with each time window corresponding to a dominant high-level pattern. Through the majority sample attribution principle, a small number of noise samples or abnormal fluctuations within the time window can be filtered out, ensuring the stability of the time window pattern.

[0043] D3: Statistically analyze the frequency and conditional probability of mode transitions between adjacent time windows to construct a mode memory matrix; Based on each determined time window Corresponding high-level mode This forms a sequence of patterns arranged chronologically. Let the time window index be t, then the high-level pattern corresponding to the t-th time window is represented as follows: ; Furthermore, the pattern sequence is traversed, and the frequency of pattern transitions between adjacent time windows is counted. The number of times pattern i transitions from time window t to time window j in time window t+1 is recorded, specifically as follows: Where i and j are the index numbers of the high-level modes, with values ​​ranging from 1 to m, i representing the i-th high-level mode. j represents the j-th high-level pattern t is the index of the time window; Furthermore, based on the statistically observed transition frequencies, the conditional probability of pattern transition is calculated and expressed as: in, The element in the i-th row and j-th column of the pattern memory matrix represents the conditional probability of transitioning from pattern i to pattern j. This indicates the frequency of transition from mode i to mode j between adjacent time windows; This represents the total frequency of pattern i in the t-th time window; Furthermore, all elements Combining and constructing a pattern memory matrix ; in, m represents the number of high-level patterns obtained through spectral clustering; A matrix representing the relationships between high-level schemas, whose elements reflect the frequency of schema transformations and the strength of dependencies; It should be further explained that the pattern memory matrix can track the transformation patterns between calling patterns over time. Each element in the pattern memory matrix quantifies the probability of evolving from one pattern to another, providing a data foundation for subsequent memory updates and abnormal evolution detection.

[0044] D4: Update the pattern memory matrix with weights based on the pattern memory matrix calculated in the current time window, the pattern memory matrix of the previous time step, and the forgetting factor; Furthermore, based on the forgetting factor The pattern memory matrix of the previous time step Pattern memory matrix with the current time window After weighted fusion, the updated pattern memory matrix is ​​obtained, represented as: in, This represents the updated pattern memory matrix, i.e., the state at time t+1; This represents the pattern memory matrix of the previous time step, i.e., the historical state at time t; Indicates the current time window The pattern memory matrix calculated within t; This represents the forgetting factor, used to control the rate at which historical memories decay. Preferably, The value can be [0, 1], when When the size is large, the model relies more on historical memory, updates slowly, but has high stability; when When the data is smaller, the model relies more on the current window data, updates rapidly, and is highly sensitive. Adjustments can be made to... The system can adaptively balance the stability of pattern evolution with the speed of response to sudden behaviors.

[0045] D5: When the similarity between the current time window's corresponding pattern and all patterns in the historical pattern set is lower than a preset threshold, the pattern is identified as a new pattern, and pattern re-identification is triggered. Furthermore, the pattern corresponding to the current time window is obtained, and its similarity with all known patterns in the historical pattern set is calculated. Specifically, cosine similarity is used to obtain the cosine value of the angle between the current pattern vector and each historical pattern vector, and the similarity is compared with a preset threshold. Compare; Furthermore, when the similarity between the pattern corresponding to the current time window and all patterns in the historical pattern set is lower than a preset threshold... If the current pattern cannot be covered by the existing set of historical patterns, then the pattern is identified as a new pattern. The similarity threshold that triggers pattern re-identification The preferred preset value is 0.5; Once a new pattern is identified, a pattern re-identification process will be triggered, and a pattern re-identification report will be generated. , This report is used to record information related to conditions triggering re-identification during pattern evolution modeling. The report includes the time period that triggered the re-identification, the corresponding pattern identifier, and changes in pattern similarity. As an intermediate output, it can be used to provide a reference for subsequent optimization of expert knowledge constraints and consistency, and to assist the system in confirming and adjusting newly generated or significantly changed patterns.

[0046] S5: Use the expert knowledge base to perform constraint optimization on the pattern set to obtain the optimized pattern structure; In step S5, the output results of the pattern evolution modeling and memory update stage will be subjected to expert knowledge constraints and consistency optimization to optimize pattern interpretability and convergence. By introducing pattern constraints and consistency correction through expert knowledge, the model can be prevented from misgrouping or pattern collapse due to data noise.

[0047] In this embodiment, the pattern set is constrained and optimized using an expert knowledge base to obtain an optimized pattern structure, including the following steps E1-E3: E1: Construct expert constraint functions based on the coupling strength and corresponding similarity between pattern pairs defined in the expert knowledge base; Furthermore, the expert knowledge base K is a set of structured rules used to store API call pattern constraint information defined by experts. Its data structure is a rule table or a set of key-value pairs. Specifically, the data structure of the expert knowledge base K can be represented as follows: ; Where L represents the total number of expert rules; This represents the Lth expert rule or constraint, which contains the index (i, j) of the schema pair that needs to be constrained. This indicates the threshold or parameter configuration corresponding to the rule, and its content includes the coupling strength between the pattern pairs. ; Furthermore, a schema pair refers to two high-level schemas whose constraints are explicitly defined in the expert knowledge base K, specifically two cluster centers. and The expert knowledge base K records all pattern pair indices (i, j) that require constraints and their corresponding coupling strengths. ; in, This represents the association strength between the i-th and j-th expert rules, and its value ranges from 1 to 2. The larger the value, the higher the degree of correlation between the rules. It can be manually set by experts based on their business experience, or automatically generated based on the co-occurrence frequency and application effect statistics of historical rules; For each pattern pair (i, j), obtain its corresponding cluster center similarity. ; Related to the previous text Both are similarity measures with the same meaning, representing the similarity value between two cluster centers. Represents the i-th cluster center with the j-th cluster center The similarity between them is calculated using the following formula: in, The function representing the similarity calculation is preferred, and a distance-based similarity metric is preferred. Based on coupling strength and corresponding similarity Construct the expert constraint function, specifically as follows: in, This represents the expert constraint function, used to inject expert knowledge constraints during the optimization process; This represents the summation of all pattern pairs (i, j) defined in the expert knowledge base K; The expert-defined coupling strength of the pattern pair (i, j) is represented. The actual computed similarity of pattern pair (i, j); Through expert constraint functions It can introduce expert knowledge constraints into the joint optimization of the overall objective function, when the cluster center similarity Coupling strength defined by experts When there is inconsistency, the function value will increase, thus penalizing this inconsistency during the optimization process. This prevents the model from misclassifying or collapsing due to data noise, thereby enabling the integration of data-driven and knowledge-driven optimization.

[0048] E2: Construct a joint optimization objective function, which includes an intra-cluster energy term to ensure cluster stability, a pattern memory matrix symmetry constraint term to maintain evolutionary symmetry, and an expert constraint function term; Furthermore, a joint optimization objective function is constructed, specifically expressed as: in, This represents the overall objective function for joint optimization, used to guide the optimization and updating of the final schema structure; This represents the energy term within a cluster, used to ensure cluster stability; The mode memory matrix represents the symmetry constraint term, used to maintain evolutionary symmetry; This represents the expert constraint function term, used to inject expert constraints to achieve consistency; parameter and These are weighting coefficients used to balance the impact of different constraint terms in the formula on the overall optimization result, and the parameters... and The preferred setting is a preset fixed value, which can be configured according to specific application scenarios. Additionally, in this formula... Compared with previous methods used to control cluster compactness These are different parameters, sharing the same symbol but with independent meanings, and each acts on different stages of the optimization process.

[0049] E3: By optimizing the joint optimization objective function, the structural relationships of each mode in the mode set are adjusted to obtain the optimized mode structure; Furthermore, to minimize the joint optimization overall objective function To optimize the objective, the structural relationships between the modes in the initial high-level mode set M are adjusted. Conventional numerical optimization algorithms in this field, such as gradient descent and expectation-maximization algorithms, are used to calculate... Regarding the gradient or update direction of the mode structure parameters, the parameters are iteratively updated until... When the joint optimization of the overall objective function converges or reaches the preset number of iterations, Upon convergence, the currently obtained pattern structure is determined as the optimized pattern structure. ; During the optimization process, adjustments to the schema structure are recorded, and a consistency correction report is generated. It is used to record the results of correcting the pattern structure during the process of expert knowledge constraint and consistency optimization. Its content includes the pattern identifier that is corrected, the corresponding correction type, and the changes in the correlation before and after correction. Furthermore, As an intermediate output of the consistency optimization phase, it is used to provide a reference for the subsequent rule back-injection and intelligent closed-loop phases, and to assist the system in recording and tracing the pattern adjustment process. The output stable pattern structure is passed as input to the final rule back-injection and intelligent closed-loop phases.

[0050] S6: Transform the optimized pattern structure into a rule template, merge it with the expert knowledge base to generate an updated rule base, and feed the updated rule base back to the feature standardization processing stage; Specifically, in step S6, the optimized pattern structure is re-injected into the rule system to achieve automatic rule generation and continuous optimization.

[0051] In this embodiment, the optimized pattern structure is transformed into a rule template, merged with the expert knowledge base to generate an updated rule base, and the updated rule base is fed back to the feature standardization processing stage, including the following steps F1-F3: F1: Abstract each pattern in the optimized pattern structure into a rule template. The rule template contains behavioral pattern feature conditions and corresponding processing actions. Obtain the optimized pattern structure of the output The stable pattern is abstracted into a rule template, represented as: in, This represents the i-th rule template; The representation pattern-action mapping relationship set is used to describe the association rules between high-level patterns and corresponding response actions; Let i represent the i-th high-level behavioral pattern, used to characterize a set of behavioral patterns with similar API call feature distributions; This represents the processing action or strategy corresponding to the i-th high-level behavior pattern, including alarm triggering, rule generation, access restriction, or risk marking, which is used to respond to the corresponding pattern in the rule injection and intelligent closed-loop stages; By abstracting rule templates, black-box clustering patterns can be transformed into interpretable business rules. It can be used to update the system's rule base, enabling the model to continuously evolve.

[0052] F2: Merge the rule templates with the rules in the expert knowledge base, retain the original rules in the expert knowledge base, and add non-duplicate rule templates to generate an updated rule base; Furthermore, expert rule base This is the same concept as the expert knowledge base K mentioned earlier, only the symbolic representation is different. Both are used to store the API call pattern constraint rules defined by experts. The data structure is a set of structured rules, which is used to constrain and correct the pattern structure during the expert knowledge constraint and consistency optimization stage. rule template With expert rule base The original rules in the table are compared, and a difference merging operation is performed: in, This indicates the updated rule base; This represents the existing set of rules in the expert knowledge base; This represents the rule template generated in this cycle; This indicates filtering out rules that do not belong to the original rule base. The new rule templates retain the original rules in the expert knowledge base and add non-repeating rule templates. After the merge is complete, an updated rule base will be generated. , It includes historical expert rules and newly identified stable pattern rules in this period, thus enabling incremental updates to the rule base; By merging differences, the system can retain historical expert knowledge while incorporating newly generated stable pattern rules, thereby ensuring a balance between the stability and adaptability of the rule base and supporting closed-loop operation of the model.

[0053] F3: Feed the updated rule base back to the feature standardization processing stage to adjust the field weights in the feature standardization processing; Furthermore, obtain the updated rule base from the output. , This represents the latest understanding of API call behavior characteristics in the current system, and the updated rule base will be updated. The reverse input is fed into the feature extraction and standardized representation stage to realize knowledge re-injection and continuous self-evolution, thereby forming a complete loop system; After this phase is completed, a model closure report will be generated. Output the final result, model closure report. This report records the execution results of a complete rule back-injection, model update, and pattern re-identification closed-loop process. The report includes the pattern identifiers involved in the update, rule changes, and model state update results, along with a model closed-loop report. It can record the results of closed-loop operation, which can be used to evaluate the model's self-updating effect and provide a reference for subsequent model operation and maintenance analysis.

[0054] In summary, by modeling the distribution of multiple cluster centers in the API behavior feature space, the identification defects of traditional single-center or fixed-threshold clustering algorithms under diverse calling patterns are solved. Each cluster center represents a typical calling behavior distribution pattern, and the model can simultaneously capture the local density differences of multiple calling patterns, thereby achieving high-precision identification of multi-mode behavior coexistence. Existing technologies rely on completely unsupervised clustering detection methods, while this solution incorporates expert knowledge constraints during training. By defining the logical similarity and behavioral coupling strength between patterns, semantic constraints and directional guidance are applied to the clustering structure during optimization, enhancing the interpretability and stability of the clustering structure. Furthermore, it ensures that the model maintains consistency in pattern evolution when absorbing historical knowledge, achieving a fusion of data-driven and knowledge-driven optimization. Moreover, it can maintain high pattern stability even after multiple scenario transfers, reducing the risk of pattern drift and structural collapse caused by unconstrained learning.

[0055] In addition, the pattern memory matrix can track the conversion frequency and lifecycle between calling patterns over time, thereby balancing the weight of historical memory and current behavior, mastering the calling patterns of APIs, identifying potential abnormal pattern evolution in advance, and making risk predictions. It can also identify problems such as periodic call imbalances, abuse of API access, and abnormal resource consumption in certain phases.

[0056] Example 2 is an embodiment of the present invention, which provides an application example of the API calling method based on the distribution of multiple cluster centers in a specific API security monitoring scenario, based on the previous embodiment.

[0057] In this embodiment, an API call record from a certain business system is selected as the input sample. The call path is / api / user / login, the request method is POST, the number of request parameters is 3, the response status code is 200, and the response time is 120ms. After feature extraction and numerical mapping, the above call record is mapped into a standardized feature vector. Ultimately, a standardized feature matrix F is formed to participate in the multi-cluster center modeling process. In the multi-center clustering modeling stage, the system initializes K cluster centers and calculates the sample distance according to the weighted distance formula. With each cluster center The distance between the sample and the cluster center was calculated. The cluster center is determined to be the one with the smallest distance. This further categorizes it into the corresponding high-level model. .

[0058] Specifically, the system divides API calls into consecutive time windows based on the call time sequence. When a large number of API requests with similar call characteristics appear in subsequent time windows, the majority sample attribution principle is used to determine that time period as the pattern. The stable calling patterns are recorded, and a pattern memory matrix is ​​constructed to count the frequency and conditional probability of pattern transitions between adjacent time windows.

[0059] If there are significant changes in the parameter structure or response time, the system calculates the cosine similarity between the new pattern and the historical pattern. When the similarity is lower than a preset threshold... When this occurs, pattern re-identification is triggered, and a pattern re-identification report is generated. Optimized pattern structure It is abstracted into a rule template, and then merged with the expert rule base to generate an updated rule base. Ultimately, this feedback is sent to the feature standardization stage to adjust the field weights for the next cycle. It also generates a model closed-loop report to record the update status of this round.

[0060] Example 3, referring to Figure 1 As one embodiment of the present invention, this embodiment provides an API calling system based on the distribution of multiple cluster centers, including: The feature standardization processing module is used to perform feature standardization processing on API call logs to obtain a standardized feature matrix; The multicenter clustering module is used to perform multicenter clustering based on the standardized feature matrix, generating a set of cluster centers and a membership matrix. The pattern recognition and structural association module is used to determine the structural similarity between cluster centers in the cluster center set, construct a pattern association graph, and group the cluster centers to form a pattern set. The pattern evolution module is used to combine the call time series and the pattern set to construct a pattern memory matrix, update the pattern memory matrix, and trigger pattern re-identification when the similarity between a new pattern and a historical pattern is lower than a preset threshold. The expert constraint optimization module is used to perform constraint optimization on the pattern set using an expert knowledge base to obtain the optimized pattern structure. The rule feedback module is used to convert the optimized pattern structure into rule templates, merge them with the expert knowledge base to generate an updated rule base, and then feed the updated rule base back to the feature standardization processing module.

[0061] This embodiment also provides an electronic device applicable to an API calling method based on the distribution of multiple cluster centers, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the API calling method based on the distribution of multiple cluster centers as proposed in the above embodiment.

[0062] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements an API calling method based on the distribution of multiple cluster centers as proposed in the above embodiment.

[0063] The storage medium proposed in this embodiment and the API calling method based on the distribution of multiple cluster centers proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0064] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0065] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An API calling method based on the distribution of multiple cluster centers, characterized in that: include, The API call logs are subjected to feature normalization processing to obtain a normalized feature matrix; Multicenter clustering is performed based on the standardized feature matrix to generate a set of cluster centers and a membership matrix. Determine the structural similarity between cluster centers in the cluster center set, construct a pattern association graph, and group the cluster centers to form a pattern set; A pattern memory matrix is ​​constructed by combining the call time series with the pattern set, the pattern memory matrix is ​​updated, and pattern re-identification is triggered when the similarity between a new pattern and a historical pattern is lower than a preset threshold. The pattern set is constrained and optimized using an expert knowledge base to obtain the optimized pattern structure. The optimized pattern structure is transformed into a rule template, merged with the expert knowledge base to generate an updated rule base, and the updated rule base is fed back to the feature standardization processing stage.

2. The API calling method based on the distribution of multiple cluster centers as described in claim 1, characterized in that, The process of standardizing the API call logs to obtain a standardized feature matrix includes: Perform numerical mapping on each feature field in the API call log, and convert non-numeric fields into numerical encoding forms; Based on the set of field weights defined by experts, each feature field after mapping is weighted to obtain a weighted feature vector. The weighted feature vectors are normalized to obtain the standardized feature vectors corresponding to each API call log. The standardized feature vectors are used to form the standardized feature matrix; Based on the standardized feature matrix, the correlation coefficients between each feature field are calculated to obtain the field correlation coefficient matrix.

3. The API calling method based on the distribution of multiple cluster centers as described in claim 2, characterized in that, The step of performing multi-center clustering based on the standardized feature matrix to generate a set of cluster centers and a membership matrix includes: Determine the actual number of cluster centers within the preset maximum number of cluster centers, and initialize the corresponding number of cluster centers; Based on the field correlation coefficient matrix, calculate the weighted distance between each standardized feature vector and each cluster center; The membership degree of each standardized feature vector to each cluster center is determined based on the weighted distance. With the goal of minimizing the energy within a cluster, the cluster centers and membership degrees are iteratively optimized. The optimized cluster centers form the cluster center set, and the membership degrees form the membership matrix.

4. The API calling method based on the distribution of multiple cluster centers as described in claim 3, characterized in that, The process of determining the structural similarity between cluster centers in the cluster center set, constructing a pattern association graph, and grouping the cluster centers to form a pattern set includes: The ratio of the vector dot product of any two cluster centers in the cluster center set to the product of their respective moduli is used as the structural similarity. An association matrix is ​​constructed based on the structural similarity, and a pattern association graph is constructed using the cluster centers as nodes and the structural similarity as edge weights. A Laplacian matrix is ​​constructed based on the correlation matrix and the corresponding degree matrix, and eigenvalues ​​are obtained by eigenvalue decomposition of the Laplacian matrix. The number of groups is determined based on the distribution of the feature values, and the cluster centers are divided into the corresponding number of groups to form the pattern set.

5. The API calling method based on the distribution of multiple cluster centers as described in claim 4, characterized in that, The process of constructing a pattern memory matrix by combining the call time series with the pattern set, updating the pattern memory matrix, and triggering pattern re-identification when the similarity between a new pattern and a historical pattern is lower than a preset threshold includes: The API calls are divided into consecutive time windows based on the call time series. For each sample within a time window, the pattern corresponding to that time window is determined based on the membership relationship of each sample in the pattern set. The frequency and conditional probability of pattern transitions between adjacent time windows are statistically analyzed to construct a pattern memory matrix; The pattern memory matrix is ​​updated with weights based on the pattern memory matrix calculated within the current time window, the pattern memory matrix at the previous time step, and the forgetting factor. When it is detected that the similarity between the current time window and all patterns in the historical pattern set is lower than the preset threshold, the pattern is identified as a new pattern and pattern re-identification is triggered.

6. The API calling method based on the distribution of multiple cluster centers as described in claim 5, characterized in that, The step of using an expert knowledge base to perform constraint optimization on the pattern set to obtain an optimized pattern structure includes: Based on the coupling strength and corresponding similarity between pattern pairs defined in the expert knowledge base, an expert constraint function is constructed; A joint optimization objective function is constructed, which includes an intra-cluster energy term to ensure cluster stability, a pattern memory matrix symmetry constraint term to maintain evolutionary symmetry, and the expert constraint function term. The optimized pattern structure is obtained by adjusting the structural relationships of each pattern in the pattern set by optimizing the joint optimization objective function.

7. The API calling method based on the distribution of multiple cluster centers as described in claim 6, characterized in that, The step of converting the optimized pattern structure into a rule template, merging it with the expert knowledge base to generate an updated rule base, and feeding the updated rule base back to the feature standardization processing stage includes: Each pattern in the optimized pattern structure is abstracted into a rule template, and the rule template contains behavioral pattern feature conditions and corresponding processing actions. The rule template is merged with the rules in the expert knowledge base, the original rules in the expert knowledge base are retained, and the unique rule template is added to generate the updated rule base. The updated rule base is fed back to the feature standardization processing stage to adjust the field weights in the feature standardization process.

8. An API calling system based on the distribution of multiple cluster centers, employing the API calling method based on the distribution of multiple cluster centers as described in any one of claims 1 to 7, characterized in that, include: The feature standardization processing module is used to perform feature standardization processing on API call logs to obtain a standardized feature matrix; The multi-center clustering module is used to perform multi-center clustering based on the standardized feature matrix, and generate a set of cluster centers and a membership matrix. The pattern recognition and structural association module is used to determine the structural similarity between cluster centers in the cluster center set, construct a pattern association graph, and group the cluster centers to form a pattern set. The pattern evolution module is used to construct a pattern memory matrix by combining the call time series with the pattern set, update the pattern memory matrix, and trigger pattern re-identification when the similarity between a new pattern and a historical pattern is lower than a preset threshold. The expert constraint optimization module is used to perform constraint optimization on the pattern set using an expert knowledge base to obtain the optimized pattern structure. The rule back-injection module is used to convert the optimized pattern structure into a rule template, merge it with the expert knowledge base to generate an updated rule base, and feed the updated rule base back to the feature standardization processing module.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the API calling method based on the distribution of multiple cluster centers as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the API calling method based on the distribution of multiple cluster centers as described in any one of claims 1 to 7.

Images