An implicit risk link identification method, system, device and medium based on API call influence surface inflation rate

Abstract

The application discloses a kind of implicit risk link identification method, system, equipment and medium based on API call influence surface inflation rate, comprising: API call log and business resource information are parsed, data, service and business state object triggered by single call are identified, and call influence surface model is built;In the continuous time window, the model size change is counted, the call influence surface inflation rate is calculated, and the inflation rate benchmark model of corresponding API is built based on historical normal business data;Real-time inflation rate is compared with benchmark model, abnormal inflation behavior is identified and risk quantification is carried out in combination with diffusion level depth, and abnormal inflation API call set is obtained;With the API call in the set as starting point, downstream API and business object are traced along model diffusion path, and cross-API implicit risk propagation link is built;According to the length of link, the influence range and the inflation rate characteristics determine the risk level, and generate differentiated protection strategy suggestion.The application effectively improves the active defense capability of system to complex API attack.

Description

Technical Field

[0001] This invention relates to the field of API anomaly detection technology, and in particular to a method, system, device and medium for identifying hidden risk links based on the API call impact surface expansion rate. Background Technology

[0002] Although research on API security governance, interface risk assessment, and business call analysis has been increasing in recent years, related technical solutions have gradually evolved from early methods based on interface permission configuration and access control rules to multiple implementation methods that combine call log analysis, call path modeling, and intelligent models to assess interface risks. However, in real-world complex business systems and high-concurrency operating environments, existing mainstream technical solutions still have significant limitations: First, existing technologies lack modeling capabilities, mainly focusing on the static attributes of the interface itself or the behavior of a single call, such as access frequency and permission level. They lack a systematic characterization of the number of downstream interfaces affected by API calls in actual business systems, the scope of data objects, and the degree of state diffusion. This makes it difficult to identify hidden risks that appear normal in terms of call behavior but whose actual impact range expands abnormally in a short period of time.

[0003] Second, existing technologies are too simplistic in identifying risk propagation paths, focusing primarily on single interfaces or linear call path sequences. They fail to quantify the impact of complex microservice architectures that exhibit tree-like or network-like diffusion characteristics. Therefore, they cannot capture, from an overall perspective, the hidden cross-API risk propagation paths formed by the abnormal expansion of the number of affected objects, the depth of the hierarchy, or the scale of linkage.

[0004] Third, existing technologies lack a mechanism for sensing the rate of dynamic change. They often focus only on the absolute size of the affected area while ignoring its expansion rate over time. This makes it impossible to establish a correlation model between the expansion rate and risk amplification, making it difficult to provide timely warnings and intervene in the potential risk amplification process in the early stages when the affected area shows a nonlinear and rapid increase.

[0005] Fourth, the risk assessment results of existing technologies lack an intuitive quantitative description of the differences in impact. They usually only output general risk levels or alarm information, which makes it impossible for security operations and maintenance personnel to accurately determine the actual damage range that different interface calls may cause. As a result, they can only adopt a one-size-fits-all coarse-grained protection strategy, making it difficult to achieve a balance between ensuring security and providing differentiated and precise protection against high-impact risks and business continuity.

[0006] The aforementioned problems are amplified as business systems continue to expand, the number of microservices continues to grow, and the coupling between systems deepens. This leads to existing technologies generally facing challenges in actual deployment, such as difficulty in timely detection of hidden risk propagation, unclear risk diffusion paths, and insufficient targeting of protection strategies. Summary of the Invention

[0007] In view of the aforementioned existing problems, the present invention is proposed.

[0008] Therefore, this invention provides a method, system, device, and medium for identifying hidden risk links based on the expansion rate of the impact surface of API calls. This addresses the problem that existing technologies lack a systematic characterization of the dynamic changes and diffusion characteristics of the impact range caused by API calls, making it difficult to identify hidden risk links caused by abnormal expansion of the impact surface, and failing to support accurate identification and graded protection of cross-API risk propagation.

[0009] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a method for identifying implicit risk links based on the API call impact surface expansion rate, including: Analyze API call logs and business resource information to identify the data objects, service objects, and business status objects that are actually triggered in the business system for a single call, and build a call impact model. Within a continuous time window, the scale change of the call impact surface model is statistically analyzed, the call impact surface expansion rate is calculated, and a benchmark model of the call impact surface expansion rate for each API is constructed based on statistical data from the historical normal business operation phase. The real-time calculated call impact surface inflation rate is compared with the call impact surface inflation rate benchmark model to identify abnormal inflation behavior that deviates from the normal range. The risk of the abnormal inflation behavior is quantified by combining the diffusion level depth of the call impact surface model to obtain the abnormal inflation API call set. Starting with the API calls in the abnormally bloated API call set, trace the associated downstream APIs and business objects along the diffusion path of the call impact model to construct a cross-API implicit risk propagation link; The risk level is determined based on the length, scope of impact, and expansion rate characteristics of the cross-API implicit risk propagation link, and differentiated protection strategy recommendations are generated based on the risk level.

[0010] As a preferred embodiment of the implicit risk link identification method based on API call influence surface expansion rate described in this invention, wherein: the construction of the call influence surface model includes: Analyze the service dependency topology diagram and database entity relationship diagram in the business resource information; Using the entry API of a single call as the root node, the downstream service objects that are directly called are obtained by traversing the service dependency topology graph through depth-first search, and the data objects that are directly manipulated are obtained by traversing the database entity relationship graph through field lineage analysis. For each acquired downstream service object, the depth-first search traversal is continued in the service dependency topology graph, starting from the downstream service object as a new starting point, until the preset maximum call depth is reached and until a leaf node with no outgoing degree is encountered. The traversal stops when either condition is met, and all nodes on the traversal path are marked as indirectly affected objects. The root node, the downstream service objects directly called, the data objects directly operated on, and the indirectly affected objects are structurally encapsulated according to the order of the calls and the dependency hierarchy, generating a directed acyclic graph with hierarchical labels as the call influence surface model.

[0011] As a preferred embodiment of the implicit risk link identification method based on API call influence surface expansion rate described in this invention, wherein: the calculation of the call influence surface expansion rate includes: The continuous time window is divided into multiple sub-time slices of equal length, and the number of newly added unique object identifiers in the call influence surface model within each sub-time slice is counted to form time series data. Perform a first-order difference operation on the time series data to obtain the absolute value of the object increment between adjacent sub-time slices; Construct a weight sequence that monotonically decreases as the sub-time slice index increases, and assign the weight values ​​in the weight sequence to the absolute values ​​of the object increments in the corresponding time order in the object increment absolute value sequence, and calculate the weighted average object increment per unit time. The ratio of the weighted average increment of objects per unit time to the baseline size of the call influence surface model in the initial time slice is defined as the call influence surface inflation rate.

[0012] As a preferred embodiment of the implicit risk link identification method based on API call impact surface expansion rate described in this invention, the step of constructing a benchmark model for the call impact surface expansion rate corresponding to each API includes: Historical call log data from the same time period and the same business scenario during the normal business operation phase were selected as the training sample set. For each sample in the training sample set, calculate the historical call influence surface inflation rate and remove outlier data that exceed three standard deviations. The kernel density estimation algorithm is used to fit the expansion rate distribution of the historical call influence surface after outlier removal, generating a probability density function curve; The upper and lower limits of the interval where the cumulative probability in the probability density function curve reaches the preset confidence threshold are set as the dynamic upper and lower limits of the reference model for the calling influence surface expansion rate, respectively, forming a reference interval band that changes with time.

[0013] The beneficial effect of this preferred technical solution is that by selecting historical data from the same scene and removing outliers by three times the standard deviation, and using kernel density estimation to fit the true distribution to generate dynamic confidence intervals, the adaptability and accuracy of abnormal expansion behavior recognition are significantly improved.

[0014] As a preferred embodiment of the implicit risk link identification method based on API call influence surface expansion rate described in this invention, the step of quantifying the risk of the abnormal expansion behavior by combining the diffusion level depth of the call influence surface model includes: Extract the specific level number of the surge in the number of objects in the call impact surface model corresponding to the abnormal expansion behavior; The ratio of the level number of the surge level to the maximum depth of the model is used to obtain the level depth coefficient; The expansion deviation coefficient is obtained by calculating the proportion by which the real-time calculation of the call influence surface expansion rate exceeds the dynamic upper bound of the call influence surface expansion rate benchmark model. A risk quantification formula is constructed, and the hierarchical depth coefficient and the expansion deviation coefficient are nonlinearly weighted and multiplied. The calculation result is then mapped to a preset risk score range to obtain the risk score of each call in the abnormal expansion API call set.

[0015] The beneficial effect of this preferred technical solution is that by integrating the hierarchical depth coefficient representing the location of risk penetration and the expansion deviation coefficient representing the severity of abnormality and performing nonlinear weighting, a leap in risk quantification from exceeding a single indicator limit to multidimensional coupling of depth and amplitude is achieved, which significantly improves the distinguishability of risk scoring and the accuracy of early warning.

[0016] As a preferred embodiment of the implicit risk link identification method based on API call impact surface expansion rate described in this invention, the step of tracing the associated downstream APIs and business objects along the diffusion path of the call impact surface model to construct a cross-API implicit risk propagation link includes: Select the target API call with the highest risk score from the abnormally bloated API call set as the seed node; In the call impact surface model, locate the seed node and identify the set of key propagation hub objects among all direct and indirect downstream nodes pointed to by the seed node, wherein the set of key propagation hub objects is an object that is jointly triggered by multiple different abnormal expansion API calls. Using the set of key propagation hub objects as the connection hub, trace back the upstream abnormal API calls that triggered the connection hub, and trace forward the subsequent abnormal API calls caused by the connection hub. All traceable upstream abnormal API calls, seed nodes, downstream abnormal API calls, and the key propagation hub object set serving as the hub are concatenated in timestamp order and call dependencies to generate a tree-like topology structure containing multi-branch concurrent propagation characteristics as the cross-API implicit risk propagation link.

[0017] As a preferred embodiment of the implicit risk link identification method based on API call impact surface expansion rate described in this invention, wherein: the generation of differentiated protection strategy suggestions based on the risk level includes: If the determined risk level is low, a policy recommendation is generated to only record detailed audit logs and mark suspicious sessions. If the determined risk level is medium risk, then a strategy recommendation is generated to implement dynamic token bucket rate limiting on the starting API in the cross-API implicit risk propagation link and to implement asynchronous delayed response on the intermediate nodes of the link. If the determined risk level is high risk, a strategy recommendation is generated to immediately block all API interface calls involving abnormal expansion behavior in the cross-API implicit risk propagation chain, and to trigger read-only locking and rollback operations for the affected data objects. The generated policy recommendations are encapsulated into an executable set of configuration instructions and pushed to security protection devices, including gateway controllers and firewall devices.

[0018] Secondly, this invention provides a system for identifying hidden risk links based on the API call impact surface expansion rate, comprising: The impact surface modeling module is invoked to parse API call logs and business resource information, identify the data objects, service objects, and business status objects actually triggered by a single call in the business system, and construct a call impact surface model. The expansion rate benchmark construction module is used to statistically analyze the scale changes of the call impact surface model within a continuous time window, calculate the call impact surface expansion rate, and construct the call impact surface expansion rate benchmark model for each API based on statistical data from the historical normal business operation phase. An anomaly detection and quantification module is used to compare the real-time calculated call impact surface expansion rate with the call impact surface expansion rate benchmark model, identify abnormal expansion behavior that deviates from the normal range, and combine the diffusion level depth of the call impact surface model to quantify the risk of the abnormal expansion behavior, thereby obtaining an abnormal expansion API call set. The risk propagation link construction module is used to trace the associated downstream APIs and business objects along the diffusion path of the call impact surface model, starting from the API calls in the abnormally expanded API call set, and construct a cross-API implicit risk propagation link. The hierarchical decision-making and strategy generation module is used to determine the risk level based on the length, scope of influence, and expansion rate characteristics of the cross-API implicit risk propagation link, and generate differentiated protection strategy recommendations based on the risk level.

[0019] Thirdly, the present invention provides an electronic device, comprising: Memory, used to store programs; A processor for executing the computer-executable instructions, which, when executed by the processor, implement the steps of the method for identifying latent risk links based on API call influence surface expansion rate.

[0020] Fourthly, the present invention provides a computer-readable storage medium, comprising: when the program is executed by a processor, implementing the method for identifying implicit risk links based on API call influence surface expansion rate.

[0021] The beneficial effects of this invention are as follows: This invention uses the API call impact surface expansion rate as the core risk perception indicator. By continuously modeling the scope and diffusion speed of the impact caused by API calls in the business system, it can identify potential risks arising from abnormal expansion of the impact surface even when the call behavior itself appears normal. By constructing the API call impact surface and performing hierarchical diffusion analysis, the risk analysis object is expanded from a single interface or a single call path to the overall impact scope covering multiple API interfaces and business objects. A benchmark model of the API call impact surface expansion rate is built during normal business operations to characterize the changing patterns of the impact scope of different APIs under normal circumstances, and this serves as the basis for anomaly judgment. By linking the risk identification results with governance strategies, the performance loss caused by uniformly hardening all interfaces can be effectively avoided, significantly improving the accuracy of risk handling and overall governance efficiency. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a basic flowchart illustrating a method for identifying hidden risk links based on the expansion rate of the influence surface of API calls, provided as an embodiment of the present invention. Detailed Implementation

[0023] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0024] Example 1, referring to Figure 1 As an embodiment of the present invention, a method for identifying implicit risk links based on the API call impact surface expansion rate is provided, comprising: S100: Parse API call logs and business resource information, identify the data objects, service objects and business status objects actually triggered in the business system by a single call, and build a call impact model; S200: Statistically analyze the scale changes of the call impact surface model within a continuous time window, calculate the call impact surface expansion rate, and construct a benchmark model of the call impact surface expansion rate for each API based on statistical data from historical normal business operation phases. S300: Compare the real-time calculated call impact surface inflation rate with the call impact surface inflation rate benchmark model to identify abnormal inflation behavior that deviates from the normal range, and combine the diffusion level depth of the call impact surface model to quantify the risk of abnormal inflation behavior and obtain the abnormal inflation API call set. S400: Starting with API calls in the abnormally bloated API call set, trace the associated downstream APIs and business objects along the diffusion path of the call impact model to build a cross-API implicit risk propagation link; S500: Determines the risk level based on the length, scope of impact, and expansion rate characteristics of the cross-API implicit risk propagation chain, and generates differentiated protection strategy recommendations based on the risk level.

[0025] It should be noted that existing technologies face a series of challenges during operation, including difficulty in identifying hidden risks where seemingly normal call behavior has an abnormally widening impact; high false positive and false negative rates due to the inability to adapt to cyclical business fluctuations caused by the use of fixed thresholds or simple statistical rules; lack of multi-dimensional coupling and quantification capabilities for the depth and magnitude of risk diffusion, making it impossible to accurately distinguish between shallow normal fluctuations and deep high-risk penetration; and the lack of an automatic construction and tracing mechanism for cross-API hidden risk propagation links, making it difficult to quantify the potential energy of risk propagation and implement differentiated blocking strategies.

[0026] Therefore, addressing the aforementioned issues where existing technologies lack a systematic characterization of the dynamic changes and diffusion characteristics of the impact scope triggered by API calls, making it difficult to identify hidden risk chains arising from abnormal expansion of the impact surface, and failing to support accurate identification and tiered protection against cross-API risk propagation, this solution utilizes steps S100-S500. By continuously modeling the scope of affected objects, downstream call levels, and diffusion speed during API calls, a benchmark model reflecting the changing patterns of the call impact surface under normal business operation is constructed. Based on the deviation between real-time call behavior and the benchmark model, abnormal expansion of the impact surface is identified, thereby automatically identifying potential hidden risk propagation chains. This solution can achieve high-precision identification of hidden API risks with long-term stability, even in the absence of clear anomaly samples and attack priors, providing more accurate and interpretable API risk governance support for complex business systems.

[0027] Example 2, this is an embodiment of the present invention, which provides a method for identifying implicit risk links based on the API call impact surface expansion rate, based on the previous embodiment, including: In this embodiment of the application, step S100 involves parsing API call logs and business resource information to identify the data objects, service objects, and business status objects actually triggered in the business system for a single call, and constructing a call impact model, specifically including: Obtain multi-source input data, including: API definition set Each of them It should at least include the interface path, request method, service name, and function description; API call log dataset. Each call record It includes the call time, caller, called interface and return status; as well as business system resource description information, including but not limited to data table structure, business object definition, service dependency relationship or configuration metadata.

[0028] Based on the above input data, analyze the set of objects that each call actually affects in the business system. For any API call record... Define its affected object set as Each of them This represents a business object directly or indirectly affected by the API call. Affected objects are specifically categorized into three types: data objects (such as data records being read, written, or updated), service objects (such as downstream services or functional modules being triggered), and business status objects (such as status nodes or transaction phases in a business process). The system automatically identifies and classifies affected objects by analyzing call results, downstream call relationships, and resource access logs, ultimately generating a set of mapping relationships between API calls and affected objects. And a basic description table of the affected objects, which serves as the basic input for subsequent modeling.

[0029] Based on the set of mapping relationships Deep modeling is performed by combining the service dependency topology graph and the database entity relationship graph: taking the entry API of a single call as the root node, the downstream service objects that are directly called are obtained by traversing the service dependency topology graph through depth-first search, and the data objects that are directly manipulated are obtained by traversing the database entity relationship graph through field lineage analysis. For each downstream service object obtained, the downstream service object is used as a new starting point to continue performing a depth-first search traversal in the service dependency topology graph until the preset maximum call depth is reached and until a leaf node with no outgoing degree is encountered. The traversal stops when either condition is met, and all nodes on the traversal path are marked as indirectly affected objects. The maximum call depth is preferably set to 3 to 5 layers.

[0030] The root node, directly invoked downstream service objects, directly manipulated data objects, and indirectly affected objects are structurally encapsulated according to the order of invocation and dependency hierarchy, generating a directed acyclic graph with hierarchical labels as the invocation influence surface model.

[0031] In this embodiment of the application, an influence surface model is defined. The union of the objects affected at each level, i.e. ,in This indicates that it directly affects the collection of objects. Indicates passage The set of objects indirectly affected by layer calls or business relationships. This represents the maximum depth of the diffusion layer; simultaneously, the system statistically analyzes the distribution of the number of affected objects at different diffusion layers, denoted as... This is used to reflect the scale changes of the call's impact at different diffusion depths, thereby completing the construction of the call's impact surface and hierarchical diffusion analysis.

[0032] In this embodiment of the application, step S200, calculating the expansion rate of the affected surface, includes: For API call sequences within a continuous time window Define the call to affect the surface expansion rate This represents the rate of change of the difference between the size of the impact area of ​​the current call and the size of the impact area of ​​the previous call relative to the time interval. The specific mathematical expression is as follows: in, The time interval between adjacent calls. Indicates a call The corresponding influence surface model is invoked. Based on the above definition, the specific calculation process includes: The continuous time window is divided into multiple sub-time slices of equal length. The number of unique object identifiers added in the influence surface model within each sub-time slice is counted to form time series data. Perform a first-order difference operation on the time series data to obtain the absolute value of the object increment between adjacent sub-time slices; Construct a weight sequence that monotonically decreases as the sub-time slice index increases, assign the weight values ​​in the weight sequence to the absolute values ​​of the object increments in the corresponding time order in the object increment absolute value sequence, and calculate the weighted average object increment per unit time. The ratio of the weighted average increment of objects per unit time to the baseline size of the call influence surface model in the initial time slice is defined as the call influence surface inflation rate.

[0033] In this embodiment of the application, step S200, which involves constructing a benchmark model for the influencing surface expansion rate of each API, includes: Historical call log data from the same time period and the same business scenario during the normal business operation phase were selected as the training sample set. For each sample in the training sample set, calculate the historical call influence surface inflation rate and remove outlier data that exceed three standard deviations. The kernel density estimation algorithm is used to fit the expansion rate distribution of the historical call influence surface after outlier removal, generating a probability density function curve; The upper and lower limits of the interval where the cumulative probability in the probability density function curve reaches a preset confidence threshold are set as the dynamic upper and lower limits of the baseline model for invoking the surface expansion rate, respectively, forming a benchmark interval band that changes over time. This preset confidence threshold is preferably set to 95%.

[0034] In this embodiment of the application, step S300, which combines the diffusion level depth of the influence surface model to quantify the risk of abnormal expansion behavior, includes: The system will calculate the expansion rate of the call-affected area in real time. The deviation is calculated by comparing it with the baseline inflation rate distribution of the corresponding API, using the following formula: in, API Average expansion rate level under normal operating conditions; When deviation When the threshold is exceeded or significantly higher than the historical normal range, the system determines that the call has an abnormally large impact risk; the preset threshold is set according to the 3σ principle in statistics.

[0035] Extract the specific level number of the surge in the number of objects in the call impact surface model corresponding to the abnormal expansion behavior; The ratio of the level number of the surge level to the maximum depth of the model is used to obtain the level depth coefficient; The expansion deviation coefficient is obtained by calculating the proportion by which the real-time calculation of the call influence surface expansion rate exceeds the dynamic upper bound of the call influence surface expansion rate benchmark model. The system defines and calls a risk scoring function to calculate a weighted average of the impact area size, expansion rate, and diffusion depth, as shown in the following formula: in, Indicates the overall scale of the impact of the call. Indicates the rate of surface expansion. Indicates the maximum layer depth of the influence diffusion; , , These are the weighting coefficients; The system maps the calculation results to a preset risk score range to obtain a risk score for each call in the abnormally bloated API call set.

[0036] In an optional implementation, the construction of the call influence surface expansion rate benchmark model in step S300 can also utilize a time series prediction model to train the historical call influence surface expansion rate sequence, predict the expected value of the current time window and its confidence interval based on historical data, and set the confidence interval as the dynamic upper and lower bounds of the call influence surface expansion rate benchmark model.

[0037] In an optional implementation, the call impact surface inflation rate benchmark model constructed in step S300 can also collect call impact surface inflation rate data from historical normal business phases as a training sample set, use the Isolation Forest algorithm to construct an unsupervised anomaly detection model, obtain an anomaly score by calculating the average path length of the isolation tree constructed in the model based on the real-time inflation rate data, and determine whether the real-time behavior deviates from the normal benchmark based on the score.

[0038] In an optional implementation, step S300 can also be used to calculate the call risk score by systematically constructing a hierarchical model that includes the scale of the impact area, the expansion rate, and the diffusion depth, constructing a judgment matrix through expert scoring and performing consistency checks, calculating the objective weight coefficients of each indicator, and then using a weighted summation formula to calculate the call risk score.

[0039] In an optional implementation, step S300 can also be used to calculate the call risk score by systematically constructing a set of factors and a set of risk level comments that include the scale of influence, expansion rate and diffusion depth. The membership function is used to convert the precise values ​​of each indicator into a fuzzy evaluation matrix, and fuzzy synthesis and defuzzification are performed in combination with the indicator weights to obtain the final call risk score.

[0040] In this embodiment of the application, step S400 traces the associated downstream APIs and business objects along the diffusion path of the call impact surface model to construct a cross-API implicit risk propagation link, including: Select the target API call with the highest risk score from the abnormally bloated API call set as the seed node; In the call impact surface model, locate the seed node and identify the set of key propagation hub objects in all direct downstream nodes and indirect downstream nodes pointed to by the seed node, wherein the set of key propagation hub objects is the object that is jointly triggered by multiple different abnormal expansion API calls. The system starts with abnormally swelling API call nodes, traces and expands along the direction of the call impact, identifies downstream APIs and business objects that are continuously triggered during the impact spread, and defines the hidden risk propagation chain as follows: in, The initial API represents the abnormal expansion, and subsequent APIs represent the interface nodes through which the risk propagates in the impact plane of the call. The system constructs a directed risk propagation graph by analyzing the mapping relationship between objects at different levels of influence and API calls. Among them, the node set This represents the API interface and the edge set. This indicates the propagation relationship of risk across the scope of its impact. All upstream abnormal API calls, seed nodes, downstream abnormal API calls, and key propagation hub objects that serve as hubs are traced and linked together according to timestamp order and call dependencies to generate a tree-like topology structure containing multi-branch concurrent propagation characteristics as a cross-API implicit risk propagation link.

[0041] In an alternative implementation, the construction of the call impact surface model in step S400 can also be achieved by embedding probes in the business system and using end-to-end tracing technology to capture and record traffic data containing call chain identifiers and span information in real time when an API call occurs, and extracting the downstream services and data objects that are actually triggered to construct the call impact surface model.

[0042] In an optional implementation, the construction of the call impact surface model in step S400 can also be carried out during the application deployment or compilation phase by using static code analysis tools to scan the source code or bytecode, and by parsing the function call instructions, RPC annotations and SQL statements in the code, to pre-build a static dependency graph containing method-level call relationships, and thereby identify the direct and indirect affected objects corresponding to a single call.

[0043] In an optional implementation, the construction of the cross-API implicit risk propagation link in step S400 can also map APIs, business objects and call relationships to nodes and edges in a graph database. Starting with abnormally bloated API calls, the propagation path with N degrees of association is retrieved using a graph query language execution path search algorithm, thereby automatically constructing the cross-API implicit risk propagation link.

[0044] In an optional implementation, the construction of the cross-API implicit risk propagation link in step S400 can also be based on the time series data of each node in the abnormally expanding API call set, using a causal inference algorithm to calculate the causal effect value between different API abnormal behaviors, retaining only the causal association edges with statistical significance, thereby constructing a cross-API implicit risk propagation link that reflects the real risk transmission path.

[0045] In this embodiment of the application, step S500, which generates differentiated protection strategy recommendations based on risk levels, includes: The system classifies risks based on the length, scope of impact, and rate of expansion of hidden risk links, and generates corresponding risk description information and visual descriptions, as well as risk assessment reports for subsequent governance decisions. If the determined risk level is low, a policy recommendation is generated to only record detailed audit logs and mark suspicious sessions. If the determined risk level is medium risk, then a strategy recommendation is generated to implement dynamic token bucket rate limiting for the starting API in the cross-API implicit risk propagation chain and to implement asynchronous delayed response for the intermediate nodes in the chain. If the risk level is determined to be high risk, then generate a strategy to immediately block all API calls involving abnormal expansion behavior in the cross-API hidden risk propagation chain, implement key audits or access controls on the API interfaces involved in the high-risk chain, strengthen policies or enhance permission verification for the interfaces of key risk propagation nodes, and trigger strategy recommendations for read-only locking and rollback operations for the affected data objects. The generated policy recommendations are packaged into an executable set of configuration instructions and pushed to security protection devices, including gateway controllers and firewall devices.

[0046] Example 3 is an embodiment of the present invention. This embodiment differs from the first embodiment in that it provides a hidden risk link identification system based on the API call influence surface expansion rate.

[0047] It should be noted that the technical solution of the implicit risk link identification system based on the API call influence surface expansion rate is the same concept as the technical solution of the implicit risk link identification method based on the API call influence surface expansion rate described above. For details not described in detail in the technical solution of the implicit risk link identification system based on the API call influence surface expansion rate in this embodiment, please refer to the description of the technical solution of the implicit risk link identification method based on the API call influence surface expansion rate described above.

[0048] This embodiment presents a hidden risk link identification system based on API call impact surface expansion rate, comprising: The impact surface modeling module is invoked to parse API call logs and business resource information, identify the data objects, service objects, and business status objects actually triggered by a single call in the business system, and construct a call impact surface model. The expansion rate benchmark construction module is used to statistically analyze the scale changes of the call impact surface model within a continuous time window, calculate the call impact surface expansion rate, and construct the call impact surface expansion rate benchmark model for each API based on statistical data from historical normal business operation phases. The anomaly detection and quantification module is used to compare the real-time calculated call impact surface expansion rate with the call impact surface expansion rate benchmark model, identify abnormal expansion behavior that deviates from the normal range, and combine the diffusion level depth of the call impact surface model to quantify the risk of abnormal expansion behavior, and obtain the abnormal expansion API call set. The risk propagation link construction module is used to trace the associated downstream APIs and business objects along the diffusion path of the call impact model, starting from the API calls in the abnormally expanding API call set, and to build a cross-API implicit risk propagation link. The hierarchical decision-making and strategy generation module is used to determine the risk level based on the length, scope of impact, and expansion rate characteristics of the cross-API implicit risk propagation chain, and generate differentiated protection strategy recommendations based on the risk level.

[0049] This embodiment also provides an electronic device applicable to a method for identifying implicit risk links based on API call influence surface expansion rate, including: The system includes a memory and a processor. The memory stores computer-executable instructions, and the processor executes these instructions to implement a method for identifying implicit risk links based on the API call influence surface expansion rate, as proposed in the above embodiments.

[0050] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements a method for identifying implicit risk links based on the influence surface expansion rate of API calls, as proposed in the above embodiments.

[0051] The storage medium proposed in this embodiment and the method for identifying implicit risk links based on the expansion rate of the influence surface of API calls proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0052] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0053] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for identifying hidden risk links based on the expansion rate of the impact surface of API calls, characterized in that, include: Analyze API call logs and business resource information to identify the data objects, service objects, and business status objects that are actually triggered in the business system for a single call, and build a call impact model. Within a continuous time window, the scale change of the call impact surface model is statistically analyzed, the call impact surface expansion rate is calculated, and a benchmark model of the call impact surface expansion rate for each API is constructed based on statistical data from the historical normal business operation phase. The real-time calculated call impact surface inflation rate is compared with the call impact surface inflation rate benchmark model to identify abnormal inflation behavior that deviates from the normal range. The risk of the abnormal inflation behavior is quantified by combining the diffusion level depth of the call impact surface model to obtain the abnormal inflation API call set. Starting with the API calls in the abnormally bloated API call set, trace the associated downstream APIs and business objects along the diffusion path of the call impact surface model to construct a cross-API implicit risk propagation link; The risk level is determined based on the length, scope of impact, and expansion rate characteristics of the cross-API implicit risk propagation link, and differentiated protection strategy recommendations are generated based on the risk level.

2. The method for identifying implicit risk links based on the API call impact surface expansion rate as described in claim 1, characterized in that: The construction of the influence surface model includes: Analyze the service dependency topology diagram and database entity relationship diagram in the business resource information; Using the entry API of a single call as the root node, the downstream service objects that are directly called are obtained by traversing the service dependency topology graph through depth-first search, and the data objects that are directly manipulated are obtained by traversing the database entity relationship graph through field lineage analysis. For each acquired downstream service object, the depth-first search traversal is continued in the service dependency topology graph, starting from the downstream service object as a new starting point, until the preset maximum call depth is reached and until a leaf node with no outgoing degree is encountered. The traversal stops when either condition is met, and all nodes on the traversal path are marked as indirectly affected objects. The root node, the downstream service objects directly called, the data objects directly operated on, and the indirectly affected objects are structurally encapsulated according to the order of the calls and the dependency hierarchy, generating a directed acyclic graph with hierarchical labels as the call influence surface model.

3. The method for identifying implicit risk links based on the API call impact surface expansion rate as described in claim 1 or 2, characterized in that: The calculation of the surface expansion rate includes: The continuous time window is divided into multiple sub-time slices of equal length, and the number of newly added unique object identifiers in the call influence surface model within each sub-time slice is counted to form time series data. Perform a first-order difference operation on the time series data to obtain the absolute value of the object increment between adjacent sub-time slices; Construct a weight sequence that monotonically decreases as the sub-time slice index increases, and assign the weight values ​​in the weight sequence to the absolute values ​​of the object increments in the corresponding time order in the object increment absolute value sequence, and calculate the weighted average object increment per unit time. The ratio of the weighted average increment of objects per unit time to the baseline size of the call influence surface model in the initial time slice is defined as the call influence surface inflation rate.

4. The method for identifying implicit risk links based on the API call impact surface expansion rate as described in claim 3, characterized in that: The construction of the call impact surface expansion rate benchmark model for each API includes: Historical call log data from the same time period and the same business scenario during the normal business operation phase were selected as the training sample set. For each sample in the training sample set, calculate the historical call influence surface inflation rate and remove outlier data that exceed three standard deviations. The kernel density estimation algorithm is used to fit the expansion rate distribution of the historical call influence surface after outlier removal, generating a probability density function curve; The upper and lower limits of the interval where the cumulative probability in the probability density function curve reaches the preset confidence threshold are set as the dynamic upper and lower limits of the reference model for the calling influence surface expansion rate, respectively, forming a reference interval band that changes with time.

5. The method for identifying implicit risk links based on the API call impact surface expansion rate as described in claim 4, characterized in that: The risk quantification of the abnormal expansion behavior by combining the diffusion level depth of the called influence surface model includes: Extract the specific level number of the surge in the number of objects in the call impact surface model corresponding to the abnormal expansion behavior; The ratio of the level number of the surge level to the maximum depth of the model is used to obtain the level depth coefficient; The expansion deviation coefficient is obtained by calculating the proportion by which the real-time calculation of the call influence surface expansion rate exceeds the dynamic upper bound of the call influence surface expansion rate benchmark model. A risk quantification formula is constructed, and the hierarchical depth coefficient and the expansion deviation coefficient are nonlinearly weighted and multiplied. The calculation result is then mapped to a preset risk score range to obtain the risk score of each call in the abnormal expansion API call set.

6. The method for identifying implicit risk links based on the API call impact surface expansion rate as described in claim 5, characterized in that: The process of tracing downstream APIs and business objects along the diffusion path of the call impact model to construct a cross-API implicit risk propagation link includes: Select the target API call with the highest risk score from the abnormally bloated API call set as the seed node; In the call impact surface model, locate the seed node and identify the set of key propagation hub objects among all direct and indirect downstream nodes pointed to by the seed node, wherein the set of key propagation hub objects is an object that is jointly triggered by multiple different abnormal expansion API calls. Using the set of key propagation hub objects as the connection hub, trace back the upstream abnormal API calls that triggered the connection hub, and trace forward the subsequent abnormal API calls caused by the connection hub. All traceable upstream abnormal API calls, seed nodes, downstream abnormal API calls, and the key propagation hub object set serving as the hub are concatenated in timestamp order and call dependencies to generate a tree-like topology structure containing multi-branch concurrent propagation characteristics as the cross-API implicit risk propagation link.

7. The method for identifying implicit risk links based on the API call impact surface expansion rate as described in claim 6, characterized in that: The generation of differentiated protection strategy recommendations based on the risk level includes: In response to the determined risk level being low, a policy recommendation is generated to only log detailed audit logs and mark suspicious sessions; In response to the determined risk level being medium risk, a strategy recommendation is generated to implement dynamic token bucket rate limiting on the starting API in the cross-API implicit risk propagation link and to implement asynchronous delayed response on the intermediate nodes of the link. In response to the determined risk level being high risk, a strategy recommendation is generated to immediately block all API interface calls involving abnormal expansion behavior in the cross-API implicit risk propagation chain, and to trigger read-only locking and rollback operations for the affected data objects. The generated policy recommendations are encapsulated into an executable set of configuration instructions and pushed to security protection devices, including gateway controllers and firewall devices.

8. A system for identifying hidden risk links based on the API call impact surface expansion rate, using the method described in any one of claims 1-7, characterized in that, include: The impact surface modeling module is invoked to parse API call logs and business resource information, identify the data objects, service objects, and business status objects actually triggered by a single call in the business system, and construct a call impact surface model. The expansion rate benchmark construction module is used to statistically analyze the scale changes of the call impact surface model within a continuous time window, calculate the call impact surface expansion rate, and construct the call impact surface expansion rate benchmark model for each API based on statistical data from the historical normal business operation phase. An anomaly detection and quantification module is used to compare the real-time calculated call impact surface expansion rate with the call impact surface expansion rate benchmark model, identify abnormal expansion behavior that deviates from the normal range, and combine the diffusion level depth of the call impact surface model to quantify the risk of the abnormal expansion behavior, thereby obtaining an abnormal expansion API call set. The risk propagation link construction module is used to trace the associated downstream APIs and business objects along the diffusion path of the call impact surface model, starting from the API calls in the abnormally expanded API call set, and to construct a cross-API implicit risk propagation link. The hierarchical decision-making and strategy generation module is used to determine the risk level based on the length, scope of influence, and expansion rate characteristics of the cross-API implicit risk propagation link, and generate differentiated protection strategy recommendations based on the risk level.

9. An electronic device, characterized in that, include: Memory, used to store programs; A processor for loading the program to perform the steps of the method as claimed in any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that, When the program is executed by a processor, it implements the steps of the method as described in any one of claims 1-7.

Images