Method, device, equipment, medium and program product for generating interface access log

Abstract

The application provides a method, device, equipment, medium and program product for generating an interface access log. In the method, after receiving a log creation request, the request uniform resource locator in the log creation request is parsed to obtain an application name and an interface path of a target interface; then, the interface configuration of the target interface is obtained from a configuration library according to the application name and the interface path; finally, the interface access log is generated according to the application name, the interface path, the interface configuration and the log creation request. According to the method, the interface configuration is obtained from the configuration library, and then the interface access log is generated in combination with the log creation request, so that the log generation efficiency is improved without manual participation.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device, medium, and program product for generating interface access logs. Background Technology

[0002] In business systems such as multi-tenant platforms, account permission systems, and enterprise operation platforms, after a user accesses an interface, it is necessary to generate auditable, traceable, and searchable access interface logs for the access behavior so that it can be queried in case of anomalies.

[0003] In existing technologies, the typical method for generating interface access logs is that when a user accesses the interface, the gateway obtains some information, and then staff supplement other information to generate the interface access log.

[0004] In summary, existing methods for accessing interface access logs require a combination of gateway and manual intervention, resulting in low generation efficiency. Summary of the Invention

[0005] The interface access log generation method, apparatus, device, medium, and program products provided in this application are intended to solve the problem that existing interface access log generation methods require a combination of gateway and manual intervention, resulting in low generation efficiency.

[0006] In a first aspect, embodiments of this application provide a method for generating interface access logs, including:

[0007] Receive log creation requests generated after a user accesses the target interface;

[0008] The request Uniform Resource Locator (URL) in the log creation request is parsed to obtain the application name and the interface path of the target interface;

[0009] Based on the application name and the interface path, obtain the interface configuration of the target interface from the configuration library, wherein the application name and interface path are different in different interface configurations in the configuration library;

[0010] An interface access log is generated based on the application name, the interface path, the interface configuration, and the log creation request.

[0011] In one possible implementation, the log creation request further includes a user identifier, interface request parameters, and interface response results;

[0012] The interface configuration also includes the collection mode, target sensitive field name, and desensitization rules for each target sensitive field name;

[0013] The step of generating interface access logs based on the application name, the interface path, the interface configuration, and the log creation request includes:

[0014] Based on the user identifier, retrieve the corresponding user data from the user database;

[0015] According to the acquisition mode, obtain the interface operation results and the number of operation data entries;

[0016] Based on each target sensitive field name and the corresponding desensitization rule, the interface request parameters and the interface response results are desensitized to obtain the interface sensitive field name, request parameter summary and response result summary.

[0017] An interface access log is generated based on the application name, the interface path, the user data, the interface operation result, the number of operation data entries, the interface sensitive field name, the request parameter summary, the response result summary, and the interface configuration.

[0018] In one possible implementation, obtaining the interface operation result and the number of operation data entries according to the acquisition mode includes:

[0019] If the collection mode is automatic collection, then the interface operation results and the number of operation data entries are collected;

[0020] If the collection mode is push collection, then the interface operation results and the number of access operations are received.

[0021] In one possible implementation, the step of performing sensitive field desensitization processing on the interface request parameters and the interface response result according to each target sensitive field name and the corresponding desensitization rule, to obtain the interface sensitive field name, request parameter digest, and response result digest, includes:

[0022] For each target sensitive field name, if the interface request parameters or interface response result include the target sensitive field name, then the target sensitive field name shall be used as the interface sensitive field name;

[0023] For each sensitive field name in the interface request parameters, the field value corresponding to the sensitive field name is desensitized according to the desensitization rule corresponding to the sensitive field name to obtain the request parameter summary;

[0024] For each sensitive field name in the interface response result, the field value corresponding to the sensitive field name is desensitized according to the desensitization rule corresponding to the sensitive field name to obtain the response result summary.

[0025] In one possible implementation, the method further includes:

[0026] If the space occupied by the request parameter digest is greater than the preset capacity threshold, the request parameter digest will be truncated to obtain an updated request parameter digest.

[0027] If the space occupied by the response result summary is greater than the preset capacity threshold, the response result summary is truncated to obtain an updated response result summary.

[0028] In one possible implementation, the method further includes:

[0029] Save the interface access log and obtain the saving result. The saving result includes a saving identifier indicating successful saving, or a saving identifier indicating failed saving and the reason for failure.

[0030] If the save flag indicates that saving has failed, and the reason for the failure is that the space occupied has exceeded the limit, then the interface access log will be truncated and saved.

[0031] If the save flag indicates that saving has failed, and the reason for the failure is not due to exceeding the space limit, then the interface access log will be saved again.

[0032] In one possible implementation, before receiving the log creation request generated after the user accesses the target interface, the method further includes:

[0033] Obtain the metadata of the target interface, which includes a sensitive field thesaurus, historical sensitive field names, request field names, response field names, and field sample values;

[0034] Based on the sensitive field thesaurus, each historical sensitive field name, each request field name, each response field name, and each field sample value, determine the target sensitive field name and generate a sensitivity score for the target interface;

[0035] If the sensitivity score is greater than a preset score threshold, then the interface configuration of the target interface is generated based on each target sensitive field name and the metadata;

[0036] The interface configuration is stored in the configuration library.

[0037] In one possible implementation, determining the target sensitive field name and generating a sensitivity score for the target interface based on the sensitive field thesaurus, each historical sensitive field name, each request field name, each response field name, and each field sample value includes:

[0038] Calculate the semantic similarity between each requested field name and each historically sensitive field name;

[0039] Calculate the semantic similarity between each requested field name and each standard sensitive field name in the sensitive field thesaurus;

[0040] Calculate the semantic similarity between each response field name and each historical sensitive field name;

[0041] Calculate the semantic similarity between each response field name and each standard sensitive field name;

[0042] For each requested field name, if the semantic similarity between the requested field name and each historical sensitive field name is greater than a preset similarity threshold, or if the semantic similarity between the requested field name and each standard sensitive field name is greater than a preset similarity threshold, then the requested field name is taken as the target sensitive field name.

[0043] For each response field name, if the semantic similarity between the response field name and each historical sensitive field name is greater than a preset similarity threshold, or if the semantic similarity between the response field name and each standard sensitive field name is greater than a preset similarity threshold, then the response field name is taken as the target sensitive field name.

[0044] Determine the sample value for each target sensitive field name from all field sample values;

[0045] The sensitivity score of the target interface is calculated based on each target sensitive field name and the sample value of each target sensitive field name.

[0046] In one possible implementation, calculating the sensitivity score of the target interface based on each target sensitive field name and a sample value for each target sensitive field name includes:

[0047] For each target sensitive field name, the first sub-score corresponding to the target sensitive field name is determined according to the preset correspondence between field names and sub-scores;

[0048] For each target sensitive field name, the second sub-score corresponding to the number of data in the sample value of the target sensitive field name is determined according to the preset correspondence between the number of data and the sub-score;

[0049] The sum of all first sub-scores and all second sub-scores is used as the sensitive score of the target interface.

[0050] In one possible implementation, the metadata further includes: Hypertext Transfer Protocol method, method name, application name, and interface path;

[0051] The step of generating the interface configuration for the target interface based on each target sensitive field name and the metadata includes:

[0052] The sensitive field dictionary, each historical sensitive field name, each request field name, and each response field name are input into the sensitive field detection model to obtain the target sensitive field name. The sensitive field detection model is a pre-trained neural network model that generates the target sensitive field name based on the sensitive field dictionary, historical sensitive field names, request field names, and response field names.

[0053] A collection mode is generated based on each Hypertext Transfer Protocol method, each method name, and the interface path.

[0054] Based on the pre-defined correspondence between field names and desensitization rules, determine the desensitization rule corresponding to each target sensitive field name;

[0055] The interface configuration of the target interface is generated based on the application name, the interface path, the collection mode, the sensitive field name of each target, and the desensitization rule corresponding to each sensitive field name.

[0056] In one possible implementation, before storing the interface configuration in the configuration library, the method further includes:

[0057] Perform integrity verification on the interface configuration and generate a verification result indicating whether the verification passed.

[0058] If the verification result indicates that the verification passed, then the configuration library is deduplicated according to the interface configuration.

[0059] Secondly, embodiments of this application provide an apparatus for generating interface access logs, comprising:

[0060] The receiving module is used to receive log creation requests generated after a user accesses the target interface.

[0061] Processing module, used for:

[0062] The request Uniform Resource Locator (URL) in the log creation request is parsed to obtain the application name and the interface path of the target interface;

[0063] Based on the application name and the interface path, obtain the interface configuration of the target interface from the configuration library, wherein the application name and interface path are different in different interface configurations in the configuration library;

[0064] The log generation module is used to generate interface access logs based on the application name, the interface path, the interface configuration, and the log creation request.

[0065] Thirdly, embodiments of this application provide an electronic device, including:

[0066] Processor, memory, communication interface;

[0067] The memory is used to store the executable instructions of the processor;

[0068] The processor is configured to execute the interface access log generation method described in any of the first aspects by executing the executable instructions.

[0069] Fourthly, embodiments of this application provide a readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method for generating interface access logs as described in any of the first aspects.

[0070] Fifthly, embodiments of this application provide a computer program product, including a computer program, which, when executed by a processor, is used to implement the interface access log generation method described in any of the first aspects.

[0071] The interface access log generation method, apparatus, device, medium, and program product provided in this application embodiment, after receiving a log creation request, parses the Request Uniform Resource Locator (URL) in the log creation request to obtain the application name and the interface path of the target interface; then, based on the application name and interface path, retrieves the interface configuration of the target interface from the configuration library; finally, based on the application name, interface path, interface configuration, and log creation request, generates the interface access log. This solution improves log generation efficiency by retrieving the interface configuration from the configuration library and combining it with the log creation request to generate the interface access log, eliminating the need for manual intervention. Attached Figure Description

[0072] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0073] Figure 1 A flowchart illustrating an embodiment of the method for generating interface access logs provided in this application;

[0074] Figure 2 A flowchart illustrating Embodiment 2 of the method for generating interface access logs provided in this application;

[0075] Figure 3 A flowchart illustrating Embodiment 3 of the method for generating interface access logs provided in this application;

[0076] Figure 4 A flowchart illustrating Embodiment 4 of the method for generating interface access logs provided in this application;

[0077] Figure 5 A schematic diagram of the structure of an embodiment of the interface access log generation device provided in this application;

[0078] Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application.

[0079] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0080] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0081] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0082] Interface access log generation technology is widely used in multi-tenant platforms, enterprise operation systems, and access control systems to record the process of users accessing business interfaces in order to meet the needs of audit tracking, operation monitoring, and compliance management.

[0083] Current solutions typically involve a gateway collecting information such as the request address, request parameters, and response results after a user accesses an interface. Staff then supplement this information or process the gateway-collected data to generate interface access logs. This reliance on a combination of gateway and manual intervention in log generation leads to low log generation efficiency.

[0084] To address the problems existing in the prior art, the inventors, during their research on methods for generating interface access logs, discovered that manual intervention could be eliminated to improve log generation efficiency. After a user accesses the target interface, a log creation request is received. The Request Uniform Resource Locator (URL) in the log creation request is parsed to obtain the application name and the interface path of the target interface. Subsequently, the interface configuration of the target interface is retrieved from the configuration library based on the application name and interface path. The interface access log is then generated by combining the application name, interface path, interface configuration, and log creation request. Based on the above inventive concept, the interface access log generation scheme of this application was designed.

[0085] The execution subject of the interface access log generation method in this application can be a computer, a server, a gateway, etc. This application does not limit it. The following explanation uses a computer as an example.

[0086] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0087] The following provides examples illustrating the application scenarios of the interface access log generation method provided in this application.

[0088] For example, in Figure 1 In the application scenario shown, when the computer detects that a new interface has been launched, it uses that interface as the target interface and obtains the target interface's metadata.

[0089] Then, based on the sensitive field thesaurus, historical sensitive field names, request field names, response field names, and field sample values ​​in the metadata, the target sensitive field names are determined, and a sensitivity score for the target interface is generated.

[0090] When the sensitivity score exceeds the preset score threshold, the interface configuration of the target interface is generated based on the sensitive field name and metadata of each target; the interface configuration is then stored in the configuration library.

[0091] It should be noted that the preset score threshold can be 6, 8, 9, etc. This application embodiment does not limit the preset score threshold, and it can be determined according to the actual situation.

[0092] When a user accesses the target interface to perform a query, the computer receives a log creation request after the user accesses the target interface.

[0093] Then, the Uniform Resource Locator (URL) in the log creation request is parsed to obtain the application name and the interface path of the target interface; based on the application name and interface path, the interface configuration of the target interface is obtained from the configuration library.

[0094] Finally, based on the application name, interface path, interface configuration, and log creation request, interface access logs are generated.

[0095] The computer saves interface access logs for later use in auditing, querying, etc.

[0096] It should be noted that the above is only a schematic diagram of an application scenario provided by the embodiments of this application. The embodiments of this application do not limit the actual form of the various devices included in the scenario. In the specific application of the solution, it can be set according to actual needs.

[0097] The technical solution of this application will now be described in detail through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0098] Figure 1 This is a flowchart illustrating an embodiment of the interface access log generation method provided in this application. This embodiment describes how, after a user accesses a target interface, the computer obtains the interface configuration of the target interface and then generates an interface access log based on the interface configuration and the received log creation request. The method in this embodiment can be implemented through software, hardware, or a combination of both. Figure 1 As shown, the method for generating the interface access log specifically includes the following steps:

[0099] S101: Receives a log creation request generated after a user accesses the target interface.

[0100] In this step, after a user accesses the target interface, in order to generate interface access logs, the device deploying the target interface will generate a log creation request and send it to the computer, which will then receive the log creation request.

[0101] The log creation request includes the basic data corresponding to this interface access. The interface access log is used to record the user's access to the target interface.

[0102] It should be noted that the target interface can be a query interface, add interface, modify interface, delete interface or composite processing interface provided by the business system. This application embodiment does not limit the target interface and can be determined according to the actual situation.

[0103] For example, after a user terminal initiates access to the target interface, the gateway layer generates a unique request identifier for this request while forwarding the request to the corresponding business application, and gathers the data from the request stage and the response stage to form a log creation request when the business processing ends or the response is returned.

[0104] Log creation requests can also be generated by interceptors within the application service. After the target interface call is completed, the interceptor extracts the request address, interface request parameters, and interface response result from the current thread context, converts them into a unified data structure, and then delivers them to a message queue, where the computer asynchronously consumes the log creation requests in the message queue.

[0105] To ensure consistency in subsequent processing, after receiving a log creation request, a structure check can be performed first. The check items include whether the request identifier exists, whether the Uniform Resource Locator is empty, whether the message content meets the preset length limit, and whether the time field format is correct. If the check passes, proceed to the next step; if the check fails, an exception handling record can be generated and the generation of this interface access log can be terminated.

[0106] S102: Parse the request URL in the log creation request to obtain the application name and the interface path of the target interface.

[0107] In this step, after the computer receives the log creation request, it needs to parse the request URL in the log creation request in order to obtain other information about the target interface, and obtain the application name and the interface path of the target interface.

[0108] It should be noted that the request URL is the address information used to identify the target interface, and its content may include protocol headers, domain name, application name, interface path, and query parameters. The request URL saved in the log creation request can be a complete address or a standardized address string retained after gateway preprocessing.

[0109] Because the request URL has a specific format, and the application name and interface path are in the request URL, it can be parsed to extract the application name and interface path.

[0110] For example, if the request URL is "http: / / gateway.aaabbb.com / order-service / api / v1 / order / detail?id=1001", the computer first removes the protocol and domain name parts, resulting in " / order-service / api / v1 / order / detail?id=1001", then removes the query parameters, resulting in " / order-service / api / v1 / order / detail". Subsequently, the first data after the first delimiter, "order-service", is identified as the application name, and the following " / api / v1 / order / detail" is identified as the interface path.

[0111] The application name is a name field used to identify the application system to which the target interface belongs. It can be the deployment service name, the application identifier in the registry center, or the route name in the gateway configuration; the interface path is a normalized path string used to identify the location of the interface resource.

[0112] It should be noted that if the request URL fails to be parsed, an exception handling record can be generated and the generation of the interface access log for this time can be terminated.

[0113] S103: Based on the application name and interface path, retrieve the interface configuration of the target interface from the configuration library.

[0114] In this step, after the computer obtains the application name and interface path, since other information about the target interface is in the interface configuration, which is stored in the configuration library, and the application name and interface path are different in different interface configurations in the configuration library, the interface configuration of the target interface can be obtained from the configuration library based on the application name and interface path.

[0115] The different application names and interface paths in different interface configurations indicate that each interface configuration in the configuration library can be distinguished from other interface configurations by the combination of application name and interface path, so that the target interface can be uniquely located.

[0116] It should be noted that the configuration library can be a relational database, a key-value database, or a configuration center storage structure. This application embodiment does not limit the configuration library and can be determined according to the actual situation.

[0117] For example, when the configuration database is large, a first-level index can be created based on the application name, and a hash index or prefix tree index can be created for the interface path under each application. The computer first narrows down the search scope by application name, and then completes the match based on the interface path, thereby reducing cross-application traversal.

[0118] It should be noted that if the interface configuration is not obtained, an exception handling record can be generated and the generation of the current interface access log can be terminated. A configuration generation message can also be output to prompt staff to generate the interface configuration for the target interface.

[0119] S104: Generate interface access logs based on the application name, interface path, interface configuration, and log creation request.

[0120] In this step, after the computer obtains the interface configuration, it can generate interface access logs based on the application name, interface path, interface configuration, and log creation request.

[0121] Specifically, the log creation request also includes the user identifier, interface request parameters, and interface response results. The interface configuration also includes the collection mode, target sensitive field names, and the de-identification rules corresponding to each target sensitive field name.

[0122] The computer retrieves the corresponding user data from the user database based on the user identifier. The user database stores the mapping between user identifiers and user data, so it can find the user data corresponding to the user identifier in the log creation request from the user database.

[0123] Based on the collection mode, obtain the interface operation results and the number of operation data entries.

[0124] If the collection mode is automatic, it means that the operation performed by the interface does not require the participation of other interfaces or modules. The computer can directly obtain the interface operation results and the number of operation data entries. If the log creation request includes a log creation request, then the interface operation results and the number of operation data entries are collected from the log creation request.

[0125] If the collection mode is push collection, it means that the operation performed by the interface requires the participation of other interfaces or modules. The computer needs to wait for other interfaces or modules to send the interface operation results and the number of access operations, and then the computer receives the interface operation results and the number of access operations.

[0126] By using different methods to obtain interface operation results and the number of operation data entries according to different collection modes, it is possible to ensure that interface operation results and the number of operation data entries are obtained when any operation is performed on the target interface.

[0127] Then, based on each target sensitive field name and its corresponding desensitization rules, sensitive fields are desensitized in the interface request parameters and interface response results, resulting in the interface sensitive field names, request parameter digests, and response result digests. The interface request parameters and interface response results include key-value pairs, each consisting of a field name and a field value.

[0128] In other words, for each target sensitive field name, if the interface request parameters or interface response result include the target sensitive field name, then the target sensitive field name is used as the interface sensitive field name.

[0129] For each sensitive field name in the API request parameters, the field value corresponding to the sensitive field name is desensitized according to the desensitization rule, and the request parameter digest is obtained.

[0130] For each sensitive field name in the API response, the corresponding field value is anonymized according to the anonymization rules, resulting in a response summary. This anonymization process ensures that subsequent API access logs will not become a source of data leakage.

[0131] Generate interface access logs based on the application name, interface path, user data, interface operation results, number of operation data entries, interface sensitive field names, request parameter summary, response result summary, and interface configuration.

[0132] In one implementation, since the interface configuration includes the application name and interface path, user data, interface operation results, number of operation data entries, interface sensitive field names, request parameter summary, response result summary, and data in the interface configuration can be stored in a blank log to obtain the interface access log.

[0133] In another implementation, the interface configuration also includes module level and interface operation type. The computer can store the application name, interface path, user data, interface operation result, number of operation data entries, interface sensitive field name, request parameter summary, response result summary, module level and interface operation type in a blank log to obtain the interface access log.

[0134] It should be noted that when the collection mode is push collection, if the computer also receives the export file URL, the export file URL can be stored in the interface access log.

[0135] It should be noted that after obtaining the request parameter digest and response result digest, if the space occupied by the request parameter digest exceeds a preset capacity threshold, the request parameter digest will be truncated to obtain an updated request parameter digest. Similarly, if the space occupied by the response result digest exceeds a preset capacity threshold, the response result digest will be truncated to obtain an updated response result digest.

[0136] For example, the truncation position can be determined according to field order, character order, or preset retention rules. The retained part can include the names of interface sensitive fields and their corresponding field values, so that the logs can still retain core information related to auditing.

[0137] It should be noted that the preset capacity threshold can be 50KB, 60KB, 70KB, etc. This application embodiment does not limit the preset capacity threshold, and it can be determined according to the actual situation.

[0138] By truncating the request parameter digest and response result digest when they are large, the log content can retain key de-identified information while maintaining storability and writability, and keep the log field length consistent, which facilitates subsequent retrieval, archiving and compliance auditing.

[0139] The interface access log generation method provided in this embodiment involves receiving a log creation request after a user accesses the target interface; parsing the Request Uniform Resource Locator (URL) in the log creation request to obtain the application name and the interface path of the target interface; retrieving the interface configuration of the target interface from the configuration library based on the application name and interface path; and finally generating the interface access log based on the application name, interface path, interface configuration, and log creation request. This solution improves log generation efficiency by retrieving the interface configuration from the configuration library and combining it with the log creation request, eliminating the need for manual intervention.

[0140] Furthermore, this solution focuses directly on configuration matching and log synthesis for the target interface, maintaining consistency and accuracy in log generation even in scenarios with complex interface paths, a large number of interfaces, and frequent configuration updates. The interface access logs also contain rich data, including module level, interface path, interface operation type, target sensitive field names, and collection mode, meeting subsequent auditing requirements.

[0141] Figure 2 This is a flowchart illustrating a second embodiment of the method for generating interface access logs provided in this application. Based on the above embodiments, this application describes how the interface access logs are saved after they are generated by the computer. Figure 2 As shown, the method for generating the interface access log specifically includes the following steps:

[0142] S201: Save the interface access logs and retrieve the saved results.

[0143] In this step, after the computer generates the interface access log, it is necessary to save the interface access log for later use and obtain the saved result.

[0144] The save result includes a save identifier indicating successful save, or a save identifier indicating failed save and the reason for failure.

[0145] It should be noted that the reasons for failure may include exceeding the space limit, network jitter, connection timeout, temporary lock conflict, etc. This application embodiment does not limit the reasons for failure, and can be determined according to the actual situation.

[0146] S202: If the save flag indicates that saving has failed, and the reason for the failure is that the space occupied has exceeded the limit, then the interface access log will be truncated and saved.

[0147] In this step, after the computer obtains the saving result, if the saving flag indicates that the saving failed and the reason for the failure is that the space occupied exceeds the limit, the interface access log will be truncated and saved in order to ensure that the interface access log can be saved.

[0148] For example, the truncated content can retain core information such as application name, interface path, user identifier, and interface operation result at the field level, and then the truncated logs can be re-saved. Alternatively, a binary search can be used to determine the maximum amount of content to retain that meets the byte limit.

[0149] It can also generate an identifier indicating that the log has been truncated and store it in the truncated interface access log.

[0150] S203: If the save flag indicates that saving has failed, and the reason for failure is not due to exceeding the space limit, then the interface access log will be saved again.

[0151] In this step, after the computer obtains the saving result, if the saving flag indicates that the saving failed, and the reason for the failure is not due to exceeding the space limit, it means that the reason for the failure can be automatically resolved, and the interface access log will be saved again.

[0152] The interface access log generation method provided in this embodiment can improve the log saving success rate by truncating or resaving the logs according to the reason for the failure when saving the interface access logs fails.

[0153] Figure 3 This is a flowchart illustrating a third embodiment of the method for generating interface access logs provided in this application. Based on the above embodiments, this application describes the process of the computer generating the interface configuration of the target interface before receiving the log creation request. For example... Figure 3As shown, the method for generating the interface access log specifically includes the following steps:

[0154] S301: Obtain the metadata of the target interface.

[0155] In this step, after the target interface goes online, in order to generate interface access logs for subsequent user access to the target interface, it is necessary to generate the interface configuration of the target interface and store it in the configuration library. This requires obtaining the metadata of the target interface first.

[0156] The metadata includes a sensitive field thesaurus, historical sensitive field names, request field names, response field names, and sample field values.

[0157] It should be noted that the triggering condition for obtaining the target interface's metadata can be: detecting that the target interface is online; receiving a configuration generation request that includes the target interface's identifier; or obtaining the target interface's identifier in response to a user's configuration generation operation. This application embodiment does not limit the triggering condition for obtaining the target interface's metadata; it can be determined according to the actual situation.

[0158] S302: Based on the sensitive field thesaurus, each historical sensitive field name, each request field name, each response field name, and each field sample value, determine the target sensitive field name and generate the sensitivity score for the target interface.

[0159] In this step, after the computer obtains the metadata, since some interfaces involve less sensitive information, it is not necessary to generate interface configuration or interface access logs. Therefore, in order to determine whether it is necessary to generate interface configuration for the target interface, it is necessary to determine the target sensitive field name and generate the sensitivity score of the target interface based on the sensitive field thesaurus, each historical sensitive field name, each request field name, each response field name, and each field sample value.

[0160] Specifically, calculate the semantic similarity between each requested field name and each historical sensitive field name. Also calculate the semantic similarity between each requested field name and each standard sensitive field name in the sensitive field thesaurus.

[0161] Calculate the semantic similarity between each response field name and each historical sensitive field name. Calculate the semantic similarity between each response field name and each standard sensitive field name.

[0162] It should be noted that semantic similarity can be cosine similarity, Euclidean distance, Manhattan distance, etc. This application does not limit semantic similarity, and it can be determined according to the actual situation.

[0163] It should be noted that the standard sensitive field name and the historical sensitive field name can be in the format of ID card number, mobile phone number, bank card number, password, etc. This application embodiment does not limit the standard sensitive field name and the historical sensitive field name, and can be determined according to the actual situation.

[0164] For each requested field name, if the semantic similarity between the requested field name and each historical sensitive field name is greater than a preset similarity threshold, or if the semantic similarity between the requested field name and each standard sensitive field name is greater than a preset similarity threshold, then the requested field name is taken as the target sensitive field name.

[0165] For each response field name, if the semantic similarity between the response field name and each historical sensitive field name is greater than a preset similarity threshold, or if the semantic similarity between the response field name and each standard sensitive field name is greater than a preset similarity threshold, then the response field name is taken as the target sensitive field name.

[0166] It should be noted that the preset similarity threshold can be 0.5, 0.6, 0.8, etc. This application embodiment does not limit the preset similarity threshold, and it can be determined according to the actual situation.

[0167] The sample value for each target sensitive field is determined from all field sample values. Each field sample value consists of a field name and a sample value, thus allowing the determination of the sample value for each target sensitive field.

[0168] Calculate the sensitivity score of the target interface based on each target sensitive field and the sample value of each target sensitive field name.

[0169] That is, for each target sensitive field name, the first sub-score corresponding to that target sensitive field name is determined according to the preset correspondence between field names and sub-scores.

[0170] For example, the field name is "Mobile Number," and the corresponding sub-score is 2; the field name is "Vehicle Identifier," and the corresponding sub-score is 1; the field name is "Driver Identifier," and the corresponding sub-score is 0.5. This application does not limit the correspondence between field names and sub-scores; it can be determined according to the actual situation.

[0171] For each target sensitive field name, the second sub-score corresponding to the number of data points in the sample values ​​of that target sensitive field name is determined according to the preset correspondence between the number of data points and sub-scores.

[0172] For example, a data point count of 1 corresponds to a sub-score of 0.5; a data point count of 2 corresponds to a sub-score of 1; and a data point count of 3 corresponds to a sub-score of 1.5. This application does not limit the correspondence between the number of data points and the sub-scores; it can be determined according to the actual situation.

[0173] The sum of all first sub-scores and all second sub-scores is used as the sensitivity score for the target interface. This sensitivity score can simultaneously reflect the sensitivity attributes of the field itself and the data scale contained in the sample values, thus providing a quantitative basis for the generation of subsequent interface configurations.

[0174] S303: If the sensitivity score is greater than the preset score threshold, then generate the interface configuration of the target interface based on the sensitive field name and metadata of each target.

[0175] In this step, after the computer obtains the sensitivity score, if the sensitivity score is greater than the preset score threshold, it means that the interface involves a large number of sensitive information types or a complex data structure, and it is necessary to generate the interface configuration of the target interface. Then, the interface configuration of the target interface is generated according to each target sensitive field name and metadata.

[0176] Specifically, metadata also includes: Hypertext Transfer Protocol method, method name, application name, and interface path.

[0177] The computer inputs a sensitive field vocabulary, each historical sensitive field name, each request field name, and each response field name into the sensitive field detection model to obtain the target sensitive field names. Using the sensitive field detection model, the target sensitive field names that were not identified in step S302 can be detected.

[0178] The sensitive field detection model is a pre-trained neural network model that generates target sensitive field names based on a sensitive field lexicon, historical sensitive field names, request field names, and response field names. Further incremental training with real data can improve the model's accuracy.

[0179] A collection pattern is generated based on each Hypertext Transfer Protocol method, each method name, and the interface path.

[0180] In other words, for each interface operation type, it checks whether each Hypertext Transfer Protocol method, each method name, and the interface path contains a field corresponding to that interface operation type. If it does, then that interface operation type is used as the target interface operation type. If the target interface operation type includes a preset interface operation type, then the collection mode is determined to be automatic collection; if the target interface operation type does not include a preset interface operation type, then the collection mode is determined to be push collection.

[0181] It should be noted that the interface operation type can be query, add, modify, delete, export, asynchronous, batch processing, etc. The preset interface operation type can be export, asynchronous, batch processing, etc. This application embodiment does not limit the interface operation type or the preset interface operation type, which can be determined according to the actual situation.

[0182] For example, the corresponding field for querying is `query`; the corresponding field for adding is `add`; the corresponding field for modifying is `update`; the corresponding field for deleting is `delete`; and the corresponding field for exporting is `export`. This application embodiment does not limit the fields corresponding to the interface operation types; these can be determined according to the actual situation.

[0183] Based on the pre-defined correspondence between field names and desensitization rules, the desensitization rule corresponding to each target sensitive field name is determined.

[0184] For example, the field name is "Mobile Number," and the corresponding desensitization rule is to retain the first 3 and last 4 digits of the mask. The field name is "Vehicle Identifier," and the corresponding desensitization rule is masking. The field name is "Driver Identifier," and the corresponding desensitization rule is to perform hash calculation. This application does not limit the correspondence between field names and desensitization rules, which can be determined according to the actual situation.

[0185] It should be noted that the desensitization method corresponding to the desensitization rule can be masking, hash calculation, extracting digest, generating an identifier indicating the presence of sensitive fields, truncation, etc. This application embodiment does not limit the desensitization method corresponding to the desensitization rule, and it can be determined according to the actual situation.

[0186] Generate the interface configuration for the target interface based on the application name, interface path, collection mode, sensitive field name of each target, and the desensitization rule corresponding to each sensitive field name.

[0187] This means putting the application name, interface path, collection mode, sensitive field name of each target, and the desensitization rule corresponding to each sensitive field name into a blank configuration file to obtain the interface configuration of the target interface.

[0188] It should be noted that the metadata can also include code annotations, method parameter types, method return types, request field types, request field comments, request field paths, response field types, response field comments, response field paths, historical logs, module levels, interface names, etc.; the semantic similarity between the target sensitive field name and historical sensitive field names or standard sensitive field names can be used as the confidence score of the target sensitive field; the sensitive field detection model can also output the confidence score of the target sensitive field name; and the interface name, module level, interface operation type, confidence score, etc. can also be added to the interface configuration.

[0189] It should be noted that the field sample values ​​can be divided into request field sample values ​​and response field sample values. A parsing model can be used to parse the response field sample values, and the parsing results are added to the interface configuration. The parsing results include the success identifier path, data path, pagination field mapping, and data row count calculation strategy, etc. The parsing model is a pre-trained neural network model that derives parsing results from the field sample values. Using a unified model ensures consistency in the parsing results.

[0190] It should be noted that if the sensitivity score is less than or equal to the preset score threshold, the interface configuration of the target interface will not be generated, the identifier and sensitivity score of the target interface will be recorded, and the process will end.

[0191] S304: Store the interface configuration in the configuration library.

[0192] In this step, after the computer generates the interface configuration, it stores the interface configuration in the configuration library for use in the subsequent generation of interface access logs.

[0193] The interface access log generation method provided in this embodiment generates interface configurations only when a high sensitivity score is determined, thus avoiding the generation of interface access logs for all interfaces, preventing over-collection, and ensuring that logs are not missed for interfaces that require them. The sensitive field detection model improves the success rate of identifying target sensitive field names. Generating and storing interface configurations ensures the smooth generation of subsequent interface access logs.

[0194] In addition, by monitoring the generation of configurations after a new interface goes live, we can avoid missing configurations and improve the timeliness of interface configuration generation. This eliminates the need for manual generation and also improves the consistency of interface configuration content.

[0195] Figure 4 This is a flowchart illustrating Embodiment 4 of the method for generating interface access logs provided in this application. Based on the above embodiments, this application embodiment describes the verification of the interface configuration after its generation. Figure 4 As shown, the method for generating the interface access log specifically includes the following steps:

[0196] S401: Perform integrity verification on the interface configuration and generate a verification result indicating whether the verification passed.

[0197] In this step, after the computer generates the interface configuration, in order to ensure that the generated configuration can be used for subsequent log generation, it is necessary to perform an integrity check on the interface configuration and generate a check result indicating whether the check passed.

[0198] If the interface configuration includes preset information, a verification result indicating that the verification has passed will be generated; if the interface configuration does not include preset information, a verification result indicating that the verification has failed will be generated.

[0199] There must be at least one preset information. If there are multiple preset information items, "includes preset information in interface configuration" means that the interface configuration includes all preset information items. "Does not include preset information in interface configuration" means that the interface configuration is missing at least one preset information item.

[0200] It should be noted that the preset information may include the application name, interface path, collection mode, target sensitive field name, desensitization rule corresponding to each target sensitive field name, interface operation type, module level, etc. This application embodiment does not limit the preset information and can be determined according to the actual situation.

[0201] S402: If the verification result indicates that the verification passed, the configuration library will be deduplicated according to the interface configuration.

[0202] In this step, after the computer generates the verification result, if the verification result indicates that the verification passed, in order to avoid obtaining multiple interface configurations during the log generation process, the configuration library is deduplicated according to the interface configuration.

[0203] This means deleting the interface configuration in the configuration library that has the exact same application name and interface path as the interface configuration.

[0204] The interface configuration will then be stored in the configuration library.

[0205] It should be noted that the interface configuration can also be used for gray-scale verification of the generated interface access logs. After obtaining the interface access logs, staff will check the generated interface access log files, and store them in the configuration database after verification. Alternatively, the interface configuration can be checked manually, and stored in the configuration database after verification.

[0206] The interface access log generation method provided in this embodiment, by performing integrity verification before deduplication, ensures that the interface configurations entering the configuration library maintain complete fields and avoid duplicate writing, thereby improving the effectiveness and consistency of interface configurations in the configuration library and reducing matching anomalies caused by missing or duplicate configurations when generating logs based on interface configurations in the future.

[0207] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0208] Figure 5 This is a schematic diagram of an embodiment of the interface access log generation device provided in this application. Figure 5As shown, the interface access log generation device 50 includes:

[0209] Receive module 51 is used to receive log creation requests generated after a user accesses the target interface;

[0210] Processing module 52 is used for:

[0211] The request Uniform Resource Locator (URL) in the log creation request is parsed to obtain the application name and the interface path of the target interface.

[0212] Based on the application name and interface path, retrieve the interface configuration of the target interface from the configuration library. The application name and interface path are different in different interface configurations in the configuration library.

[0213] The log generation module 53 is used to generate interface access logs based on the application name, interface path, interface configuration, and log creation request.

[0214] Furthermore, the log creation request also includes the user identifier, interface request parameters, and interface response results;

[0215] The interface configuration also includes the collection mode, the target sensitive field name, and the desensitization rules for each target sensitive field name;

[0216] Log generation module 53 is specifically used for:

[0217] Based on the user identifier, retrieve the corresponding user data from the user database;

[0218] Based on the collection mode, obtain the interface operation results and the number of operation data entries;

[0219] Based on each target sensitive field name and the corresponding desensitization rule, the interface request parameters and interface response results are desensitized to obtain the interface sensitive field name, request parameter summary and response result summary.

[0220] Generate interface access logs based on the application name, interface path, user data, interface operation results, number of operation data entries, interface sensitive field names, request parameter summary, response result summary, and interface configuration.

[0221] Furthermore, the log generation module 53 is specifically used for:

[0222] If the collection mode is automatic, then collect the interface operation results and the number of operation data entries;

[0223] If the collection mode is push collection, then receive the interface operation results and the number of access operations.

[0224] Furthermore, the log generation module 53 is specifically used for:

[0225] For each target sensitive field name, if the target sensitive field name is included in the interface request parameters or interface response result, then the target sensitive field name will be used as the interface sensitive field name.

[0226] For each sensitive field name in the API request parameters, the field value corresponding to the sensitive field name is desensitized according to the desensitization rule to obtain the request parameter digest;

[0227] For each sensitive field name in the interface response, the field value corresponding to the sensitive field name is desensitized according to the desensitization rule to obtain the response result summary.

[0228] Furthermore, the log generation module 53 is also used for:

[0229] If the space occupied by the request parameter digest is greater than the preset capacity threshold, the request parameter digest will be truncated to obtain the updated request parameter digest.

[0230] If the space occupied by the response result summary is greater than the preset capacity threshold, the response result summary will be truncated to obtain the updated response result summary.

[0231] Furthermore, the processing module 52 is also used for:

[0232] Save the interface access logs and obtain the saving result. The saving result includes a saving identifier indicating successful saving, or a saving identifier indicating failed saving and the reason for failure.

[0233] If the save flag indicates that saving has failed, and the reason for the failure is that the space usage limit has been exceeded, then the interface access log will be truncated and saved.

[0234] If the save flag indicates that saving failed, and the reason for failure is not due to exceeding the space limit, then the interface access log will be saved again.

[0235] Furthermore, before receiving the log creation request, the processing module 52 is also used for:

[0236] Obtain the metadata of the target interface, which includes a sensitive field thesaurus, historical sensitive field names, request field names, response field names, and sample field values;

[0237] Based on the sensitive field thesaurus, each historical sensitive field name, each request field name, each response field name, and each field sample value, determine the target sensitive field name and generate a sensitivity score for the target interface;

[0238] If the sensitivity score is greater than the preset score threshold, the interface configuration of the target interface will be generated based on the sensitive field name and metadata of each target.

[0239] Store the interface configuration in the configuration library.

[0240] Furthermore, the processing module 52 is specifically used for:

[0241] Calculate the semantic similarity between each requested field name and each historically sensitive field name;

[0242] Calculate the semantic similarity between each requested field name and each standard sensitive field name in the sensitive field thesaurus;

[0243] Calculate the semantic similarity between each response field name and each historical sensitive field name;

[0244] Calculate the semantic similarity between each response field name and each standard sensitive field name;

[0245] For each requested field name, if the semantic similarity between the requested field name and each historical sensitive field name is greater than the preset similarity threshold, or if the semantic similarity between the requested field name and each standard sensitive field name is greater than the preset similarity threshold, then the requested field name will be used as the target sensitive field name.

[0246] For each response field name, if the semantic similarity between the response field name and each historical sensitive field name is greater than a preset similarity threshold, or if the semantic similarity between the response field name and each standard sensitive field name is greater than a preset similarity threshold, then the response field name will be used as the target sensitive field name.

[0247] Determine the sample value for each target sensitive field name from all field sample values;

[0248] Calculate the sensitivity score of the target interface based on each target sensitive field name and the sample value of each target sensitive field name.

[0249] Furthermore, the processing module 52 is specifically used for:

[0250] For each target sensitive field name, the first sub-score corresponding to the target sensitive field name is determined according to the preset correspondence between field names and sub-scores;

[0251] For each target sensitive field name, the second sub-score corresponding to the number of data points in the sample value of the target sensitive field name is determined according to the preset correspondence between the number of data points and sub-scores;

[0252] The sum of all first sub-scores and all second sub-scores is used as the sensitive score of the target interface.

[0253] Furthermore, the metadata also includes: Hypertext Transfer Protocol method, method name, application name, and interface path; processing module 52 is specifically used for:

[0254] The sensitive field dictionary, each historical sensitive field name, each request field name, and each response field name are input into the sensitive field detection model to obtain the target sensitive field name. The sensitive field detection model is a pre-trained neural network model that generates the target sensitive field name based on the sensitive field dictionary, historical sensitive field names, request field names, and response field names.

[0255] Generate a collection pattern based on each Hypertext Transfer Protocol method, each method name, and the interface path;

[0256] Based on the pre-defined correspondence between field names and desensitization rules, determine the desensitization rule corresponding to each target sensitive field name;

[0257] Generate the interface configuration for the target interface based on the application name, interface path, collection mode, sensitive field name of each target, and the desensitization rule corresponding to each sensitive field name.

[0258] Furthermore, before storing the interface configuration in the configuration library, processing module 52 is also used for:

[0259] Perform integrity verification on the interface configuration and generate a verification result indicating whether the verification passed;

[0260] If the verification result indicates that the verification passed, the configuration library will be deduplicated according to the interface configuration.

[0261] The interface access log generation device provided in this embodiment is used to execute the technical solution in any of the foregoing method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0262] Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application. Figure 6 As shown, the electronic device 60 includes:

[0263] Processor 61, memory 62, and communication interface 63;

[0264] Memory 62 is used to store executable instructions of processor 61;

[0265] The processor 61 is configured to execute the technical solutions in any of the foregoing method embodiments by executing executable instructions.

[0266] Optionally, the memory 62 can be either standalone or integrated with the processor 61.

[0267] Optionally, when the memory 62 is a device independent of the processor 61, the electronic device 60 may further include:

[0268] Bus 64, memory 62 and communication interface 63 are connected to processor 61 through bus 64 and complete communication with each other. Communication interface 63 is used to communicate with other devices.

[0269] Optionally, the communication interface 63 can be implemented using a transceiver. The communication interface is used to enable communication between the database access device and other devices (e.g., clients, read-write databases, and read-only databases). The memory may include random access memory (RAM) and may also include non-volatile memory, such as at least one disk drive.

[0270] Bus 64 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, only one thick line is used in the diagram, but this does not indicate that there is only one bus or one type of bus.

[0271] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0272] The electronic device is used to execute the technical solutions in any of the foregoing method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0273] This application also provides a readable storage medium storing a computer program thereon, which, when executed by a processor, implements the technical solution provided in any of the aforementioned method embodiments.

[0274] This application also provides a computer program product, including a computer program, which, when executed by a processor, is used to implement the technical solutions provided in any of the foregoing method embodiments.

[0275] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0276] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for generating interface access logs, characterized in that, include: Receive log creation requests generated after a user accesses the target interface; The request Uniform Resource Locator (URL) in the log creation request is parsed to obtain the application name and the interface path of the target interface; Based on the application name and the interface path, obtain the interface configuration of the target interface from the configuration library, wherein the application name and interface path are different in different interface configurations in the configuration library; An interface access log is generated based on the application name, the interface path, the interface configuration, and the log creation request.

2. The method according to claim 1, characterized in that, The log creation request also includes a user identifier, interface request parameters, and interface response results; The interface configuration also includes the collection mode, target sensitive field name, and desensitization rules corresponding to each target sensitive field name; The step of generating interface access logs based on the application name, the interface path, the interface configuration, and the log creation request includes: Based on the user identifier, retrieve the corresponding user data from the user database; According to the acquisition mode, obtain the interface operation results and the number of operation data entries; Based on each target sensitive field name and the corresponding desensitization rule, the interface request parameters and the interface response results are desensitized to obtain the interface sensitive field name, request parameter summary and response result summary. An interface access log is generated based on the application name, the interface path, the user data, the interface operation result, the number of operation data entries, the interface sensitive field name, the request parameter summary, the response result summary, and the interface configuration.

3. The method according to claim 2, characterized in that, The step of obtaining the interface operation result and the number of operation data entries according to the acquisition mode includes: If the collection mode is automatic collection, then the interface operation results and the number of operation data entries are collected; If the collection mode is push collection, then the interface operation results and the number of access operations are received.

4. The method according to claim 2, characterized in that, The process involves desensitizing the interface request parameters and the interface response results according to each target sensitive field name and the corresponding desensitization rule, resulting in the interface sensitive field name, request parameter summary, and response result summary, including: For each target sensitive field name, if the interface request parameters or interface response result include the target sensitive field name, then the target sensitive field name shall be used as the interface sensitive field name; For each sensitive field name in the interface request parameters, the field value corresponding to the sensitive field name is desensitized according to the desensitization rule corresponding to the sensitive field name to obtain the request parameter summary; For each sensitive field name in the interface response result, the field value corresponding to the sensitive field name is desensitized according to the desensitization rule corresponding to the sensitive field name to obtain the response result summary.

5. The method according to claim 4, characterized in that, The method further includes: If the space occupied by the request parameter digest is greater than the preset capacity threshold, the request parameter digest is truncated to obtain an updated request parameter digest. If the space occupied by the response result summary is greater than the preset capacity threshold, the response result summary is truncated to obtain an updated response result summary.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: Save the interface access log and obtain the saving result. The saving result includes a saving identifier indicating successful saving, or a saving identifier indicating failed saving and the reason for failure. If the save flag indicates that saving has failed, and the reason for the failure is that the space occupied has exceeded the limit, then the interface access log will be truncated and saved. If the save flag indicates that saving has failed, and the reason for the failure is not due to exceeding the space limit, then the interface access log will be saved again.

7. The method according to any one of claims 1 to 5, characterized in that, Before receiving the log creation request generated after the user accesses the target interface, the method further includes: Obtain the metadata of the target interface, which includes a sensitive field thesaurus, historical sensitive field names, request field names, response field names, and field sample values; Based on the sensitive field thesaurus, each historical sensitive field name, each request field name, each response field name, and each field sample value, determine the target sensitive field name and generate a sensitivity score for the target interface; If the sensitivity score is greater than a preset score threshold, then the interface configuration of the target interface is generated based on each target sensitive field name and the metadata; The interface configuration is stored in the configuration library.

8. The method according to claim 7, characterized in that, The step of determining the target sensitive field name and generating a sensitivity score for the target interface based on the sensitive field thesaurus, each historical sensitive field name, each request field name, each response field name, and each field sample value includes: Calculate the semantic similarity between each requested field name and each historically sensitive field name; Calculate the semantic similarity between each requested field name and each standard sensitive field name in the sensitive field thesaurus; Calculate the semantic similarity between each response field name and each historical sensitive field name; Calculate the semantic similarity between each response field name and each standard sensitive field name; For each requested field name, if the semantic similarity between the requested field name and each historical sensitive field name is greater than a preset similarity threshold, or if the semantic similarity between the requested field name and each standard sensitive field name is greater than a preset similarity threshold, then the requested field name is taken as the target sensitive field name. For each response field name, if the semantic similarity between the response field name and each historical sensitive field name is greater than a preset similarity threshold, or if the semantic similarity between the response field name and each standard sensitive field name is greater than a preset similarity threshold, then the response field name is taken as the target sensitive field name. Determine the sample value for each target sensitive field name from all field sample values; The sensitivity score of the target interface is calculated based on each target sensitive field name and the sample value of each target sensitive field name.

9. The method according to claim 8, characterized in that, The step of calculating the sensitivity score of the target interface based on each target sensitive field name and a sample value for each target sensitive field name includes: For each target sensitive field name, the first sub-score corresponding to the target sensitive field name is determined according to the preset correspondence between field names and sub-scores; For each target sensitive field name, the second sub-score corresponding to the number of data in the sample value of the target sensitive field name is determined according to the preset correspondence between the number of data and the sub-score; The sum of all first sub-scores and all second sub-scores is used as the sensitive score of the target interface.

10. The method according to claim 7, characterized in that, The metadata also includes: Hypertext Transfer Protocol method, method name, application name, and interface path; The step of generating the interface configuration for the target interface based on each target sensitive field name and the metadata includes: The sensitive field dictionary, each historical sensitive field name, each request field name, and each response field name are input into the sensitive field detection model to obtain the target sensitive field name. The sensitive field detection model is a pre-trained neural network model that generates the target sensitive field name based on the sensitive field dictionary, historical sensitive field names, request field names, and response field names. A collection mode is generated based on each Hypertext Transfer Protocol method, each method name, and the interface path. Based on the pre-defined correspondence between field names and desensitization rules, determine the desensitization rule corresponding to each target sensitive field name; The interface configuration of the target interface is generated based on the application name, the interface path, the collection mode, the sensitive field name of each target, and the desensitization rule corresponding to each sensitive field name.

11. The method according to claim 7, characterized in that, Before storing the interface configuration in the configuration library, the method further includes: Perform integrity verification on the interface configuration and generate a verification result indicating whether the verification passed. If the verification result indicates that the verification passed, then the configuration library is deduplicated according to the interface configuration.

12. An apparatus for generating interface access logs, characterized in that, include: The receiving module is used to receive log creation requests generated after a user accesses the target interface. Processing module, used for: The request Uniform Resource Locator (URL) in the log creation request is parsed to obtain the application name and the interface path of the target interface; Based on the application name and the interface path, obtain the interface configuration of the target interface from the configuration library, wherein the application name and interface path are different in different interface configurations in the configuration library; The log generation module is used to generate interface access logs based on the application name, the interface path, the interface configuration, and the log creation request.

13. An electronic device, characterized in that, include: Processor, memory, communication interface; The memory is used to store the executable instructions of the processor; The processor is configured to execute the interface access log generation method according to any one of claims 1 to 11 by executing the executable instructions.

14. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method for generating interface access logs as described in any one of claims 1 to 11.

15. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, is used to implement the method for generating interface access logs as described in any one of claims 1 to 11.

Images