CN116302875A - API grading method - Google Patents
API grading method Download PDFInfo
- Publication number
- CN116302875A CN116302875A CN202310049603.XA CN202310049603A CN116302875A CN 116302875 A CN116302875 A CN 116302875A CN 202310049603 A CN202310049603 A CN 202310049603A CN 116302875 A CN116302875 A CN 116302875A
- Authority
- CN
- China
- Prior art keywords
- api
- grading
- field
- library
- fields
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3409—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention relates to a method for grading an API, which comprises the steps of establishing a field library, and establishing various attributes for fields, including classification, labels, sensitivity and business influence degree; establishing an API grading rule template, calculating a weight formula by using each attribute of the comprehensive field of the template, and recommending the level; when an API provider registers an API, the system automatically detects and scans the fields contained in the API and automatically matches with a field library; analyzing the API, automatically classifying and labeling the API, recommending and grading the API, and adjusting the weight of each field under the condition of automatic grading by an API provider. The method utilizes the machine intelligence and the manual labeling method to realize the efficient and accurate grading of the APIs, is beneficial to solving the problem that enterprises are difficult to carry out grading management on the APIs in the process of treating the APIs, ensures that the enterprises are more efficiently focused on the service field, and also furthest considers the cost and efficiency required by grading.
Description
Technical Field
The invention relates to application program development and interaction technology, in particular to an API grading method.
Background
APIs are designed differently as a set of functions for operating components, applications or operating systems, for example, interfaces for fast execution typically include functions, constants, variables and data structures.
Those skilled in the art will appreciate that since the application program interface is a set of thousands of very complex functions and subroutines, many tasks can be performed by a programmer, while the API of the operating system can be used to allocate memory or read files, many system applications can be implemented by the API interface.
Therefore, APIs have become the most important means for developing and interacting modern applications, and in the process of digital transformation, modern enterprises have a large number of APIs, and these APIs support services of various aspects of the enterprises, but the enterprises do not effectively manage these APIs, and once some important APIs have problems, are attacked by people or have data leakage, normal production and operation of the enterprises will be seriously affected.
As shown by analyzing the related application technical means of the prior API, the designer of the technical scheme of the present invention also tries to use some hierarchical processing techniques in the prior and current API management, however, in the implementation process of the techniques, the API is defined as the highest security level roughly, or is hierarchical by means of manual labels. The two ways each have serious problems:
firstly, if the mode of defining the highest security level is adopted, since in the current method of protecting the API information, a protecting method is designed mainly in a mode of taking all APIs as a whole, if part of APIs to be shared relate to life lines of government enterprises, all APIs to be shared are regarded as a whole, and safety protection is set according to the method of the highest security level. Obviously, although the protection problem of information security is primarily solved by using such an integrated method, since the APIs actually related to enterprise information security are only a few, most of the APIs except for the few APIs do not relate to the problem of information security, that is, the protection processing by adopting the corresponding technology is not needed at all, and as a result, in the actual operation, the few parts are also protected and set in the same manner. In this way, the access to each API needs to be subjected to the audit processing of the layer-by-layer security protection, which causes unnecessary waste of computing resources and also affects the convenience of information sharing.
Secondly, if grading is performed by means of a simple manual label, the corresponding problem is also exposed: for example, the actual security level of the API is not clear to the operator performing the hierarchical process; for another example, when grading is performed, security level assessment is inaccurate due to factors which easily follow subjective consciousness of operators, so that the situation of unreasonable grading is very easy to occur; for another example, even if all of the manual classification is relied upon, the operator is required to evaluate the classification one by one, which consumes a lot of time and is inefficient.
In summary, the feasibility analysis and the analysis of the prior art, the designer of the technical scheme of the invention provides an API grading method which is favorable for solving the problem that enterprises are difficult to carry out grading management on the APIs in the process of treating the APIs on the basis of the prior known technology and technical means implemented by some technicians through practical experience summary. Therefore, the technical scheme can alleviate, partially solve or thoroughly solve the problems existing in the prior art.
Disclosure of Invention
In order to overcome the problems or at least partially alleviate and partially solve the problems, the invention provides an API grading method, which is beneficial to solving the problem that enterprises are difficult to graded and manage in the process of managing APIs, so that the enterprises are focused on the service field efficiently.
In order to achieve the above purpose, the present invention adopts the following technical scheme:
a method of API classification for an enterprise to manage APIs hierarchically in a process of harnessing them, the method comprising the steps of:
step one: establishing a field library, and sequentially establishing various attributes for all the fields comprising the field library, including classification, labels, sensitivity and business influence degree;
step two: establishing an API grading rule template, calculating a weight formula by using each attribute of the comprehensive field of the template, and recommending the level;
step three: when an API provider registers an API, the system automatically detects and scans the fields contained in the API and automatically matches with a field library; if some fields are not matched in the field library, namely, a field item is newly built in the field library for the field, partial data are automatically acquired for analysis, and corresponding classification, labels, sensitivity and business influence degree attributes are endowed;
step four: the system analyzes the API according to the fields in the registered API, automatically classifies and labels the API, recommends and classifies the API according to the sensitivity of the fields and the influence of the service, and an API provider adjusts the weight of each field under the condition of automatic classification;
step five: the API provider, in the case of a recommended rating level, may manually alter the rating level for which the system will record and incorporate rating influencing factors.
For the third step, the system automatically detects the fields contained in the scanning API and automatically matches the fields with a field library, and the algorithm steps adopted in the process comprise: analyzing JSON data of API resources, and identifying all KEY values in the JSON data; putting the KEY value set identified in the step into a field library for comparison; if the KEY value is successfully compared with the content in the field library, continuing to compare until all the KEY values are compared, and if the KEY value is not compared with the content in the field library, adding the KEY into the field library.
Aiming at the technical scheme, the technical personnel can further select and implement the method to form corresponding technical means, including:
the administrator can adjust the field classification, label, sensitivity and business impact attributes in the field library.
And establishing an API grading rule template, establishing according to the historical API grading data result, and determining the API characteristics with the largest association degree of the API grading result as classification, label, sensitivity and business influence degree.
When the API resource is classified, the system automatically detects the fields contained in the API, matches each field with the information in the field library, and automatically brings the fields into the field library if it is finally identified that some fields are not contained in the current field library.
The technical scheme also comprises the following technical means in combination with the practical situation during application:
under the condition that the platform has established a field library and a grading rule, the method comprises the following steps in sequence:
filling in basic information of an API by a user, and registering the API;
after receiving an API registration request, the platform acquires basic registration information fields filled in by the API, matches each field with each field in a field library, and carries out label and grading information recommendation on the API according to the matched fields;
and the API provider confirms and adjusts the grading result according to the recommended result.
The system automatically calculates according to the adjustment of the weight, and recommends the API grading level again.
And for the calculation and distribution mode of the weights, adopting a naive Bayesian algorithm to calculate the grading probability according to four characteristics of classification, labels, sensitivity and business influence degree.
After the basic information of the API is input, automatic algorithm upgrading is carried out, the algorithm grading result is confirmed manually, a training library is filled, and the weight is refreshed after the training library is updated.
In addition, the administrator may adjust the API hierarchical rule templates and make appropriate augmentations based on the four-level templates.
According to the method for classifying the API, the high-efficiency and accurate classification of the API is realized by utilizing the machine intelligence and combining the manual labeling method, firstly, the machine intelligence mode comprises that a platform provides a set of intelligent algorithm capable of continuously and automatically iterating and optimizing based on data, so that the more accurate the classification effect of automatic recommendation is along with the increase of the data quantity; secondly, the system carries out grading recommendation only according to the historical data and the currently set algorithm weight, and finally, the system is still confirmed by manpower, so that the grading cost can be reduced, and the final grading effect is achieved; therefore, by adopting a mode of combining machine intelligence with manual labeling, the method is beneficial to solving the problem that enterprises are difficult to manage the APIs in a grading manner in the process of treating the APIs, so that the enterprises can be focused on the service field more efficiently; in addition, the cost and efficiency required by classification are also considered to the greatest extent while the classification effect is ensured.
Drawings
The invention is described in further detail below with reference to the accompanying drawings.
FIG. 1 is a flow diagram of a method of API grading implemented by the present invention;
FIG. 2 is a flow chart of the calculation and distribution modes of weights in the steps of the method for grading the APIs implemented by the invention.
Description of the embodiments
The technical means of the method for classifying the APIs to be implemented aims to solve the problem that the prior enterprises are difficult to manage the APIs in a classified manner in the process of treating the APIs.
The technical scheme of the invention mainly solves the problem of API hierarchical management by adopting a mode of combining machine intelligence with manual labeling. In addition, on the basis of the same conception, corresponding auxiliary technical means can be additionally added according to different application requirements. If there are other different technical means in the API classifying step according to the technical scheme of the present invention, no detailed limitation is required, and all the technical means that can be adopted in the technical scheme of the present invention can be implemented by a technician according to the technical scheme implemented by the present invention. Thus, if some algorithm details, program codes, specific functional modules and the like are involved in implementing the technical scheme of the present invention, it is not necessary for the specific embodiment of the present invention to refine each detail. Obviously, the technical scheme implemented by the invention is a method for grading the API, which can be referred to and implemented by a person skilled in the art in combination with conventional technical means, and the person can actually obtain a series of advantages brought by the technical scheme according to different application conditions and use requirements, and the advantages are gradually represented in the following analysis of the method for grading the API.
As shown in fig. 1, the API grading method implemented by the present invention includes the following main steps:
firstly, establishing a field library, and sequentially establishing various attributes for all fields in the field library, including but not limited to classification, labels, sensitivity and business influence degree;
secondly, an API grading rule template is established, and the template can integrate various attributes such as field classification, labels, sensitivity, business influence degree and the like, and weight formula calculation and level recommendation formula are carried out; then, the system defaults to build a L1-L4 hierarchical template from low to high, and an administrator can adjust the hierarchical template and perform proper expansion based on the four-level template;
for the establishment of the API grading rule template, the establishment is mainly carried out according to the historical API grading data result, and the API characteristics with the largest association degree of the API grading result are determined to be classification, label, sensitivity and business influence degree, so that the current grading rule template can be set according to the result.
For the manner in which the field library is established, for example:
the current actual field library contains (name, classification, label, sensitivity, business impact level);
the current API resource comprises corresponding fields (name, owner unit, classification and label);
when the API resource is classified, the system automatically detects the fields contained in the API, matches each field with the information in the field library, and finally recognizes that the field is not contained in the current field library, and automatically brings the field into the field library.
Third, when the API provider registers the API, the system automatically detects the fields contained in the scanning API and automatically matches with the field library; if the fields are not matched in the field library, namely, a field item is newly built in the field library for the fields, partial data are automatically acquired for analysis, and attributes such as corresponding classification, labels, sensitivity, business influence degree and the like are endowed; of course, the administrator can adjust the field classification, label, sensitivity, business influence and other attributes in the field library;
wherein, for the fields contained in the detection scan, the algorithm of matching is as follows: analyzing JSON data of API resources, and identifying all KEY values in the JSON data; then, the KEY value set identified in the step is put into a field library for comparison; if the KEY value is successfully compared with the content in the field library, continuing to compare until all the KEY values are compared, and if the KEY value is not compared with the content in the field library, adding the KEY into the field library.
The fourth system analyzes the APIs according to the fields in the registered APIs, automatically classifies and labels the APIs, and recommends and grades the APIs according to the sensitivity of the fields and the influence of the business; the API provider adjusts the weight of each field under the condition of automatic grading, for example, the total weight is divided into 100 points, the system automatically calculates according to the adjustment of the weight, and recommends the API grading level again;
the calculation and distribution of the weights can be implemented by referring to the graph shown in fig. 2, currently, a naive bayes algorithm is adopted in the system, the calculation of the grading probability is carried out according to four characteristics of [ classification, label, sensitivity and business influence degree ], and the weight calculation of the four attributes is mainly carried out by taking grading data as an algorithm training library for training;
after the basic information of the API is input, automatic algorithm upgrading is carried out, the grading result of the algorithm is manually confirmed, the training library is filled, and weights are refreshed after the training library is updated, for example, the classified weights account for 30.36%, the labels account for 23.47%, the sensitive weights account for 38.14%, and the business influence accounts for 8.03%.
(V) the API provider can manually change the rating level in the case of a recommended rating level for which the system will record and incorporate rating influencing factors to provide a more accurate reference for subsequent further automated rating analysis.
The method steps implemented by the method can be obviously obtained after practical application, and when the method is used in the field of government data opening, the data classification efficiency can be improved; when the method is used in the field of enterprise public API, the efficiency of the API grading can be improved.
The method for grading the API comprises two key parts of manual labeling and machine intelligence, and the method can not be completed in a mode of directly giving up the manual labeling or by means of the machine intelligence, which is the key technical core of the method implemented by the method; according to the steps, the method of combining the machine intelligence with the manual labeling is utilized to realize high-efficiency and accurate grading of the APIs, so that the problem that enterprises are difficult to carry out grading management on the APIs in the process of treating the APIs is solved, and the enterprises can be focused on the service field more efficiently. In addition, the cost and efficiency required by classification are also considered to the greatest extent while the classification effect is ensured.
In order to more conveniently understand the API grading method implemented by the invention, taking primary API resource registration during application as an example, analysis is performed, and the preconditions are as follows: the platform has established a field library and grading rules, and the formed step flow is as follows:
firstly, a user fills in basic information of an API and carries out API registration;
after receiving the API registration request, the platform acquires basic registration information fields filled in by the API, matches each field with each field in a field library, and recommends the API with labels and grading information according to the matched fields;
thirdly, the API provider confirms and adjusts the grading result according to the recommended result;
(IV) if the user makes a hierarchical result adjustment, i.e. manually changes the hierarchical level, the system will record this adjustment and incorporate the result of the adjustment into the hierarchical algorithm calculation weight (which, after incorporation, will affect the subsequent algorithm results).
In the method for classifying the API implemented by the invention, the level setting can be identified by using the degree of sensitivity, and the data levels L4 to L1 are sequentially set as sensitive, insensitive and insensitive, and the judging standard can be judged according to the influence degree caused. Therefore, the system background can effectively authenticate different levels according to the corresponding API security levels, and the sharing convenience of other non-core APIs is not affected.
In the description of the present specification, the terms "present embodiment," "detailed description," and the like, if any, mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention or invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiments or examples; furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
The embodiments described above are intended to facilitate understanding and application by those skilled in the art, and it will be apparent to those skilled in the art that various modifications may be made to these examples and that the general principles described herein may be applied to other embodiments without undue burden. Therefore, the present application is not limited to the above embodiments, and modifications to the following cases should be within the scope of protection of the present application: (1) based on the technical scheme of the invention and combined with the new technical scheme implemented by the prior common knowledge, the technical effect produced by the new technical scheme does not exceed the technical effect of the invention, for example, the technical scheme for the API grading method is developed by adopting a mode of combining machine intelligence with manual labeling, and the expected effect produced by the new technical scheme does not exceed the technical effect of the invention; (2) the technical effects generated by adopting the equivalent replacement of part of the characteristics of the technical scheme of the invention by adopting the known technology are the same as those of the technical scheme of the invention, for example, the equivalent replacement is carried out on an algorithm which can be selected according to the requirement; (3) the technical scheme of the invention is used as a basis for expansion, and the essence of the expanded technical scheme is not beyond the technical scheme of the invention; (4) and applying the obtained technical means to schemes in other related technical fields by utilizing equivalent transformation of the text record content of the invention.
Claims (10)
1. A method for hierarchical management of APIs by an enterprise in administering the APIs, the method comprising the steps of:
step one: establishing a field library, and sequentially establishing various attributes for all the fields comprising the field library, including classification, labels, sensitivity and business influence degree;
step two: establishing an API grading rule template, calculating a weight formula by using each attribute of the comprehensive field of the template, and recommending the level;
step three: when an API provider registers an API, the system automatically detects and scans the fields contained in the API and automatically matches with a field library; if some fields are not matched in the field library, namely, a field item is newly built in the field library for the field, partial data are automatically acquired for analysis, and corresponding classification, labels, sensitivity and business influence degree attributes are endowed;
step four: the system analyzes the API according to the fields in the registered API, automatically classifies and labels the API, recommends and classifies the API according to the sensitivity of the fields and the influence of the service, and an API provider adjusts the weight of each field under the condition of automatic classification;
step five: the API provider, in the case of a recommended rating level, may manually alter the rating level for which the system will record and incorporate rating influencing factors.
2. The method of API grading according to claim 1, wherein for step three, the system automatically detects fields contained within the scanned API and automatically matches the field library, the algorithm employed by the process comprising the steps of:
analyzing JSON data of API resources, and identifying all KEY values in the JSON data;
putting the KEY value set identified in the step into a field library for comparison;
if the KEY value is successfully compared with the content in the field library, continuing to compare until all the KEY values are compared, and if the KEY value is not compared with the content in the field library, adding the KEY into the field library.
3. The method of API grading according to claim 1, characterized by: the administrator can adjust the field classification, label, sensitivity and business impact attributes in the field library.
4. The method of API grading according to claim 1, characterized by: and establishing an API grading rule template, establishing according to the historical API grading data result, and determining the API characteristics with the largest association degree of the API grading result as classification, label, sensitivity and business influence degree.
5. The method of API grading according to claim 1, characterized by: when the API resource is classified, the system automatically detects the fields contained in the API, matches each field with the information in the field library, and automatically brings the fields into the field library if it is finally identified that some fields are not contained in the current field library.
6. The method of API grading according to any of the claims 1-5, characterized in that in case the platform has already established a field library and grading rules, the method steps are in order:
filling in basic information of an API by a user, and registering the API;
after receiving an API registration request, the platform acquires basic registration information fields filled in by the API, matches each field with each field in a field library, and carries out label and grading information recommendation on the API according to the matched fields;
and the API provider confirms and adjusts the grading result according to the recommended result.
7. A method of API grading according to any of claims 1-5, characterized in that: the system automatically calculates according to the adjustment of the weight, and recommends the API grading level again.
8. The method of API grading according to claim 7, characterized by: and for the calculation and distribution mode of the weights, adopting a naive Bayesian algorithm to calculate the grading probability according to four characteristics of classification, labels, sensitivity and business influence degree.
9. A method of API grading according to claim 1 or 8, characterized in that: after the basic information of the API is input, automatic algorithm upgrading is carried out, the algorithm grading result is confirmed manually, a training library is filled, and the weight is refreshed after the training library is updated.
10. The method of API grading according to claim 1, characterized by: the administrator may adjust the API hierarchical rule templates and make appropriate augmentations based on these four-level templates.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310049603.XA CN116302875A (en) | 2023-02-01 | 2023-02-01 | API grading method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310049603.XA CN116302875A (en) | 2023-02-01 | 2023-02-01 | API grading method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116302875A true CN116302875A (en) | 2023-06-23 |
Family
ID=86782439
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310049603.XA Pending CN116302875A (en) | 2023-02-01 | 2023-02-01 | API grading method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116302875A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117435959A (en) * | 2023-11-17 | 2024-01-23 | 广西壮族自治区信息中心 | Parameter-based API interface classification method and system |
-
2023
- 2023-02-01 CN CN202310049603.XA patent/CN116302875A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117435959A (en) * | 2023-11-17 | 2024-01-23 | 广西壮族自治区信息中心 | Parameter-based API interface classification method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9934134B2 (en) | Generating a test scenario template from runs of test scenarios belonging to different organizations | |
| US9032360B1 (en) | Selecting a test scenario template based on similarity of testing profiles belonging to different organizations | |
| US11410448B2 (en) | Predictive analysis systems and methods using machine learning | |
| CN112633962B (en) | Service recommendation method and device, computer equipment and storage medium | |
| US11315196B1 (en) | Synthesized invalid insurance claims for training an artificial intelligence / machine learning model | |
| US9348735B1 (en) | Selecting transactions based on similarity of profiles of users belonging to different organizations | |
| CN111931049B (en) | Business processing method based on big data and artificial intelligence and block chain financial system | |
| CN111897528B (en) | Low-code platform for enterprise online education | |
| WO2019100635A1 (en) | Editing method and apparatus for automated test script, terminal device and storage medium | |
| US9201774B1 (en) | Generating test scenario templates from testing data of different organizations utilizing similar ERP modules | |
| US9201773B1 (en) | Generating test scenario templates based on similarity of setup files | |
| CN111861463A (en) | Intelligent information identification method based on block chain and artificial intelligence and big data platform | |
| CN113468317B (en) | Resume screening method, system, equipment and storage medium | |
| CN112684396B (en) | Data preprocessing method and system for electric energy meter operation error monitoring model | |
| CN116302875A (en) | API grading method | |
| CN113901463B (en) | Concept drift-oriented interpretable Android malicious software detection method | |
| CN112115507B (en) | Cloud service interaction method and big data platform based on cloud computing and information digitization | |
| CN116880867A (en) | Policy big model-based decision engine updating method and device | |
| CN115485662A (en) | Quota request resolution on a computing platform | |
| CN111507829A (en) | Overseas credit card wind control model iteration method, device, equipment and storage medium | |
| CN117807545B (en) | Abnormality detection method and system based on data mining | |
| KR102555733B1 (en) | Object management for improving machine learning performance, control method thereof | |
| Azzalini et al. | Data Quality and Fairness: Rivals or Friends? | |
| Gil et al. | Automatic contrast evaluation for android themes | |
| Saif | A New Cost-Quality Estimation Model Based on Case-Based Reasoning Technique |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |