WO2025152628A1 - Application programming interface asset management method and apparatus, and electronic device - Google Patents

Abstract

Disclosed in the present application are an application programming interface asset management method and apparatus, and an electronic device, which method is applied to the field of data processing. The method comprises: upon receiving network traffic data, extracting from the network traffic data asset information of application programming interface assets included in each network request, so as to obtain an asset information set; on the basis of an asset path and a request type, performing aggregation on asset information in the asset information set, so as to obtain N types of asset information; on the basis of the asset information set, statistically compiling a sensitive information type related to each of the N types of asset information, so as to obtain target asset information; and on the basis of the target asset information, updating asset information in a preset database, so as to manage the application programming interface assets in the network traffic data.

Description

Application program interface asset management method, device and electronic device

Related Applications

This application claims priority to Chinese patent application number 2024100644708, filed on January 16, 2024, entitled “Application Programming Interface Asset Management Method, Device and Electronic Device”, the entire text of which is hereby incorporated by reference.

Technical Field

The present application relates to the field of data processing, and more specifically, to a method, device and electronic device for managing application program interface assets.

Background Art

As more and more digital systems are established in companies or organizations, various data digital systems will provide internal or external application programming interfaces (APIs). All information and resources related to APIs are called API assets, such as the API name, description, version, endpoint, authorization mechanism, availability, and performance indicators. In order to better manage the API assets and security audit needs in the organization, it is necessary to collect API information from each system for centralized management.

In the prior art, when managing API assets in network traffic data, each business system can collect the API assets involved in real time and then report them to the system that manages API assets. However, due to differences between business systems and network problems, this method inevitably leads to omissions and coverage of collected API assets, and results in poor real-time management of API assets. In addition, this method does not count the sensitive information involved in API assets, and cannot take corresponding measures for APIs involving sensitive information, resulting in low data security.

Regarding the problem of poor timeliness of managing application program interface assets in network traffic data in related technologies due to the large amount of network traffic data, no effective solution has been proposed so far.

Summary of the invention

According to the first aspect of the present application, a method for managing application program interface assets is provided, the method comprising: when network traffic data is received, extracting asset information of the application program interface assets contained in each network request in the network traffic data to obtain an asset information set, wherein the asset information comprises at least the following information: asset path, request type, sensitive information type, wherein the sensitive information type refers to the type of sensitive information when the application program interface asset contains sensitive information; aggregating the asset information in the asset information set according to the asset path and the request type to obtain N types of asset information, wherein N is a positive integer; counting the sensitive information type involved in each type of asset information in the N types of asset information according to the asset information set to obtain target asset information; and updating the asset information in a preset database according to the target asset information to manage the application program interface assets in the network traffic data, wherein the preset database stores the asset information of the application program interface assets.

In some embodiments, extracting the asset information of the application interface assets contained in each network request in the network traffic data to obtain an asset information set includes: extracting the request parameters of each network request in the network traffic data to obtain a request parameter set, wherein the request parameters include at least the following field information: request domain name, request path, request parameters, response parameters, and the request type; determining the application interface assets contained in the request parameter set through a preset regular expression to obtain an asset information set; determining first asset information containing sensitive information in the asset information set through the regular expression, marking the first asset information, and updating the asset information in the asset information set.

In some embodiments, determining the application program interface assets included in the request parameter set by a preset regular expression to obtain the asset information set includes: using a first regular expression to match the target parameter of each network request in the request parameter set to obtain a first matching result, wherein the target parameter at least includes the following field information: the request domain name, the request path; when the first matching result indicates a successful match, determining the first network request corresponding to the first matching result, and generating the asset path of the first network request; when the first matching result indicates a failed match, using multiple second regular expressions to match the request path of the second network request to obtain a second matching result, and generating the asset path of the second network request based on the second matching result, wherein the second network request refers to the network request other than the first network request in the request parameter set; combining the request type of the first network request, the asset path of the first network request, the request type of the second network request, and the asset path of the second network request to obtain the asset information set.

In some embodiments, multiple second regular expressions are used to match the request path of the second network request to obtain a second matching result, and the asset path of the second network request is generated according to the second matching result, including: splitting the request path of each second network request according to preset characters to obtain a first path list for each second network request; using the multiple second regular expressions to perform regular matching on each element in the first path list in turn to obtain a third matching result, wherein the multiple second regular expressions are regular expressions constructed according to different aggregation rules; when the third matching result indicates a successful match, a second preset string is used to replace the successfully matched elements to obtain a second path list for each second network request; the elements in the second path list are concatenated to obtain a target path for each second network request, and the asset path of the second network request is generated according to the request parameters of each second network request and the target path of each second network request.

In some embodiments, determining the first asset information containing sensitive information in the asset information set through the regular expression, marking the first asset information, and updating the asset information in the asset information set includes: using a third regular expression set to match each network request in the request parameter set to obtain a third matching result, wherein the third regular expression set includes a set of regular expressions constructed based on different sensitive information types; when the third matching result indicates a successful match, determining the asset information corresponding to the successfully matched network request in the asset information set to obtain the first asset information; determining the sensitive information type of the first asset information based on the third matching result, and updating the asset information set using the sensitive information type of the first asset information.

In some embodiments, before determining the application interface assets included in the request parameter set through a preset regular expression to obtain an asset information set, the method also includes: determining aggregation rules for the application interface assets based on business needs; configuring regular expressions based on the aggregation rules to obtain the preset regular expressions, and loading the preset regular expressions.

In some embodiments, updating the asset information in the preset database based on the target asset information includes: when the target asset information is inconsistent with the asset information in the preset database, updating the corresponding asset information in the preset database based on the target asset information; when the target asset information is consistent with the asset information in the preset database, updating the time information of the corresponding asset information in the target asset information in the preset database.

According to a second aspect of the present application, a device for managing application program interface assets is provided, the device comprising: an extraction unit, for extracting, when receiving network traffic data, asset information of application program interface assets contained in each network request in the network traffic data, to obtain an asset information set, wherein the asset information comprises at least the following information: asset path, request type, sensitive information type, wherein the sensitive information type refers to the type of sensitive information when the application program interface asset contains sensitive information; an aggregation unit, for aggregating the asset information in the asset information set according to the asset path and the request type, to obtain N types of asset information, wherein N is a positive integer; a statistics unit, for counting the sensitive information type involved in each type of asset information in the N types of asset information according to the asset information set, to obtain target asset information; an update unit, for updating the asset information in a preset database according to the target asset information, so as to manage the application program interface assets in the network traffic data, wherein the preset database stores the asset information of the application program interface assets.

In some embodiments, the extraction unit includes: an extraction subunit, used to extract request parameters of each network request in the network traffic data to obtain a request parameter set, wherein the request parameters include at least the following field information: request domain name, request path, request parameters, response parameters, and the request type; a first determination subunit, used to determine the application interface assets included in the request parameter set through a preset regular expression to obtain an asset information set; a marking subunit, used to determine the first asset information containing sensitive information in the asset information set through the regular expression, mark the first asset information, and update the asset information in the asset information set.

In some embodiments, the determination subunit includes: a first matching module, which is used to match the target parameter of each network request in the request parameter set with a first regular expression to obtain a first matching result, wherein the target parameter at least includes the following field information: the request domain name, the request path; a first determination module, which is used to determine the first network request corresponding to the first matching result when the first matching result indicates a successful match, and generate the asset path of the first network request; a second matching module, which is used to match the request path of the second network request with multiple second regular expressions when the first matching result indicates a failed match, and generate the asset path of the second network request based on the second matching result, wherein the second network request refers to the network request other than the first network request in the request parameter set; a combination module, which is used to combine the request type of the first network request, the asset path of the first network request, the request type of the second network request and the asset path of the second network request to obtain the asset information set.

In some embodiments, the second matching module includes: a splitting submodule, which is used to split the request path of each second network request according to preset characters to obtain a first path list for each second network request; a matching submodule, which is used to use the multiple second regular expressions to perform regular matching on each element in the first path list in turn to obtain a third matching result, wherein the multiple second regular expressions are regular expressions constructed according to different aggregation rules; a replacement submodule, which is used to replace the successfully matched elements with a second preset string when the third matching result indicates a successful match to obtain a second path list for each second network request; a splicing submodule, which is used to splice the elements in the second path list to obtain a target path for each second network request, and generate the asset path of the second network request according to the request parameters of each second network request and the target path of each second network request.

In some embodiments, the annotation subunit includes: a third matching module, used to use a third regular expression set to match each network request in the request parameter set to obtain a third matching result, wherein the third regular expression set includes a set of regular expressions constructed based on different sensitive information types; a second determination module, used to determine the asset information corresponding to the successfully matched network request in the asset information set when the third matching result indicates a successful match, to obtain the first asset information; an update module, used to determine the sensitive information type of the first asset information based on the third matching result, and update the asset information set using the sensitive information type of the first asset information.

In some embodiments, the extraction unit also includes: a second determination sub-unit, used to determine the application interface assets included in the request parameter set through a preset regular expression, and before obtaining the asset information set, determine the aggregation rules of the application interface assets according to business needs; a loading sub-unit, used to configure the regular expression according to the aggregation rule, obtain the preset regular expression, and load the preset regular expression.

In some embodiments, the update unit includes: a first update sub-unit, used to update the corresponding asset information in the preset database according to the target asset information when the target asset information is inconsistent with the asset information in the preset database; a second update sub-unit, used to update the time information of the corresponding asset information in the target asset information in the preset database when the target asset information is consistent with the asset information in the preset database.

According to a third aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned application program interface asset management methods.

According to the fourth aspect of the present application, an electronic device is provided, comprising one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned methods for managing application program interface assets.

The details of one or more embodiments of the present application are set forth in the following drawings and description. Other features, objects, and advantages of the present application will become apparent from the description, drawings, and claims.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

FIG1 is a flow chart of a method for managing application program interface assets according to a first embodiment of the present application;

FIG2 is a schematic diagram of an optional method for managing application program interface assets provided according to the first embodiment of the present application;

3 is a schematic diagram of an application program interface asset management device provided according to Embodiment 2 of the present application;

FIG. 4 is a schematic diagram of an electronic device for managing application program interface assets provided according to a fifth embodiment of the present application.

DETAILED DESCRIPTION

It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

It should be noted that the user information (including but not limited to user device information, user personal information, user information contained in network traffic data, user information contained in application program interfaces, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, collected network traffic data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards in the relevant areas, and corresponding operation entrances shall be provided for users to choose to authorize or refuse.

In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

Flink: Apache Flink is a framework and distributed processing engine for stateful computations on unbounded and bounded data streams. Flink runs on all common cluster environments and can compute at memory speed and at any scale.

Embodiment 1

The present application is described below in conjunction with the implementation steps. FIG. 1 is a flow chart of a method for managing application program interface assets provided according to Embodiment 1 of the present application. As shown in FIG. 1 , the method includes the following steps:

Step S101, when network traffic data is received, extract the asset information of the application interface assets contained in each network request in the network traffic data to obtain an asset information set, wherein the asset information includes at least the following information: asset path, request type, sensitive information type, and the sensitive information type refers to the type of sensitive information when the application interface asset contains sensitive information.

In the first embodiment, a network request refers to the behavior of a client where a user is located sending a request to a server to obtain a specific resource, for example, a request to obtain a web page, a picture, a video, data, etc. This request can be made through the http protocol or other requests, for example, FTP (File Transfer Protocol) requests, SSH (Secure Shell) requests, DNS (Domain Name System) requests, etc. Requests generated through the http protocol can be called http requests.

In order to manage the API asset information (i.e. the information of the application program interface assets mentioned above) in the network traffic data in real time, it is necessary to extract the API asset information involved in the network request from the request parameters of each network request in the network traffic data, and obtain the above asset information set from the API asset information of each network request. The asset path in the API asset information is used to identify the API asset involved in the network request, the request type refers to the type of network request, such as GET, POST, PUT, DELETE, etc., and the sensitive information type refers to the type of sensitive information contained in the network request, such as ID number, mobile phone number, etc.

Step S102, aggregating the asset information in the asset information set according to the asset path and the request type to obtain N types of asset information, where N is a positive integer.

In the first embodiment of the present invention, in order to manage the API assets in the network requests collected in real time, it is necessary to aggregate the API assets in the network requests according to business needs or the aggregation needs of business personnel, so as to count the API asset information in the network traffic data according to the category of API assets, meet the needs of business personnel to manage API assets, and at the same time remove redundant asset information in the network requests to facilitate management by business personnel, thereby achieving the effect of improving the efficiency of business personnel in managing API assets.

In an optional embodiment, aggregation rules can be determined according to business needs, in which different asset paths and request types can be defined. Then, each API asset in the asset information set is classified according to the asset path and request type to obtain the above-mentioned N types of asset information.

Step S103, based on the asset information set, statistics are collected on the type of sensitive information involved in each type of asset information in N types of asset information to obtain target asset information.

In the first embodiment of the present invention, after the asset information is aggregated and classified, the sensitive information involved in plain text transmission in each type of API assets can be counted, that is, the unencrypted sensitive information transmitted in each type of API assets. This can help enterprises to promptly discover and deal with potential security risks, take corresponding protection measures, and ensure user data security and privacy. At the same time, it avoids the problem of too many API assets and redundant asset information making it difficult for business personnel to manage API assets.

Step S104, updating the asset information in the preset database according to the target asset information to manage the application program interface assets in the network traffic data, wherein the preset database stores the asset information of the application program interface assets.

In the first embodiment of the present invention, in order to avoid storing each API asset immediately in the preset database after parsing, resulting in a large amount of read and write resources being occupied and causing low cluster processing efficiency, the API asset information can be aggregated, and the sensitive information types involving sensitive information can be counted to obtain the target asset information. Then, the asset information in the preset database can be updated in batches according to the target asset information, so as to achieve the effect of saving cluster resources while improving the real-time and accuracy of asset information.

In summary, the method for managing application program interface assets provided in the first embodiment of the present application, when receiving network traffic data, extracts the asset information of the application program interface assets contained in each network request in the network traffic data to obtain an asset information set, wherein the asset information includes at least the following information: asset path, request type, sensitive information type, and the sensitive information type refers to the type of sensitive information when the application program interface asset contains sensitive information; the asset information in the asset information set is aggregated according to the asset path and the request type to obtain N types of asset information, wherein N is a positive integer; the sensitive information type involved in each type of asset information in the N types of asset information is counted according to the asset information set to obtain the target asset information; the asset information in the preset database is updated according to the target asset information to manage the application program interface assets in the network traffic data, wherein the preset database stores the asset information of the application program interface assets, and solves the problem of poor timeliness of managing application program interface assets in the related technology due to the large amount of network traffic data when managing application program interface assets in network traffic data. By extracting and aggregating a large number of API assets requested by network traffic data, and updating the API asset information in the preset database in batches according to the aggregated asset information, it is possible to extract key information and remove redundant information to assist business personnel in managing API assets, thereby ensuring the real-time nature of API asset information and enabling business personnel to manage API assets in real time. At the same time, by counting sensitive information types, it is helpful for business personnel to configure corresponding security measures for API assets according to the sensitive information types, thereby ensuring data security.

Optionally, in the management method of application interface assets provided in Example 1 of the present application, asset information of the application interface assets contained in each network request in the network traffic data is extracted to obtain an asset information set, including: extracting request parameters of each network request in the network traffic data to obtain a request parameter set, wherein the request parameters include at least the following field information: request domain name, request path, request parameters, response parameters, request type; determining the application interface assets contained in the request parameter set through a preset regular expression to obtain an asset information set; determining the first asset information containing sensitive information in the asset information set through a regular expression, marking the first asset information, and updating the asset information in the asset information set.

In the first embodiment of the present invention, in order to manage API assets in real time, network traffic data can be captured in real time, and relevant parameters of each network request (i.e., the request parameter set mentioned above) can be extracted therefrom. The API assets contained in the network request can be parsed according to the relevant parameters of each network request in the request parameter set, and the sensitive information type of each API asset involving sensitive information can be marked.

Specifically, a flow probe is used to collect network flow data (for example, http data stream) and store it in a kafka cluster or other data storage system, the network flow data is obtained from the kafka cluster, and then the relevant parameters of each network request in the network flow data are parsed into a preset data structure, that is, the above-mentioned request parameters. The field information contained in the request parameters is shown in Table 1, wherein the request domain name refers to the domain name address accessed by the http request, for example, "www.example.com", the request path refers to the path of the specific resource of the http request, for example, "/index.html", the request parameter refers to the parameter of the http request, for example, "id=123" in "http://example.com/api/user?id=123", the response parameter refers to the parameter of the response result returned to the client by the server after responding to the http request, for example, the status code is 200 to indicate a successful response, the Content-Type (the type of data returned) is a string, etc., and the request type refers to the type of the http request to indicate the operation that the server needs to perform, for example, GET, POST, PUT, DELETE, etc. After parsing the network parameters of each network request, the above-mentioned request parameter set is obtained from the network parameters of all network requests.

Then, the request parameters of each network request in the above request parameter set are matched by using a preset regular expression, and the API assets therein are parsed to obtain the above asset information set, wherein the preset regular expression is pre-configured and loaded according to the API asset aggregation rule. Finally, whether each API asset information in the asset information set contains sensitive information is determined based on the regular expression matching the sensitive information, and the type of sensitive information is determined, and corresponding annotations are performed to update the asset information in the asset information set.

Table 1

Optionally, in the management method of application program interface assets provided in the first embodiment of the present application, the application program interface assets included in the request parameter set are determined by a preset regular expression, and the asset information set is obtained, including: using a first regular expression to match the target parameter of each network request in the request parameter set to obtain a first matching result, wherein the target parameter at least includes the following field information: request domain name, request path; when the first matching result indicates a successful match, determining the first network request corresponding to the first matching result, and generating the asset path of the first network request; when the first matching result indicates a failed match, using multiple second regular expressions to match the request path of the second network request to obtain a second matching result, and generating the asset path of the second network request based on the second matching result, wherein the second network request refers to the network request other than the first network request in the request parameter set; combining the request type of the first network request, the asset path of the first network request, the request type of the second network request, and the asset path of the second network request to obtain the asset information set.

In the first embodiment, the first regular expression is a regular expression configured according to a higher priority aggregation rule, and the higher priority aggregation rule may be an aggregation rule formulated according to business requirements. An example of the first regular expression may be shown in Table 2, wherein the rule tag value refers to the tag value used when marking the asset information of the network request after a successful match. It should be noted that the number of the first regular expressions may be adaptively adjusted according to business requirements, and is not specifically limited in the first embodiment.

The multiple second regular expressions are multiple regular expressions constructed according to different URL path analysis rules, and are used to classify API assets into multiple categories according to different URL paths. An example of the second regular expression can be shown in Table 3, which includes aggregation rules for three types of URL paths, corresponding to different rule tag values (such as ":id", ":uuid", ":.jpg" in Table 3).

Table 2

Table 3

In an optional embodiment, when parsing the API assets in the network request, at least one first regular expression can be used to match the request domain name and request path (i.e., the above-mentioned target parameters) of each network request in the request parameter set. If the request domain name and request path of the network request successfully match the first regular expression, the asset path of the API assets of the current network request is directly marked according to the request type of the network request and the rule tag value corresponding to the first regular expression. If the request domain name and request path of the network request do not successfully match the first regular expression, multiple second regular expressions are used to match the network request. Once it successfully matches any one of the multiple second regular expressions, the asset path of the network request is generated according to the request parameters of the network request and the rule tag value corresponding to the second regular expression that successfully matches. If the network request fails to match all the second regular expressions, the next network request is parsed. Finally, the asset information of each network request is determined according to the request type and asset path of each network request to obtain the above-mentioned asset information set.

Optionally, in the management method of application program interface assets provided in the first embodiment of the present application, multiple second regular expressions are used to match the request path of the second network request to obtain a second matching result, and the asset path of the second network request is generated based on the second matching result, including: splitting the request path of each second network request according to preset characters to obtain a first path list for each second network request; using multiple second regular expressions to perform regular matching on each element in the first path list in turn to obtain a third matching result, wherein the multiple second regular expressions are regular expressions constructed based on different aggregation rules; when the third matching result indicates a successful match, using a second preset string to replace the successfully matched elements to obtain a second path list for each second network request; splicing the elements in the second path list to obtain a target path for each second network request, and generating the asset path of the second network request based on the request parameters of each second network request and the target path of each second network request.

In an optional embodiment, the delimiter "/" (i.e., the preset character mentioned above) can be used to split the request path of each second network request, and the split character string is used as each element of the list to obtain the first path list of each second network request mentioned above. Then, multiple second regular expressions contained in Table 3 are used to perform regular matching with each element in the first path list in turn. When a column element successfully matches any second regular expression, the rule mark value corresponding to the successfully matched second regular expression is used to replace the successfully matched element in the first path list. If each element in the first path list does not successfully match all second regular expressions, the element in the first path list is not replaced. Finally, after the first path list corresponding to each network request is matched, the replaced first path list is spliced as the target path corresponding to each network request, and the request type, request domain name and target path of the network request are used as the asset path of the network request.

Optionally, in the management method of application interface assets provided in Example 1 of the present application, first asset information containing sensitive information in an asset information set is determined by using a regular expression, the first asset information is marked, and the asset information in the asset information set is updated, including: using a third regular expression set to match each network request in a request parameter set to obtain a third matching result, wherein the third regular expression set includes a set of regular expressions constructed based on different sensitive information types; when the third matching result indicates a successful match, determining in the asset information set the asset information corresponding to the successfully matched network request to obtain the first asset information; determining the sensitive information type of the first asset information based on the third matching result, and updating the asset information set using the sensitive information type of the first asset information.

In the first embodiment, a corresponding regular expression can be configured according to at least one sensitive information type involved in the API asset, that is, the third regular expression set mentioned above, and each third regular expression in the third regular expression set is matched with the request parameters in each network request. If the match is successful, the sensitive information identifier corresponding to the third regular expression (such as the rule tag value in Table 4), that is, the first asset information mentioned above, is added to the network request, thereby determining the sensitive information type of the sensitive information involved in each API asset in the asset information set, and updating the asset information set. Among them, the third regular expression in the third regular expression set can be as shown in Table 4.

Table 4

Optionally, in the application interface asset management method provided in Example 1 of the present application, before determining the application interface assets included in the request parameter set through a preset regular expression to obtain the asset information set, the above method also includes: determining the aggregation rules of the application interface assets based on business needs; configuring the regular expression based on the aggregation rules to obtain the preset regular expression, and loading the preset regular expression.

In the first embodiment of the present invention, in order to flexibly adjust the aggregation results of API assets according to business needs, the aggregation rules of the API can be flexibly configured and/or adjusted according to business needs, and the corresponding regular expressions, i.e., the above-mentioned preset regular expressions (e.g., the above-mentioned first regular expression, the above-mentioned second regular expression, the above-mentioned third regular expression) are configured according to the determined aggregation rules, and it is necessary to pre-load the configured aggregation rules before parsing the network traffic data so as to parse the collected network traffic data in real time. In addition, in an optional embodiment, the preset regular expression can also be loaded into the keyby operator, and multiple network requests can be parsed in parallel through the keyby operator, thereby achieving the effect of improving the processing efficiency of network requests, and further achieving the effect of ensuring the real-time management of API assets.

In an optional embodiment, when business personnel need to replace the aggregation rules (for example, business personnel find that there is unclustered API asset information in the preset database, or API asset information with incorrect clustering results), the parsing rules can be adjusted according to the API asset information in the preset database, that is, the above-mentioned higher-priority aggregation rules, and the first regular expression corresponding to the higher-priority aggregation rules can be adjusted accordingly, and then the adjusted first regular expression can be reconfigured and loaded to continue processing the http data stream subsequently.

Optionally, in the application interface asset management method provided in Example 1 of the present application, updating the asset information in the preset database based on the target asset information includes: when the target asset information is inconsistent with the asset information in the preset database, updating the corresponding asset information in the preset database based on the target asset information; when the target asset information is consistent with the asset information in the preset database, updating the time information of the corresponding asset information in the target asset information in the preset database.

In the first embodiment of the present invention, in order to ensure the real-time nature of the API asset information in the preset database, it is necessary to compare the target asset information with the API asset information stored in the preset database after the target asset information is counted, and compare whether the network request information, API asset type, quantity, and sensitive information type of the API assets in the two are consistent. If not, the API asset information in the preset database is updated according to the target asset information. For example, if there is one more API asset of type jpg in the target asset information than in the preset database, the API asset is added to the preset database and the update time is recorded; if not, the update time of the API asset contained in the target asset information in the preset database is updated according to the current moment to ensure the real-time nature of the API asset information. Business personnel can also adjust the aggregation rules according to the updated asset information in the preset database, and load the aggregation rules so that the adjusted aggregation rules can be used to parse the http data stream later.

Optionally, in the first embodiment of the present invention, the process of updating API asset information in real time in this scheme can be shown in FIG2. First, the http data stream is collected through the flow probe, the http data stream is formatted, and the request parameters of each http request in the http data stream are extracted to obtain the above-mentioned request parameter set. Then, the first regular expression with a higher priority is used to match the request parameters of each network request in the request parameter set. If the match is successful, the next network request is matched. If the match is unsuccessful, multiple second regular expressions are used for matching, and the asset information of each network request is parsed to obtain the asset information, and the sensitive information type of each network request involving sensitive information is marked to obtain the above-mentioned asset information set. Finally, the API assets in the http data stream are aggregated according to the asset information of each network request, and the sensitive information type involved in each type of asset information is counted to obtain the above-mentioned target asset information, and the API asset information in the preset database (such as the API asset library in FIG2) is updated according to the target asset information to ensure the real-time performance of the data.

It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

Embodiment 2

The second embodiment of the present application also provides a management device for application program interface assets. It should be noted that the management device for application program interface assets in the second embodiment of the present application can be used to execute the management method for application program interface assets provided in the first embodiment of the present application. The management device for application program interface assets provided in the second embodiment of the present application is introduced below.

Fig. 3 is a schematic diagram of an application program interface asset management device according to the second embodiment of the present application. As shown in Fig. 3 , the device includes: an extraction unit 301 , an aggregation unit 302 , a statistics unit 303 and an update unit 304 .

Specifically, the extraction unit 301 is used to extract the asset information of the application interface assets contained in each network request in the network traffic data when the network traffic data is received, and obtain an asset information set, wherein the asset information includes at least the following information: asset path, request type, and sensitive information type, and the sensitive information type refers to the type of sensitive information when the application interface asset contains sensitive information.

The aggregation unit 302 is used to aggregate the asset information in the asset information set according to the asset path and the request type to obtain N types of asset information, where N is a positive integer.

The statistical unit 303 is used to count the sensitive information types involved in each type of asset information in N types of asset information based on the asset information set to obtain target asset information.

The updating unit 304 is used to update the asset information in the preset database according to the target asset information so as to manage the application program interface assets in the network traffic data, wherein the preset database stores the asset information of the application program interface assets.

The second embodiment of the present application provides an application interface asset management device. When receiving network traffic data, the extraction unit 301 extracts the asset information of the application interface asset contained in each network request in the network traffic data to obtain an asset information set, wherein the asset information includes at least the following information: asset path, request type, and sensitive information type, wherein the sensitive information type refers to the type of sensitive information when the application interface asset contains sensitive information; the aggregation unit 302 aggregates the asset information in the asset information set according to the asset path and the request type to obtain N types of asset information, wherein N is a positive integer; the statistical unit 303 counts the sensitive information type involved in each type of asset information in the N types of asset information according to the asset information set to obtain target asset information; the update unit 304 updates the asset information in the preset database according to the target asset information to manage the application interface assets in the network traffic data, wherein the preset database stores the asset information of the application interface assets, and solves the problem of poor timeliness of managing application interface assets in the related art due to the large amount of network traffic data when managing application interface assets in network traffic data. By extracting and aggregating a large number of API assets requested by network traffic data, and updating the API asset information in the preset database in batches according to the aggregated asset information, it is possible to extract key information and remove redundant information to assist business personnel in managing API assets, thereby ensuring the real-time nature of API asset information and enabling business personnel to manage API assets in real time. At the same time, by counting sensitive information types, it is helpful for business personnel to configure corresponding security measures for API assets according to the sensitive information types, thereby ensuring data security.

Optionally, in the application interface asset management device provided in Example 2 of the present application, the above-mentioned extraction unit 301 includes: an extraction sub-unit, used to extract request parameters of each network request in the network traffic data to obtain a request parameter set, wherein the request parameters include at least the following field information: request domain name, request path, request parameters, response parameters, request type; a first determination sub-unit, used to determine the application interface assets included in the request parameter set through a preset regular expression to obtain an asset information set; a marking sub-unit, used to determine the first asset information containing sensitive information in the asset information set through a regular expression, mark the first asset information, and update the asset information in the asset information set.

Optionally, in the application program interface asset management device provided in Example 2 of the present application, the above-mentioned determination subunit includes: a first matching module, which is used to use a first regular expression to match the target parameter of each network request in the request parameter set to obtain a first matching result, wherein the target parameter at least includes the following field information: request domain name, request path; a first determination module, which is used to determine the first network request corresponding to the first matching result when the first matching result indicates a successful match, and generate the asset path of the first network request; a second matching module, which is used to use multiple second regular expressions to match the request path of the second network request when the first matching result indicates a failed match, and obtain a second matching result, and generate the asset path of the second network request based on the second matching result, wherein the second network request refers to the network request other than the first network request in the request parameter set; a combination module, which is used to combine the request type of the first network request, the asset path of the first network request, the request type of the second network request and the asset path of the second network request to obtain an asset information set.

Optionally, in the application program interface asset management device provided in Example 2 of the present application, the above-mentioned second matching module includes: a splitting submodule, which is used to split the request path of each second network request according to preset characters to obtain a first path list for each second network request; a matching submodule, which is used to use multiple second regular expressions to perform regular matching on each element in the first path list in turn to obtain a third matching result, wherein the multiple second regular expressions are regular expressions constructed according to different aggregation rules; a replacement submodule, which is used to replace the successfully matched elements with a second preset string when the third matching result indicates a successful match to obtain a second path list for each second network request; a splicing submodule, which is used to splice the elements in the second path list to obtain the target path of each second network request, and generate the asset path of the second network request based on the request parameters of each second network request and the target path of each second network request.

Optionally, in the application interface asset management device provided in Example 2 of the present application, the above-mentioned annotation sub-unit includes: a third matching module, used to use a third regular expression set to match each network request in the request parameter set to obtain a third matching result, wherein the third regular expression set includes a set of regular expressions constructed according to different sensitive information types; a second determination module, used to determine the asset information corresponding to the successfully matched network request in the asset information set when the third matching result indicates a successful match, and obtain the first asset information; an update module, used to determine the sensitive information type of the first asset information based on the third matching result, and update the asset information set using the sensitive information type of the first asset information.

Optionally, in the application interface asset management device provided in Example 2 of the present application, the above-mentioned extraction unit 301 also includes: a second determination sub-unit, used to determine the application interface assets included in the request parameter set through a preset regular expression, and before obtaining the asset information set, determine the aggregation rules of the application interface assets according to business needs; a loading sub-unit, used to configure the regular expression according to the aggregation rule, obtain the preset regular expression, and load the preset regular expression.

Optionally, in the application interface asset management device provided in Example 2 of the present application, the above-mentioned update unit 304 includes: a first update sub-unit, used to update the corresponding asset information in the preset database according to the target asset information when the target asset information is inconsistent with the asset information in the preset database; a second update sub-unit, used to update the time information of the corresponding asset information in the target asset information in the preset database when the target asset information is consistent with the asset information in the preset database.

The management device of the application interface assets includes a processor and a memory. The above-mentioned extraction unit 301, aggregation unit 302, statistics unit 303 and update unit 304 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the real-time performance of managing API assets can be improved by adjusting kernel parameters.

The memory may include non-permanent memory in a computer-readable medium, in the form of random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

Embodiment 3 of the present application provides a computer-readable storage medium having a program stored thereon, which implements a method for managing application program interface assets when executed by a processor.

Embodiment 4 of the present application provides a processor, which is used to run a program, wherein the method for managing application program interface assets is executed when the program is running.

As shown in Figure 4, embodiment 5 of the present application provides an electronic device, the device includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: when receiving network traffic data, extract the asset information of the application interface asset contained in each network request in the network traffic data to obtain an asset information set, wherein the asset information includes at least the following information: asset path, request type, sensitive information type, and the sensitive information type refers to the type of sensitive information of the application interface asset when it contains sensitive information; aggregate the asset information in the asset information set according to the asset path and the request type to obtain N types of asset information, wherein N is a positive integer; count the sensitive information type involved in each type of asset information in the N types of asset information according to the asset information set to obtain target asset information; update the asset information in the preset database according to the target asset information to manage the application interface assets in the network traffic data, wherein the preset database stores the asset information of the application interface assets.

When the processor executes the program, the following steps are also implemented: extracting the asset information of the application interface assets contained in each network request in the network traffic data, and obtaining an asset information set including: extracting the request parameters of each network request in the network traffic data, and obtaining a request parameter set, wherein the request parameters at least include the following field information: request domain name, request path, request parameters, response parameters, and request type; determining the application interface assets contained in the request parameter set through a preset regular expression, and obtaining an asset information set; determining the first asset information containing sensitive information in the asset information set through a regular expression, marking the first asset information, and updating the asset information in the asset information set.

When the processor executes the program, the following steps are also implemented: determining the application program interface assets included in the request parameter set by a preset regular expression, and obtaining the asset information set includes: using a first regular expression to match the target parameter of each network request in the request parameter set to obtain a first matching result, wherein the target parameter at least includes the following field information: request domain name, request path; when the first matching result indicates a successful match, determining the first network request corresponding to the first matching result, and generating the asset path of the first network request; when the first matching result indicates a failed match, using multiple second regular expressions to match the request path of the second network request to obtain a second matching result, and generating the asset path of the second network request based on the second matching result, wherein the second network request refers to a network request other than the first network request in the request parameter set; combining the request type of the first network request, the asset path of the first network request, the request type of the second network request, and the asset path of the second network request to obtain the asset information set.

When the processor executes the program, the following steps are also implemented: using multiple second regular expressions to match the request path of the second network request to obtain a second matching result, and generating the asset path of the second network request based on the second matching result includes: splitting the request path of each second network request according to preset characters to obtain a first path list of each second network request; using multiple second regular expressions to perform regular matching on each element in the first path list in turn to obtain a third matching result, wherein the multiple second regular expressions are regular expressions constructed according to different aggregation rules; when the third matching result indicates a successful match, using a second preset string to replace the successfully matched element to obtain a second path list of each second network request; splicing the elements in the second path list to obtain a target path of each second network request, and generating the asset path of the second network request based on the request parameters of each second network request and the target path of each second network request.

When the processor executes the program, the following steps are also implemented: determining the first asset information containing sensitive information in the asset information set through a regular expression, marking the first asset information, and updating the asset information in the asset information set, including: using a third regular expression set to match each network request in the request parameter set to obtain a third matching result, wherein the third regular expression set includes a set of regular expressions constructed based on different sensitive information types; when the third matching result indicates a successful match, determining the asset information corresponding to the successfully matched network request in the asset information set to obtain the first asset information; determining the sensitive information type of the first asset information based on the third matching result, and using the sensitive information type of the first asset information to update the asset information set.

When the processor executes the program, the following steps are also implemented: before determining the application interface assets included in the request parameter set through a preset regular expression and obtaining the asset information set, the above method also includes: determining the aggregation rules of the application interface assets based on business needs; configuring the regular expression based on the aggregation rules, obtaining the preset regular expression, and loading the preset regular expression.

When the processor executes the program, the following steps are also implemented: Updating the asset information in the preset database based on the target asset information includes: when the target asset information is inconsistent with the asset information in the preset database, updating the corresponding asset information in the preset database based on the target asset information; when the target asset information is consistent with the asset information in the preset database, updating the time information of the corresponding asset information in the target asset information in the preset database.

The devices in this article can be servers, PCs, PADs, mobile phones, etc.

The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: when network traffic data is received, extracting the asset information of the application interface assets contained in each network request in the network traffic data to obtain an asset information set, wherein the asset information includes at least the following information: asset path, request type, sensitive information type, and the sensitive information type refers to the type of sensitive information of the application interface asset when it contains sensitive information; aggregating the asset information in the asset information set according to the asset path and request type to obtain N types of asset information, wherein N is a positive integer; counting the sensitive information type involved in each type of asset information in the N types of asset information according to the asset information set to obtain target asset information; and updating the asset information in the preset database according to the target asset information to manage the application interface assets in the network traffic data, wherein the preset database stores the asset information of the application interface assets.

When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: extracting asset information of application interface assets contained in each network request in network traffic data to obtain an asset information set including: extracting request parameters of each network request in network traffic data to obtain a request parameter set, wherein the request parameters include at least the following field information: request domain name, request path, request parameters, response parameters, request type; determining the application interface assets contained in the request parameter set by a preset regular expression to obtain an asset information set; determining the first asset information containing sensitive information in the asset information set by a regular expression, marking the first asset information, and updating the asset information in the asset information set.

When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: determining the application interface assets included in the request parameter set by a preset regular expression, and obtaining the asset information set includes: using a first regular expression to match the target parameter of each network request in the request parameter set to obtain a first matching result, wherein the target parameter at least includes the following field information: request domain name, request path; when the first matching result indicates a successful match, determining the first network request corresponding to the first matching result, and generating the asset path of the first network request; when the first matching result indicates a failed match, using multiple second regular expressions to match the request path of the second network request to obtain a second matching result, and generating the asset path of the second network request based on the second matching result, wherein the second network request refers to the network request other than the first network request in the request parameter set; combining the request type of the first network request, the asset path of the first network request, the request type of the second network request, and the asset path of the second network request to obtain the asset information set.

When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: using multiple second regular expressions to match the request path of the second network request to obtain a second matching result, and generating the asset path of the second network request based on the second matching result, including: splitting the request path of each second network request according to preset characters to obtain a first path list of each second network request; using multiple second regular expressions to perform regular matching on each element in the first path list in turn to obtain a third matching result, wherein the multiple second regular expressions are regular expressions constructed based on different aggregation rules; when the third matching result indicates a successful match, using a second preset string to replace the successfully matched element to obtain a second path list for each second network request; splicing the elements in the second path list to obtain a target path for each second network request, and generating the asset path of the second network request based on the request parameters of each second network request and the target path of each second network request.

When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: determining first asset information containing sensitive information in an asset information set through a regular expression, marking the first asset information, and updating the asset information in the asset information set, including: using a third regular expression set to match each network request in a request parameter set to obtain a third matching result, wherein the third regular expression set includes a set of regular expressions constructed based on different sensitive information types; when the third matching result indicates a successful match, determining in the asset information set the asset information corresponding to the successfully matched network request to obtain the first asset information; determining the sensitive information type of the first asset information based on the third matching result, and using the sensitive information type of the first asset information to update the asset information set.

When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: before determining the application interface assets included in the request parameter set through a preset regular expression and obtaining the asset information set, the above method also includes: determining the aggregation rules of the application interface assets based on business needs; configuring the regular expression based on the aggregation rules to obtain the preset regular expression, and loading the preset regular expression.

When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: updating the asset information in a preset database based on target asset information, including: when the target asset information is inconsistent with the asset information in the preset database, updating the corresponding asset information in the preset database based on the target asset information; when the target asset information is consistent with the asset information in the preset database, updating the time information of the corresponding asset information in the target asset information in the preset database.

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

The present application is described with reference to the flowchart and/or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and/or box in the flowchart and/or block diagram, and the combination of the process and/or box in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims (10)

A method for managing application program interface assets, comprising: When network traffic data is received, asset information of the application program interface asset contained in each network request in the network traffic data is extracted to obtain an asset information set, wherein the asset information includes at least the following information: asset path, request type, and sensitive information type, wherein the sensitive information type refers to the type of sensitive information when the application program interface asset contains sensitive information; Aggregating the asset information in the asset information set according to the asset path and the request type to obtain N types of asset information, where N is a positive integer; According to the asset information set, the sensitive information type involved in each type of asset information in the N types of asset information is counted to obtain target asset information; The asset information in a preset database is updated according to the target asset information to manage the application program interface assets in the network traffic data, wherein the preset database stores the asset information of the application program interface assets. The method according to claim 1, wherein extracting the asset information of the application program interface asset contained in each network request in the network traffic data to obtain the asset information set comprises: Extracting request parameters of each network request in the network traffic data to obtain a request parameter set, wherein the request parameters at least include the following field information: request domain name, request path, request parameters, response parameters, and the request type; Determine the application program interface assets included in the request parameter set by using a preset regular expression to obtain an asset information set; The first asset information containing sensitive information in the asset information set is determined by using the regular expression, the first asset information is marked, and the asset information in the asset information set is updated. The method according to claim 2, wherein determining the application program interface assets included in the request parameter set by a preset regular expression to obtain the asset information set comprises: A first regular expression is used to match the target parameter of each network request in the request parameter set to obtain a first matching result, wherein the target parameter at least includes the following field information: the request domain name and the request path; If the first matching result indicates a successful match, determining a first network request corresponding to the first matching result, and generating the asset path of the first network request; When the first matching result indicates a matching failure, multiple second regular expressions are used to match the request path of the second network request to obtain a second matching result, and the asset path of the second network request is generated according to the second matching result, wherein the second network request refers to a network request other than the first network request in the request parameter set; The request type of the first network request, the asset path of the first network request, the request type of the second network request, and the asset path of the second network request are combined to obtain the asset information set. According to the method of claim 3, wherein using a plurality of second regular expressions to match the request path of the second network request to obtain a second matching result, and generating the asset path of the second network request according to the second matching result comprises: Splitting the request path of each second network request according to preset characters to obtain a first path list of each second network request; Using the multiple second regular expressions to perform regular matching on each element in the first path list in turn to obtain a third matching result, wherein the multiple second regular expressions are regular expressions constructed according to different aggregation rules; When the third matching result indicates a successful match, the second preset character string is used to replace the successfully matched element to obtain a second path list for each second network request; The elements in the second path list are concatenated to obtain the target path of each second network request, and the asset path of the second network request is generated according to the request parameters of each second network request and the target path of each second network request. The method according to claim 2, wherein determining the first asset information containing sensitive information in the asset information set by the regular expression, marking the first asset information, and updating the asset information in the asset information set comprises: Using a third regular expression set to match each network request in the request parameter set to obtain a third matching result, wherein the third regular expression set includes a set of regular expressions constructed according to different sensitive information types; If the third matching result indicates a successful match, determine the asset information corresponding to the successfully matched network request in the asset information set to obtain the first asset information; The sensitive information type of the first asset information is determined according to the third matching result, and the asset information set is updated using the sensitive information type of the first asset information. The method according to claim 2, wherein before determining the application program interface assets included in the request parameter set by using a preset regular expression to obtain the asset information set, the method further comprises: Determine aggregation rules for the application program interface assets according to business requirements; A regular expression is configured according to the aggregation rule to obtain the preset regular expression, and the preset regular expression is loaded. The method according to claim 1, wherein updating the asset information in the preset database according to the target asset information comprises: When the target asset information is inconsistent with the asset information in the preset database, updating the corresponding asset information in the preset database according to the target asset information; When the target asset information is consistent with the asset information in the preset database, the time information of the corresponding asset information in the target asset information is updated in the preset database. A management device for application program interface assets, comprising: The extraction unit is used to extract the asset information of the application program interface asset contained in each network request in the network flow data when the network flow data is received, and obtain an asset information set, wherein the asset information at least includes the following information: asset path, request type, sensitive information type, and the sensitive information type refers to the type of sensitive information when the application program interface asset contains sensitive information; an aggregation unit, configured to aggregate the asset information in the asset information set according to the asset path and the request type to obtain N types of asset information, where N is a positive integer; A statistical unit, configured to count the sensitive information type involved in each type of asset information in the N types of asset information according to the asset information set, to obtain target asset information; An updating unit is used to update the asset information in a preset database according to the target asset information so as to manage the application program interface assets in the network traffic data, wherein the preset database stores the asset information of the application program interface assets. A computer-readable storage medium, the computer-readable storage medium comprising a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method for managing application program interface assets as described in any one of claims 1 to 7. An electronic device comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for managing application program interface assets as described in any one of claims 1 to 7.