부산대학교 도서관

API has become an indispensable component of information systems, facing various network security threats. This article proposes an API behavior anomaly detection method that utilizes deep learning features to compress and extract API data features, and uses adaptive clustering algorithms to detect API behavior anomalies. Extracting API behavior features through cross training of LSTM and autoencoder improves the model’s ability to synthesize attack behavior. Adaptive clustering of feature compressed data can identify unknown attack events. Experiments have shown that this method can effectively identify abnormal behavior of APIs and detect malicious attacks.