伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(M...伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(MCP)无缝通信智能体,提出一种隐藏API发现和漏洞检测的智能体系统A2A(Agent to API vulnerability detection)来实现从API发现到漏洞检测的全流程自动化。A2A通过自适应枚举和HTTP响应分析自动识别潜在的隐藏API端点,并结合服务特定的API指纹库进行隐藏API的确认和发现。A2A在API漏洞检测上则是结合大语言模型(LLM)与检索增强生成(RAG)技术,并通过反馈迭代优化策略,自动生成高质量测试用例以验证漏洞是否存在。实验评估结果表明,A2A的平均API发现率为91.9%,假发现率为7.8%,并成功发现NAUTILUS和RESTler未能检测到的多个隐藏API漏洞。展开更多
API(Application Programming Interface)documentation often only describes individual APIs and lacks information on complex API relations and code examples.Retrieval-based and generation-based methods can both produce d...API(Application Programming Interface)documentation often only describes individual APIs and lacks information on complex API relations and code examples.Retrieval-based and generation-based methods can both produce documentation that includes API relationship descriptions and code examples.However,they are limited by the richness of available API resources.As a result,they struggle to be effective when dealing with resource-scarce languages such as Kotlin.We propose an on-demand API tutorial generation method for resource-scarce languages,transferring API knowledge from a resource-rich language like Java to Kotlin using an AI chain.Evaluating our method on 500 Kotlin APIs,we generated more API documents than the state-of-the-art retrieval-based method ADECK and the generate-based method gDoc.The number of API guidelines generated by our method is 37 times that of ADECK and 1.6 times that of gDoc.Compared with the scheme that did not adopt the knowledge transfer strategy,the success rate of our method has increased by 31.25 percentage points.This demonstrates the feasibility and potential of using LLMs to create new API knowledge across languages.展开更多
文摘伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(MCP)无缝通信智能体,提出一种隐藏API发现和漏洞检测的智能体系统A2A(Agent to API vulnerability detection)来实现从API发现到漏洞检测的全流程自动化。A2A通过自适应枚举和HTTP响应分析自动识别潜在的隐藏API端点,并结合服务特定的API指纹库进行隐藏API的确认和发现。A2A在API漏洞检测上则是结合大语言模型(LLM)与检索增强生成(RAG)技术,并通过反馈迭代优化策略,自动生成高质量测试用例以验证漏洞是否存在。实验评估结果表明,A2A的平均API发现率为91.9%,假发现率为7.8%,并成功发现NAUTILUS和RESTler未能检测到的多个隐藏API漏洞。
基金Supported by the High-Level Research Fund(12225000404)。
文摘API(Application Programming Interface)documentation often only describes individual APIs and lacks information on complex API relations and code examples.Retrieval-based and generation-based methods can both produce documentation that includes API relationship descriptions and code examples.However,they are limited by the richness of available API resources.As a result,they struggle to be effective when dealing with resource-scarce languages such as Kotlin.We propose an on-demand API tutorial generation method for resource-scarce languages,transferring API knowledge from a resource-rich language like Java to Kotlin using an AI chain.Evaluating our method on 500 Kotlin APIs,we generated more API documents than the state-of-the-art retrieval-based method ADECK and the generate-based method gDoc.The number of API guidelines generated by our method is 37 times that of ADECK and 1.6 times that of gDoc.Compared with the scheme that did not adopt the knowledge transfer strategy,the success rate of our method has increased by 31.25 percentage points.This demonstrates the feasibility and potential of using LLMs to create new API knowledge across languages.
