伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(M...伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(MCP)无缝通信智能体,提出一种隐藏API发现和漏洞检测的智能体系统A2A(Agent to API vulnerability detection)来实现从API发现到漏洞检测的全流程自动化。A2A通过自适应枚举和HTTP响应分析自动识别潜在的隐藏API端点,并结合服务特定的API指纹库进行隐藏API的确认和发现。A2A在API漏洞检测上则是结合大语言模型(LLM)与检索增强生成(RAG)技术,并通过反馈迭代优化策略,自动生成高质量测试用例以验证漏洞是否存在。实验评估结果表明,A2A的平均API发现率为91.9%,假发现率为7.8%,并成功发现NAUTILUS和RESTler未能检测到的多个隐藏API漏洞。展开更多
With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raisin...With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raising increasing concerns about their security.Existing fuzz testing methods include random or dictionary-based input generation,which often fail to ensure both syntactic and semantic correctness,and OpenAPIbased approaches,which offer better accuracy but typically lack detailed descriptions of endpoints,parameters,or data formats.To address these issues,this paper proposes the APIDocX fuzz testing framework.It introduces a crawler tailored for dynamic web pages that automatically simulates user interactions to trigger APIs,capturing and extracting parameter information from communication packets.A multi-endpoint parameter adaptation method based on improved Jaccard similarity is then used to generalize these parameters to other potential API endpoints,filling in gaps in OpenAPI specifications.Experimental results demonstrate that the extracted parameters can be generalized with 79.61%accuracy.Fuzz testing using the enriched OpenAPI documents leads to improvements in test coverage,the number of valid test cases generated,and fault detection capabilities.This approach offers an effective enhancement to automated REST API security testing.展开更多
The method for malware detection based on Application Programming Interface(API)call sequences,as a primary research focus within dynamic detection technologies,currently lacks attention to subsequences of API calls,t...The method for malware detection based on Application Programming Interface(API)call sequences,as a primary research focus within dynamic detection technologies,currently lacks attention to subsequences of API calls,the variety of API call types,and the length of sequences.This oversight leads to overly complex call sequences.To address this issue,a dynamic malware detection approach based on multiple subsequences is proposed.Initially,APIs are remapped and encoded,with the introduction of percentile lengths to process sequences.Subsequently,a combination of One-Dimensional Convolutional Neural Network(1D-CNN)and Bidirectional Long Short-Term Memory(Bi-LSTM)networks,along with an attention mechanism,is employed to extract features from subsequences of varying lengths for feature fusion and classification.Experiments conducted on two widely used public API-based datasets,namelyMalBehavD-V1 and Alibaba Cloud,demonstrate that the proposedmethod reduces the number of API call types by approximately 20%compared to representative deep learning–based API sequence detection methods,while achieving a peak accuracy of 98.70%.Additionally,experimental results indicate that sequence length at the 95th percentile represents the optimal solution that balances classification performance and computational efficiency.展开更多
文摘伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(MCP)无缝通信智能体,提出一种隐藏API发现和漏洞检测的智能体系统A2A(Agent to API vulnerability detection)来实现从API发现到漏洞检测的全流程自动化。A2A通过自适应枚举和HTTP响应分析自动识别潜在的隐藏API端点,并结合服务特定的API指纹库进行隐藏API的确认和发现。A2A在API漏洞检测上则是结合大语言模型(LLM)与检索增强生成(RAG)技术,并通过反馈迭代优化策略,自动生成高质量测试用例以验证漏洞是否存在。实验评估结果表明,A2A的平均API发现率为91.9%,假发现率为7.8%,并成功发现NAUTILUS和RESTler未能检测到的多个隐藏API漏洞。
基金supported by the Open Foundation of Key Laboratory of Cyberspace Security,Ministry of Education of China(KLCS20240211)。
文摘With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raising increasing concerns about their security.Existing fuzz testing methods include random or dictionary-based input generation,which often fail to ensure both syntactic and semantic correctness,and OpenAPIbased approaches,which offer better accuracy but typically lack detailed descriptions of endpoints,parameters,or data formats.To address these issues,this paper proposes the APIDocX fuzz testing framework.It introduces a crawler tailored for dynamic web pages that automatically simulates user interactions to trigger APIs,capturing and extracting parameter information from communication packets.A multi-endpoint parameter adaptation method based on improved Jaccard similarity is then used to generalize these parameters to other potential API endpoints,filling in gaps in OpenAPI specifications.Experimental results demonstrate that the extracted parameters can be generalized with 79.61%accuracy.Fuzz testing using the enriched OpenAPI documents leads to improvements in test coverage,the number of valid test cases generated,and fault detection capabilities.This approach offers an effective enhancement to automated REST API security testing.
基金supported by the National Natural Science Foundation of China(62262020)the Graduate Education Innovation Project of Hubei Minzu University(MYK2024025).
文摘The method for malware detection based on Application Programming Interface(API)call sequences,as a primary research focus within dynamic detection technologies,currently lacks attention to subsequences of API calls,the variety of API call types,and the length of sequences.This oversight leads to overly complex call sequences.To address this issue,a dynamic malware detection approach based on multiple subsequences is proposed.Initially,APIs are remapped and encoded,with the introduction of percentile lengths to process sequences.Subsequently,a combination of One-Dimensional Convolutional Neural Network(1D-CNN)and Bidirectional Long Short-Term Memory(Bi-LSTM)networks,along with an attention mechanism,is employed to extract features from subsequences of varying lengths for feature fusion and classification.Experiments conducted on two widely used public API-based datasets,namelyMalBehavD-V1 and Alibaba Cloud,demonstrate that the proposedmethod reduces the number of API call types by approximately 20%compared to representative deep learning–based API sequence detection methods,while achieving a peak accuracy of 98.70%.Additionally,experimental results indicate that sequence length at the 95th percentile represents the optimal solution that balances classification performance and computational efficiency.
