伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(M...伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(MCP)无缝通信智能体,提出一种隐藏API发现和漏洞检测的智能体系统A2A(Agent to API vulnerability detection)来实现从API发现到漏洞检测的全流程自动化。A2A通过自适应枚举和HTTP响应分析自动识别潜在的隐藏API端点,并结合服务特定的API指纹库进行隐藏API的确认和发现。A2A在API漏洞检测上则是结合大语言模型(LLM)与检索增强生成(RAG)技术,并通过反馈迭代优化策略,自动生成高质量测试用例以验证漏洞是否存在。实验评估结果表明,A2A的平均API发现率为91.9%,假发现率为7.8%,并成功发现NAUTILUS和RESTler未能检测到的多个隐藏API漏洞。展开更多
With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raisin...With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raising increasing concerns about their security.Existing fuzz testing methods include random or dictionary-based input generation,which often fail to ensure both syntactic and semantic correctness,and OpenAPIbased approaches,which offer better accuracy but typically lack detailed descriptions of endpoints,parameters,or data formats.To address these issues,this paper proposes the APIDocX fuzz testing framework.It introduces a crawler tailored for dynamic web pages that automatically simulates user interactions to trigger APIs,capturing and extracting parameter information from communication packets.A multi-endpoint parameter adaptation method based on improved Jaccard similarity is then used to generalize these parameters to other potential API endpoints,filling in gaps in OpenAPI specifications.Experimental results demonstrate that the extracted parameters can be generalized with 79.61%accuracy.Fuzz testing using the enriched OpenAPI documents leads to improvements in test coverage,the number of valid test cases generated,and fault detection capabilities.This approach offers an effective enhancement to automated REST API security testing.展开更多
The resting zone(RZ)in mammalian growth plates is critical for maintaining and regulating chondrocyte turnover during longitudinal bone growth as a control tower and stem cell reservoir.Although recent lineage tracing...The resting zone(RZ)in mammalian growth plates is critical for maintaining and regulating chondrocyte turnover during longitudinal bone growth as a control tower and stem cell reservoir.Although recent lineage tracing studies have identified several markers for stem cells in the RZ,these markers only partially label chondrocytes in the RZ,suggesting that the resting chondrocytes(RCs)are a heterogeneous population with different types of stem cells.Since a comprehensive marker for RCs is still lacking,the RZ is generally determined based on ambiguous histological criteria,such as small and round chondrocytes without columnar formation,which may lead to inconsistencies among researchers.Therefore,in this study,we used single-cell RNA sequencing(scRNAseq)of growth plate chondrocytes followed by validation by fluorescence in situ hybridization(FISH)to precisely annotate cell clusters in scRNAseq and search for a marker of RCs.The scRNAseq analysis revealed that apolipoprotein E(Apoe)was the tophit gene,which was ubiquitously expressed in the RC cluster.FISH confirmed that Apoe was exclusively localized to the histologically defined RZ.In newly generated Apoe^(mCherry)knock-in mice,we further confirmed that mCherry expression mirrored the distribution of Apoe-expressing chondrocytes in the RZ particularly after the formation of the secondary ossification center.These mCherry+RCs were slow cycling in vivo and exhibited stem cell properties in vitro.Moreover,APOE was detected in human growth plate RCs.These findings suggest that apolipoprotein E is a novel pan-RC marker in both mouse and human growth plates.展开更多
AIM:To analyze whether alterations of voxel mirror homology connectivity(VMHC)values,as determined by resting-state functional magnetic resonance imaging(rsfMRI),occur in cerebral regions of patients with hypertensive...AIM:To analyze whether alterations of voxel mirror homology connectivity(VMHC)values,as determined by resting-state functional magnetic resonance imaging(rsfMRI),occur in cerebral regions of patients with hypertensive retinopathy(HR)and to determine the relationship between VMHC values and clinical characteristics in patients with HR.METHODS:Twenty-one patients with HR and 21 agematched healthy controls(HCs)were assessed by rsfMRI scanning.The functional connectivity between the hemispheres of the cerebrum was assessed by measuring VMHC,with the ability of VMHC to distinguish between the HR and HC groups assessed using receiver operating characteristic(ROC)curve analysis.Differences in the demographic and clinical characteristics of the HR and HC groups were analyzed by independent sample t-tests.The relationship between average VMHC in several brain areas of HR patients and clinical features was determined using Pearson correlation analysis.RESULTS:Mean VMHC values of the bilateral cuneus gyrus(BA19),bilateral middle orbitofrontal gyrus(BA47),bilateral middle temporal gyrus(BA39)and bilateral superior medial frontal gyrus(BA9)were lower in the HR than in the HC group.CONCLUSION:VMHC values can predict the development of early HR,prevent the transformation of hypertensive microangiopathy,and provide useful information explaining the changes in neural mechanism associated with HR.展开更多
RESTful APIs have been adopted as the standard way of developing web services,allowing for smooth communication between clients and servers.Their simplicity,scalability,and compatibility have made them crucial to mode...RESTful APIs have been adopted as the standard way of developing web services,allowing for smooth communication between clients and servers.Their simplicity,scalability,and compatibility have made them crucial to modern web environments.However,the increased adoption of RESTful APIs has simultaneously exposed these interfaces to significant security threats that jeopardize the availability,confidentiality,and integrity of web services.This survey focuses exclusively on RESTful APIs,providing an in-depth perspective distinct from studies addressing other API types such as GraphQL or SOAP.We highlight concrete threats-such as injection attacks and insecure direct object references(IDOR)-to illustrate the evolving risk landscape.Our work systematically reviews state-of-the-art detection methods,including static code analysis and penetration testing,and proposes a novel taxonomy that categorizes vulnerabilities such as authentication and authorization issues.Unlike existing taxonomies focused on general web or network-level threats,our taxonomy emphasizes API-specific design flaws and operational dependencies,offering a more granular and actionable framework for RESTful API security.By critically assessing current detection methodologies and identifying key research gaps,we offer a structured framework that advances the understanding and mitigation of RESTful API vulnerabilities.Ultimately,this work aims to drive significant advancements in API security,thereby enhancing the resilience of web services against evolving cyber threats.展开更多
The dependence of energy metabolism on temperature is universally recognized as a critical physiological hallmark for evaluating the susceptibility of ectothermic organisms to global warming.However,the underlying phy...The dependence of energy metabolism on temperature is universally recognized as a critical physiological hallmark for evaluating the susceptibility of ectothermic organisms to global warming.However,the underlying physiological and biochemical bases of this temperature dependence remain largely unknown.In this study,we conducted a simulated climate warming experiment under seminatural enclosure conditions and compared the differences in resting metabolic rate (RMR) and key metabolic enzyme activities between the warming and control groups of Takydromus septentrionalis at various test temperatures.We found that the activities of hexokinase,lactate dehydrogenase,alanine aminotransferase and acetyl-CoA carboxylase of T.septentrionalis were not affected by climate warming,despite a decrease in RMR measured at high temperatures of 34°C and 38°C.Overall,these findings suggest that artificial warming simulating climate change can lead to a decline in RMR,but does not alter the activity of key metabolic enzymes.Our study provides insight into how climate warming influences the energy metabolism of lizards.展开更多
AIM:To assess the alterations in the resting-state function connections between the two cerebral hemispheres in patients with optic neuritis(ON)and healthy controls(HCs).METHODS:A total of 12 ON patients(six males and...AIM:To assess the alterations in the resting-state function connections between the two cerebral hemispheres in patients with optic neuritis(ON)and healthy controls(HCs).METHODS:A total of 12 ON patients(six males and six females)and 12 HCs(six males and six females)who were highly matched for sex,age,and educational level were recruited.They underwent functional magnetic resonance imaging(fMRI),testing and brain activities were assessed using the degree centrality(DC)method.Correlation analysis between the mean DC values in specific brain areas and behavior performances was analyzed as well.Linear correlations between A anxiety scale(AS)and depression scale(DS)values and DC values in brain regions of patients with ON were also analyzed.RESULTS:The areas that showed a higher DC value in ON patients were the right angular gyrus and bilateral precuneus,while the left insula and left superior temporal gyrus(LSTG)were regions that presented a lower DC value in ON patients.A receiver operating characteristic(ROC)curve analysis confirmed the accuracy of the area under the curve(AUC)assessment.Linear analysis showed anxiety scale(AS)and depression scale(DS)values in the left insula were both negatively correlated with DC values,while best corrected visual acuity logMAR-R(BCVA logMAR-R)showed a negative correlation with DC in the LSTG.CONCLUSION:The study explores altered brain activities of specific regions in patients with ON.The results provide clues for revealing the underlying mechanism of ON development.展开更多
Dear Editor,Sleep deprivation and loss can have detrimental effects on brain function.Among common patterns of sleep loss are delayed sleep onset(early night sleep loss,EL)and premature awakening(late night sleep loss...Dear Editor,Sleep deprivation and loss can have detrimental effects on brain function.Among common patterns of sleep loss are delayed sleep onset(early night sleep loss,EL)and premature awakening(late night sleep loss,LL).Here,we investigated the distinct impacts of EL and LL on resting-state brain activity.A total of 100 healthy students from several universities in Beijing were recruited and randomly assigned to one of three groups:EL,LL,or full sleep(FS).Restingstate functional magnetic resonance imaging(rs-fMRI)scans were conducted following the sleep manipulations.Compared to the FS group,the LL group showed abnormal low-frequency fluctuation(fALFF)in the prefrontal cortex and insula.展开更多
文摘伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(MCP)无缝通信智能体,提出一种隐藏API发现和漏洞检测的智能体系统A2A(Agent to API vulnerability detection)来实现从API发现到漏洞检测的全流程自动化。A2A通过自适应枚举和HTTP响应分析自动识别潜在的隐藏API端点,并结合服务特定的API指纹库进行隐藏API的确认和发现。A2A在API漏洞检测上则是结合大语言模型(LLM)与检索增强生成(RAG)技术,并通过反馈迭代优化策略,自动生成高质量测试用例以验证漏洞是否存在。实验评估结果表明,A2A的平均API发现率为91.9%,假发现率为7.8%,并成功发现NAUTILUS和RESTler未能检测到的多个隐藏API漏洞。
基金supported by the Open Foundation of Key Laboratory of Cyberspace Security,Ministry of Education of China(KLCS20240211)。
文摘With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raising increasing concerns about their security.Existing fuzz testing methods include random or dictionary-based input generation,which often fail to ensure both syntactic and semantic correctness,and OpenAPIbased approaches,which offer better accuracy but typically lack detailed descriptions of endpoints,parameters,or data formats.To address these issues,this paper proposes the APIDocX fuzz testing framework.It introduces a crawler tailored for dynamic web pages that automatically simulates user interactions to trigger APIs,capturing and extracting parameter information from communication packets.A multi-endpoint parameter adaptation method based on improved Jaccard similarity is then used to generalize these parameters to other potential API endpoints,filling in gaps in OpenAPI specifications.Experimental results demonstrate that the extracted parameters can be generalized with 79.61%accuracy.Fuzz testing using the enriched OpenAPI documents leads to improvements in test coverage,the number of valid test cases generated,and fault detection capabilities.This approach offers an effective enhancement to automated REST API security testing.
基金supported by the National Institute of Arthritis and Musculoskeletal and Skin Diseases of the National Institutes of Health (R01AR075733, R01AR083363, R21AR077654 to S.O.)by the Maryland Stem Cell Research Fund (MSCRF) Discovery Grant (2023-MSCRFD-6160 to S.O.)supported by the Post-Doctoral Fellowship from MSCRF (2023-MSCRFF-6176)
文摘The resting zone(RZ)in mammalian growth plates is critical for maintaining and regulating chondrocyte turnover during longitudinal bone growth as a control tower and stem cell reservoir.Although recent lineage tracing studies have identified several markers for stem cells in the RZ,these markers only partially label chondrocytes in the RZ,suggesting that the resting chondrocytes(RCs)are a heterogeneous population with different types of stem cells.Since a comprehensive marker for RCs is still lacking,the RZ is generally determined based on ambiguous histological criteria,such as small and round chondrocytes without columnar formation,which may lead to inconsistencies among researchers.Therefore,in this study,we used single-cell RNA sequencing(scRNAseq)of growth plate chondrocytes followed by validation by fluorescence in situ hybridization(FISH)to precisely annotate cell clusters in scRNAseq and search for a marker of RCs.The scRNAseq analysis revealed that apolipoprotein E(Apoe)was the tophit gene,which was ubiquitously expressed in the RC cluster.FISH confirmed that Apoe was exclusively localized to the histologically defined RZ.In newly generated Apoe^(mCherry)knock-in mice,we further confirmed that mCherry expression mirrored the distribution of Apoe-expressing chondrocytes in the RZ particularly after the formation of the secondary ossification center.These mCherry+RCs were slow cycling in vivo and exhibited stem cell properties in vitro.Moreover,APOE was detected in human growth plate RCs.These findings suggest that apolipoprotein E is a novel pan-RC marker in both mouse and human growth plates.
基金Supported by National Natural Science Foundation of China(No.82160195,No.82460203).
文摘AIM:To analyze whether alterations of voxel mirror homology connectivity(VMHC)values,as determined by resting-state functional magnetic resonance imaging(rsfMRI),occur in cerebral regions of patients with hypertensive retinopathy(HR)and to determine the relationship between VMHC values and clinical characteristics in patients with HR.METHODS:Twenty-one patients with HR and 21 agematched healthy controls(HCs)were assessed by rsfMRI scanning.The functional connectivity between the hemispheres of the cerebrum was assessed by measuring VMHC,with the ability of VMHC to distinguish between the HR and HC groups assessed using receiver operating characteristic(ROC)curve analysis.Differences in the demographic and clinical characteristics of the HR and HC groups were analyzed by independent sample t-tests.The relationship between average VMHC in several brain areas of HR patients and clinical features was determined using Pearson correlation analysis.RESULTS:Mean VMHC values of the bilateral cuneus gyrus(BA19),bilateral middle orbitofrontal gyrus(BA47),bilateral middle temporal gyrus(BA39)and bilateral superior medial frontal gyrus(BA9)were lower in the HR than in the HC group.CONCLUSION:VMHC values can predict the development of early HR,prevent the transformation of hypertensive microangiopathy,and provide useful information explaining the changes in neural mechanism associated with HR.
文摘RESTful APIs have been adopted as the standard way of developing web services,allowing for smooth communication between clients and servers.Their simplicity,scalability,and compatibility have made them crucial to modern web environments.However,the increased adoption of RESTful APIs has simultaneously exposed these interfaces to significant security threats that jeopardize the availability,confidentiality,and integrity of web services.This survey focuses exclusively on RESTful APIs,providing an in-depth perspective distinct from studies addressing other API types such as GraphQL or SOAP.We highlight concrete threats-such as injection attacks and insecure direct object references(IDOR)-to illustrate the evolving risk landscape.Our work systematically reviews state-of-the-art detection methods,including static code analysis and penetration testing,and proposes a novel taxonomy that categorizes vulnerabilities such as authentication and authorization issues.Unlike existing taxonomies focused on general web or network-level threats,our taxonomy emphasizes API-specific design flaws and operational dependencies,offering a more granular and actionable framework for RESTful API security.By critically assessing current detection methodologies and identifying key research gaps,we offer a structured framework that advances the understanding and mitigation of RESTful API vulnerabilities.Ultimately,this work aims to drive significant advancements in API security,thereby enhancing the resilience of web services against evolving cyber threats.
基金supported by the National Natural Science Foundation of China (Grant Nos.32330067,31971419,32311530110,and 32171486)。
文摘The dependence of energy metabolism on temperature is universally recognized as a critical physiological hallmark for evaluating the susceptibility of ectothermic organisms to global warming.However,the underlying physiological and biochemical bases of this temperature dependence remain largely unknown.In this study,we conducted a simulated climate warming experiment under seminatural enclosure conditions and compared the differences in resting metabolic rate (RMR) and key metabolic enzyme activities between the warming and control groups of Takydromus septentrionalis at various test temperatures.We found that the activities of hexokinase,lactate dehydrogenase,alanine aminotransferase and acetyl-CoA carboxylase of T.septentrionalis were not affected by climate warming,despite a decrease in RMR measured at high temperatures of 34°C and 38°C.Overall,these findings suggest that artificial warming simulating climate change can lead to a decline in RMR,but does not alter the activity of key metabolic enzymes.Our study provides insight into how climate warming influences the energy metabolism of lizards.
基金Supported by National Natural Science Foundation of China(No.82160195No.82460203)Key R&D Program of Jiangxi Province(No.20223BBH80014).
文摘AIM:To assess the alterations in the resting-state function connections between the two cerebral hemispheres in patients with optic neuritis(ON)and healthy controls(HCs).METHODS:A total of 12 ON patients(six males and six females)and 12 HCs(six males and six females)who were highly matched for sex,age,and educational level were recruited.They underwent functional magnetic resonance imaging(fMRI),testing and brain activities were assessed using the degree centrality(DC)method.Correlation analysis between the mean DC values in specific brain areas and behavior performances was analyzed as well.Linear correlations between A anxiety scale(AS)and depression scale(DS)values and DC values in brain regions of patients with ON were also analyzed.RESULTS:The areas that showed a higher DC value in ON patients were the right angular gyrus and bilateral precuneus,while the left insula and left superior temporal gyrus(LSTG)were regions that presented a lower DC value in ON patients.A receiver operating characteristic(ROC)curve analysis confirmed the accuracy of the area under the curve(AUC)assessment.Linear analysis showed anxiety scale(AS)and depression scale(DS)values in the left insula were both negatively correlated with DC values,while best corrected visual acuity logMAR-R(BCVA logMAR-R)showed a negative correlation with DC in the LSTG.CONCLUSION:The study explores altered brain activities of specific regions in patients with ON.The results provide clues for revealing the underlying mechanism of ON development.
基金supported by the STI2030-Major Projects(2021ZD0202100,2021ZD0200801,and 2021ZD0201900)the National Natural Science Foundation of China(82130040,82288101).
文摘Dear Editor,Sleep deprivation and loss can have detrimental effects on brain function.Among common patterns of sleep loss are delayed sleep onset(early night sleep loss,EL)and premature awakening(late night sleep loss,LL).Here,we investigated the distinct impacts of EL and LL on resting-state brain activity.A total of 100 healthy students from several universities in Beijing were recruited and randomly assigned to one of three groups:EL,LL,or full sleep(FS).Restingstate functional magnetic resonance imaging(rs-fMRI)scans were conducted following the sleep manipulations.Compared to the FS group,the LL group showed abnormal low-frequency fluctuation(fALFF)in the prefrontal cortex and insula.
