检索结果-内蒙古大学图书馆

Automated broken object-level authorization attack detection in REST APIs through openapi to colored petri nets transformation

引用

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2025年第2期24卷 1-19页

作者： Santos Filho, Ailton Rodriguez, Ricardo J. Feitosa, Eduardo L. Fed Univ Amazonas UFAM Inst Comp Ave Gen Rodrigo Octavio Jordao Ramos1200-Coroado BR-69067005 Manaus AM Brazil Univ Zaragoza Inst Invest Ingn Aragon I3A Edificio IDiCalle Mariano Esquillor S-N Zaragoza 50018 Spain

The representational state transfer architectural style (REST) specifies a set of rules for creating web services. In REST, data and functionality are considered resources, accessed, and manipulated using a uniform, well-defined set of rules. RESTful web services are web services that follow the REST architectural style and are exposed to the Internet using RESTful APIs. Most of them are described by openapi, a standard language-independent interface for RESTful APIs. RESTful APIs are continuously available on the Internet and are therefore a common target for cyberattacks. To prevent vulnerabilities and reduce risks in web systems, there are several security guidelines available, such as those provided by the Open Web Application Security Project (OWASP) foundation. A common vulnerability in web services is broken object level authorization (BOLA), which allows an attacker to modify or delete data or perform actions intended only for authorized users. For example, an attacker can change an order status, delete a user account, or add unauthorized data to the server. In this paper, we propose a transformation from openapi to Petri nets, which enables formal modeling and analysis of REST APIs using existing Petri net analysis techniques to detect potential security risks directly from the analysis of web server logs. In addition, we also provide a tool, named Links2CPN, which automatically performs model transformation (taking the openapi specification as input) and BOLA attack detection by analyzing web server execution traces. We apply it to a case study of a vulnerable web application to demonstrate its applicability. Our results show that it is capable of detecting BOLA attacks with an accuracy greater than 95% in the proposed scenarios.

关键词： RESTful web services openapi Colored Petri nets Security analysis Vulnerabilities Broken access control Web application security

来源：评论

学校读者我要写书评

暂无评论

openapi Thing Descriptions for the Web of Things 33

OpenAPI Thing Descriptions for the Web of Things

引用

IEEE 33rd International Conference on Tools with Artificial Intelligence (ICTAI)

作者： Tzavaras, Aimilios Mainas, Nikolaos Bouraimis, Fotios Petrakis, Euripides G. M. Tech Univ Crete TUC Sch Elect & Comp Engn Khania Crete Greece

ISBN: (纸本)9781665408981

The Web of Things (WoT) recommendation of W3C suggests a model for integrating Things (e.g. devices) in the Web. In addition to W3C, openapi specification provides a method for documenting RESTful services so that a user or another service can comprehend their purpose and reuse them in applications. This work applies the openapi service description framework to Web objects (i.e. Things). As a result, openapi descriptions of Web Things provide a complete documentation of the services exposed by Things and of their capabilities. The resulting descriptions can be converted to an ontology in order to allow a machine to better understand the inherent meaning of Thing descriptions and interact with them. Then, Thing descriptions exposed in the Web can be easily discovered, queried by Semantic Web query languages (e.g. SPARQL) and checked by reasoners (e.g. Pellet) for consistency or, for inferencing hidden properties. The approach is compared to the Web of Things Description (TD) model of W3C in terms of completeness of the representation.

关键词： Web of Things Thing Description openapi

来源：评论

学校读者我要写书评

暂无评论

EMPIRICAL ANALYSIS ON openapi TOPIC EXPLORATION AND DISCOVERY TO SUPPORT THE DEVELOPER COMMUNITY

引用

COMPUTING AND INFORMATICS 2021年第6期40卷 1345-1369页

作者： da Rocha Araujo, Leonardo Rodriguez, Guillermo Vidal, Santiago Marcos, Claudia dos Santos, Rodrigo Pereira UNICEN ISISTAN CONICET Tandil Argentina UNICEN ISISTAN CIC Tandil Argentina Univ Fed Estado Rio de Janeiro Rio de Janeiro Brazil

openapi has become a dominant standard for documentation in the service-oriented software industry. openapi is used in many analysis and reengineering approaches for RESTful service and microservice-based systems. An openapi document has several components that are usually filled by humans using natural language (e.g. description of a certain functionality). Thus, subjectivity may lead to inconsistencies and ambiguities. Understanding what an API does is a challenging question. As a consequence, this issue could hinder developers from identifying the functionality of APIs, after reading all its components. Along this line, we argue that developers will be provided with supportive tools to find those APIs that better suit their needs. In this paper, we propose a step towards creating these kinds of tools by empirically analyzing a set of 2 000 openapi documents with the goal of extracting the main topics of an API using three topic modeling algorithms. To address this issue, we focus on three tasks: i) determine which component of an openapi document provides the most meaningful information, ii) compare three state-of-the-art topic modeling algorithms, and iii) determine the optimal number of topics to represent an API. Our findings show that the best results could be obtained from the Description component by using the Non-negative Matrix Factorization (NMF) or Latent Semantic Indexing (LSI) algorithms. To help developers find services in the openapi directory, we also propose a prototype tool to explore the openapi documents and analyze extracted topics to assess if the APIs meet developers needs.

关键词： RESTful web services APIs documentation topic modeling openapi topic coherence

来源：评论

学校读者我要写书评

暂无评论

openapitoUML: A Tool to Generate UML Models from openapi Definitions 18th

OpenAPItoUML: A Tool to Generate UML Models from OpenAPI Def...

引用

18th International Conference on Web Engineering (ICWE)

作者： Ed-douibi, Hamza Canovas Izquierdo, Javier Luis Cabot, Jordi UOC Barcelona Spain ICREA Barcelona Spain

ISBN: (纸本)9783319916620;9783319916613

REpresentational State Transfer (REST) has become the prominent architectural style for designing Web APIs. This increasing adoption has triggered the creation of languages to formally describe REST APIs, thus facilitating and promoting their usage. In particular, a consortium of companies has created the openapi Initiative, which aims at creating a vendor neutral, portable, standard and open specification for describing REST APIs. openapi specification has become the choice of reference for describing REST APIs, and its adopters can benefit from a plethora of tools for documenting, developing and integrating REST APIs. However, current documentation tools for openapi only describe REST APIs in HTML pages using text and code samples, thus requiring a considerable effort to visualize and understand what the APIs offer. In this paper, we propose a tool called openapitoUML, which generates UML models from openapi definitions, thus offering a better visualization of the data model and operations of REST APIs.

关键词： openapi UML REST API

来源：评论

学校读者我要写书评

暂无评论

Querying semantic openapi descriptions with OASL

引用

INTERNATIONAL JOURNAL OF WEB AND GRID SERVICES 2024年第2期20卷 188-205页

作者： Tsinaraki, Chrisa Lagogiannis, Nikolaos Mainas, Nikolaos Ieronymakis, Emmanouil-Georgios Petrakis, Euripides G. M. Tech Univ Crete TUC Sch Elect & Comp Engn Khania Greece

openapi is a standard for describing RESTful services in YAML or JSON that has been actively supported by the industry. The use of semantic web tools (like reasoners) would extend the usage of the semantics captured in openapi descriptions, also allowing for more sophisticated scenarios, like (semi)automatic service composition. To achieve this, openapi descriptions should be mapped to ontologies based on a reference openapi ontology. Querying such ontologies (essentially semantic openapi descriptions) using SPARQL is not an easy task for two reasons: 1) the SPARQL queries are complex, since they comprise many triples;2) the users should be familiar with the openapi ontology. The openapi SPARQL language (OASL) aims to ease query formulation for semantic openapi descriptions. It is a SPARQL-like RDF query language that allows openapi ontology agnostic users, knowledgeable only of the basics of SPARQL and REST services, to express their queries with a few statements. We have evaluated the performance of OASL on top of a GraphDB database that contains semantic openapi descriptions of real-world services.

关键词： query language openapi SPARQL language OASL openapi ontology SPARQL-like

来源：评论

学校读者我要写书评

暂无评论

Fuzzy Matching of openapi Described REST Services 22

Fuzzy Matching of OpenAPI Described REST Services

引用

22nd International Conference on Knowledge-Based and Intelligent Information and Engineering Systems (KES)

作者： Peng, Cong Goswami, Prashant Bai, Guohua Blekinge Inst Technol Dept Creat Technol Karlskrona Sweden

The vast amount of Web services brings the problem of discovering desired services for composition and orchestration. The syntactic service matching methods based on the classical set theory have a difficulty to capture the imprecise information. Therefore, an approximate service matching approach based on fuzzy control is explored in this paper. A service description matching model to the openapi specification, which is the most widely used standard for describing the defacto REST Web services, is proposed to realize the fuzzy service matching with the fuzzy inference method developed by Mamdani and Assilian. An evaluation shows that the fuzzy service matching approach performed slightly better than the weighted approach in the setting context. (C) 2018 The Authors. Published by Elsevier Ltd.

关键词： service matching fuzzy inference openapi REST fuzzy set theory

来源：评论

学校读者我要写书评

暂无评论

Ontology for openapi REST Services Descriptions 32

Ontology for OpenAPI REST Services Descriptions

引用

32nd IEEE International Conference on Tools with Artificial Intelligence (ICTAI)

作者： Karavisileiou, Aikaterini Mainas, Nikolaos Petrakis, Euripides G. M. Tech Univ Crete TUC Sch Elect & Comp Engn Iraklion Greece

ISBN: (纸本)9781728192284

openapi Specification (OAS) defines a description format for REST APIs. In order for a machine to understand the meaning of REST services, openapi service descriptions must be unambiguous. In a previous work we analysed the reasons that cause ambiguities in openapi and showed that, in order to eliminate ambiguities, openapi properties must be semantically annotated and mapped to a semantic model. Leveraging latest results for hypermediabased construction ofWeb APIs (i.e. Hydra), the present work forwards this approach and proposes a reference ontology for REST services along with a formal procedure for converting openapi service descriptions to instances of this ontology.

关键词： Web service Ontology openapi REST Hydra

来源：评论

学校读者我要写书评

暂无评论

QuickREST: Property-based Test Generation of openapi-Described RESTful APIs 13

QuickREST: Property-based Test Generation of OpenAPI-Describ...

引用

13th IEEE International Conference on Software Testing, Verification and Validation (ICST)

作者： Karlsson, Stefan Causevic, Adnan Sundmark, Daniel Malardalen Univ ABB AB Vasteras Sweden Malardalen Univ Vasteras Sweden

ISBN: (纸本)9781728157788

RESTful APIs are an increasingly common way to expose software systems functionality and it is therefore of high interest to find methods to automatically test and verify such APIs. To lower the barrier for industry adoption, such methods need to be straightforward to use with a low effort. This paper introduces a method to explore the behaviour of a RESTful API. This is done by using automatic property-based tests produced from openapi documents that describe the REST API under test. We describe how this method creates artifacts that can be leveraged both as property-based test generators and as a source of validation for results (i.e., as test oracles). Experimental results, on both industrial and open source services, indicate how this approach is a low effort way of finding real faults. Furthermore, it supports building additional knowledge about the system under test by automatically exposing misalignment of specification and implementation. Since the tests are generated from the openapi document this method automatically evolves test cases as the REST API evolves.

关键词： Property-based testing openapi REST

来源：评论

学校读者我要写书评

暂无评论

Uses and applications of the openapi/Swagger specification: a systematic mapping of the literature 40

Uses and applications of the OpenAPI/Swagger specification: ...

引用

40th International Conference of the Chilean-Computer-Science-Society (SCCC)

作者： Casas, Sandra Cruz, Diana Vidal, Graciela Constanzo, Marcela Univ Patagonia Austral Inst Tecnol Aplicada Unidad Acad Rio Gallegos Rio Gallegos Argentina Univ Patagonia Austral Inst Tecnol Aplicada Unidad Acad Rio Turbio Rio Turbio Argentina

ISBN: (纸本)9781665409568

The openapi or Swagger specification has become the reference choice for describing web APIs (REST, RESTful, etc.). That is why this specification has been and is currently the center of many research articles. Several activities, tasks, and problems associated with software development can be improved, simplified, solved and/or automated with this specification. The purpose of this study is to synthesize the uses and applications of the openapi/Swagger specification. The development activities in which it has been useful, the software artifacts (results) generated from it, and which domains have been covered, among others, are identified. The literature review that we analyzed had a total of 47 articles published between 2011 and 2020. The search corresponded with these parameters: a) mention of the development activities in which the specification has been useful, b) inclusion of the software artifacts (results) that it generates and their corresponding validation, and c) reference to the domains covered. Results show that the openapi/Swagger specification has benefited various software development activities, being the improvement of the documentation the one that predominates (43 %). Similarly, 77% of the articles provide solutions to the requirements and/or problems of the web API consumers. The automation of tasks, based on diverse tools, constitutes the most predominant result in 68% of the manuscripts. Besides, 40% of the works consulted cover a specific domain (IoT, Cloud, etc.).

关键词： API web openapi API Rest Servicios web

来源：评论

学校读者我要写书评

暂无评论

From openapi Fragments to API Pattern Primitives and Design Smells 26

From OpenAPI Fragments to API Pattern Primitives and Design ...

引用

European Conference on Pattern Languages of Programs (EuroPLoP)

作者： Serbout, Souhaila Pautasso, Cesare Zdun, Uwe Zimmermann, Olaf USI Software Inst Lugano Switzerland Univ Vienna Fac Comp Sci Software Architecture Res Grp Vienna Austria Univ Appl Sci Eastern Switzerland Rapperswil Switzerland

ISBN: (纸本)9781450389976

In the past few years, the openapi Specification (OAS) has emerged as a standard description language for accurately modeling Web APIs. Today, thousands of openapi descriptions can be found by mining open source repositories. In this paper, we attempt to exploit these artifacts to extract commonly occurring building blocks used inWeb API structures, in order to assistWeb API designers in their modelling task. Our work is based on a fragmentation mechanism, that starts from openapi descriptions of Web APIs to extract their structures, then fragment these structures into smaller blocks. This approach enabled us to extract a large dataset of reoccurring fragments from a collection of 6619 API specifications. Such fragments have been found multiple times in the same or across different APIs. We have classified the most reoccurring fragments into four pattern primitives used to expose in the API access to collections of items. We distinguish for each primitive variants from design smells. This classification is based on the specific combinations of operations associated with the collection items and on an in-depth analysis of their natural language labels and descriptions. The resulting pattern primitives are intended to support designers who would like to introduce one or more collections for a specific class of items in their HTTP-based API.

关键词： Application ProgrammingInterfaces APIPatterns APIDesign Smells API Structural Fragments Collections Pattern Minning openapi

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：