检索结果-内蒙古大学图书馆

小型微型计算机系统 2025年第5期 1224-1231页

作者：陈静宗国笑王新蕾魏强武泽慧郑州大学网络空间安全学院信息工程大学网络空间安全学院

随着rest api在Web服务和云服务中的广泛应用，其安全问题也引起越来越多的关注.模糊测试作为主流的缺陷检测方法之一，已被适用到该领域.但现有的模糊测试方法缺乏有效的探索机制，平等的对待所有api操作和参数，导致难以生成复杂而有... 详细信息

随着rest api在Web服务和云服务中的广泛应用，其安全问题也引起越来越多的关注.模糊测试作为主流的缺陷检测方法之一，已被适用到该领域.但现有的模糊测试方法缺乏有效的探索机制，平等的对待所有api操作和参数，导致难以生成复杂而有效的请求，很难发现api中的深层bug.为解决上述问题，本文提出基于依赖图的rest api模糊测试方法，首先采用动静结合的方式对api间的数据依赖关系进行分析建模，构建加权api依赖图，优先考虑具有更多潜在依赖项的api,提升有效测试用例的生成率；其次，提出对参数的变异价值进行评估的方法，优先对不安全的参数进行测试；最后基于反馈信息验证缺陷的存在性.为测试本文方法的有效性，编码开发了原型系统restFuzzer,并与restler、restTestGen、ZAP等现有rest api缺陷检测工具进行比较.实验结果表明，与现有工具相比，测试用例生成的质量更高，并且在实际测试中发现了更多api安全缺陷.

关键词： rest api api依赖图模糊测试缺陷检测

来源：评论

学校读者我要写书评

暂无评论

SEAPP: A secure application management framework based on rest api access control in SDN-enabled cloud environment

引用

JOURNAL OF PARALLEL AND DISTRIBUTED COMPUTING 2021年 147卷 108-123页

作者： Hu, Tao Zhang, Zhen Yi, Peng Liang, Dong Li, Ziyong Ren, Quan Hu, Yuxiang Lan, Julong Natl Digital Switching Syst Engn & Technol Res Ct Zhengzhou Henan Peoples R China Informat Engn Univ Zhengzhou Henan Peoples R China

Cloud computing provides scalable network services and makes network management more flexible by combining Software-Defined Networking (SDN). Through the northbound interface (e.g., rest api) offered by the SDN controller, users can easily deploy diversified applications to access the network resources. However, exploiting the openness of the northbound interface, malicious applications abuse apis to launch hostile attacks, which poses serious threats to the network. In this paper, we propose SEAPP, a secure application management framework based on rest api access control. Our main idea is to granularly manage application permissions and encrypt rest api calls to defend against malicious attacks. SEAPP includes two components: 1) permissions detection engine identifies the facticity of application permissions by analyzing permission manifests and byte codes and further identifies the legality of permissions with constructed sensitive api list;2) registration authorization engine executes encrypted registration between applications and controller by virtue of NTRU algorithm and authorizes applications to call the requested rest apis based on their risk levels after securely authenticating them. Besides, SEAPP is a lightweight logic architecture between application plane and control plane and supports quick deployment and reconfiguration in runtime. Both theoretical analysis and evaluation results show the security and effectiveness of SEAPP. Besides, SEAPP introduces negligible CPU and memory overheads. (C) 2020 Elsevier Inc. All rights reserved.

关键词： Cloud Software-Defined Networking Network security Application rest api

来源：评论

学校读者我要写书评

暂无评论

rest api Design Patterns for SDN Northbound api

REST API Design Patterns for SDN Northbound API

引用

28th IEEE International Conference on Advanced Information Networking and Applications Workshops (IEEE WAINA)

作者： Zhou, Wei Li, Li Luo, Min Chou, Wu Huawei Technol Co Ltd Shannon IT Lab Shenzhen Peoples R China

ISBN: (纸本)9781479926527

rest architectural style gains increasing popularity in the networking protocol design, and it has become a prevalent choice for northbound api of Software-Defined Networking (SDN). This paper addresses many critical issues in restful networking protocol design, and presents a framework on how a networking protocol can be designed in a truly restful manner, making it towards a service oriented data networking. In particular, we introduce the HTTP content negotiation mechanism which allows clients to select different representation formats from the same resource URI. Most importantly, we present a hypertext-driven approach, so that hypertext links are defined between rest resources for the networking protocol to guide clients to identify the right resources rather than relying on fixed resource URIs. The advantages of our approach are verified in two folds. First, we show how to apply our approach to fix rest design problems in some existing northbound networking apis, and then we show how to design a restful northbound api of SDN in the context of OpenStack. We implemented our proposed approach in the northbound rest api of SOX, a generalized SDN controller, and the benefits of the proposed approach are experimentally verified.

关键词： SDN Controller Northbound api OpenStack Quantum rest api Hypertext Driven

来源：评论

学校读者我要写书评

暂无评论

Design Patterns and Extensibility of rest api for Networking Applications

引用

IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT 2016年第1期13卷 154-167页

作者： Li, Li Chou, Wu Zhou, Wei Luo, Min Huawei Cent Res Shannon IT Lab Bridgewater NJ 08807 USA Huawei Cent Res Shannon IT Lab Shenzhen Peoples R China CSIRO Digital Prod Flagship Autonomous Syst Sandy Bay Tas 7005 Australia Huawei Cent Res Shannon IT Lab Santa Clara CA 95050 USA

rest architectural style has become a prevalent choice for distributed resources, such as the northbound api of software-defined networking (SDN). As services often undergo frequent changes and updates, the corresponding rest apis need to change and update accordingly. To allow rest apis to change and evolve without breaking its clients, a rest api can be designed to facilitate hypertext-driven navigation and its relatedmechanisms to deal with structure changes in the api. This paper addresses the issues in hypertext-driven navigation in rest apis from three aspects. First, we present rest Chart, a Petri-Net-based rest service description framework and language to design extensible rest apis, and it is applied to cope with the rapid evolution of SDN northbound apis. Second, we describe some important design patterns, such as backtracking and generator, within the rest Chart framework to navigate through large scale apis in the restful architecture. Third, we present a client side differential cache mechanism to reduce the overhead of hypertext-driven navigation, addressing a major issue that affects the application of rest api. The proposed approach is applied to applications in SDN, which is integrated with a generalized SDN controller, SOX. The benefits of the proposed approach are verified in different conditions. Experimental results on SDN applications show that on average, the proposed cache mechanism reduces the overhead of using the hypertext-driven rest api by 66%, while fully maintaining the desired flexibility and extensibility of the rest api.

关键词： SDN controller northbound api OpenStack Neutron rest api hypertext driven rest Chart Petri-Net differential cache

来源：评论

学校读者我要写书评

暂无评论

rest api Fuzzing by Coverage Level Guided Blackbox Testing

REST API Fuzzing by Coverage Level Guided Blackbox Testing

引用

21st IEEE International Conference on Software Quality, Reliability and Security (QRS)

作者： Tsai, Chung-Hsuan Tsai, Shi-Chun Huang, Shih-Kun Natl Yang Ming Chiao Tung Univ Dept Comp Sci Hsinchu Taiwan Natl Yang Ming Chiao Tung Univ Informat Technol Serv Ctr Hsinchu Taiwan

ISBN: (纸本)9781665458139

With the growth of web applications, rest APls have become the primary communication method between services. In order to ensure system reliability and security, software quality can be assured by effective testing methods. Black box fuzz testing is one of the effective methods to perform tests on a large scale. However, conventional black box fuzz testing generates random data without judging the quality of the input. We implement a black box fuzz testing method for rest APls. It resolves the issues of blind mutations without knowing the effectiveness by Test Coverage Level feedback. We also enhance the mutation strategies by reducing the testing complexity for rest APls, generating more appropriate test cases to cover possible paths. We evaluate our method by testing two large open-source projects and 89 bugs are reported and confirmed. In addition, we find 351 bugs from 64 remote api services in APls. guru. The work is in https://***/hsuan-fuzz.

关键词： Openapi rest api Test coverage level Black-box testing Fuzz testing Software quality

来源：评论

学校读者我要写书评

暂无评论

Test Traffic Control Based on rest api for Software-Defined Networking 8th

Test Traffic Control Based on REST API for Software-Defined ...

引用

8th International Conference on Artificial Intelligence and Security (ICAIS)

作者： Yao, Jiangyuan Wang, Minrui Yang, Weiping Weng, Shuhua Jiang, Zheng Jing, Min Li, Deshun Cao, Xingcan Hainan Univ Haikou 570228 Peoples R China Univ British Columbia Vancouver BC V6T IZ1 Canada

ISBN: (纸本)9783031067884;9783031067877

With the expansion of software-defined network deployment scale, the number of switches on the data plane is increasing, which causes many problems on the data link, like packet loss and bandwidth degradation. Due to the existence of multi-link redundancy technology in the network, network operators hardly find these problems in time. Therefore, based on rest api, this paper proposes an SDN network test traffic control method. By controlling the test traffic and using different test coverage criterions, this method can support the data plane to complete the test of switch forwarding function and data link performance with multiple SDN controllers to find possible errors in the topology. Through experiments, it is found that edge coverage test has better cost performance than vertex coverage and full coverage test, completing the coverage of data plane and improving fault discovery rate.

关键词： Software-defined networking rest api Test traffic control Test coverage

来源：评论

学校读者我要写书评

暂无评论

Connection Minimization in rest api with Random Walks

Connection Minimization in REST API with Random Walks

引用

IEEE/WIC/ACM International Conference on Web Intelligence (WI)

作者： Li, Li Luo, Min Huawei Shannon IT Lab Bridgewater NJ 08807 USA Huawei Shannon IT Lab Santa Clara CA USA

ISBN: (纸本)9781509044702

A key constraint of rest api is that all the resources must be reachable by some hyperlink paths from an entry point. However, to apply this constraint without prudence can result in excessive hyperlinks that do not provide new services but increase the dependence between the resources. Excessive hyperlinks are difficult to identify because: 1) a rest api can have dynamic and unbounded paths;and 2) the hyperlinks used to navigate a path are not observable and can be ambiguous. To tackle the first challenge, we propose a rest api model and a random walk algorithm to reduce the paths of a rest api to a small set. To address the second challenge, we develop a client model and a connection minimization algorithm to identify excessive hyperlinks based on given paths. By combining the random walk and the connection minimization algorithms, our method can minimize the connections of a rest api in polynomial time without involving the actual clients. A prototype system has been implemented and the tests show that the method is correct and can converge 90.6% to 99.9% faster than the baseline approach.

关键词： rest api connection minimization random walk excessive hyperlinks essential hyperlinks resource-oriented network path tree linear path nonlinear path ambiguous path cache-first recent-first distinct walk

来源：评论

学校读者我要写书评

暂无评论

Splineapi: A rest api for NLP Services 1

引用

4th International Symposium on Languages, Applications and Technologies (SLATE)

作者： Vieira, Nuno Simoes, Alberto Carvalho, Nuno Ramos Univ Minho Ctr Algoritmi Braga Portugal Univ Minho Ctr Estudos Humanist Braga Portugal

ISBN: (数字)9783319276533

ISBN: (纸本)9783319276533;9783319276526

Modern applications often use Natural Language Processing (NLP) techniques and algorithms to provide sets of rich features. Researchers, who come up with these algorithms, often implement them for case studies, evaluation or as proof of concepts. These implementations are, in most cases, freely available for download and use. Nevertheless, these implementations do not comprise final software packages, with extensive installation instructions and detailed usage guides. Most lack a proper installation mechanism and library dependency tracking. The programming interfaces are, usually, limited to their usage through command line, or with just a few programming languages support. To overcome these shortcomings, this work aims to develop a new web platform to make available a set of common operations to third party applications that can be used to quickly access NLP based processes. Of course this platform still relies on the same tools mentioned before, as a base support to specific requests. Nevertheless, the end user will not need to install and learn their specific Application Programming Interfaces (api). For this to be possible, the architectural solution is to implement a restful api that hides all the tool details in a simple api that is common or, at least, coherent, across the different tools.

关键词： Natural language processing rest api Web service DSL

来源：评论

学校读者我要写书评

暂无评论

Quantitative Security Assurance Metrics - rest api Case Studies 18

Quantitative Security Assurance Metrics - REST API Case Stud...

引用

12th European Conference on Software Architecture (ECSA)

作者： Katt, Basel Prasher, Nishu Norwegian Univ Sci & Technol NTNU Trondheim Norway Stat Norway Div Qual & Team Management Oslo Norway

ISBN: (纸本)9781450364836

Security assurance is the confidence that a system meets its security requirements based on specific evidences that an assurance technique provide. The notion of measuring security is complex and tricky. Existing approaches either (1) consider one aspect of assurance, like security requirements fulfillment, or threat/vulnerability existence, or (2) do not consider the relevance of the different security requirements to the evaluated application context. Furthermore, they are mostly qualitative in nature and are heavily based on manual processing, which make them costly and time consuming. Therefore, they are not widely used and applied, especially by small and medium-sized enterprises (SME), which constitute the backbone of the Norwegian economy. In this paper, we propose a quantification method that aims at evaluating security assurance of systems by measuring (1) the level of confidence that the mechanisms fulfilling security requirements are present and (2) the vulnerabilities associated with possible security threats are absent. Additionally, an assurance evaluation process is proposed. Two case studies applying our method are presented. The case studies use our assurance method to evaluate the security level of two rest apis developed by Statistics Norway, where one of the authors is employed. Analysis shows that the api with the most security mechanisms implemented got a slightly higher security assurance score. Security requirement relevance and vulnerability impact played a role in the overall scores.

关键词： Security metric security assurance security testing rest api

来源：评论

学校读者我要写书评

暂无评论

Compatibility Checking of rest api Based on Coloured Petri Net 11th

Compatibility Checking of REST API Based on Coloured Petri N...

引用

11th International Conference on Web Information Systems and Technologies (WEBIST)

作者： Li, Li Chou, Wu Huawei Shannon IT Lab Bridgewater NJ USA

ISBN: (纸本)9783319309965;9783319309958

One of the underutilized advantages of rest api is extensibility. Extensibility allows a rest api to make certain changes to its resource representation, identification, interaction, and connection without breaking its clients. A client can cope with these changes in the rest api through hypertext-driven interactions - an iterative process in which the client can determine the resource identification based on its representation, utilize its identification to determine the interactions, and follow the interactions to determine its connections. However, our analysis reveals that there are limitations to the flexibility of the hypertext-driven navigation due to the dependency between these interaction layers in the rest api, and there is a critical need to determine if two rest apis are compatible for the client. To address this issue, we describe a structured approach to rest client modelling that decomposes a rest client into two functional components: client oracle and client agent. From this client model, we derive a formal definition of compatibility based on the rest Chart representation of the rest api, and an efficient algorithm is developed to verify the compatibility between two rest Charts. A prototype system has been implemented, and the preliminary experimental results show that the approach is feasible and promising.

关键词： rest api Coloured petri net rest chart Compatibility checking Client oracle Client agent

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：