信息网络安全

信息网络安全 ›› 2025, Vol. 25 ›› Issue (8): 1313-1325.doi: 10.3969/j.issn.1671-1122.2025.08.011

• 技术研究 • 上一篇    下一篇

REST API设计安全性检测研究

张燕怡1,2,3, 阮树骅1,2,3(), 郑涛1,2,3   

  1. 1.四川大学网络空间安全学院，成都 610065
    2.数据安全防护与智能治理教育部重点实验室，成都 610065
    3.四川大学网络空间安全研究院，成都 610065
  • 收稿日期:2024-10-25 出版日期:2025-08-10 发布日期:2025-09-09
  • 通讯作者: 阮树骅 E-mail:ruanshuhua@scu.edu.cn
  • 作者简介:张燕怡（2000—），女，四川，硕士研究生，主要研究方向为云计算安全|阮树骅（1966—），女，浙江，副教授，硕士，主要研究方向为云计算与大数据安全、区块链安全|郑涛（1994—）男，四川，博士研究生，主要研究方向为移动安全和软件安全分析
  • 基金资助:
    中央高校基本科研业务费专项资金(SCU2024D012);四川大学理工学科内涵发展项目(2020SCUNG129)

Research on REST API Design Security Testing

ZHANG Yanyi1,2,3, RUAN Shuhua1,2,3(), ZHENG Tao1,2,3   

  1. 1. School of Cyber Science and Engineering, Sichuan University, Chengdu 610065, China
    2. Key Laboratory of Data Protection and Intelligent Management (Sichuan University), Ministry of Education, Chengdu 610065, China
    3. Cyber Science Research Institute, Sichuan University, Chengdu 610065, China
  • Received:2024-10-25 Online:2025-08-10 Published:2025-09-09

RichHTML

9

PDF (PC)

18

摘要：

在REST API的设计和开发过程中，遵循 REST原则以及最佳实践等规范，对确保REST API服务的一致性、可用性和安全性是至关重要的。针对 REST API设计检测领域中存在的安全维度及语义层面检测机制不完善问题，文章提出一个REST API设计安全性检测框架RADSD，旨在从不同结构层次对API设计的安全性进行检测。首先，通过收集整理 REST API相关指导规范并结合实证研究，构建了一个多层次的 REST API 安全设计规范库；然后，针对规范库中各项规范要求设计对应的检测算法，并将大语言模型引入REST API设计检测，实现针对API设计语法和语义的多种检测方法。实验结果证明，RADSD框架能够对业界真实REST API进行多层次检测，识别API存在的设计安全性问题，并生成详细的检测报告，平均准确率达97.1%。

关键词: REST API安全性, 设计规范, 模式匹配, 大语言模型

Abstract:

In the process of REST API design and development, adhering to REST principles, best practices, and other specifications is paramount to ensure the consistency, usability, and security of REST API services. Addressing the issue of inadequate security measures and semantic-level detection mechanisms in REST API design detection, this article introduced the RADSD framework. RADSD was specifically designed to detect security flaws in API designs across various structural levels. Initially, a comprehensive multi-level REST API security design specification library was established by amassing and organizing relevant REST API guidance specifications, augmented by empirical research. Subsequently, tailored detection algorithms were devised for each specification requirement within this library. The integration of large language models into REST API design detection enabled diverse detection methods for both API design syntax and semantics. Experimental results demonstrate that the RADSD framework effectively conducts multi-level detection of real-world REST APIs, pinpointing design security issues, and generating detailed detection reports with an average accuracy rate of 97.1%.

Key words: REST API security, design specification, pattern matching, large language model

中图分类号: