With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raisin...With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raising increasing concerns about their security.Existing fuzz testing methods include random or dictionary-based input generation,which often fail to ensure both syntactic and semantic correctness,and OpenAPIbased approaches,which offer better accuracy but typically lack detailed descriptions of endpoints,parameters,or data formats.To address these issues,this paper proposes the APIDocX fuzz testing framework.It introduces a crawler tailored for dynamic web pages that automatically simulates user interactions to trigger APIs,capturing and extracting parameter information from communication packets.A multi-endpoint parameter adaptation method based on improved Jaccard similarity is then used to generalize these parameters to other potential API endpoints,filling in gaps in OpenAPI specifications.Experimental results demonstrate that the extracted parameters can be generalized with 79.61%accuracy.Fuzz testing using the enriched OpenAPI documents leads to improvements in test coverage,the number of valid test cases generated,and fault detection capabilities.This approach offers an effective enhancement to automated REST API security testing.展开更多
服务质量(quality of service,QoS)感知云API推荐系统在解决云API过载问题、差异化云API性能和实现高质量云API选择中具有重要作用.但由于网络环境的开放性和云API的货币属性,推荐系统易受到投毒攻击,从而导致推荐结果偏离公平性和可信...服务质量(quality of service,QoS)感知云API推荐系统在解决云API过载问题、差异化云API性能和实现高质量云API选择中具有重要作用.但由于网络环境的开放性和云API的货币属性,推荐系统易受到投毒攻击,从而导致推荐结果偏离公平性和可信性.现有防御方法主要采用“检测防御”策略,即在模型训练前通过检测算法滤除恶意用户来缓解攻击影响,但受限于检测算法性能,不可避免地会出现无法将恶意用户全部滤除的情形.为此,从“以攻学防”的视角提出一种基于可信数据增强的QoS感知云API推荐系统投毒攻击持续防御方法.首先构建基于可信数据增强的投毒攻击防御框架,通过生成高质量可信用户数据并参与模型训练来增强推荐系统的鲁棒性.其次,设计基于扩散模型的可信用户生成算法.采用迭代去噪的方式学习真实云API的QoS数据分布,生成高质量的可信用户向量,消解投毒攻击数据对训练模型的影响.最后,基于真实云API的QoS数据集进行大量实验,利用3类11种推荐算法全面评估所提防御方法的有效性和普适性.实验结果表明,所提出的基于可信数据增强的投毒攻击持续防御框架是有效的,生成的可信用户可显著提高云API推荐系统的鲁棒性.展开更多
In this paper,we provide a comprehensive examination of the evolution of graphics Application Programming Interfaces(APIs).We begin by exploring traditional graphics APIs,elucidating their distinct features and inhere...In this paper,we provide a comprehensive examination of the evolution of graphics Application Programming Interfaces(APIs).We begin by exploring traditional graphics APIs,elucidating their distinct features and inherent challenges.This sets the stage for a detailed exploration of modern graphics APIs,with a focus on four critical design principles.These principles are further analyzed through specific case studies and categorical examinations.The paper then introduces MoerEngine,a bespoke rendering engine,as a practical case to demonstrate the real-world application of these modern principles in software engineering.In conclusion,the study offers insights into the potential future trajectory of graphics APIs,spotlighting emerging design patterns and technological innovations.It also ventures to predict the development trends and capabilities of next-generation graphics APIs.展开更多
API(Application Programming Interface)documentation often only describes individual APIs and lacks information on complex API relations and code examples.Retrieval-based and generation-based methods can both produce d...API(Application Programming Interface)documentation often only describes individual APIs and lacks information on complex API relations and code examples.Retrieval-based and generation-based methods can both produce documentation that includes API relationship descriptions and code examples.However,they are limited by the richness of available API resources.As a result,they struggle to be effective when dealing with resource-scarce languages such as Kotlin.We propose an on-demand API tutorial generation method for resource-scarce languages,transferring API knowledge from a resource-rich language like Java to Kotlin using an AI chain.Evaluating our method on 500 Kotlin APIs,we generated more API documents than the state-of-the-art retrieval-based method ADECK and the generate-based method gDoc.The number of API guidelines generated by our method is 37 times that of ADECK and 1.6 times that of gDoc.Compared with the scheme that did not adopt the knowledge transfer strategy,the success rate of our method has increased by 31.25 percentage points.This demonstrates the feasibility and potential of using LLMs to create new API knowledge across languages.展开更多
The method for malware detection based on Application Programming Interface(API)call sequences,as a primary research focus within dynamic detection technologies,currently lacks attention to subsequences of API calls,t...The method for malware detection based on Application Programming Interface(API)call sequences,as a primary research focus within dynamic detection technologies,currently lacks attention to subsequences of API calls,the variety of API call types,and the length of sequences.This oversight leads to overly complex call sequences.To address this issue,a dynamic malware detection approach based on multiple subsequences is proposed.Initially,APIs are remapped and encoded,with the introduction of percentile lengths to process sequences.Subsequently,a combination of One-Dimensional Convolutional Neural Network(1D-CNN)and Bidirectional Long Short-Term Memory(Bi-LSTM)networks,along with an attention mechanism,is employed to extract features from subsequences of varying lengths for feature fusion and classification.Experiments conducted on two widely used public API-based datasets,namelyMalBehavD-V1 and Alibaba Cloud,demonstrate that the proposedmethod reduces the number of API call types by approximately 20%compared to representative deep learning–based API sequence detection methods,while achieving a peak accuracy of 98.70%.Additionally,experimental results indicate that sequence length at the 95th percentile represents the optimal solution that balances classification performance and computational efficiency.展开更多
伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(M...伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(MCP)无缝通信智能体,提出一种隐藏API发现和漏洞检测的智能体系统A2A(Agent to API vulnerability detection)来实现从API发现到漏洞检测的全流程自动化。A2A通过自适应枚举和HTTP响应分析自动识别潜在的隐藏API端点,并结合服务特定的API指纹库进行隐藏API的确认和发现。A2A在API漏洞检测上则是结合大语言模型(LLM)与检索增强生成(RAG)技术,并通过反馈迭代优化策略,自动生成高质量测试用例以验证漏洞是否存在。实验评估结果表明,A2A的平均API发现率为91.9%,假发现率为7.8%,并成功发现NAUTILUS和RESTler未能检测到的多个隐藏API漏洞。展开更多
基金supported by the Open Foundation of Key Laboratory of Cyberspace Security,Ministry of Education of China(KLCS20240211)。
摘要With the rapid development of Internet technology,REST APIs(Representational State Transfer Application Programming Interfaces)have become the primary communication standard in modern microservice architectures,raising increasing concerns about their security.Existing fuzz testing methods include random or dictionary-based input generation,which often fail to ensure both syntactic and semantic correctness,and OpenAPIbased approaches,which offer better accuracy but typically lack detailed descriptions of endpoints,parameters,or data formats.To address these issues,this paper proposes the APIDocX fuzz testing framework.It introduces a crawler tailored for dynamic web pages that automatically simulates user interactions to trigger APIs,capturing and extracting parameter information from communication packets.A multi-endpoint parameter adaptation method based on improved Jaccard similarity is then used to generalize these parameters to other potential API endpoints,filling in gaps in OpenAPI specifications.Experimental results demonstrate that the extracted parameters can be generalized with 79.61%accuracy.Fuzz testing using the enriched OpenAPI documents leads to improvements in test coverage,the number of valid test cases generated,and fault detection capabilities.This approach offers an effective enhancement to automated REST API security testing.
摘要服务质量(quality of service,QoS)感知云API推荐系统在解决云API过载问题、差异化云API性能和实现高质量云API选择中具有重要作用.但由于网络环境的开放性和云API的货币属性,推荐系统易受到投毒攻击,从而导致推荐结果偏离公平性和可信性.现有防御方法主要采用“检测防御”策略,即在模型训练前通过检测算法滤除恶意用户来缓解攻击影响,但受限于检测算法性能,不可避免地会出现无法将恶意用户全部滤除的情形.为此,从“以攻学防”的视角提出一种基于可信数据增强的QoS感知云API推荐系统投毒攻击持续防御方法.首先构建基于可信数据增强的投毒攻击防御框架,通过生成高质量可信用户数据并参与模型训练来增强推荐系统的鲁棒性.其次,设计基于扩散模型的可信用户生成算法.采用迭代去噪的方式学习真实云API的QoS数据分布,生成高质量的可信用户向量,消解投毒攻击数据对训练模型的影响.最后,基于真实云API的QoS数据集进行大量实验,利用3类11种推荐算法全面评估所提防御方法的有效性和普适性.实验结果表明,所提出的基于可信数据增强的投毒攻击持续防御框架是有效的,生成的可信用户可显著提高云API推荐系统的鲁棒性.
摘要随着人工智能与高性能计算的快速发展,图形处理器(graphics processing unit,GPU)已成为算力中心的核心资源。现代算力中心往往同时部署多厂商、不同架构的GPU,而传统基于硬件切分或驱动绑定的方案仅支持单一厂商,难以在多架构环境中实现高效共享与隔离。提出一种面向异构GPU的资源池化与应用程序接口(application program interface,API)沙盒机制设计方案SandGPU,在资源抽象层构建统一的虚拟GPU三维资源模型,引入厂商级折算系数,对不同架构GPU的计算能力、显存容量和带宽进行等效表征;在执行层通过基于API的沙盒机制,利用显存配额门、带宽令牌桶和计算节流门实现按配额限流和跨任务干扰抑制。基于自研离散时间仿真平台的实验表明,在保持平均算力利用率且在一定时延内完成任务的比例不下降的前提下,所提方案将干扰率分布的P95值平均降低22.4%,显著收敛尾部干扰。
基金supported by ZTE Industry-University-Institute Cooperation Funds under Grant No.IA20230921014。
摘要In this paper,we provide a comprehensive examination of the evolution of graphics Application Programming Interfaces(APIs).We begin by exploring traditional graphics APIs,elucidating their distinct features and inherent challenges.This sets the stage for a detailed exploration of modern graphics APIs,with a focus on four critical design principles.These principles are further analyzed through specific case studies and categorical examinations.The paper then introduces MoerEngine,a bespoke rendering engine,as a practical case to demonstrate the real-world application of these modern principles in software engineering.In conclusion,the study offers insights into the potential future trajectory of graphics APIs,spotlighting emerging design patterns and technological innovations.It also ventures to predict the development trends and capabilities of next-generation graphics APIs.
基金Supported by the High-Level Research Fund(12225000404)。
摘要API(Application Programming Interface)documentation often only describes individual APIs and lacks information on complex API relations and code examples.Retrieval-based and generation-based methods can both produce documentation that includes API relationship descriptions and code examples.However,they are limited by the richness of available API resources.As a result,they struggle to be effective when dealing with resource-scarce languages such as Kotlin.We propose an on-demand API tutorial generation method for resource-scarce languages,transferring API knowledge from a resource-rich language like Java to Kotlin using an AI chain.Evaluating our method on 500 Kotlin APIs,we generated more API documents than the state-of-the-art retrieval-based method ADECK and the generate-based method gDoc.The number of API guidelines generated by our method is 37 times that of ADECK and 1.6 times that of gDoc.Compared with the scheme that did not adopt the knowledge transfer strategy,the success rate of our method has increased by 31.25 percentage points.This demonstrates the feasibility and potential of using LLMs to create new API knowledge across languages.
基金supported by the National Natural Science Foundation of China(62262020)the Graduate Education Innovation Project of Hubei Minzu University(MYK2024025).
摘要The method for malware detection based on Application Programming Interface(API)call sequences,as a primary research focus within dynamic detection technologies,currently lacks attention to subsequences of API calls,the variety of API call types,and the length of sequences.This oversight leads to overly complex call sequences.To address this issue,a dynamic malware detection approach based on multiple subsequences is proposed.Initially,APIs are remapped and encoded,with the introduction of percentile lengths to process sequences.Subsequently,a combination of One-Dimensional Convolutional Neural Network(1D-CNN)and Bidirectional Long Short-Term Memory(Bi-LSTM)networks,along with an attention mechanism,is employed to extract features from subsequences of varying lengths for feature fusion and classification.Experiments conducted on two widely used public API-based datasets,namelyMalBehavD-V1 and Alibaba Cloud,demonstrate that the proposedmethod reduces the number of API call types by approximately 20%compared to representative deep learning–based API sequence detection methods,while achieving a peak accuracy of 98.70%.Additionally,experimental results indicate that sequence length at the 95th percentile represents the optimal solution that balances classification performance and computational efficiency.
摘要伴随RESTful API在现代Web服务中的普及,安全问题日益凸显。而现有的主流API识别与漏洞检测工具依赖API文档或公开路径进行扫描,在识别隐藏API或无文档API时效果有限,在复杂或动态API环境下漏洞误报率高。针对这些挑战,基于上下文协议(MCP)无缝通信智能体,提出一种隐藏API发现和漏洞检测的智能体系统A2A(Agent to API vulnerability detection)来实现从API发现到漏洞检测的全流程自动化。A2A通过自适应枚举和HTTP响应分析自动识别潜在的隐藏API端点,并结合服务特定的API指纹库进行隐藏API的确认和发现。A2A在API漏洞检测上则是结合大语言模型(LLM)与检索增强生成(RAG)技术,并通过反馈迭代优化策略,自动生成高质量测试用例以验证漏洞是否存在。实验评估结果表明,A2A的平均API发现率为91.9%,假发现率为7.8%,并成功发现NAUTILUS和RESTler未能检测到的多个隐藏API漏洞。