Request and interface association method and system

Abstract

The invention provides a request and interface association method and system. The method comprises the following steps of scanning the interface configuration information, establishing a mapping relationship between an interface and an interface method, generating a corresponding interface marking code according to the method data of the interface method, and instrumenting the interface marking code into the interface method; generating a request context object of a current thread according to the user request information, when the current thread executes an interface method, calling an interface mark code of instrumentation in the interface method, setting an interface mark character string into the request context object via the interface mark code; and performing association setting on the current user request and the interface according to the interface mark character string in the request context object in combination with the mapping relationship. According to the method, the interface configuration information is actively scanned, the interface mark code is instrumented to the interface, the request context object of the current thread is generated according to the user request information, and the interface corresponding to the current user request is obtained in the program running process.

Description

technical field [0001] The invention relates to the technical field of security scanning, in particular to a method and system for associating a request and an interface. Background technique [0002] API (Application Programming Interface, application programming interface) are some predefined functions, the purpose is to provide applications and developers with the ability to access a set of routines based on a piece of software or hardware, without having to access the source code, or understand the inner workings Mechanism details. [0003] The current security detection tools cannot realize the binding of API traffic and interfaces. However, if the above-mentioned security detection tools want to realize functions such as interface detection coverage, traffic classification, and API-level rule control, a method that can bind interfaces and traffic is required. Methods. [0004] In view of the above problems, the current implementation of security detection tools is: o...

AI Technical Summary

Problems solved by technology

However, the above existing technologies have disadvantages such as high false alarm rate and poor performance, and the accuracy is even worse in high concurrency scenarios

For example, the Get request host / user / abc for user ID abc and the Get request host / user / users for all user information are often considered to be the same request and cannot be distinguished

And for the unreceived request, the relevant API information cannot be generated, resulting in the inability to know all the API information of the entire web project, and the test coverage problem in the process of security testing cannot be known

Images