Application programming interface detection method, device and electronic device

Abstract

The present invention discloses a method, device and electronic device for detecting an application programming interface. Relating to the field of information security, the method comprises: obtaining configuration information corresponding to at least one target interface, wherein the target interface is an application programming interface, and the configuration information at least includes the business type corresponding to the target interface; based on the configuration information, screening out at least one interface to be detected from at least one target interface, wherein the interface to be detected is a target interface in a first target call state, and the first target call state indicates that the interface to be detected can be successfully called; based on the business type corresponding to each interface to be detected, determining the detection rule corresponding to each interface to be detected; based on the detection rule, performing security detection on at least one interface to be detected to obtain a detection result. The present invention solves the technical problem of low detection efficiency caused by relying on manual detection of application programming interfaces in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method, device and electronic device for detecting an application programming interface. Background Art

[0002] An Application Programming Interface (API) is a set of predefined functions that allows applications and developers to access a set of routines based on a piece of software or hardware without having to access the source code or understand the details of the internal workings.

[0003] API security has always been a key concern for enterprises. In practical applications, regular API security testing is necessary to ensure the normal operation of related businesses. However, current API security testing is mainly performed manually by testers, which is not only inefficient but also prone to omissions due to the large workload.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present invention provide a method, device and electronic device for detecting an application programming interface (API), so as to at least solve the technical problem of low detection efficiency caused by manual detection of the API in the prior art.

[0006] According to one aspect of an embodiment of the present invention, a method for detecting an application programming interface is provided, comprising: obtaining configuration information corresponding to at least one target interface, wherein the target interface is an application programming interface, and the configuration information includes at least a business type corresponding to the target interface; based on the configuration information, screening out at least one interface to be detected from at least one target interface, wherein the interface to be detected is a target interface in a first target call state, and the first target call state indicates that the interface to be detected can be successfully called; based on the business type corresponding to each interface to be detected, determining a detection rule corresponding to each interface to be detected; based on the detection rule, performing a security detection on at least one interface to be detected to obtain a detection result.

[0007] Furthermore, the detection method of the application programming interface also includes: obtaining at least one interface before obtaining the configuration information corresponding to at least one target interface; determining the difficulty level of scanning each interface based on the data packet corresponding to each interface; based on the difficulty level corresponding to at least one interface, allocating at least one interface to a cache queue corresponding to the difficulty level; and determining the interface at the head of the cache queue as the target interface.

[0008] Furthermore, the detection method of the application programming interface also includes: sending the data message and configuration information corresponding to each target interface to the target gateway, wherein the configuration information also includes the private key of the application to which the target interface belongs; receiving the test result feedback from the target gateway, wherein the test result at least includes the signature verification result obtained by the target gateway based on the private key to the public key corresponding to the target gateway; based on the test result, screening out at least one interface to be detected from at least one target interface, wherein the test result is used to determine the calling status of the target interface.

[0009] Furthermore, the detection method of the application programming interface also includes: based on the detection rules corresponding to each interface to be detected, updating the data message corresponding to each interface to be detected to obtain the target data message; sending the target data message and configuration information corresponding to each interface to be detected to the target server through the target gateway, wherein the target server corresponds to the interface to be detected; receiving the return message fed back by the target server, wherein the return message is generated by the target server in response to the target data message; based on the return message, determining the detection result corresponding to each interface to be detected.

[0010] Furthermore, the detection method of the application programming interface also includes: after receiving the test results fed back by the target gateway, based on the test results, screening out at least one abnormal interface from at least one target interface, wherein the abnormal interface is a target interface in a second target call state, and the second target call state indicates that the interface to be detected cannot be successfully called; determining the abnormal information corresponding to each abnormal interface from the test results, and storing the abnormal information in the first storage area.

[0011] Furthermore, the detection method of the application programming interface further includes: after obtaining the detection result, if the detection result indicates that the security level of at least one interface to be detected is lower than a preset level, storing the detection result in a second storage area.

[0012] Furthermore, the detection method of the application programming interface also includes: responding to the detection rule library update instruction of the target object, obtaining the target detection rules and the correspondence between the target detection rules and the business type; storing the target detection rules and the correspondence between the target detection rules and the business type in the detection rule library.

[0013] According to another aspect of an embodiment of the present invention, a detection device for an application programming interface is also provided, including: an acquisition module for acquiring configuration information corresponding to at least one target interface, wherein the target interface is an application programming interface, and the configuration information includes at least a business type corresponding to the target interface; a screening module for screening out at least one interface to be detected from at least one target interface based on the configuration information, wherein the interface to be detected is a target interface in a first target call state, and the first target call state indicates that the interface to be detected can be successfully called; a determination module for determining a detection rule corresponding to each interface to be detected based on the business type corresponding to each interface to be detected; and a detection module for performing security detection on at least one interface to be detected based on the detection rule to obtain a detection result.

[0014] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the above-mentioned method for detecting an application programming interface when running.

[0015] According to another aspect of an embodiment of the present invention, an electronic device is also provided, which includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the above-mentioned application programming interface detection method during runtime.

[0016] In an embodiment of the present invention, a method is used to determine the detection rules for each interface based on interface configuration information, thereby detecting different interfaces based on different detection rules. The method obtains configuration information corresponding to at least one target interface, and then, based on the configuration information, screens at least one interface to be detected from the at least one target interface. Then, based on the business type corresponding to each interface to be detected, the detection rules corresponding to each interface to be detected are determined, and then, based on the detection rules, security detection is performed on the at least one interface to be detected to obtain a detection result. The target interface is an application programming interface, the configuration information includes at least the business type corresponding to the target interface, and the interface to be detected is a target interface in a first target call state, and the first target call state indicates that the interface to be detected can be successfully called.

[0017] In the above process, before performing security testing on the target interface, it is determined whether the target interface can be successfully called, and only the target interface that can be successfully called is determined as the interface to be tested for security testing. This avoids invalid testing caused by still testing the target interface based on the detection rules when there is a problem with the configuration information of a certain target interface, thereby effectively improving the efficiency of interface testing. Furthermore, by determining the detection rules corresponding to each interface to be tested based on the business type corresponding to each interface to be tested, and performing security testing on the interface to be tested based on the detection rules, it avoids performing indiscriminate full testing on all interfaces to be tested, thereby further improving the efficiency of interface testing.

[0018] It can be seen that the solution provided by this application achieves the purpose of determining the detection rules for each interface based on the configuration information of the interface, and thus detecting different interfaces based on different detection rules, thereby achieving the technical effect of improving detection efficiency, and further solving the technical problem of low detection efficiency caused by relying on manual application programming interface detection in the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0020] Figure 1 is a schematic diagram of an optional API detection system according to an embodiment of the present invention;

[0021] Figure 2 is a schematic diagram of an optional application programming interface detection method according to an embodiment of the present invention;

[0022] Figure 3 is a schematic diagram of an optional correspondence between service types and detection rules according to an embodiment of the present invention;

[0023] Figure 4 is a schematic diagram of the operation of an optional scanning module according to an embodiment of the present invention;

[0024] Figure 5 is a schematic diagram of the operation of an optional safety test submodule according to an embodiment of the present invention;

[0025] Figure 6 is a schematic diagram of an optional application programming interface detection device according to an embodiment of the present invention;

[0026] Figure 7 is a schematic diagram of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0030] Example 1

[0031] According to an embodiment of the present invention, an embodiment of a method for detecting an application programming interface is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] In this embodiment, if Figure 1 As shown, the aforementioned application programming interface detection method is executed with an optional API detection system as the execution body. The API detection system includes at least a scanning module, and optionally, may also include a configuration module and a feedback module, wherein the scanning module may also include a functional test submodule and a security test submodule.

[0033] Figure 2 FIG. 1 is a schematic diagram of an optional detection method for an application programming interface according to an embodiment of the present invention. Figure 2As shown, the method includes the following steps:

[0034] Step S201: Acquire configuration information corresponding to at least one target interface, wherein the target interface is an application programming interface, and the configuration information at least includes a service type corresponding to the target interface.

[0035] In step S201, configuration information corresponding to at least one target interface may be obtained through electronic devices, servers, application systems, and other devices. In the present application, configuration information corresponding to at least one target interface is obtained through an API detection system.

[0036] Optional, such as Figure 1 As shown, relevant staff can send the configuration information of the target interface to the API detection system through the front-end interactive interface, so that the configuration module in the API detection system can store the aforementioned configuration information in the configuration table of the relevant database, and the configuration table can use MySQL to store the configuration information persistently. Among them, the aforementioned configuration information includes at least the business type corresponding to the target interface, and can also include the access path, access type, application information of the application to which the target interface belongs, the application private key of the application to which the target interface belongs, etc. In addition, the configuration information can also include the contact information of the relevant configuration personnel, the urgency of the detection task corresponding to the target interface, etc.

[0037] Step S202: based on the configuration information, screen out at least one interface to be detected from at least one target interface, wherein the interface to be detected is a target interface in a first target call state, and the first target call state indicates that the interface to be detected can be successfully called.

[0038] In step S202, the aforementioned functional test submodule can be used to test whether each target interface can be successfully called in the current environment based on the configuration information of each target interface. Optionally, the functional test submodule can read the configuration information of a target interface from the aforementioned database, and then rely on the preset replay engine to send the configuration information and data message corresponding to the target interface to the API gateway (i.e., the target gateway), and then obtain the message (i.e., the test result) fed back by the API gateway based on the configuration information and data message it received, so as to determine whether the target interface can be successfully called in the current environment based on the message fed back by the API gateway.

[0039] Furthermore, when the functional testing sub-module determines that the target interface of the aforementioned test can be called successfully in the current environment, it determines that the target interface is in the first target call state and determines it as the interface to be detected. The method executed by the aforementioned functional testing sub-module is executed on all target interfaces in at least one target interface, thereby realizing the determination of all interfaces to be detected in at least one target interface.

[0040] It should be noted that by determining whether the target interface can be called successfully before performing security testing on the target interface, and only performing security testing on the target interface that can be called successfully, it is avoided that when there is a problem with the configuration information of a target interface, the invalid test caused by still testing the target interface based on the test rules is avoided, thereby effectively improving the efficiency of security testing of the interface.

[0041] Step S203: determining a detection rule corresponding to each interface to be detected based on the service type corresponding to each interface to be detected.

[0042] In step S203, the aforementioned security test submodule can be used to determine the detection rules for the target interface that has passed the functional test (i.e., the aforementioned interface to be detected). Optionally, the security test submodule can determine the business type of each interface to be detected based on the configuration information of the target interface that has been obtained. Each business type can correspond to at least one detection rule, and the detection rules corresponding to different business types can be completely different or partially the same. For example, for common technical vulnerabilities, each business type can be set with a detection rule corresponding to the vulnerability, and for vulnerabilities with a strong correlation with business types, the detection rule corresponding to the vulnerability can be set only for the business type corresponding to the vulnerability. Among them, Figure 3 As shown, the aforementioned business types can be "SMS business class", "query business class", "credit card business class", "page rendering class", "file upload class", etc. For the business type of "SMS business class", the corresponding detection rules can be as follows Figure 3 The following are vulnerability detections for SMS bypass and SMS bombing. For the "query business" business type, the corresponding detection rules can be as follows: Figure 3 The following vulnerability detections are shown: SQL injection, unauthorized access, and leakage of sensitive bank card information.

[0043] It should be noted that by determining the detection rules corresponding to each interface to be detected based on the business type corresponding to each interface to be detected, indiscriminate full detection of all interfaces to be detected is avoided, thereby further improving the security detection efficiency of the interface.

[0044] Step S204: Based on the detection rules, a security detection is performed on at least one interface to be detected to obtain a detection result.

[0045] In step S204, the security testing submodule may perform a security test on each interface to be detected based on the detection rule corresponding to each interface to be detected, thereby obtaining a monitoring result corresponding to each interface to be detected.

[0046] It should be noted that by performing security testing on at least one interface to be tested based on detection rules, manual testing of the interface to be tested by relevant staff is avoided, thereby reducing the workload of the staff, improving work efficiency and reducing work costs.

[0047] Based on the scheme defined in the above steps S201 to S204, it can be known that in an embodiment of the present invention, the detection rules for each interface are determined based on the configuration information of the interface, so that different interfaces are detected based on different detection rules. The configuration information corresponding to at least one target interface is obtained, and then at least one interface to be detected is screened out from at least one target interface based on the configuration information. Then, based on the business type corresponding to each interface to be detected, the detection rules corresponding to each interface to be detected are determined, so that security detection is performed on at least one interface to be detected based on the detection rules to obtain a detection result. Wherein, the target interface is an application programming interface, the configuration information includes at least the business type corresponding to the target interface, and the interface to be detected is a target interface in a first target call state, and the first target call state indicates that the interface to be detected can be successfully called.

[0048] It is easy to notice that in the above process, by first determining whether the target interface can be successfully called before performing security testing on the target interface, and only determining the target interface that can be successfully called as the interface to be tested for security testing, it is avoided that when there is a problem with the configuration information of a certain target interface, the target interface is still tested based on the detection rules, resulting in invalid testing, thereby effectively improving the efficiency of interface testing. Furthermore, by determining the detection rules corresponding to each interface to be tested based on the business type corresponding to each interface to be tested, and performing security testing on the interface to be tested based on the detection rules, it is avoided to perform indiscriminate full testing on all interfaces to be tested, thereby further improving the efficiency of interface testing.

[0049] It can be seen that the solution provided by this application achieves the purpose of determining the detection rules for each interface based on the configuration information of the interface, and thus detecting different interfaces based on different detection rules, thereby achieving the technical effect of improving detection efficiency, and further solving the technical problem of low detection efficiency caused by relying on manual API interface detection in the existing technology.

[0050] In an optional embodiment, before obtaining configuration information corresponding to at least one target interface, the API detection system may assign each interface to a different cache queue to be scanned based on the score of each interface. Specifically, the system may obtain at least one interface, determine a difficulty level for scanning each interface based on the data packets corresponding to each interface, and then assign the at least one interface to a cache queue corresponding to the difficulty level based on the difficulty level corresponding to the at least one interface, thereby determining the interface at the head of the cache queue as the target interface.

[0051] Optionally, the aforementioned configuration module can determine the difficulty level of scanning each interface based on the data packets of each interface. For example, for an interface with a large number of parameters in the data packet, the scanning difficulty level of the interface will be relatively high, and for an interface with a small number of parameters in the data packet, the scanning difficulty level of the interface will be relatively low. Among them, the aforementioned data packet at least includes input parameters for the interface, and the data packet of each interface can be pre-set by the staff, or it can be automatically generated by the API detection system based on the relevant information of the interface. Among them, the aforementioned scanning work refers to the aforementioned testing work and detection work.

[0052] Furthermore, after determining the difficulty level corresponding to each interface, the configuration module may allocate interfaces corresponding to the same difficulty level to the same cache queue, and allocate interfaces corresponding to different difficulty levels to different cache queues. Figure 1 As shown, the scanning module can detect each cache queue, and when it detects that there is an interface to be scanned in the cache queue, it determines the interface at the head of the cache queue as the target interface, so as to perform the aforementioned test processing on the target interface. It should be emphasized that when there are interfaces to be scanned in multiple cache queues, the scanning module can determine the interface at the head of each cache queue as the target interface, and use multi-threading to perform tests on multiple target interfaces simultaneously. When the interface at the current head of the cache queue is scanned, the interface at the next head of the cache queue can be used as the target interface to continue scanning until all interfaces in the cache queue are scanned.

[0053] It's important to note that because security checks typically require numerous replacement attack vectors for each parameter, scanning complex interfaces can take a long time, potentially blocking subsequent scans of simpler interfaces. Therefore, by assigning interfaces of varying difficulty levels to different cache queues, we avoid blocking the overall scan task with difficult interfaces, thus achieving more efficient resource utilization.

[0054] In an optional embodiment, in the process of selecting at least one interface to be tested from at least one target interface based on configuration information, the API detection system may send the data packet and configuration information corresponding to each target interface to the target gateway, and then receive the test results fed back by the target gateway, thereby selecting at least one interface to be tested from the at least one target interface based on the test results. The configuration information also includes the private key of the application to which the target interface belongs, and the test results include at least a signature verification result obtained by the target gateway verifying the public key corresponding to the target gateway based on the private key. The test results are used to determine the call status of the target interface.

[0055] Optional, such as Figure 4 As shown, the aforementioned functional test submodule can obtain the data message and configuration information corresponding to each target interface, and then rely on the replay engine to perform functional testing on each target interface. Specifically, during the test process, the replay engine can send a data packet containing the data message and configuration information of a certain target interface to the API gateway (that is, the aforementioned target gateway), and then the API gateway detects the data packet. Optionally, the API gateway can first obtain the private key of the application to which the target interface in the data packet belongs, and then perform signature verification in combination with the public key corresponding to the API gateway to obtain a signature verification result of the signature verification. When the signature verification result indicates that the signature verification failed, the signature verification result is directly determined as the test result. When the signature verification result indicates that the signature verification is successful, based on the configuration information in the data packet, the server corresponding to the configuration information is searched to obtain the search result, and the signature verification result and the search result can be determined as the test result. Among them, the aforementioned target interface belongs to the application that uses the target interface, the aforementioned server is a server for running the underlying program corresponding to the target interface, and the aforementioned search result is used to indicate whether the server is found.

[0056] Furthermore, the functional testing submodule can obtain the test interface fed back by the API gateway. When the signature verification result in the test result indicates that the signature verification failed, or the search result in the test result indicates that the server was not found, it is determined that the target interface under test cannot be successfully called. On the contrary, when the signature verification result in the test result indicates that the signature verification is successful and the search result in the test result indicates that the corresponding server is found, it is determined that the target interface under test can be successfully called, and the target interface is determined as the interface to be tested. In this way, the screening of the interface to be tested is achieved.

[0057] It should be noted that since the target interface may have permission requirements, the signature verification is performed based on the private key of the application to which the target interface belongs and the public key of the target gateway, thereby achieving effective judgment on whether the target interface can be successfully called, avoiding the problem of link failure caused by direct security testing of the target interface, which in turn affects the accuracy and efficiency of the security testing results.

[0058] In an optional embodiment, in the process of performing security detection on at least one interface to be detected based on detection rules and obtaining detection results, the API detection system can update the data message corresponding to each interface to be detected based on the detection rules corresponding to each interface to be detected to obtain a target data message, and then send the target data message and configuration information corresponding to each interface to be detected to the target server through the target gateway, and then receive the return message fed back by the target server, so as to determine the detection result corresponding to each interface to be detected based on the return message. Wherein, the target server corresponds to the interface to be detected, and the return message is generated by the target server in response to the target data message.

[0059] Among them, in this application, Figure 3 、 Figure 4 As shown, the aforementioned detection rules can be stored in the security testing library. The detection rules in the security testing library can be used to address at least the following three types of vulnerabilities: 1) common technical vulnerabilities; 2) common business vulnerabilities; and 3) new vulnerabilities. Common technical vulnerabilities include error-based SQL injection detection, reflected XSS injection detection, command execution vulnerabilities, and XXE vulnerabilities. Common business vulnerabilities include SMS verification code bypass, sensitive information leakage, and unauthorized access. New vulnerabilities include log4j vulnerability detection and fastjson vulnerability detection. Different vulnerabilities correspond to different detection rules.

[0060] Optionally, the security testing submodule may obtain at least one detection rule corresponding to each interface to be tested from the security testing library, first determine a detection rule from the at least one detection rule corresponding to a particular interface to be tested, and then update the data packet corresponding to the interface to be tested based on the determined detection rule to obtain a target data packet. Different detection rules may have different update rules for data packets.

[0061] Furthermore, if Figure 4 、 Figure 5As shown, after obtaining the target data message, the security test submodule can use the replay engine to send the target data message and configuration information corresponding to each interface to be detected to the target server through the API gateway. Among them, the target server is a server used to run the underlying program corresponding to the interface to be detected. And when the target server receives the target data message, the target server generates a corresponding return message in response to the target data message, and feeds it back to the security test submodule through the API gateway. Furthermore, after the security test submodule obtains the return message, the security test submodule can analyze the return message to determine the detection result corresponding to the interface to be detected. For example, for reflected XSS vulnerabilities, the parameters in the data message can be replaced with XSS attack vectors one by one, and the return message can be checked for the presence of the attack vector to obtain a detection result. For unauthorized access detection, the cookie information of a low-privileged user can be used to replace queries or other operations of a high-privileged user in the data message, and the detection result can be determined based on the success / failure of the operation indicated by the return message. For sensitive information detection, the data message or return message can be directly tested for customized sensitive information, such as ID cards or sensitive serial numbers within the enterprise, to determine the detection result. For Apache log4j vulnerability detection, the RMI service address can be injected into the data message, and the information in the return message can be used to confirm whether a vulnerability exists, thereby determining the detection result. The aforementioned detection results are used to at least characterize the security level of the interface being tested. For example, for unauthorized access detection, if the return message indicates a successful operation, the detection result can be determined as: the security level of the interface being tested is low. Conversely, if the return message indicates a failure, the detection result can be determined as: the security level of the interface being tested is high. Furthermore, the detection results can also indicate the cause of the security issue in the interface being tested.

[0062] It should be noted that by updating the data message and determining the detection result based on the return message generated by the target server in response to the target data message, effective determination of the detection result is achieved.

[0063] In an optional embodiment, after receiving the test results fed back by the target gateway, the API detection system may, based on the test results, screen out at least one abnormal interface from at least one target interface, then determine the abnormal information corresponding to each abnormal interface from the test results, and store the abnormal information in the first storage area. The abnormal interface is a target interface in a second target call state, where the second target call state indicates that the interface to be detected cannot be successfully called.

[0064] Optional, such as Figure 1As shown, when the API gateway determines that the target interface call fails, the message returned by the API gateway will include a related error code. When the test result contains error information, the functional test submodule can determine that the target interface corresponding to the test result containing the error information is an abnormal interface, and obtain the error code (that is, the aforementioned abnormal information) in the message returned by the API gateway. The error code is then stored in the first storage area, and the generation prompt of the abnormal interface and the abnormal information corresponding to the abnormal interface is fed back to the feedback module. It should be noted that, Figure 1 The database in is used to represent all databases and storage areas appearing in this application.

[0065] Furthermore, if Figure 1 As shown, the feedback module can obtain the abnormal interface and the abnormal information corresponding to the abnormal interface from the first storage area, and display it through the front-end interactive interface so that relevant staff can understand and handle it in time.

[0066] It should be noted that the exception information corresponding to the target interface that calls the exception is stored so that relevant staff can handle it in a timely manner.

[0067] In an optional embodiment, after obtaining the detection result, the API detection system may store the detection result in the second storage area if the detection result indicates that the security level of at least one interface to be detected is less than a preset level.

[0068] Optional, such as Figure 1 As shown, after the security test submodule completes the detection of the interface to be detected, the security test submodule can only store the detection results corresponding to the interface to be detected with security issues (i.e., the aforementioned security level is less than the preset level) in the second storage area, and feed back the generation prompt of the interface to be detected with security issues and the abnormal information corresponding to the interface to be detected to the feedback module. Optionally, the security test submodule can also store the detection results corresponding to all interfaces to be detected in the second storage area, and feed back the corresponding generation prompt to the feedback module. The aforementioned first storage area and second storage area can be the same or different.

[0069] Furthermore, if Figure 1 As shown, the feedback module can obtain the test results corresponding to the aforementioned interfaces to be tested from the second storage area and display them through the front-end interactive interface so that relevant staff can understand and handle them in a timely manner. Among them, the feedback module can provide an overview of all target interfaces and a detailed report for specific interfaces.

[0070] It should be noted that by storing the test results corresponding to the interfaces to be tested that have security issues, relevant staff can handle them in a timely manner.

[0071] In an optional embodiment, the API detection system can respond to the detection rule library update instruction of the target object, obtain the target detection rules and the correspondence between the target detection rules and the business type, and then store the target detection rules and the correspondence between the target detection rules and the business type in the detection rule library.

[0072] Optionally, in order to achieve timely detection of the latest vulnerabilities, staff can input detection rule library update instructions into the API detection system, and upload the detection rules corresponding to the latest vulnerabilities (i.e. the aforementioned target detection rules), as well as the business types corresponding to the detection rules. The API detection system then stores the target detection rules and the correspondence between the target detection rules and the business types in the security testing library (i.e. the aforementioned detection rule library).

[0073] It should be noted that by acquiring and storing target detection rules and the correspondence between target detection rules and business types, the latest vulnerability detection of interfaces of different business types can be achieved, thereby improving the reliability of detection.

[0074] It can be seen that the solution provided by this application achieves the purpose of determining the detection rules for each interface based on the configuration information of the interface, and thus detecting different interfaces based on different detection rules, thereby achieving the technical effect of improving detection efficiency, and further solving the technical problem of low detection efficiency caused by relying on manual application programming interface detection in the existing technology.

[0075] Example 2

[0076] According to an embodiment of the present invention, an embodiment of a detection device for an application programming interface is provided, wherein: Figure 6 is a schematic diagram of a detection device for an optional application programming interface according to an embodiment of the present invention, such as Figure 6 As shown, the device includes:

[0077] An acquisition module 601 is configured to acquire configuration information corresponding to at least one target interface, wherein the target interface is an application programming interface, and the configuration information includes at least a service type corresponding to the target interface;

[0078] A screening module 602 is configured to screen at least one target interface to select at least one interface to be detected from at least one target interface based on the configuration information, wherein the interface to be detected is a target interface in a first target call state, where the first target call state indicates that the interface to be detected can be successfully called;

[0079] Determining module 603, for determining a detection rule corresponding to each interface to be detected based on a service type corresponding to each interface to be detected;

[0080] The detection module 604 is configured to perform a security detection on at least one interface to be detected based on the detection rules to obtain a detection result.

[0081] It should be noted that the above-mentioned acquisition module 601, screening module 602, determination module 603 and detection module 604 correspond to steps S201 to S204 in the above-mentioned embodiment. The examples and application scenarios implemented by the four modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0082] Optionally, the detection device for the application programming interface also includes: a first acquisition submodule, used to acquire at least one interface; a first determination submodule, used to determine the difficulty level of scanning each interface based on the data packet corresponding to each interface; an allocation module, used to allocate at least one interface to a cache queue corresponding to the difficulty level based on the difficulty level corresponding to at least one interface; and a second determination submodule, used to determine the interface at the head position in the cache queue as the target interface.

[0083] Optionally, the screening module also includes: a first sending module, used to send the data message and configuration information corresponding to each target interface to the target gateway, wherein the configuration information also includes the private key of the application to which the target interface belongs; a first receiving module, used to receive the test results fed back by the target gateway, wherein the test results at least include the signature verification result obtained by the target gateway based on the private key to the public key corresponding to the target gateway; a first screening sub-module, used to screen out at least one interface to be detected from at least one target interface based on the test results, wherein the test results are used to determine the calling status of the target interface.

[0084] Optionally, the detection module also includes: an update module, which is used to update the data packet corresponding to each interface to be detected based on the detection rules corresponding to each interface to be detected to obtain a target data packet; a second sending module, which is used to send the target data packet and configuration information corresponding to each interface to be detected to the target server through the target gateway, wherein the target server corresponds to the interface to be detected; a second receiving module, which is used to receive the return message fed back by the target server, wherein the return message is generated by the target server in response to the target data message; and a third determination submodule, which is used to determine the detection result corresponding to each interface to be detected based on the return message.

[0085] Optionally, the detection device of the application programming interface also includes: a second screening submodule, used to screen out at least one abnormal interface from at least one target interface based on the test results, wherein the abnormal interface is a target interface in a second target call state, and the second target call state indicates that the interface to be detected cannot be successfully called; a first storage module, used to determine the abnormal information corresponding to each abnormal interface from the test results, and store the abnormal information in a first storage area.

[0086] Optionally, the detection device for the application programming interface further includes: a second storage module, configured to store the detection result in a second storage area when the detection result indicates that the security level of at least one interface to be detected is lower than a preset level.

[0087] Optionally, the detection device of the application programming interface also includes: a second acquisition sub-module, used to respond to the detection rule library update instruction of the target object, obtain the target detection rules and the correspondence between the target detection rules and the business type; a third storage module, used to store the target detection rules and the correspondence between the target detection rules and the business type in the detection rule library.

[0088] Example 3

[0089] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the above-mentioned detection method of the application programming interface when running.

[0090] Example 4

[0091] According to another aspect of an embodiment of the present invention, an electronic device is provided, wherein: Figure 7 is a schematic diagram of an optional electronic device according to an embodiment of the present invention, such as Figure 7 As shown, the electronic device includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the above-mentioned application programming interface detection method when running.

[0092] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0093] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0094] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some target interface, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0095] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0096] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0097] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0098] The above are only preferred embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting an application programming interface, characterized in that: include: Acquire configuration information corresponding to at least one target interface, wherein the target interface is an application programming interface, and the configuration information includes at least a service type corresponding to the target interface; Based on the configuration information, at least one interface to be detected is screened out from the at least one target interface, wherein the interface to be detected is a target interface in a first target call state, and the first target call state indicates that the interface to be detected can be successfully called; Determining a detection rule corresponding to each interface to be detected based on a service type corresponding to each interface to be detected; Based on the detection rules, perform a security detection on the at least one interface to be detected to obtain a detection result; Filtering at least one interface to be detected from the at least one target interface based on the configuration information includes: Sending the data message and configuration information corresponding to each target interface to the target gateway, wherein the configuration information also includes the private key of the application to which the target interface belongs; Receive a test result fed back by the target gateway, wherein the test result at least includes a signature verification result obtained by the target gateway verifying a public key corresponding to the target gateway based on the private key; Based on the test result, screening at least one interface to be detected from the at least one target interface, wherein the test result is used to determine the call status of the target interface; Based on the detection rule, a security detection is performed on the at least one interface to be detected to obtain a detection result, including: Based on the detection rules corresponding to each interface to be detected, the data message corresponding to each interface to be detected is updated to obtain the target data message; Sending the target data message and configuration information corresponding to each interface to be detected to the target server through the target gateway, wherein the target server corresponds to the interface to be detected; receiving a return message fed back by the target server, wherein the return message is generated by the target server in response to the target data message; Based on the returned message, a detection result corresponding to each interface to be detected is determined.

2. The method according to claim 1, characterized in that Before obtaining configuration information corresponding to at least one target interface, the method includes: Get at least one interface; Determining a difficulty level for scanning each interface based on data packets corresponding to each interface; Based on the difficulty level corresponding to the at least one interface, allocating the at least one interface to a cache queue corresponding to the difficulty level; The interface at the head position in the cache queue is determined as the target interface.

3. The method according to claim 1, characterized in that After receiving the test result fed back by the target gateway, the method further includes: Based on the test result, at least one abnormal interface is screened out from the at least one target interface, wherein the abnormal interface is a target interface in a second target call state, and the second target call state indicates that the interface to be tested cannot be successfully called; Exception information corresponding to each abnormal interface is determined from the test results, and the exception information is stored in a first storage area.

4. The method according to claim 1, wherein After obtaining the test results, the method further includes: When the detection result indicates that the security level of the at least one interface to be detected is lower than a preset level, the detection result is stored in a second storage area.

5. The method according to claim 1, characterized in that The method further comprises: Responding to a detection rule library update instruction for a target object, obtaining a target detection rule and a correspondence between the target detection rule and the service type; The target detection rule and the corresponding relationship between the target detection rule and the business type are stored in a detection rule library.

6. A detection device for an application programming interface, characterized in that: include: an acquisition module, configured to acquire configuration information corresponding to at least one target interface, wherein the target interface is an application programming interface, and the configuration information includes at least a service type corresponding to the target interface; a screening module, configured to screen out at least one interface to be detected from the at least one target interface based on the configuration information, wherein the interface to be detected is a target interface in a first target call state, and the first target call state indicates that the interface to be detected can be successfully called; A determination module, configured to determine a detection rule corresponding to each interface to be detected based on a service type corresponding to each interface to be detected; A detection module, configured to perform a security detection on the at least one interface to be detected based on the detection rule to obtain a detection result; The screening module also includes: A first sending module is configured to send a data packet and configuration information corresponding to each target interface to a target gateway, wherein the configuration information further includes a private key of an application to which the target interface belongs; A first receiving module is configured to receive a test result fed back by the target gateway, wherein the test result at least includes a signature verification result obtained by the target gateway verifying a public key corresponding to the target gateway based on the private key; a first screening submodule, configured to screen out at least one interface to be detected from the at least one target interface based on the test result, wherein the test result is used to determine a call state of the target interface; The detection module also includes: An updating module is used to update the data message corresponding to each interface to be detected based on the detection rule corresponding to each interface to be detected to obtain a target data message; A second sending module is used to send the target data message and configuration information corresponding to each interface to be detected to a target server through the target gateway, wherein the target server corresponds to the interface to be detected; a second receiving module, configured to receive a return message fed back by the target server, wherein the return message is generated by the target server in response to the target data message; The third determining submodule is configured to determine the detection result corresponding to each interface to be detected based on the returned message.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method for detecting the application programming interface according to any one of claims 1 to 5 when running.

8. An electronic device, characterized in that: The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the detection method of the application programming interface described in any one of claims 1 to 5 at runtime.

Images