Restful API (Application Program Interface) fuzzy testing method for generating request sequence based on resource attribute graph

Abstract

The invention relates to the technical field of Web security, in particular to a Restful API (Application Program Interface) fuzzy test method for generating a request sequence based on a resource attribute graph, which comprises the following steps of: S1, analyzing and identifying a Restful API standard document: extracting an API operation, a resource mode and a request parameter by analyzing the Restful API standard document; s2, constructing a resource attribute graph: constructing a Restful resource attribute graph; s3, generating a request sequence: based on the constructed Restful resource attribute graph, adopting a depth-first traversal algorithm to generate an effective request sequence conforming to a CRUD rule; s4, filling request parameters: filling the request parameters for the generated request sequence, wherein the request parameters comprise assignment according to API specifications and assignment according to service logic; s5, sending the request and collecting response: sending the request, collecting response information and outputting a vulnerability report; and S6, updating the resource attribute graph: updating the Restful resource attribute graph according to the dynamic execution feedback. According to the method, the construction of the Restful resource attribute graph is perfected, so that the test process is more accurate and efficient.

Description

Technical Field

[0001] The present invention relates to the field of Web security technology, and in particular to a Restful API fuzzy testing method for generating a request sequence based on a resource attribute graph. Background Art

[0002] With the rapid development of Internet technology, representational state transfer has become the de facto standard for Web service interaction. The application program interface that follows this standard is called Restful API. Due to its high efficiency and flexibility, it has been widely used in various Web services. Many well-known network service providers provide service interfaces to the outside world through Restful API. In addition, Restful API is also widely deployed in e-commerce, social media, financial services, healthcare and other fields, providing key support for the rapid development of Internet applications.

[0003] However, the valid input of most Restful API requests depends on the response parameters of other requests, forming complex operation dependencies and parameter dependencies. Existing black-box fuzz testing tools have limited ability to identify and process these dependencies, resulting in the frequent generation of a large number of request sequences that do not conform to the semantic rules of Restful API during the Restful API fuzz testing process. These invalid request sequences not only significantly reduce the detection efficiency, but also may cause many potential security vulnerabilities to be missed and ignored. For example, when a resource ID generated by a create operation needs to be used in subsequent read or update operations, if the fuzz testing tool cannot correctly identify and reuse these dynamically generated parameter values, it will not be able to construct a valid test case and thus cannot trigger the relevant security vulnerabilities.

[0004] In addition, existing fuzz testing tools often rely on static request sequence generation strategies and lack the ability to respond to dynamic execution feedback. This means that when encountering failed requests or abnormal responses during the test process, the tool cannot adjust the request sequence generation strategy in time to adapt to the actual operating status of the target API, further affecting the detection efficiency and effectiveness of fuzz testing. Summary of the invention

[0005] The present invention provides a RESTful API fuzzy testing method for generating a request sequence based on a resource attribute graph.

[0006] The RESTful API fuzz testing method for generating request sequences based on resource attribute graphs includes the following steps: S1, parse and identify the Restful API specification document: extract API operations, resource modes and their request parameters by parsing the Restful API specification document; S2, building a resource attribute graph: building a Restful resource attribute graph, including node extraction, high-value parameter tagging, and using a large language model to derive the edges of the Restful resource attribute graph; S3, generate request sequence: Based on the constructed RESTful resource attribute graph, a depth-first traversal algorithm is used to generate a valid request sequence that complies with the CRUD (Create, Read, Update, Delete, i.e., the four basic data operations of create, read, update, and delete) rules; S4, fill in request parameters: fill in request parameters for the generated request sequence, including assigning values ​​according to API specifications and assigning values ​​according to business logic; S5, send request and collect response: send request, collect response information and output vulnerability report; S6, update resource attribute graph: update the Restful resource attribute graph according to dynamic execution feedback.

[0007] Optionally, the parsing and identification of the Restful API specification document in S1 includes: S11, extract API operations and paths: Extract API operations (such as GET, POST, PUT, DELETE, etc.) through the path information in the Restful API specification document. For each operation , extract the corresponding operation path and operation description , where the operation type ; S12, extract resource mode: extract resource mode through the path information in the Restful API specification document. Each resource mode consists of a set of attributes that define the resource mode. ,in Represents resource mode The set of attributes in , and ; S13, extract request parameters: For each operation , extract the request parameter set required for the operation , where each request parameter Includes parameter name, type, and whether it is required.

[0008] Optionally, constructing a resource attribute graph in S2 includes: S21, Node Extraction: Construct a node set in the RESTful resource property graph by analyzing the identified API operations and resource patterns , node set Includes a collection of pattern nodes and a collection of operation nodes , pattern node set Represents various resources defined in the API, a collection of operation nodes Represents the operation performed on a resource; S22, high-value parameter marking: based on node extraction, mark high-value parameters and define high-value sets ,in is a Boolean function to determine whether a node is of high value; S23, derive the edges of the Restful resource attribute graph: use the big language model to derive the complex dependencies between API operations through prompt word engineering. The big language model analyzes the logical relationship and data flow between operations based on the provided API operation description and constructs an edge set and edge label set .

[0009] Optionally, the edges of the Restful resource attribute graph derived in S23 include resource dependency edges , data dependency edge , pattern equivalent edge and operation-related edges ,in; The resource dependency edge is a directed edge, representing the production relationship between operations and modes, expressed as: ; The pattern equivalent edge is a directed edge, representing the consumption relationship between operations and modes, expressed as: ; The pattern equivalent edge is an undirected edge, representing the equivalent attribute relationship between different modes, expressed as: ; The operation is associated with the edge It is an undirected edge, indicating that the two operations belong to the same Restful API endpoint, formally expressed as: .

[0010] Optionally, the generation request sequence in S3 includes: S31, Generate basic call sequence: According to the Restful resource attribute graph, the request sequence generation algorithm starts from the Book mode node Start generating Book mode nodes The basic calling sequence of S32, generate extended call sequence: detect Book mode node through Restful resource attribute graph The id attribute of the Order mode node The bookId attribute of the Order mode node is equivalent to the bookId attribute of the Book mode node. The basic calling sequence is connected to generate an extended calling sequence; S33, apply CRUD constraint filtering to call sequences: Apply CRUD constraint filtering to all call sequences and define the validation function as , which for any sequence of calls Verify, expressed as: ; S34, output the final result: output the call sequence that meets the constraint conditions, expressed as: .

[0011] Optionally, the generating of the basic request sequence in S31 includes: S311, select the initial mode node: select the Book mode node As a starting point, extract its related operation nodes; S312, extracting output and input operations: extracting the output operation set and input operation set of the Book mode node, expressed as: ; ; S313, calculate the basic call sequence of the Book mode node: the output operation set of the Book mode node and input operation set Cartesian product , to generate a Book mode node The basic calling sequence is expressed as: ( , ).

[0012] Optionally, the recursive extension request sequence in S32 includes: S321, discovering the mode equivalence relationship: parsing the Restful resource attribute graph, and detecting the equivalence relationship between the id attribute of the Book mode node and the bookId attribute of the Order mode node; S322, recursively access the Order mode node: access the Order mode node, extract the output operation set and input operation set of the Order mode node, expressed as: ; ; S323, calculating the basic call sequence of the Order mode node: performing a Cartesian product on the output operation set and the input operation set of the Order mode node to generate the basic call sequence of the Order mode node, which is expressed as: ( , ); S324, connect the call sequence of Book and Order: calculate the call sequence of the Book mode node and connect it with the call sequence of the Order mode node to generate an extended call sequence, which is expressed as: ( , , , ).

[0013] Optionally, sending the request and collecting the response in S5 includes: S51, send request: Use the HTTP client library to construct an HTTP request, through The function sends a request, expressed as: ; in, Is the HTTP response object; S52, collect response information: receive and store the response information of each request, define the received HTTP response object as , which includes the HTTP status code , Response Header and the response body , the storage operation is expressed as: ; S53, output vulnerability report: analyze the collected response information, identify abnormal response patterns, including status code 500, abnormal error information, and detect potential security vulnerabilities based on predefined security rules, and finally generate a vulnerability report, including vulnerability type , Vulnerability Description , Affected API operations and its request sequence , expressed as: .

[0014] Optionally, updating the resource attribute graph in S6 includes: S61, feedback information collection: by analyzing the collected response information, dynamic parameters are generated and used as feedback information to update the Restful resource attribute graph; S62, Restful resource attribute graph update: adjust the edge and node attributes of the Restful resource attribute graph according to the dynamic parameters, including adding or deleting nodes or edges in the Restful resource attribute graph. If the feedback information includes a new resource mode or operation node or , then add it to the node set If the feedback information includes new dependencies (such as the dependency between an operation node and a pattern node), the new edge Add to edge set If the operation or mode nodes are wrong or no longer used, these nodes and their related edges will be deleted.

[0015] Beneficial effects of the present invention: The present invention, by designing and constructing a RESTful resource attribute graph, comprehensively identifies the dependencies between API operations, ensures that the generated request sequence conforms to the business logic, thereby avoiding the generation of a large number of invalid request sequences, and improving the efficiency and coverage of Restful API fuzzy testing. Based on the depth-first traversal algorithm, combined with CRUD rules, it effectively generates request sequences that conform to the business logic, enhances the pertinence and effectiveness of the test, and at the same time, adopts a high-value parameter marking mechanism to identify key API dependencies, and combines a large language model to parse the unstructured information in the Restful API specification document, further improves the construction of the Restful resource attribute graph, and makes the testing process more accurate and efficient.

[0016] The present invention optimizes the test process by combining dynamic execution feedback, collects API response information in real time during the request execution process, generates dynamic parameters, and uses them to update the Restful resource attribute graph, thereby ensuring the applicability and accuracy of the test sequence in the Restful API operating environment. By automatically adjusting the newly discovered resource modes, operation nodes and dependencies, the generation process of the request sequence is continuously optimized to make it more in line with the actual operating status of the Restful API, thereby improving the comprehensiveness and effectiveness of vulnerability detection and facilitating the efficient implementation of Restful API security testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of a testing method flow chart of an embodiment of the present invention; Figure 2 A schematic diagram of a portion of the RESTful API specification document of an embodiment of the present invention; Figure 3 Schematic diagram of the system architecture of an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0020] It should be noted that the references to "one embodiment", "embodiment", "exemplary embodiments", "some embodiments" and the like in the specification indicate that the embodiments described may include specific features, structures or characteristics, but not every embodiment may include the specific features, structures or characteristics. In addition, when a specific feature, structure or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the art to implement such feature, structure or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0021] In general, a term can be understood, at least in part, from its use in context. For example, depending, at least in part, on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending, at least in part, on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0022] The present invention proposes the concept of Restful Resource Attribute Graph (RRAG). The Restful Resource Attribute Graph is a hybrid multigraph with edge labels and attributes. It has both directed and undirected edges. Its formal definition is: ; ; in, is a collection of nodes; It is a collection of schema nodes, representing various resource schemas in the Restful API. Each schema node contains the attribute information of the resource. It is a collection of operation nodes, which represent various operations that can be performed in the Restful API. Each operation node contains the operation type and a string that identifies the operation.

[0023] ; in, is a set of edges; resource-dependent edges It is a set of directed edges from the operation node to the pattern node, indicating the output pattern after the operation is executed; data dependency edge It is a set of directed edges from the pattern node to the operation node, indicating the input pattern required to perform the operation; the pattern equivalence edge It is a set of undirected edges connecting two mode nodes, indicating the equivalent attribute relationship between different modes; operation association edge It is a set of undirected edges connecting two operation nodes, indicating that the two operations belong to the same Restful API endpoint.

[0024] ; in, is the set of edge labels; yes A set of edge labels indicating which attributes of the pattern are used as parameters of the operation; yes The edge label set of , indicating the equivalent attribute pairs of two patterns.

[0025] ; in, is a set of node attribute functions; for Assign attributes to the pattern nodes in; for Assign attributes to the operation nodes in .

[0026] ; in, It is a collection of high-value nodes; It is a collection of high-value pattern nodes; It is a combination of high-value operation nodes.

[0027] like Figure 1-Figure 2 As shown in FIG. 1 , a RESTful API fuzz testing method for generating a request sequence based on a resource property graph includes the following steps: S1. Parse and identify the RESTful API specification document, specifically: By parsing the specification document of the Restful API, such as the OpenAPI specification, key information such as API operations, resource modes, and request parameters can be extracted. The specific steps include the following: S11. Extract API operations and paths. Extract API operations (such as GET, POST, PUT, DELETE, etc.) through the path information in the Restful API specification document. For each operation , extract the corresponding operation path and operation description , where the operation type ; S12. Extract resource mode. Extract resource mode through path information in the Restful API specification document. Each resource mode consists of a set of attributes that define the resource mode. ,in Represents resource mode The set of attributes in , and ; S13. Extract request parameters for each operation , extract the request parameter set required for the operation , where each request parameter Including parameter name, type, whether it is required, etc. S2. Constructing the RESTful resource attribute graph, including node extraction, high-value parameter marking, and using the large language model to derive the edges of the RESTful resource attribute graph, specifically including the following sub-steps: S21, node extraction, by analyzing the identified API operations and resource patterns, constructing a node set in the Restful resource attribute graph . Node Collection Includes a collection of pattern nodes and a collection of operation nodes , pattern node set Represents various resources defined in the API, a collection of operation nodes Represents the specific operations performed on these resources; S22, high-value parameter marking, based on node extraction, mark high-value parameters and define high-value sets ,in To determine whether a node is a high-value Boolean function, the high-value parameter tag helps to identify and focus on nodes with high value and priority in vulnerability detection; S23. Use the big language model to derive the edges of the Restful resource attribute graph, and use the big language model to derive the complex dependencies between API operations through prompt word engineering. The big language model analyzes the logical relationship and data flow between operations based on the provided API operation description, and constructs an edge set. and edge label set .

[0028] Among them, the edges in S23 are divided into resource-dependent edges , data dependency edge , pattern equivalent edge and operation-related edges , specifically: Resource dependency edge, which is directed and represents the production relationship between operations and modes, is formally expressed as: .For example, Indicates operation Returns a pattern The object as response; Data dependency edge, which is directed, represents the consumption relationship between operations and patterns, and is formally expressed as: .For example, Indicates operation The parameter requires a An object or some of its properties; The pattern equivalence edge is undirected and represents the equivalent attribute relationship between different patterns. It is formally expressed as: .For example, It indicates that the attribute id of mode A and the AId of mode B are the same concept; The operation association edge is undirected, indicating that two operations belong to the same Restful API endpoint, formally expressed as: .For example, Indicates that operations C and D are two operations under the same Restful API endpoint.

[0029] S3. Generate a request sequence based on the Restful resource attribute graph, specifically: The request sequence generation module uses a depth-first traversal algorithm based on the constructed Restful resource attribute graph to generate a valid request sequence that complies with the CRUD (Create, Read, Update, Delete, i.e., the four basic data operations of create, read, update, and delete) rules. Figure 3 The Restful API specification document shown in the figure is used as an example to explain the process of generating a request sequence based on the Restful resource property graph, specifically: S31, Generate a basic request sequence. According to the Restful resource attribute graph, the request sequence generation algorithm starts from the Book mode node Start generating basic request sequences, and recursively access the associated Order mode nodes step by step to generate valid request sequences that meet CRUD constraints. Starting from the Book mode node, extract its related operation nodes. The output operation set is ; The input operation set is These input operations need to be started from the Book mode node The id and status attributes of the output operation set are obtained. and input operation set Cartesian product , to generate a Book mode node The basic calling sequence of , ); S32, recursively extending the request sequence, generating a basic sequence ( , ), the algorithm detects the Book mode node through the Restful resource attribute graph The id attribute of the Order mode node Based on this finding, the algorithm recursively accesses the Order mode node connected to the Book mode node. After entering the Order mode node, it extracts its related operation nodes. The output operation set of the Order mode node is ; The input operation set is By taking a Cartesian product of the input and output operation sets, the basic call sequence of the Order mode node can be generated, for example ( , ). Then, the algorithm connects the basic call sequence of this Order mode node with the basic call sequence previously generated in the Book mode node, further expanding it to ( , , , ), which means to create a book first, get the book details, generate an order for the book, and get the order details; S33, Apply CRUD constraints to filter request sequences. In the final stage of generating sequences, the algorithm applies CRUD constraints to filter all sequences. Define the validation function , which for any request sequence Verify as follows: ; Finally, the set of all request sequences that meet the conditions is recorded as: For example, make sure Always appears before other operations, while ensuring Not present in Previously, it was verified that the above sequence ( , , , ) complies with all CRUD constraints and is therefore retained; The pseudo code of the above process is as follows: S4. Fill in request parameters for the generated requests. After generating the request sequence, fill in specific parameter values ​​for each request. These parameter values ​​are assigned according to the definitions and business logic in the Restful API specification document to ensure that each request contains necessary and valid inputs. The parameter filling process takes into account the various types and formats of parameters required for different request operations to ensure the validity of the request and the comprehensiveness of the test.

[0030] S5, sending requests, collecting response information, and outputting vulnerability reports, specifically includes the following sub-steps: S51, send a request, use the HTTP client library to construct an HTTP request, through The function sends a request to ensure the correctness and completeness of the request, which is formally expressed as ,in, Is the HTTP response object; S52, collect response information, receive and store the response information of each request, and define the received HTTP response object as , which includes the HTTP status code , Response Header and the response body , the storage operation is formalized as ; S53, output vulnerability report, analyze the collected response information, identify abnormal response patterns, such as status code 500, abnormal error information, etc., and detect potential security vulnerabilities based on predefined security rules, and finally generate a detailed vulnerability report , including vulnerability types , Vulnerability Description , Affected API operations and its request sequence , which makes it easier for developers to make subsequent repairs.

[0031] S6. Update the RESTful resource attribute graph according to dynamic execution feedback. During the request execution process, update the RESTful resource attribute graph according to the actual dynamic execution feedback, specifically: S61, feedback collection and analysis, by analyzing the response information collected from S5, extracting the successfully generated dynamic parameters, and using these feedback information to update the Restful resource attribute graph; S62, Restful resource attribute graph update, adjust the edge and node attributes of the Restful resource attribute graph according to the feedback information, including adding or deleting nodes or edges in the Restful resource attribute graph, if the feedback information contains a new resource mode or operation node or , then add it to the node set If the feedback information contains a new dependency (such as the dependency between an operation node and a pattern node), the new edge Add to edge set In , if some operation or mode nodes are wrong or no longer used, these nodes and their related edges will be deleted.

[0032] like Figure 3 As shown, a RESTful API fuzz testing system for generating request sequences based on a RESTful resource property graph includes the following modules: Specification document parsing module: responsible for parsing the RESTful API specification document and extracting API operations, resource modes and their request parameter information.

[0033] Restful resource attribute graph construction module: Use the large language model to build a Restful resource attribute graph to identify resource dependencies and data dependencies between API operations. This module includes the following three submodules: Node extraction submodule: extracts API operations and resource modes, and builds node sets in the Restful resource attribute graph; High-value parameter marking submodule: marking important parameters passed between operations; The edge sub-module of the RESTful resource attribute graph is derived using the large language model: through interaction with the large language model, the resource dependency edges, data dependency edges, mode equivalence edges and operation association edges between operations are derived to construct the edge set of the RESTful resource attribute graph.

[0034] Request sequence generation module: Based on the Restful resource attribute graph, a depth-first traversal algorithm is used to extract valid request sequences from the Restful resource attribute graph, and invalid or redundant request sequences are filtered out through logical judgment and CRUD constraint verification to optimize detection efficiency.

[0035] Filling request parameter module: adopts a variety of parameter generation strategies to fill specific parameter values ​​for the generated request sequence. These parameter values ​​are assigned according to the definition and business logic in the Restful API specification document to ensure that each request contains necessary and valid input.

[0036] Request sending and response collection module: Use the HTTP client library to construct and send HTTP requests, and receive and store the response information of each request.

[0037] Vulnerability detection and reporting module: Analyzes the collected response information, identifies abnormal response patterns, detects potential security vulnerabilities based on predefined security rules, and finally generates a detailed vulnerability report.

[0038] Dynamic execution feedback update Restful resource property graph module: Update the Restful resource property graph according to dynamic execution feedback. During the request execution process, the system adjusts the edge and node properties of the Restful resource property graph according to the feedback information, including adding and deleting the corresponding edges in the Restful resource property graph.

[0039] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0040] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A RESTful API fuzz testing method based on resource attribute graph to generate request sequence, characterized in that: The following steps are involved: S1, parse and identify the Restful API specification document: extract API operations, resource modes and their request parameters by parsing the Restful API specification document; S2, building a resource attribute graph: building a Restful resource attribute graph, including node extraction, high-value parameter tagging, and using a large language model to derive the edges of the Restful resource attribute graph; S3, generate request sequence: Based on the constructed Restful resource attribute graph, a depth-first traversal algorithm is used to generate a valid request sequence that complies with CRUD rules; S4, fill in request parameters: fill in request parameters for the generated request sequence, including assigning values ​​according to API specifications and assigning values ​​according to business logic; S5, send request and collect response: send request, collect response information and output vulnerability report; S6, update resource attribute graph: update the Restful resource attribute graph according to dynamic execution feedback.

2. According to claim 1, the RESTful API fuzzy testing method for generating request sequences based on resource attribute graphs is characterized in that: The parsing and identification of RESTful API specification documents in S1 include: S11, extract API operations and paths: extract API operations through the path information in the Restful API specification document. For each operation , extract the corresponding operation path and operation description , where the operation type ; S12, extract resource mode: extract resource mode through the path information in the Restful API specification document. Each resource mode consists of a set of attributes that define the resource mode. ,in Represents resource mode The set of attributes in , and ; S13, extract request parameters: For each operation , extract the request parameter set required for the operation , where each request parameter Includes parameter name, type, and whether it is required.

3. The Restful API fuzz testing method based on resource attribute graph to generate request sequence according to claim 2 is characterized in that: The resource attribute graph constructed in S2 includes: S21, Node Extraction: Construct a node set in the RESTful resource property graph by analyzing the identified API operations and resource patterns , node set Includes a collection of pattern nodes and a collection of operation nodes , pattern node set Represents various resources defined in the API, a collection of operation nodes Represents the operation performed on a resource; S22, high-value parameter marking: based on node extraction, mark high-value parameters and define high-value sets ,in is a Boolean function to determine whether a node is of high value; S23, derive the edges of the Restful resource attribute graph: use the big language model to derive the complex dependencies between API operations through prompt word engineering. The big language model analyzes the logical relationship and data flow between operations based on the provided API operation description and constructs an edge set and edge label set .

4. The Restful API fuzzy testing method for generating request sequences based on resource attribute graph according to claim 3 is characterized in that: The edges of the derived Restful resource attribute graph in S23 include resource dependency edges , data dependency edge , pattern equivalent edge and operation-related edges ,in; The resource dependency edge is a directed edge, representing the production relationship between operations and modes, expressed as: ; The pattern equivalent edge is a directed edge, representing the consumption relationship between operations and modes, expressed as: ; The pattern equivalent edge is an undirected edge, representing the equivalent attribute relationship between different modes, expressed as: ; The operation is associated with the edge It is an undirected edge, indicating that the two operations belong to the same Restful API endpoint, formally expressed as: .

5. The Restful API fuzzy testing method for generating request sequences based on resource attribute graph according to claim 4 is characterized in that: The generation request sequence in S3 includes: S31, generate basic call sequence: according to the Restful resource attribute graph, the request sequence generation algorithm starts from the Book mode node Start generating Book mode nodes The basic calling sequence of S32, generate extended call sequence: detect Book mode node through Restful resource attribute graph The id attribute of the Order mode node The bookId attribute of the Order mode node is equivalent to the bookId attribute of the Book mode node. The basic calling sequence is connected to generate an extended calling sequence; S33, apply CRUD constraint filtering to call sequences: Apply CRUD constraint filtering to all call sequences and define the verification function as , which for any sequence of calls Verify, expressed as: ； S34, output the final result: output the call sequence that meets the constraint conditions, expressed as: .

6. The Restful API fuzzy testing method for generating request sequences based on resource attribute graph according to claim 5 is characterized in that: The generating basic request sequence in S31 includes: S311, select the initial mode node: select the Book mode node As a starting point, extract its related operation nodes; S312, extracting output and input operations: extracting the output operation set and input operation set of the Book mode node, expressed as: ； ； S313, calculate the basic call sequence of the Book mode node: the output operation set of the Book mode node and input operation set Cartesian product , to generate a Book mode node The basic calling sequence is expressed as: ( , )。 7. The Restful API fuzz testing method for generating request sequences based on resource attribute graph according to claim 6 is characterized in that: The recursive extension request sequence in S32 includes: S321, discovering the mode equivalence relationship: parsing the Restful resource attribute graph, and detecting the equivalence relationship between the id attribute of the Book mode node and the bookId attribute of the Order mode node; S322, recursively access the Order mode node: access the Order mode node, extract the output operation set and input operation set of the Order mode node, expressed as: ； ； S323, calculating the basic call sequence of the Order mode node: performing a Cartesian product on the output operation set and the input operation set of the Order mode node to generate the basic call sequence of the Order mode node, which is expressed as: ( , )； S324, connect the call sequence of Book and Order: calculate the call sequence of the Book mode node and connect it with the call sequence of the Order mode node to generate an extended call sequence, which is expressed as: ( , , , )。 8. The Restful API fuzzy testing method for generating request sequences based on resource attribute graph according to claim 7 is characterized in that: The sending of requests and collecting of responses in S5 include: S51, send request: Use the HTTP client library to construct an HTTP request, through The function sends a request, expressed as: ； in, Is the HTTP response object; S52, collect response information: receive and store the response information of each request, define the received HTTP response object as , which includes the HTTP status code , Response Header and the response body , the storage operation is expressed as: ； S53, output vulnerability report: analyze the collected response information, identify abnormal response patterns, including status code 500, abnormal error information, and detect potential security vulnerabilities based on predefined security rules, and finally generate a vulnerability report, including vulnerability type , Vulnerability Description , Affected API operations and its request sequence , expressed as: 。 9. The Restful API fuzz testing method for generating request sequences based on resource attribute graph according to claim 8 is characterized in that: The updating of the resource attribute graph in S6 includes: S61, feedback information collection: by analyzing the collected response information, dynamic parameters are generated and used as feedback information to update the Restful resource attribute graph; S62, Restful resource attribute graph update: adjust the edge and node attributes of the Restful resource attribute graph according to the dynamic parameters, including adding or deleting nodes or edges in the Restful resource attribute graph.

Images