Api security device testing method and apparatus, system, electronic device, storage medium

Abstract

The present disclosure discloses an API security device testing method and device, system, electronic equipment and storage medium, relates to the technical field of data simulation, and a specific implementation scheme is as follows: obtaining interface traffic data under a current test scene from a pre-generated interface traffic data set; loading the interface traffic data to a server and a client respectively, and controlling the server and the client to perform interface traffic replay on the interface traffic data; receiving feedback data of an API security device during the interface traffic data replay, the API security device being a device for monitoring the interface traffic data; and generating an evaluation result of the API security device based on the feedback data, thereby improving the flexibility of API security device testing.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data simulation, and particularly relates to an API security device testing method and device, system, electronic device and computer readable storage medium. BACKGROUND

[0002] With continuous improvement of network systems, the number of APIs (Application Programming Interface) exposed to the Internet is gradually increasing. These APIs have various protocol styles, such as HTTP (Hyper Text Transfer Protocol) protocol, non-HTTP protocol, and the like. These APIs exposed to the public network may have unpredictable security risks, such as sensitive data leakage caused by the APIs, or the APIs being used by hackers to attack and invade the system.

[0003] The API security device is a device that detects the request and response traffic passing through the current API to determine whether the API is attacked, invaded, or causes sensitive information or sensitive data leakage.

[0004] In the traditional technology, since there are many API related protocols and various communication modes, manual testing of the API security device requires too much manpower and is too low in efficiency.

[0005] The information disclosed in this BACKGROUND section is only intended to increase an understanding of the general context in which the present application can be practiced. It is not intended to be in any way a definition of the prior art to which the present application pertains. SUMMARY

[0006] The present disclosure aims to solve the technical problem of low efficiency of manual testing of API security devices, and provides an API security device testing method and device, system, electronic device and computer readable storage medium.

[0007] The first aspect of the present disclosure provides an API security device testing method, which comprises: obtaining interface traffic data under a current test scene from a pre-generated interface traffic data set; loading the interface traffic data to a server and a client respectively, and controlling the server and the client to perform interface traffic replay on the interface traffic data; receiving feedback data of the API security device during the interface traffic data replay, the API security device being a device for monitoring the interface traffic data; and generating an evaluation result of the API security device based on the feedback data.

[0008] The second aspect of the present disclosure provides an API security device testing apparatus, comprising: an acquisition unit configured to acquire interface traffic data under a current testing scenario from a pre-generated interface traffic data set; a control unit configured to load the interface traffic data to a server and a client respectively, and control the server and the client to perform interface traffic replay on the interface traffic data; a receiving unit configured to receive feedback data of the API security device during the interface traffic replay, the API security device being a device for monitoring the interface traffic data; and an evaluation unit configured to generate an evaluation result of the API security device based on the feedback data.

[0009] According to a third aspect, an API security device testing system is provided for testing an API security device, characterized in that the system comprises: a testing controller, a server, a client, and the API security device for monitoring interface traffic data between the server and the client; the testing controller is configured to acquire interface traffic data under a current testing scenario from a pre-generated interface traffic data set, load the interface traffic data to the server and the client respectively, and control the server and the client to perform interface traffic replay on the interface traffic data; receive feedback data of the API security device; and generate an evaluation result of the API security device based on the feedback data.

[0010] According to a fourth aspect, an electronic device is provided, comprising: at least one processor; and a memory connected with the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in any implementation manner of the first aspect.

[0011] According to a fifth aspect, a non-transitory computer-readable storage medium storing computer instructions is provided, the computer instructions being used to cause a computer to perform the method described in any implementation manner of the first aspect.

[0012] The API security device testing method and device provided by the embodiments of the present disclosure first acquire interface traffic data under a current testing scenario from a pre-generated interface traffic data set; secondly, the interface traffic data is loaded to a server and a client respectively, and the server and the client are controlled to perform interface traffic replay on the interface traffic data; thirdly, feedback data of an API security device during the interface traffic data replay is received, the API security device being a device for monitoring the interface traffic data; finally, based on the feedback data, an evaluation result of the API security device is generated. In this way, interface traffic data under different scenarios is selected from the interface traffic data set in real time, the server and the client are controlled to perform traffic replay, and the feedback data of the API security device is acquired, thereby reproducing the monitoring of the API security device on traffic under different scenarios, completing the automatic evaluation of the API security device, and improving the testing efficiency of the API security device. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 is a flowchart of an embodiment of the API security device testing method according to the present disclosure;

[0014] Figure 2 is a structural schematic diagram of interface traffic data in the present disclosure;

[0015] Figure 3 is a structural schematic diagram of an embodiment of the API security device testing device according to the present disclosure;

[0016] Figure 4 is a structural schematic diagram of an embodiment of the API security device testing system according to the present disclosure;

[0017] Figure 5 is a block diagram of an electronic device for implementing the API security device testing method of the embodiments of the present disclosure. DETAILED DESCRIPTION

[0018] Unless otherwise clearly indicated, in the entire specification and claims of the present disclosure, the term “comprise” or its variants such as “comprises” or “comprising” will be understood to encompass the stated element or components, but not exclude other elements or components.

[0019] The technical solutions of the present application are described below through specific examples. It should be understood that the one or more steps mentioned in the present application do not exclude the existence of other methods and steps before and after the combination steps, or other methods and steps can be inserted between these explicitly mentioned steps. It should also be understood that these examples are only used to illustrate the present application and not to limit the scope of the present application. Unless otherwise specified, the numbering of each method step is only for the purpose of identifying each method step, and is not intended to limit the arrangement order of each method or to limit the scope of the implementation of the present application. Changes or adjustments of the relative relationship, without substantial technical content changes, can also be considered as the scope of implementation of the present application.

[0020] The raw materials and instruments used in the examples are not specifically limited in source, and can be purchased on the market or prepared according to the conventional methods well known to those skilled in the art.

[0021] The number of APIs on the Internet is gradually increasing, and these APIs will have various styles. Not only are there HTTP protocol APIs, such as RestFul style APIs, GraphQL style APIs, SOAP (Simple Object Access Protocol) simple object access protocol, and Websocket communication methods, but there are also non-HTTP protocols, such as Dubbo's RPC (Remote Procedure Call), gRPC protocol, and various other protocol and form APIs. These APIs exposed to the public network will be unpredictable.

[0022] API security devices monitor, alarm, and intercept API traffic. If you want to know whether the functions and rules of the API security detection device correspond to a specific intrusion attack method, you need to simulate the intrusion attack method; or if you want to know whether the API security detection device can identify the leakage of sensitive data, you also need to simulate the relevant leakage scene. However, the simulation of these scenes needs to be done manually, and the simulation efficiency is low.

[0023] In view of the defect of low efficiency of manual testing of API security devices in the prior art, the present disclosure provides an API security device testing method, Figure 1 The flow 100 of one embodiment of the API security device testing method is shown, and the API security device testing method includes the following steps:

[0024] Step 101, obtaining interface traffic data under the current test scene from a pre-generated interface traffic data set.

[0025] In this embodiment, the interface traffic data refers to the amount of data transmitted through an interface within a certain time, which reflects the actual use of network resources and is an important indicator for measuring network load and evaluating network performance. The above interface exposes only the necessary function interface by abstracting technical details, for example, the operating system provides file management, graphics rendering and other services through API, and the developer can call without paying attention to the hardware bottom.

[0026] In this embodiment, the interface traffic data set includes various types of interface traffic data, such as HTTP type interface traffic data or non-HTTP type interface traffic data, each type of interface traffic data can be used to test API security devices, wherein the API security device is a device that detects request and response traffic through the current API to determine whether the API is attacked, invaded or causes sensitive information or sensitive data leakage.

[0027] In this embodiment, the current test scenario is a scenario for testing API security devices, such as a normal interface communication scenario, or an intrusion attack test scenario, or a sensitive data leakage scenario, etc. Abnormal interface communication scenarios, generally, the current test scenario is determined by the test requirements of the API security device, and the current test scenario can also be configured by the developer.

[0028] In this embodiment, the interface traffic data set can be obtained by applying the interface traffic template, and the interface traffic template can be implemented by using the YAML template. YAML format is easy to read and write, and is suitable for configuring complex HTTP request messages. The YAML template is a template that defines the structure and content of requests and responses implemented by the YAML (short for YAML Ain't Markup Language) language, which can be used in configuration files, data exchange, object persistence, etc. Wherein, the YAML language is a text-based markup language for data serialization.

[0029] In this optional implementation, the application interface traffic templates under each test scenario under multiple test scenarios can be generated first, and the application interface traffic template of the current test scenario is determined after the current test scenario is determined based on the development requirements. The interface traffic data is obtained by processing the application interface traffic template as follows: read the YAML template language configuration, identify the template protocol of the API defined by the current template, and parse the template of the request and response of the API. The related pre-defined variables of the request and response, such as the placeholder of the hash (unique identifier) of the special identifier of the API, are dynamically rendered, and the placeholder text content is replaced with the real identifier value; the rendered request and response are generated according to the template definition protocol, and the final multiple sets of request and response pairs of binary data form interface traffic data.

[0030] Step 102, loading the interface traffic data to the server and the client respectively, and controlling the server and the client to perform interface traffic replay on the interface traffic data.

[0031] In this embodiment, the interface traffic data is loaded to the server and the client respectively, which is the same as the traditional traffic loading, that is, the process of transmitting data from the network to the user equipment in the network communication process. Specifically, when a user accesses a webpage, downloads a file or watches an online video through the Internet, data needs to be transmitted from the server to the user equipment, and this way of transmitting data from the server to the user equipment is the traffic loading process. In this embodiment, the execution subject on which the API security device testing method runs belongs to the server relative to the server and the client, and accordingly, the server and the client belong to the user equipment relative to the above-mentioned execution subject.

[0032] In this embodiment, the execution subject on which the API security device testing method runs can send different control instructions to the server and the client respectively, so as to control the server and the client to perform interface traffic replay through the control instructions. Traffic replay is a technical means to simulate the operation of a real user or the behavior of a system by capturing, storing and resending network traffic data. Through the interface traffic replay of the present disclosure, the client can request the server according to the predetermined traffic at the transport layer, such as the TCP (Transmission Control Protocol) protocol or the UDP (User Datagram Protocol) protocol, and the server can respond according to the predetermined traffic.

[0033] In this embodiment, the above-mentioned step 102 includes: controlling the client to capture the request data and the response data in the interface traffic data, and for the interface traffic data of the HTTP protocol, the above-mentioned data usually includes HTTP request, response header, request body, etc. The captured data is stored in a reusable format in the client; after receiving the control instruction of the execution subject, the stored request data is resent to the server, the response of the server is received, and the response of the server is compared with the original response to detect any inconsistency or error. At the same time, the server is controlled to capture the request data and the response data in the interface traffic data, and these data usually include HTTP request, response header, request body, etc. The captured data is stored in a reusable format in the server; after receiving the control instruction of the execution subject, the stored response data is resent to the client.

[0034] As Figure 2As shown, by performing data analysis and dynamic rendering on the application interface traffic template, the generated request and response are converted into binary stream data, and the request and response pairs of binary stream data are loaded to the server side, and the server side opens the response service listening to wait for the request of the client; the request and response pairs of binary stream data are loaded to the client, and the client requests the server side according to the predetermined traffic in the transport layer (TCP protocol or UDP protocol), and the server side responds according to the predetermined traffic.

[0035] In step 103, feedback data of the API security device during the interface traffic data replay is received.

[0036] In this embodiment, the API security device is a device for monitoring interface traffic data. When the service side and the client side perform interface traffic replay on the interface traffic data, the API security device can check whether the response data of the service side meets the functional, performance and security requirements according to different scenarios, and specifically verify whether the response data is correct, whether there is SQL injection, authorization / identity authentication bypass and the like. The API security device can also detect whether the request data of the client side has intrusion attack content.

[0037] In this embodiment, the feedback data is the data fed back by the API security device to the execution subject on which the API security device test method runs, and the feedback data is also the feedback of the API security device on whether the interface traffic data is abnormal or normal under the current test scenario.

[0038] In step 104, based on the feedback data, an evaluation result of the API security device is generated.

[0039] In this embodiment, the interface traffic data under the current test scenario has corresponding functional test instructions, such as normal interaction traffic or abnormal interaction traffic, wherein the abnormal interaction traffic includes API attack, intrusion or causing sensitive information or sensitive data leakage; when the feedback data is consistent with the functional test instructions corresponding to the interface traffic data, it is determined that the function of the API security device is normal, and the evaluation result of the API security device is that the API security device can detect normal API interaction.

[0040] The API security device testing method provided by the embodiments of the present disclosure first acquires interface traffic data under a current test scenario from a pre-generated interface traffic data set; second, loads the interface traffic data to a server and a client respectively, and controls the server and the client to perform interface traffic replay on the interface traffic data; third, receives feedback data of an API security device during the interface traffic data replay, the API security device being a device for monitoring the interface traffic data; and finally, generates an evaluation result of the API security device based on the feedback data. In this way, interface traffic data under different scenarios is selected from the interface traffic data set in real time, the server and the client are controlled to perform traffic replay, and the feedback data of the API security device is acquired, thereby reproducing the monitoring of the API security device on traffic under different scenarios, completing the automatic evaluation of the API security device, and improving the testing efficiency of the API security device.

[0041] In some optional manners of the present disclosure, the interface traffic data includes an interface request-response pair, and the loading of the interface traffic data to the server and the client and the control of the server and the client to perform interface traffic replay on the interface traffic data include: loading the interface request-response pair to the server and the client respectively; controlling the client to access the interface of the server by using the interface request in the interface request-response pair; and controlling the server to feed back the response data in the interface request-response pair to the client after the interface access of the client is passed.

[0042] In the embodiment, the interface request-response pair includes an interface request and response data under a current test scenario, and the content of the interface request and the response data is different for different test scenarios. The control of the client to access the interface of the server by using the interface request in the interface request-response pair includes: establishing a connection with the client, sending a control instruction for enabling the interface request to the client, and enabling the client to send the interface request to the interface of the server. The control of the server to feed back the response data in the interface request-response pair to the client after the interface access of the client is passed includes: establishing a connection with the server, sending a control instruction for enabling processing of the interface request to the server, so that the server, after receiving the interface request, matches the received interface request with a pre-loaded interface request, and in response to a successful matching, sends the response data corresponding to the pre-loaded interface request to the client. The interaction of the interface request-response pair between the server and the client realizes data exchange and function calling between the server and the client.

[0043] The method for controlling the server and the client to perform interface traffic replay on the interface traffic data provided by the embodiment first loads an interface request-response pair to the server and the client respectively, and controls the client and the server to perform actual interface access and response data feedback, thereby realizing real interface traffic replay of the interface traffic data and improving the simulation effect of the interface traffic replay.

[0044] Optionally, the interface traffic data comprises an interface request-response pair, the loading the interface traffic data to the server and the client respectively, and the controlling the server and the client to perform the interface traffic replay on the interface traffic data comprises: loading the interface request-response pair to the server and the client respectively; controlling the server to access the interface of the client by using the interface request in the interface request-response pair; and controlling the client to feed back the response data in the interface request-response pair to the server after the interface access of the server is passed.

[0045] In some optional implementations of the present disclosure, the interface request-response pair comprises a leakage guide request and a leakage response data pair, the controlling the client to access the interface of the server by using the interface request in the interface request-response pair comprises: controlling the client to send an interface access request to the client according to the leakage guide request in the leakage guide request and the leakage response data pair; and the controlling the server to feed back the response data in the interface request-response pair to the client after the interface access of the client is passed comprises: controlling the server to feed back the leakage response data in the leakage guide request and the leakage response data pair to the client after receiving the interface access request.

[0046] In the optional implementation, the leakage guide request is simulation data for guiding the client or the server to perform important data, and through the leakage guide request, the subject receiving the leakage guide request can be guided to tend to disclose important data. It should be noted that the leakage guide request is a simulation request for detecting the API security device, and is not a real request.

[0047] In the optional implementation, the leakage response data is simulation data of the important data output by the client or the server, that is, the leakage response data is the important data disclosed by the subject receiving the leakage guide request. It should be noted that the leakage response data is a simulation data for detecting the API security device, and is not real data.

[0048] The method for the client to access the interface provided by the optional implementation controls the client to send an interface access request to the client according to the leakage guide request in the leakage guide request and the leakage response data pair, and the controlling the server to feed back the response data in the interface request-response pair to the client after the interface access of the client is passed comprises: controlling the server to feed back the leakage response data in the leakage guide request and the leakage response data pair to the client after receiving the interface access request, thereby providing a reliable implementation for controlling the client and the server to interact with the interface data.

[0049] Optionally, the interface request response pair comprises: a simulated intrusion data and an intrusion response data pair, and the control client accesses the interface of the service end by using the interface request in the interface request response pair comprises: the control client sends an interface access request to the client according to the simulated intrusion data in the simulated intrusion data and the intrusion response data pair; and the control service end feeds back the response data in the interface request response pair to the client after the interface access of the client is passed, which comprises: the control service end feeds back the intrusion response data in the simulated intrusion data and the intrusion response data pair to the client after receiving the interface access request. The simulated intrusion data is a kind of data simulating hacker intrusion, and the intrusion response data is data simulating response feedback to hacker intrusion.

[0050] In some optional implementations of the present disclosure, the interface traffic data comprises: normal type simulated traffic data and abnormal type simulated traffic data, and the generating of the evaluation result of the API security device based on the feedback data comprises: for the normal type simulated traffic data, detecting whether the feedback data represents normal interface calling between the client and the service end; and in response to detecting that the feedback data represents normal interface calling between the client and the service end, giving an evaluation result that the function of the API security device is normal; and for the abnormal type simulated traffic data, detecting whether the feedback data represents abnormal interface calling between the client and the service end; and in response to detecting that the feedback data does not represent abnormal interface calling between the client and the service end, giving an evaluation result that the function of the API security device is normal.

[0051] In the optional implementation, the normal type simulated traffic data is traffic data simulating interface interaction between the service end and the client, and the abnormal type simulated traffic data is abnormal traffic data simulating interface interaction between the service end and the client, such as traffic data simulating external intrusion or traffic data in a leakage situation.

[0052] In the optional implementation, the interface traffic data is set as the normal type simulated traffic data and the abnormal type simulated traffic data for the interface traffic data in each test scenario, and the normal type simulated traffic data and the abnormal type simulated traffic data can be used to comprehensively detect the function of the API security device, thereby improving the comprehensiveness of the API security device detection.

[0053] Optionally, the generating of the evaluation result of the API security device based on the feedback data further comprises: for the normal type simulated traffic data, in response to detecting that the feedback data represents abnormal interface calling between the client and the service end, giving an evaluation result that the function of the API security device is abnormal.

[0054] Optionally, the generating of the evaluation result of the API security device based on the feedback data further comprises: for the abnormal type simulated traffic data, in response to detecting that the feedback data represents normal interface calling between the client and the service end, giving an evaluation result that the function of the API security device is abnormal.

[0055] In some optional implementations of the present disclosure, the interface traffic data of each scenario in the set of interface traffic data is obtained by the following steps: for each scenario in the plurality of scenarios, obtaining an application interface traffic template under the scenario; parsing the application interface traffic template to obtain template analysis data including a specified variable and a specified variable placeholder; obtaining specified data of the specified variable; and generating the interface traffic data based on the template analysis data and the specified data.

[0056] In the optional implementation, the plurality of scenarios includes a normal traffic transmission scenario and an abnormal traffic transmission scenario, wherein the abnormal traffic transmission scenario includes an external data intrusion scenario and a content data leakage scenario.

[0057] In the optional implementation, the application interface traffic template is a template for defining application program interface traffic, specifically a template for defining requests and responses. The application interface traffic template can be divided into at least two regions, including a request definition region and a response definition region. The request definition region is a region recording the structure and content of a request, and the response definition region is a region recording the structure and content of a response.

[0058] In the embodiment, the application interface traffic template can have multiple types, each type corresponding to a test scenario. The general structure and content of the message and response, such as the structure and content in the request definition region of the application interface traffic template, are divided into four regions: request line, request header, space, and request body. Each region can record different structures and contents of the request message, such as the request line region recording the request method, the URL (Uniform Resource Locator, Uniform Resource Locator) field, the placeholder corresponding to the URL field, and the protocol version; the request header region recording the client environment and the useful information of the request body; the space region is only a blank line, indicating the end of the request header; and the request body region can record content or not. When no content is recorded, it is determined that the request message has no request body.

[0059] In the optional implementation, the specified variable is a variable defined by a field in the protocol of the message and response that can be flexibly changed or specially specified according to business needs, such as the URL field. Since the actual content of the specified variable needs to be specified, the application interface traffic template records the specified variable and provides a corresponding position for the actual content of the specified variable. After parsing the application interface traffic template, the specified variable and the specified variable placeholder corresponding to the specified variable can be obtained. The specified variable placeholder is used to occupy the actual content of the specified variable.

[0060] In the optional implementation, the specified data is actual data required to fill in the specified variable, which can be directly specified by the R&D personnel or automatically generated according to the generation requirement of the target request message when the target request message is generated in batches. For example, when the target request message is generated in batches, the URL of the target site is directly determined and used as the specified data of the URL field.

[0061] In the optional implementation, the template analysis data is data obtained after the information recorded in the application interface traffic template is understood in terms of the format of the message and the response.

[0062] The method for generating interface traffic data provided in the optional implementation obtains, for each of a plurality of scenarios, an application interface traffic template for the scenario, analyzes the application interface traffic template to obtain template analysis data including a specified variable and a specified variable placeholder, obtains specified data of the specified variable, and generates interface traffic data based on the template analysis data and the specified data. Thus, the flexibility of the interface traffic data is improved by analyzing the interface traffic template and generating the interface traffic data using the specified data.

[0063] In some optional implementations of the present disclosure, the above-mentioned analysis of the application interface traffic template to obtain template analysis data including a specified variable and a specified variable placeholder includes: determining message structure data and body content data in the application interface traffic template; extracting the message structure data according to a preset message protocol to obtain protocol analysis data including the specified variable and the specified variable placeholder; and taking the protocol analysis data and the body content data as the template analysis data.

[0064] The generation of the interface traffic data based on the template analysis data and the specified data includes: identifying the specified variable placeholder from the protocol analysis data; replacing the specified variable placeholder with the specified data to obtain protocol message data; sequentially combining the protocol message data and the body content data according to the format of the message protocol to obtain to-be-processed traffic data; and performing binary data conversion on the to-be-processed traffic data to obtain the interface traffic data.

[0065] The interface traffic data generation method provided in the optional implementation first analyzes the application interface traffic template to obtain template analysis data, and replaces the specified variable placeholder in the template analysis data with the specified variable and the specified data, thereby providing a reliable implementation for obtaining the interface traffic data.

[0066] Optionally, for some types of interface traffic data, a part in which no text is set in the application interface traffic template can be applied, and therefore the above parsing of the application interface traffic template to obtain template parsing data including the specified variable and the specified variable placeholder includes: determining message structure data in the application interface traffic template; extracting the message structure data according to a preset message protocol to obtain protocol parsing data including the specified variable and the specified variable placeholder; and taking the protocol parsing data as the template parsing data.

[0067] The above generation of the interface traffic data based on the template parsing data and the specified data includes: identifying the specified variable placeholder from the protocol parsing data; replacing the specified variable placeholder with the specified data to obtain protocol message data; sequentially combining the protocol message data according to a format of the message protocol and adding a corresponding interval symbol (such as a line feed character) to obtain to-be-processed traffic data; and performing binary data conversion on the to-be-processed traffic data to obtain the interface traffic data.

[0068] Further referring to Figure 3 , as an implementation of the method shown in the above figures, the disclosure provides an embodiment of an API security device testing apparatus, which corresponds to the method embodiment shown in Figure 1 , and the apparatus can be specifically applied to various electronic devices.

[0069] As shown in Figure 3 , the API security device testing apparatus 300 provided in the embodiment includes an acquisition unit 301, a control unit 302, a receiving unit 303, and an evaluation unit 304. The acquisition unit 301 can be configured to acquire interface traffic data under a current test scene from a pre-generated set of interface traffic data. The control unit 302 can be configured to load the interface traffic data to a server and a client respectively, and control the server and the client to perform interface traffic replay on the interface traffic data. The receiving unit 303 can be configured to receive feedback data of an API security device during the interface traffic data replay, the API security device being a device for monitoring the interface traffic data. The evaluation unit 304 can be configured to generate an evaluation result of the API security device based on the feedback data.

[0070] In the embodiment, the specific processing of the acquisition unit 301, the control unit 302, the receiving unit 303, and the evaluation unit 304 in the API security device testing apparatus 300 and the technical effects brought by the specific processing can be respectively referred to the related descriptions of steps 101, 102, 103, and 104 in the corresponding embodiment. Figure 1 The related descriptions of steps 101, 102, 103, and 104 in the corresponding embodiment will not be repeated here.

[0071] In an embodiment of the present disclosure, the interface traffic data comprises an interface request-response pair, and the control unit 302 is configured to: load the interface request-response pair to the server and the client respectively; control the client to access the interface of the server using the interface request in the interface request-response pair; and control the server to feed back response data in the interface request-response pair to the client after the interface access of the client is passed.

[0072] In an embodiment of the present disclosure, the interface request-response pair comprises a leakage guide request and a leakage response data pair, and the control unit 302 is configured to: control the client to send an interface access request to the client according to the leakage guide request in the leakage guide request and leakage response data pair; and control the server to feed back response data in the interface request-response pair to the client after the interface access of the client is passed, comprising: control the server to feed back the leakage response data in the leakage guide request and leakage response data pair to the client after receiving the interface access request.

[0073] In an embodiment of the present disclosure, the interface traffic data comprises normal type simulation traffic data and abnormal simulation traffic data, and the evaluation unit 304 is configured to: for the normal type simulation traffic data, detect whether the feedback data represents normal interface call between the client and the server; and in response to detecting that the feedback data represents normal interface call between the client and the server, give an evaluation result that the API security device function is normal; for the abnormal simulation traffic data, detect whether the feedback data represents abnormal interface call between the client and the server; and in response to detecting that the feedback data does not represent abnormal interface call between the client and the server, give an evaluation result that the API security device function is normal.

[0074] In an embodiment of the present disclosure, the device 300 further comprises a construction unit (not shown in the figure), which is configured to: for each of a plurality of scenarios, obtain an application interface traffic template under the scenario; parse the application interface traffic template to obtain template analysis data comprising specified variables and specified variable placeholders; obtain specified data of the specified variables; and generate interface traffic data based on the template analysis data and the specified data.

[0075] In an embodiment of the present disclosure, the construction unit is further configured to: determine message structure data and body content data in the application interface traffic template; extract the message structure data according to a preset message protocol to obtain protocol analysis data comprising specified variables and specified variable placeholders; identify the specified variable placeholders from the protocol analysis data; replace the specified variable placeholders with the specified data to obtain protocol message data; sequentially combine the protocol message data and the body content data according to the format of the message protocol to obtain to-be-processed traffic data; and perform binary data conversion on the to-be-processed traffic data to obtain the interface traffic data.

[0076] In this embodiment of the API security device testing apparatus, the acquisition unit 301 first acquires interface traffic data for the current test scenario from a pre-generated interface traffic data set. Second, the control unit 302 loads the interface traffic data onto the server and client respectively, and controls the server and client to replay the interface traffic data. Third, the receiving unit 303 receives feedback data from the API security device during the interface traffic data replay; the API security device is a device that listens to the interface traffic data. Finally, the evaluation unit 304 generates an evaluation result for the API security device based on the feedback data. Thus, by selecting interface traffic data from the interface traffic data set in real time for different scenarios, controlling the server and client to replay the traffic, and acquiring feedback data from the API security device, the API security device's monitoring of traffic in different scenarios is reproduced, completing the automated evaluation of the API security device. The entire testing process requires no manual intervention, improving the testing efficiency of the API security device.

[0077] Further reference Figure 4 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of an API security device testing system, which is similar to... Figure 1 The illustrated method embodiments are used to test API security devices.

[0078] like Figure 4 As shown, the API security device testing system 400 provided in this embodiment includes: a test controller 401, a server 402, a client 403, and an API security device s for monitoring interface traffic data between the server and the client.

[0079] The test controller 401 is used to obtain interface traffic data under the current test scenario from a pre-generated set of interface traffic data; load the interface traffic data into the server 402 and client 403 respectively, and control the server 402 and client 403 to replay the interface traffic data; receive feedback data from the API security device s; and generate evaluation results for the API security device s based on the feedback data.

[0080] In this embodiment, the specific processing of the test controller 401 and its resulting technical effects in the API security device testing system 400 can be found in the following references: Figure 1 The relevant descriptions of steps 101, 102, 103, and 104 in the corresponding embodiments will not be repeated here.

[0081] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0082] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their modes of operation, are meant to be examples only, and are not intended to limit the implementations of the present disclosure described and / or claimed in this document.

[0083] As shown, the device 500 includes a computing unit 501 that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory (ROM) 502 or a computer program loaded into a random access memory (RAM) 503 from a storage unit 508. In the RAM 503, various programs and data required for the operation of the device 500 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504. Figure 5 Various components in the device 500 are connected to the I / O interface 505, including an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a magnetic disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0084]

[0085] ​The computing unit 501 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 501 performs various methods and processes described above, such as the API security device testing method. For example, in some embodiments, the API security device testing method can be implemented as a computer software program that is tangibly embodied in a machine-readable medium, such as the storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 500 via the ROM 502 and / or the communication unit 509. When the computer program is loaded onto the RAM 503 and executed by the computing unit 501, one or more steps of the API security device testing method described above can be performed. Alternatively, in other embodiments, the computing unit 501 can be configured to perform the API security device testing method by any other appropriate means, such as by means of firmware.

[0086] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0087] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, implements the methods / operations specified in the flowcharts and / or block diagrams. The program code can execute entirely on a machine, partly on a machine, as a stand-alone software package, partly on a machine and partly on a remote machine or entirely on a remote machine or server.

[0088] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include a lined- based system, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0089] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0090] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0091] It should be understood that various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the spirit of the present disclosure. For example, the steps recited in the present disclosure can be performed in parallel, in series, or in a different order, without departing from the desired results of the technology disclosed in the present disclosure, which are not limited herein.

[0092] The foregoing description of specific exemplary embodiments of the application has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the application to the precise forms disclosed, and obviously many modifications and variations are possible in light of the above teaching. It is intended that the scope of the application be limited not with this detailed description, but rather by the claims appended hereto.

Claims

1. A method for testing API security devices, characterized in that, The method includes: The interface traffic data for the current test scenario is obtained from a pre-generated set of interface traffic data. The interface traffic data refers to the amount of data transmitted through the interface within a certain time period. The current test scenario includes: normal interface communication scenario or abnormal interface communication scenario. The abnormal interface communication scenario includes: intrusion attack test scenario or sensitive data leakage scenario. The interface traffic data for each scenario in the interface traffic data set is obtained through the following steps: For each scenario in multiple scenarios, obtain the application interface traffic template for that scenario; parse the application interface traffic template to obtain template parsing data including specified variables and specified variable placeholders; obtain the specified data for the specified variables; generate interface traffic data based on the template parsing data and the specified data; the specified variables are quantities defined for fields in the message and response protocols that can be flexibly changed or specially specified according to business needs; the specified variable placeholders are used to place space for the actual content of the specified variables. The interface traffic data is loaded into the server and client respectively, and the server and client are controlled to replay the interface traffic data. The API security device receives feedback data from the API security device when the interface traffic data is replayed. The API security device is a device that monitors the interface traffic data. Based on the feedback data, an evaluation result for the API security device is generated.

2. The method according to claim 1, characterized in that, The interface traffic data includes: interface request-response pairs. Loading the interface traffic data into the server and client respectively, and controlling the server and client to perform interface traffic replay on the interface traffic data includes: The interface request and response pairs are loaded into the server and the client respectively; Control the client to access the server's interface using the interface request / response pair; After the client successfully accesses the interface, the server controls the server to send the response data from the interface request-response pair back to the client.

3. The method according to claim 2, characterized in that, The interface request-response pair includes: a leaked bootstrapping request and a leaked response data pair. Controlling the client to access the server's interface using the interface request in the interface request-response pair includes: The client is controlled to send an interface access request to the client according to the leak guidance request in the leak guidance request and leak response data pair; The control mechanism, after the client's interface access is successful, sends the response data from the interface request-response pair back to the client, including: After receiving the interface access request, the server controls the client to return the leakage response data from the leakage guidance request and leakage response data pair.

4. The method according to claim 1, characterized in that, The interface traffic data includes: normal simulated traffic data and abnormal simulated traffic data. The generation of evaluation results for the API security device based on the feedback data includes: For the normal simulated traffic data, detect whether the feedback data indicates that the interface call between the client and the server is normal; in response to detecting that the feedback data indicates that the interface call between the client and the server is normal, give an evaluation result that the API security device is functioning normally; For the abnormal simulated traffic data, detect whether the feedback data indicates an abnormal interface call between the client and the server; in response to detecting that the feedback data does not indicate an abnormal interface call between the client and the server, give an evaluation result that the API security device is functioning normally.

5. The method according to claim 1, characterized in that, The process of parsing the application interface traffic template to obtain template parsing data, including specified variables and specified variable placeholders, includes: Determine the message structure data and body content data in the application interface traffic template; The message structure data is extracted according to the preset message protocol to obtain protocol parsing data including specified variables and specified variable placeholders; The protocol parsing data and the text content data are used as the template parsing data; The process of generating interface traffic data based on the template parsing data and the specified data includes: Identify the specified variable placeholder from the protocol parsing data; Replace the specified variable placeholder with the specified data to obtain protocol message data; According to the format of the message protocol, the protocol message data and the body content data are combined sequentially to obtain the traffic data to be processed; The traffic data to be processed is converted into binary data to obtain interface traffic data.

6. An API security device testing apparatus, characterized in that, The device includes: The acquisition unit is configured to acquire interface traffic data under the current test scenario from a pre-generated set of interface traffic data. The interface traffic data refers to the amount of data transmitted through the interface within a certain period of time. The current test scenario includes: normal interface communication scenario or abnormal interface communication scenario. The abnormal interface communication scenario includes: intrusion attack test scenario or sensitive data leakage scenario. The control unit is configured to load the interface traffic data into the server and the client respectively, and control the server and the client to replay the interface traffic data. The receiving unit is configured to receive feedback data from the API security device when the interface traffic data is replayed, wherein the API security device is a device that monitors the interface traffic data. The evaluation unit is configured to generate an evaluation result for the API security device based on the feedback data; The construction unit is configured to: obtain application interface traffic templates for each scenario in multiple scenarios; parse the application interface traffic templates to obtain template parsing data including specified variables and specified variable placeholders; obtain specified data for the specified variables; and generate interface traffic data based on the template parsing data and the specified data. The specified variables are quantities defined for fields in the message and response protocols that can be flexibly changed or specially specified according to business needs. The specified variable placeholders are used to place space for the actual content of the specified variables.

7. An API security device testing system for testing API security devices, characterized in that, The system includes: The test controller, server, and client are used, and the API security device is used to monitor the interface traffic data between the server and the client. The test controller is used to obtain interface traffic data for the current test scenario from a pre-generated interface traffic data set. The interface traffic data refers to the amount of data transmitted through the interface within a certain period of time. The current test scenario includes: normal interface communication scenario or abnormal interface communication scenario. The abnormal interface communication scenario includes: intrusion attack test scenario or sensitive data leakage scenario. The controller loads the interface traffic data into the server and the client respectively, and controls the server and the client to replay the interface traffic data. The controller receives feedback data from the API security device. Based on the feedback data, the controller generates an evaluation result for the API security device. The interface traffic data for each scenario in the interface traffic data set is obtained through the following steps: for each scenario in multiple scenarios, the controller obtains the application interface traffic template for that scenario; the controller parses the application interface traffic template to obtain template parsing data including specified variables and specified variable placeholders; the controller obtains the specified data of the specified variables; and the controller generates interface traffic data based on the template parsing data and the specified data. The specified variables are quantities defined for fields in the message and response protocols that can be flexibly changed or specially specified according to business needs. The specified variable placeholders are used to place space for the actual content of the specified variables.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-5.

Images