APIMiner: Identifying Web Application APIs Based on Web Page States Similarity Analysis
Modern web applications offer various APIs for data interaction. However, as the number of these APIs increases, so does the potential for security threats. Essentially, more APIs in an application can lead to more detectable vulnerabilities. Thus, it is crucial to identify APIs as comprehensively a...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2024-03-01
|
| Series: | Electronics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2079-9292/13/6/1112 |
| _version_ | 1797241312034947072 |
|---|---|
| author | Yuanchao Chen Yuliang Lu Zulie Pan Juxing Chen Fan Shi Yang Li Yonghui Jiang |
| author_facet | Yuanchao Chen Yuliang Lu Zulie Pan Juxing Chen Fan Shi Yang Li Yonghui Jiang |
| author_sort | Yuanchao Chen |
| collection | DOAJ |
| description | Modern web applications offer various APIs for data interaction. However, as the number of these APIs increases, so does the potential for security threats. Essentially, more APIs in an application can lead to more detectable vulnerabilities. Thus, it is crucial to identify APIs as comprehensively as possible in web applications. However, this task faces challenges due to the increasing complexity of web development techniques and the abundance of similar web pages. In this paper, we propose APIMiner, a framework for identifying APIs in web applications by dynamically traversing web pages based on web page state similarity analysis. APIMiner first builds a web page model based on the HTML elements of the current web page. APIMiner then uses this model to represent the state of the page. Then, APIMiner evaluates each element’s similarity in the page model and determines the page state similarity based on these similarity values. From the different states of the page, APIMiner extracts the data interaction APIs on the page. We conduct extensive experiments to evaluate APIMiner’s effectiveness. In the similarity analysis, our method surpasses state-of-the-art methods like NDD and mNDD in accurately distinguishing similar pages. We compare APIMiner with state-of-the-art tools (e.g., Enemy of the State, Crawlergo, and Wapiti3) for API identification. APIMiner excels in the number of identified APIs (average 1136) and code coverage (average 28,470). Relative to these tools, on average, APIMiner identifies 7.96 times more APIs and increases code coverage by 142.72%. |
| first_indexed | 2024-04-24T18:21:19Z |
| format | Article |
| id | doaj.art-7218a4d7cf30452e987bd42bc7bf380e |
| institution | Directory Open Access Journal |
| issn | 2079-9292 |
| language | English |
| last_indexed | 2024-04-24T18:21:19Z |
| publishDate | 2024-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Electronics |
| spelling | doaj.art-7218a4d7cf30452e987bd42bc7bf380e2024-03-27T13:35:01ZengMDPI AGElectronics2079-92922024-03-01136111210.3390/electronics13061112APIMiner: Identifying Web Application APIs Based on Web Page States Similarity AnalysisYuanchao Chen0Yuliang Lu1Zulie Pan2Juxing Chen3Fan Shi4Yang Li5Yonghui Jiang6College of Electronic Engineering, National University of Defense Technology, Heifei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Heifei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Heifei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Heifei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Heifei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Heifei 230037, ChinaAnhui Shenwu Information Technology Co., Ltd., Heifei 241000, ChinaModern web applications offer various APIs for data interaction. However, as the number of these APIs increases, so does the potential for security threats. Essentially, more APIs in an application can lead to more detectable vulnerabilities. Thus, it is crucial to identify APIs as comprehensively as possible in web applications. However, this task faces challenges due to the increasing complexity of web development techniques and the abundance of similar web pages. In this paper, we propose APIMiner, a framework for identifying APIs in web applications by dynamically traversing web pages based on web page state similarity analysis. APIMiner first builds a web page model based on the HTML elements of the current web page. APIMiner then uses this model to represent the state of the page. Then, APIMiner evaluates each element’s similarity in the page model and determines the page state similarity based on these similarity values. From the different states of the page, APIMiner extracts the data interaction APIs on the page. We conduct extensive experiments to evaluate APIMiner’s effectiveness. In the similarity analysis, our method surpasses state-of-the-art methods like NDD and mNDD in accurately distinguishing similar pages. We compare APIMiner with state-of-the-art tools (e.g., Enemy of the State, Crawlergo, and Wapiti3) for API identification. APIMiner excels in the number of identified APIs (average 1136) and code coverage (average 28,470). Relative to these tools, on average, APIMiner identifies 7.96 times more APIs and increases code coverage by 142.72%.https://www.mdpi.com/2079-9292/13/6/1112web applicationweb APIstate awaresimilarity analysis |
| spellingShingle | Yuanchao Chen Yuliang Lu Zulie Pan Juxing Chen Fan Shi Yang Li Yonghui Jiang APIMiner: Identifying Web Application APIs Based on Web Page States Similarity Analysis Electronics web application web API state aware similarity analysis |
| title | APIMiner: Identifying Web Application APIs Based on Web Page States Similarity Analysis |
| title_full | APIMiner: Identifying Web Application APIs Based on Web Page States Similarity Analysis |
| title_fullStr | APIMiner: Identifying Web Application APIs Based on Web Page States Similarity Analysis |
| title_full_unstemmed | APIMiner: Identifying Web Application APIs Based on Web Page States Similarity Analysis |
| title_short | APIMiner: Identifying Web Application APIs Based on Web Page States Similarity Analysis |
| title_sort | apiminer identifying web application apis based on web page states similarity analysis |
| topic | web application web API state aware similarity analysis |
| url | https://www.mdpi.com/2079-9292/13/6/1112 |
| work_keys_str_mv | AT yuanchaochen apimineridentifyingwebapplicationapisbasedonwebpagestatessimilarityanalysis AT yulianglu apimineridentifyingwebapplicationapisbasedonwebpagestatessimilarityanalysis AT zuliepan apimineridentifyingwebapplicationapisbasedonwebpagestatessimilarityanalysis AT juxingchen apimineridentifyingwebapplicationapisbasedonwebpagestatessimilarityanalysis AT fanshi apimineridentifyingwebapplicationapisbasedonwebpagestatessimilarityanalysis AT yangli apimineridentifyingwebapplicationapisbasedonwebpagestatessimilarityanalysis AT yonghuijiang apimineridentifyingwebapplicationapisbasedonwebpagestatessimilarityanalysis |