Inferring dependency constraints on parameters for web services

Abstract

Recently many popular websites such as Twitter and Flickr expose their data through web service APIs, enabling third-party organizations to develop client applications that provide functionalities beyond what the original websites offer. These client applications should follow certain constraints in order to correctly interact with the web services. One common type of such constraints is Dependency Constraints on Parameters. Given a web service operation O and its parameters Pi, Pj,…, these constraints describe the requirement on one parameter Pi that is dependent on the conditions of some other parameter(s) Pj. For example, when requesting the Twitter operation "GET statuses/user_timeline", a user_id parameter must be provided if a screen_name parameter is not provided. Violations of such constraints can cause fatal errors or incorrect results in the client applications. However, these constraints are often not formally specified and thus not available for automatic verification of client applications. To address this issue, we propose a novel approach, called INDICATOR, to automatically infer dependency constraints on parameters for web services, via a hybrid analysis of heterogeneous web service artifacts, including the service documentation, the service SDKs, and the web services themselves. To evaluate our approach, we applied INDICA-TOR to infer dependency constraints for four popular web services. The results showed that INDICATOR effectively infers constraints with an average precision of 94.4% and recall of 95.5%.

Lom: Discovering logic flaws within MongoDB-based web applications

“…InteGuard [24] performs security checks over a set of invariant relations among HTTP interactions to defeat logic attack at runtime. INDICATOR [29] employs hybrid analysis to infer the dependency constraints on parameters for web services. Guha et al [30] extracted event graphs from client-side web applications and detect malicious client behaviors at runtime.…”

A Genetic Algorithm to Find the Adequate Granularity for Service Interfaces

“…These clients invoke different sets of independent methods denoted in Figure 2 by rectangles (e.g., Client1 invokes setBillingAddress(), setShippingAddress(), and setPriorityShipment()). These methods are considered independent because the invocation of one method does not require the invocation of the other ones [20]. In total there are 13 remote invocations: 3 performed by Client1, 3 by Client2, 3 by Client3, and 4 by Client4.…”

“…In this paper we do not cover the problem of mining independent methods because it has already been subject of related work [20] that can be integrated in our approach. Furthermore, related work [20] shows that 78.1% of the methods in their analyzed web services are independent.…”

“…Furthermore, related work [20] shows that 78.1% of the methods in their analyzed web services are independent. This percentage shows that most of the methods can be potentially joined in coarse-grained methods, motivating further the need of performing this task with a proper approach.…”

Inferring Data Contract for Web-Based API

“…Inferring data contract for Web services from API documentation has attracted many interests for the above reasons [6,9]. These approaches first use predefined template to extract candidate data contracts and then validate them by testing services or manually investigation.…”