Research Towards Key Issues of API Security

Abstract With the mass application of virtualization, micro-services, and cloud-native technologies, interaction between service entities through APIs has become a norm. Many platforms are still maintaining large number old due to business needs. At same time, many new gradually going online. Both these statuses put forward higher requirements for API security. Focusing on APIs’ security protection other issues, this article starts from process asset discovery, vulnerability detection, auditing. Aiming at problem summarizes technical methods automatically clustering unowned assets using characteristics various commonly used APIs. analysis method based finite state machine is proposed. For first cross-network communication taint propagation dynamic technology system-level simulation realized, enabling sensitive data flow tracing in feasible. We designed flowbased audit system improve automated protection. Finally, analyzed opportunities challenges detail prospected research’s next direction development trend.