源代码中的API密钥自动识别方法  

Automatic Identification Method of API Key in Source Code

作　　者：薛敏 方勇 黄诚[1] 刘亮 XUE Min 1,FANG Yong 2,HUANG Cheng 1,LIU Liang 2(1.College of Electronics and Information,Sichuan University,Chengdu 610065,China; 2.College of Cybersecurity,Sichuan University,Chengdu 610207,Chin)

机构地区：[1]四川大学电子信息学院,成都610065 [2]四川大学网络空间安全学院,成都610207

出　　处：《计算机工程》2018年第6期117-121,129,共6页Computer Engineering

摘　　要：应用程序编程接口(API)密钥的泄露可能导致相关服务被恶意利用,从而造成难以预估的经济损失。为此,通过对样本进行基本特征统计和源代码静态结构分析,提取出不同项目代码中API密钥的共性特征,从而构建一种基于机器学习的自动识别源代码中API密钥的方法。实验结果表明,该识别方法的检索性能比全文匹配搜索、关键字搜索和信息熵值搜索等传统检测方式更优。The leak of Application Programming Interface（API） key may cause the illegal use of services,and then lead to unpredictable economic losses.The common characteristics of API keys in different project codes are extracted by analyzing the basic characteristics statistics and the source code static structure of the samples.Then,an automatic identification method based on machine learning is built to detect the API keys in the source code.The result of 10-fold cross-validation experiment results show that the identification method is better in retrieval performance than traditional detection approaches such as full-text matching search,keywords search and information entropy search.

关 键 词：应用程序编程接口密钥 源代码 机器学习 静态结构 信息熵 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]