摘要： 应用程序编程接口(API)密钥的泄露可能导致相关服务被恶意利用,从而造成难以预估的经济损失。为此,通过对样本进行基本特征统计和源代码静态结构分析,提取出不同项目代码中API密钥的共性特征,从而构建一种基于机器学习的自动识别源代码中API密钥的方法。实验结果表明,该识别方法的检索性能比全文匹配搜索、关键字搜索和信息熵值搜索等传统检测方式更优。

关键词: 应用程序编程接口密钥, 源代码, 机器学习, 静态结构, 信息熵

Abstract: The leak of Application Programming Interface(API) key may cause the illegal use of services,and then lead to unpredictable economic losses.The common characteristics of API keys in different project codes are extracted by analyzing the basic characteristics statistics and the source code static structure of the samples.Then,an automatic identification method based on machine learning is built to detect the API keys in the source code.The result of 10-fold cross-validation experiment results show that the identification method is better in retrieval performance than traditional detection approaches such as full-text matching search,keywords search and information entropy search.

Key words: Application Programming Interface(API) key, source code, machine learning, static structure, information entropy

中图分类号: 

• TP309