REST API自动化测试综述

REST API已经成为访问和使用云服务、Web、移动应用程序的重要途径,如何对这些API进行自动化测试以保证服务的安全性和可靠性是亟待解决的问题。目前虽然关于REST API自动化测试的研究成果众多,但仍缺少对测试技术全面的分析和总结。梳理了该领域近10年的代表性成果,首先总结了REST API自动化测试的发展历程;然后结合REST API自动化测试特征,提炼了测试的通用流程;接着分别从预处理、测试用例生成、测试用例执行与监测、结果分析四个环节阐述现有成果的技术特征,对比分析其优缺点;最后论述当前研究存在的不足,讨论可能的解决思路,展望了下一步研究方向。

某三级甲等公立医院API接口安全监测实践与思考

目的:建立医院API接口资产台账,实现API接口的统一集中管理,并对API接口的运行状态进行实时监控,及时发现接口安全风险并整改,提升医院信息安全防护水平。方法:以某三级甲等公立医院为例,通过人工和系统识别相结合的方式,梳理医院API接口,建立台账,利用API接口监测设备对网络流量实时监测,识别安全风险并整改、加固。结果:实现了全院API接口的集中统一管理,提升了医院信息安全防护水平,保障医疗数据在信息系统间的安全共享和流通。结论:对API接口进行安全监测,有助于发现医疗机构应用系统安全风险,提升医疗机构网络安全防护能力,保障医疗数据安全。

基于概率逻辑推理的高阶互补云API推荐方法

云时代,云API作为服务交付、数据交换和能力复制的最佳载体,已成长为当今面向服务软件开发和企业数字化转型不可或缺的核心要素.然而动态开放网络中持续增长的云API在给开发者提供了更多选择的同时,也将其淹没在海量的云API选择之中,设计有效的云API推荐方法就此成为API经济健康发展中迫切要解决的现实问题.但是,现有研究主要利用搜索关键词、服务质量和调用偏好进行建模,生成质量高功能单一的云API推荐列表,没有考虑服务化软件实际开发中开发者对多元化高阶互补云API的客观需要.高阶互补云API推荐旨在为多个查询云API生成多元互补云API列表,要求推荐结果与查询云API均互补,以满足开发者的联合需求.针对此问题,本文提出基于概率逻辑推理的高阶互补云API推荐方法(Probabilistic Logic Reasoning for High-order Complementary Cloud API Recom⁃mendation,PLR4HCCR).首先,通过云API生态真实数据分析论证云API互补推荐需求的必要性和互补关系建模中替补噪声的客观存在,为云API互补推荐问题研究提供动机和数据支持.其次,采用Beta概率嵌入对云API及其之间的关系约束进行编码,以刻画云API间互补关系的不确定性和支持互补逻辑推理.接着,设计由投影、取反和交并三个基本逻辑算子构建的互补关系逻辑推理网络,使查询集中的每个云API获得非对称互补关系感知和替补噪声消解约束下的互补云API表示.然后,引入注意力机制为查询云API的互补云API分配不同权重,增强高阶互补云API基向量的表征能力.在此基础上,采用KL散度度量高阶互补云API基向量与候选云API之间的距离,并根据KL散度排序生成高阶互补性可感知下的云API推荐结果.最后,我们利用两个真实云API数据集在不同阶互补推荐场景下进行实验,实验表明,与传统启发式推荐方法和深度学习推荐方法相比,PLR4HCCR在互补关系感知推理和替补噪声消解方面均具有较大的优势,继而使其在低阶、高阶和混合阶互补云API推荐中均展示出更优的推荐效果和更强的泛化能力.进一步,超参数敏感性实验、实例分析和用户调查验证了方法的有效性、实用性和可行性,这使结合高阶互补关系的云API推荐方法PLR4HCCR不仅更有可能生成开发者满意的结果,而且可有效提升云API服务提供者的收益.

Docker API与SpringBoot Actuator未授权访问风险分析与防范研究

随着云计算技术的普及和容器化技术的发展,Docker和SpringBoot已成为现代软件开发和部署的重要工具。然而,这种广泛的使用也伴随着安全风险。针对DockerAPI与SpringBoot Actuator的未授权访问风险进行了深入分析。当这些关键组件暴露于未授权访问之下时,攻击者可能利用这些漏洞执行恶意操作,如部署恶意容器、篡改应用程序配置或窃取敏感信息。这些行为不仅可能导致服务中断和数据泄露,还可能对企业造成严重的声誉和财务损失。

基于API潜在语义的勒索软件早期检测方法

加密型勒索软件通过加密用户文件来勒索赎金.现有的基于第一条加密应用编程接口(Application Programming Interface,API)的早期检测方法无法在勒索软件执行加密行为前将其检出.由于不同家族的勒索软件开始执行其加密行为的时刻各不相同,现有的基于固定时间阈值的早期检测方法仅能将少量勒索软件在其执行加密行为前准确检出.为进一步提升勒索软件检测的及时性,本文在分析多款勒索软件运行初期调用动态链接库(Dynamic Link Library,DLL)和API行为的基础上,提出了一个表征软件从开始运行到首次调用加密相关DLL之间的时间段的概念——运行初始阶段(Initial Phase of Operation,IPO),并提出了一个以软件在IPO内产生的API序列为检测对象的勒索软件早期检测方法,即基于API潜在语义的勒索软件早期检测方法(Ransomware Early Detection Method based on API Latent Semantics,REDMALS).REDMALS采集IPO内的API序列后,采用TF-IDF(Term Frequency-Inverse Document Frequency)算法以及潜在语义分析(Latent Semantic Analysis,LSA)算法对采集的API序列生成特征向量及提取潜在的语义结构,再运用机器学习算法构建检测模型用于勒索软件检测.实验结果显示运用随机森林算法的REDMALS在构建的变种测试集和未知测试集上可分别获得97.7%、96.0%的准确率,且两个测试集中83%和76%的勒索软件样本可在其执行加密行为前被检出.

API 521—2020火灾环境下气体压力容器安全泄放量计算讨论

为深入理解压力容器超压泄放设计,针对火灾环境下无隔热气体压力容器的安全泄放量计算问题,推导了气体压力容器泄放过程的质量及能量平衡方程,分析了方程求解过程的简化及假设条件,明确了API 520—2020标准内火灾环境无隔热气体压力容器安全泄放量公式的来源,研究了各简化假设条件对安全泄放量计算结果的影响。结果表明,API 521—2020安全泄放量公式是在质量平衡及能量平衡方程基础上,对一些参数进行工程简化得到的。其假设简化条件包括:泄放过程定压、火焰热量经壁面完全传递至气体、大空间竖直平板自然对流、采用常温常压空气物性简化实际气体的h'/(c_(p)M^(1/2))、理想气体假设、容器壁面不发生破坏及壁面温度推荐取固定值。上述简化及假设条件均使安全泄放量计算结果偏于保守,在应用时偏安全。研究可为科学开展火灾环境下气体压力容器超压泄放设计提供一定的指导。

The evolution of robotics:research and application progress of dental implant robotic systems

The use of robots to augment human capabilities and assist in work has long been an aspiration.Robotics has been developing since the 1960s when the first industrial robot was introduced.As technology has advanced,robotic-assisted surgery has shown numerous advantages,including more precision,efficiency,minimal invasiveness,and safety than is possible with conventional techniques,which are research hotspots and cutting-edge trends.This article reviewed the history of medical robot development and seminal research papers about current research progress.Taking the autonomous dental implant robotic system as an example,the advantages and prospects of medical robotic systems would be discussed which would provide a reference for future research.

异常信息敏感的框架API生命周期模型构造

大型软件系统的实现依赖于底层框架或第三方库,但这些复杂的框架/库代码在演化升级时往往独立于其调用者,为上层软件的质量保障带来挑战.例如,框架/库代码演化时新增和删除API、更改API的代码语义等行为会导致框架/库代码的不同版本之间不兼容,进而在上层应用开发者更新版本时,影响应用代码的正确性.为应对这一问题,需精准提取框架/库代码API的演化过程,形成演化报告,协助上层应用开发者选择兼容的版本或快速进行代码适配.其中,框架/库代码API的演化过程分析对应着框架API生命周期模型构造.现有工作中的API生命周期模型主要关注API的存在性变动,而未考虑特定代码语义变更对开发者的影响,特别是异常相关代码带来的语义变更,给上层软件系统带来隐患.为此,本文采用面向Java字节码的静态分析方法,识别框架API中的异常抛出行为并为其生成异常摘要报告,通过多轮流式匹配策略获取异常信息的变更情况,最终为框架/库代码构造异常信息敏感的API生命周期模型.该方法:(1)通过控制依赖语句切片提取异常抛出语句的关键触发条件,采用参数推断策略将局部变量的约束条件转换为仅与外部输入参数相关的异常前断言,并基于自底向上的摘要传递实现跨过程异常摘要提取;(2)通过关键信息精准匹配和自适应模糊匹配策略,分析异常摘要信息的新增、删除和修改情况,最终得到异常敏感的API生命周期模型(共涉及七种API变更形式).基于该方法,实现了基于Java字节码分析的API生命周期提取工具JavaExP.与现有最新方法相比,JavaExP的异常摘要信息提取准确性(F1值)提高了67%,分析用时减少了87%.对真实项目的API生命周期演化分析表明,与异常不敏感的API生命周期模型相比,采用异常敏感的模型时,API发生变动的比例提高了18%.在75,433个被分析的API中,约有20%API的异常抛出行为至少发生过一次改变,这些API共涉及超过七千多处独立的异常变更.在多个项目上的分析结果表明,异常敏感的模型构造能够更加精准地描述API的演化过程.

APIE培训模式在高级新手护士核心能力培养中的应用

目的:探讨APIE培训模式在高级新手护士核心能力培养中的应用效果。方法:选取本院185名规范化培训护士作为研究对象,将2019年7月—2020年6月规范化培训护士作为对照组(n=96),2021年7月—2022年6月规范化培训护士作为观察组(n=89)。对照组采用常规教学方法进行培训,观察组在对照组的基础上实施APIE培训教学模式,分析比较两组护士的综合能力、理论与技能考核成绩、培训满意度、护理不良事件发生率情况。结果:观察组综合能力得分、理论与技能考核成绩、培训满意度均优于对照组,差异均有统计学意义(P<0.05)。结论:应用APIE培训模式对高级新手护士核心能力培养取得较好的效果。

Potential industrial applications of photo/electrocatalysis: Recent progress and future challenges

Nowadays,the rapid development of the social economy inevitably leads to global energy and environmental crisis.For this reason,more and more scholars focus on the development of photocatalysis and/or electrocatalysis technology for the advantage in the sustainable production of high-value-added products,and the high efficiency in pollutants remediation.Although there is plenty of outstanding research has been put forward continuously,most of them focuses on catalysis performance and reaction mechanisms in laboratory conditions.Realizing industrial application of photo/electrocatalytic processes is still a challenge that needs to be overcome by social demand.In this regard,this review comprehensively summarized several explorations in thefield of photo/electrocatalytic reduction towards potential industrial applications in recent years.Special attention is paid to the successful attempts and the current status of photo/electrocatalytic water splitting,carbon dioxide conversion,resource utilization from waste,etc.,by using advanced reactors.The key problems and challenges of photo/electrocatalysis in future industrial practice are also discussed,and the possible development directions are also pointed out from the industry view.

Drilling-based measuring method for the c-φ parameter of rock and its field application

The technology of drilling tests makes it possible to obtain the strength parameter of rock accurately in situ. In this paper, a new rock cutting analysis model that considers the influence of the rock crushing zone(RCZ) is built. The formula for an ultimate cutting force is established based on the limit equilibrium principle. The relationship between digital drilling parameters(DDP) and the c-φ parameter(DDP-cφ formula, where c refers to the cohesion and φ refers to the internal friction angle) is derived, and the response of drilling parameters and cutting ratio to the strength parameters is analyzed. The drillingbased measuring method for the c-φ parameter of rock is constructed. The laboratory verification test is then completed, and the difference in results between the drilling test and the compression test is less than 6%. On this basis, in-situ rock drilling tests in a traffic tunnel and a coal mine roadway are carried out, and the strength parameters of the surrounding rock are effectively tested. The average difference ratio of the results is less than 11%, which verifies the effectiveness of the proposed method for obtaining the strength parameters based on digital drilling. This study provides methodological support for field testing of rock strength parameters.

基于API分组重构与图像表示的恶意软件检测分类

针对目前恶意软件检测分类方法在特征提取、检测准确率等方面面临的挑战,提出一种基于API分组重构与图像表示的恶意软件检测分类方法。首先,对恶意软件调用的API类别统一编号,将API指令序列中相同编号的API聚合为同一API组,根据恶意软件运行时各类API的首次调用顺序对API组重排序,将各API组的条目数记录为该类API对软件样本的贡献度。经分组重构后,各API组按序组织,其顺序为软件样本调用各类API的顺序。各API组内部有序,其内部各API的排列顺序即为软件样本对单个API的调用顺序。有序化的API分组有助于API指令序列信息的图像化表达。基于重组的API指令序列提取API编号作为全局特征列表、API贡献度作为局部特征列表、API顺序索引作为时序特征列表,对特征列表进行标准化与零填充,转化为统一尺寸的特征数组。其中,API编号能清晰地标识API类别,API贡献度可以表征该API的调用频繁程度,API顺序索引可区分各API被调用的顺序。然后,分别用3类特征数组填充RGB图像的3个通道,生成3通道的API编号贡献度及顺序索引特征图像(Feature image of API code devotion and sequential index,FimgCDS)。最后,将Fimg CDS特征图像输入自主构建的轻量型恶意软件特征图像卷积神经网络(malware feature image convolutional neural network,MficNN)分类器,实现对恶意软件的检测与分类。实验结果表明,本文方法在两类数据集上的检测分类准确率分别为98.66%和98.35%,具有较高的恶意软件检测分类性能指标和检测分类速度。

MXene-Based Elastomer Mimetic StretchableSensors: Design, Properties, and Applications

Flexible sensors based on MXene-polymer composites are highly prospective for next-generation wearable electronics used in human-machine interfaces.One of the motivating factors behind the progress of flexible sensors is the steady arrival of new conductive materials.MXenes,a new family of 2D nanomaterials,have been draw-ing attention since the last decade due to their high electronic conduc-tivity,processability,mechanical robustness and chemical tunability.In this review,we encompass the fabrication of MXene-based polymeric nanocomposites,their structure-property relationship,and applications in the flexible sensor domain.Moreover,our discussion is not only lim-ited to sensor design,their mechanism,and various modes of sensing platform,but also their future perspective and market throughout the world.With our article,we intend to fortify the bond between flexible matrices and MXenes thus promoting the swift advancement of flexible MXene-sensors for wearable technologies.

基于地图API的城市地质调查信息平台

城市地质调查信息的有效处理是地质调查工作的重要环节。文章基于WebGIS技术,借助地图API,结合Vue前端框架搭建了一款轻量级的城市地质调查信息平台,实现了地质数据的有效管理,提高了平台信息的交互效果,在保证数据信息安全性的同时,满足了用户的功能需求,为城市地质调查工作信息化建设提供了一定参考。

The Application of Bilayer Artificial Dermis Combined with VSD Technology in Chronic Wounds

Background: Bilayer artificial dermis promotes wound healing and offers a treatment option for chronic wounds. Aim: Examine the clinical efficacy of bilayer artificial dermis combined with Vacuum Sealing Drainage (VSD) technology in the treatment of chronic wounds. Method: From June 2021 to December 2023, our hospital treated 24 patients with chronic skin tissue wounds on their limbs using a novel tissue engineering product, the bilayer artificial dermis, in combination with VSD technology to repair the wounds. The bilayer artificial dermis protects subcutaneous tissue, blood vessels, nerves, muscles, and tendons, and also promotes the growth of granulation tissue and blood vessels to aid in wound healing when used in conjunction with VSD technology for wound dressing changes in chronic wounds. Results: In this study, 24 cases of chronic wounds with exposed bone or tendon larger than 1.0 cm2 were treated with a bilayer artificial skin combined with VSD dressing after wound debridement. The wounds were not suitable for immediate skin grafting. At 2 - 3 weeks post-treatment, good granulation tissue growth was observed. Subsequent procedures included thick skin grafting or wound dressing changes until complete wound healing. Patients were followed up on average for 3 months (range: 1 - 12 months) post-surgery. Comparative analysis of the appearance, function, skin color, elasticity, and sensation of the healed chronic wounds revealed superior outcomes compared to traditional skin fl repairs, resulting in significantly higher satisfaction levels among patients and their families. Conclusion: The application of bilayer artificial dermis combined with VSD technology for the repair of chronic wounds proves to be a viable method, yielding satisfactory therapeutic effects compared to traditional skin flap procedures.

Clinical application of SARS-CoV-2 antibody detection and monoclonal antibody therapies against COVID-19

The purpose of this study was to investigate the clinical application of severe acute respiratory distress syndrome coronavirus-2(SARS-CoV-2)specific antibody detection and anti-SARS-CoV-2 specific monoclonal antibodies(mAbs)in the treatment of coronavirus infectious disease 2019(COVID-19).The dynamic changes of SARS-CoV-2 specific antibodies during COVID-19 were studied.Immunoglobulin M(IgM)appeared earlier and lasted for a short time,while immunoglobulin G(IgG)appeared later and lasted longer.IgM tests can be used for early diagnosis of COVID-19,and IgG tests can be used for late diagnosis of COVID-19 and identification of asymptomatic infected persons.The combination of antibody testing and nucleic acid testing,which complement each other,can improve the diagnosis rate of COVID-19.Monoclonal anti-SARS-CoV-2 specific antibodies can be used to treat hospitalized severe and critically ill patients and non-hospitalized mild to moderate COVID-19 patients.COVID-19 convalescent plasma,highly concentrated immunoglobulin,and anti-SARS-CoV-2 specific mAbs are examples of anti-SARS-CoV-2 antibody products.Due to the continuous emergence of mutated strains of the novel coronavirus,especially omicron,its immune escape ability and infectivity are enhanced,making the effects of authorized products reduced or invalid.Therefore,the optimal application of anti-SARS-CoV-2 antibody products(especially anti-SARS-CoV-2 specific mAbs)is more effective in the treatment of COVID-19 and more conducive to patient recovery.

Improved RF power performance of InAlN/GaN HEMT by optimizing rapid thermal annealing process for high-performance low-voltage terminal applications

Improved radio-frequency(RF)power performance of InAlN/GaN high electron mobility transistor(HEMT)is achieved by optimizing the rapid thermal annealing(RTA)process for high-performance low-voltage terminal applications.By optimizing the RTA temperature and time,the optimal annealing condition is found to enable low parasitic resistance and thus a high-performance device.Besides,compared with the non-optimized RTA HEMT,the optimized one demonstrates smoother ohmic metal surface morphology and better heterojunction quality including the less degraded heterojunction sheet resistance and clearer heterojunction interfaces as well as negligible material out-diffusion from the barrier to the channel and buffer.Benefiting from the lowered parasitic resistance,improved maximum output current density of 2279 mA·mm^(-1)and higher peak extrinsic transconductance of 526 mS·mm^(-1)are obtained for the optimized RTA HEMT.In addition,due to the superior heterojunction quality,the optimized HEMT shows reduced off-state leakage current of 7×10^(-3)mA·mm^(-1)and suppressed current collapse of only 4%,compared with those of 1×10^(-1)mA·mm^(-1)and 15%for the non-optimized one.At 8 GHz and V_(DS)of 6 V,a significantly improved power-added efficiency of 62%and output power density of 0.71 W·mm^(-1)are achieved for the optimized HEMT,as the result of the improvement in output current,knee voltage,off-state leakage current,and current collapse,which reveals the tremendous advantage of the optimized RTA HEMT in high-performance low-voltage terminal applications.

一种API长圆螺纹套管外螺纹接头虚拟紧密距算法

针对目前紧密距测量效率低、重复性和稳定性较差、易损伤螺纹等问题,提出了一种API长圆螺纹套管外螺纹接头虚拟紧密距的算法。该算法通过测量同一批次套管螺纹的顶径、锥度及少量紧密距即可预测批次内后续石油套管虚拟紧密距值。通过与2种规格的长圆螺纹套管实测结果对比,该虚拟紧密距计算结果与石油套管的实测紧密距具有较好的一致性。同时分析了定扭矩测量和人工手紧测量的情况下虚拟紧密距与实测紧密距的一致性,发现在定扭矩情况下测量的紧密距与虚拟紧密距的一致性更好。研究表明,该方法在保证测量精度的前提下提高了紧密距的检测效率和稳定性,能够作为一种预测方法为石油套管紧密距测量提供参考。

企业API网关热插拔插件的设计与实现

为了解决微服务架构下传统API网关扩展能力弱、无法热更新等问题,对API网关扩展性进行研究分析,引入热插拔机制来实现企业API网关热插拔插件,同时,提出了一种企业API网关热插拔插件解决方案。实验结果表明,所提出的API网关的热插拔插件方案在支持网关插件热更新的同时不会对API网关的整体性能造成影响,也不会对业务功能的稳定性造成影响。目前,企业API网关已经在几十家大型企业得到应用,提供了身份鉴权、限流限速、协议转换、请求改写等30余种热插拔插件。通过企业API网关彻底解决了原有API网关无法热更新、热部署、难扩展等问题,减少了40%的重复开发工作,节省了30%运维成本,为企业API网关的进一步发展和应用提供了有益的参考,也为构建高效、安全、可扩展的企业API网关提供了新的思路。

Comprehensive Evaluation of Flower Border Application Value of New and Superior Plants in Hefei Area

An analytic hierarchy process(AHP)was employed to assess the applicability of 18 new and superior varieties of flowers in Hefei City flower border applications.A total of 12 indicators were selected from three distinct aspects of adaptability,ornamental characteristics and use traits,in order to establish a comprehensive evaluation model.The results demonstrate that grade I(J≥2.685)exhibits excellent application value,encompassing six species of plants,such asHydrangeamacrophylla‘Endless Summer’;grade II(2.684≤J≤2.420)is also of notable application value,encompassing five species of plants,such asCallistemonrigidus;grade III(2.419≤J≤2.615)is of average application value,including five species of plants,such asCrocosmiacrocosmiflora;grade IV(J≤2.16)is of relatively poor application value.The evaluation results may be utilized as a theoretical reference for the promotion of new and superior varieties in the flower border of Hefei.