关键词: 微服务；API链路重构；交互式应用安全测试

Abstract: The proliferation of microservice architectures has exacerbated Application Programming Interface (API) security and sensitive data tracing challenges, owing to their inherently distributed and heterogeneous nature. Conventional tools are substantially limited in payload analysis and cross-service data flow reconstruction, often failing to satisfy compliance requirements. This paper proposes a novel methodology for API access path characterization and privacy-aware tracking, based on Interactive Application Security Testing (IAST). By deploying lightweight IAST agents across multilingual microservice instances and integrating a Privacy-Aware Intelligent Rules Engine (PAIRE), our approach enables precise identification of sensitive data and reconstruction of its propagation trajectories. To address complex scenarios involving absent TraceIDs and asynchronous communication, we innovatively devise a multi-dimensional stitching mechanism that synthesizes parameter matching, temporal correlation, service topology, and business identifiers, thereby improving tracking coverage and robustness. Concurrently, a visualization platform is developed to facilitate real-time risk alerts and anomalous behavior response. Experimental validation conducted on the TrainTicket microservice application demonstrates that our method surpasses state-of-the-art solutions in sensitive data detection accuracy, path reconstruction coverage, and performance overhead control, confirming its efficacy and practicality in complex operational environments.

Key words: microservices; API link reconstruction; interactive application security testing