Abstract: The proliferation of microservice architectures has exacerbated Application Programming Interface (API) security and sensitive data tracing challenges, owing to their inherently distributed and heterogeneous nature. Conventional tools are substantially limited in payload analysis and cross-service data flow reconstruction, often failing to satisfy compliance requirements. This paper proposes a novel methodology for API access path characterization and privacy-aware tracking, based on Interactive Application Security Testing (IAST). By deploying lightweight IAST agents across multilingual microservice instances and integrating a Privacy-Aware Intelligent Rules Engine (PAIRE), our approach enables precise identification of sensitive data and reconstruction of its propagation trajectories. To address complex scenarios involving absent TraceIDs and asynchronous communication, we innovatively devise a multi-dimensional stitching mechanism that synthesizes parameter matching, temporal correlation, service topology, and business identifiers, thereby improving tracking coverage and robustness. Concurrently, a visualization platform is developed to facilitate real-time risk alerts and anomalous behavior response. Experimental validation conducted on the TrainTicket microservice application demonstrates that our method surpasses state-of-the-art solutions in sensitive data detection accuracy, path reconstruction coverage, and performance overhead control, confirming its efficacy and practicality in complex operational environments.

Key words: microservices; API link reconstruction; interactive application security testing

摘要： 随着微服务架构的普及，其分布式与异构特性导致应用程序编程接口（Application Programming Interface，API）防护安全与敏感数据追踪面临严峻挑战。传统工具在负载分析及跨服务数据流重构方面能力不足，难以满足合规性要求。本文提出基于交互式应用安全测试（Interactive Application Security Testing，IAST）的API访问链路刻画与隐私感知追踪方法，通过在多语言微服务实例部署轻量级IAST Agent，结合隐私感知智能规则引擎（Privacy-Aware Intelligent Rules Engine，PAIRE），实现敏感数据的精准识别与传播路径重构。本文针对追踪标识符（TraceID）缺失、异步通信等复杂场景，创新设计了融合参数匹配、时间关联、服务拓扑与业务标识符的多维链路拼接机制，有效提升了追踪覆盖率与鲁棒性。同时构建可视化平台，可支持实时风险告警与异常行为响应。基于TrainTicket微服务应用上开展的实验表明，该方法在敏感数据检测精度、链路重构覆盖率及性能开销控制方面均优于主流方案，验证了其在复杂环境中的高效性与实用性。

关键词: 微服务；API链路重构；交互式应用安全测试