This work deals with an analysis and design of application programming interface (API) within the architectural style known as REST (Representational State Transfer). Beginning of this thesis covers basic introduction of HTTP protocol and REST fundamentals, followed by analysis and solution proposals of common situations that can occur in API. Sample application was implemented by following these proposals.

This paper's aim is to design and implement a tool transforming REST Web APIs into APIs which facilitate the integration process. The improvement of integration is mainly divided into two parts: The embedding of semantic data in order to establish a common understanding of objects, properties and relations and the possibility to navigate through the API structure in an easy and automated way. The theoretical part is dealing with the fundamentals of Web APIs, today's related trends and the API's shortages and points of improvement. Another objective of this paper is to compare current data standards of output formats for so called Hypermedia APIs, whereas the most suitable components will be chosen as the output format of this paper's resulting tool. The practical part is dealing with the design and implementation of the tool being developed. Included, there is the description of test scenarios, related benefits for the tool's users as well as a final evaluation of the resulting tool and a discussion of the tool's future potential. The benefits of the tool are evaluated in a case study.

Scraping is known to be difficult to detect and prevent, especially in the context of web APIs. It is in the interest of organisations that rely heavily on the content they provide through their web APIs to protect their content from scrapers. In this thesis, a machine learning approach towards detecting web API content scrapers is proposed. Three supervised machine learning algorithms were evaluated to see which would perform better on data from Spotify's web API. Data used to evaluate the classifiers consisted of aggregated HTTP request data that describes each application having sent HTTP requests to the web API over a span of two weeks. Two separate experiments were performed for each classifier, where the second experiment consisted of synthetic data for scrapers (the minority class) in addition to the original dataset. SMOTE was the algorithm used to perform oversampling in experiment two. The results show that Random Forest was the better classifier, with an MCC value of 0.692, without the use of synthetic data. For this particular problem, it is crucial that the classifier does not have a high false positive rate as legitimate usage of the web API should not be blocked. The Random Forest classifier has a low false positive rate and is therefore more favourable, and considered the strongest classifier out of the three examined. / Scraping är svårt att upptäcka och undvika, speciellt vad gäller att upptäcka applikationer som skrapar webb-APIer. Det finns ett särskilt intresse för organisationer, som är beroende av innehållet de tillhandahåller via sina webb-APIer, att skydda innehållet från applikationer som skrapar det. I denna avhandling föreslås ett tillvägagångssätt för att upptäcka dessa applikationer med hjälp av maskininlärning. Tre maskininlärningsalgoritmer utvärderades för att se vilka som skulle fungera bäst på data från Spotify's webb-API. Data som användes för att utvärdera dessa klassificerare bestod av aggregerade HTTP-request-data som beskriver varje applikation som har skickat HTTP-requests till webb-APIet under två veckors tid. Två separata experiment utfördes för varje klassificerare, där det andra experimentet var utökat med syntetisk data för applikationer som skrapar (minoritetsklassen) utöver det ursprungliga som användes i första experimentet. SMOTE var algoritmen som användes för att generera syntetisk data i experiment två. Resultaten visar att Random Forest var den bättre klassificeraren, med ett MCC-värde på 0,692, utan syntetisk data i det första experimentet. I detta fall är det viktigt att klassificeraren inte genererar många falska positiva resultat eftersom vanlig användning av ett web-API inte bör blockeras. Random Forest klassificeraren genererar få falska positiva resultat och är därför mer fördelaktig och anses vara den mest pålitliga klassificeraren av de tre undersökta.

In this work we present the design and implementation of a platform for automated measurement of the use of JavaScript APIs in a web browser. This platform is based on OpenWPM, which is used to instrument the web browser. In our architecture, the browser is extended with a modified Web API Manager extension, which allows to capture calls to JavaScript methods and log information about these calls. The platform was used to perform measurements on a 10,000 websites. From the analysis of the data obtained by the measurement, we found that the most used APIs over measured websites are APIs specified in HTML and DOM standards, High Resolution Time API and Web Cryptography API. Within the APIs that were implemented in Mozilla Firefox after 2016, we identified the Intersection Observer API, Background Tasks API and Resize Observer API as the most frequently used.

Submitted by Cássia Santos (cassia.bcufg@gmail.com) on 2017-03-28T11:45:59Z No. of bitstreams: 2 Dissertação - João Neto Cronemberger Galvão - 2017.pdf: 3677244 bytes, checksum: 131ab2bd6a3da711a718560ca96c89b6 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Approved for entry into archive by Luciana Ferreira (lucgeral@gmail.com) on 2017-03-28T13:49:38Z (GMT) No. of bitstreams: 2 Dissertação - João Neto Cronemberger Galvão - 2017.pdf: 3677244 bytes, checksum: 131ab2bd6a3da711a718560ca96c89b6 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Made available in DSpace on 2017-03-28T13:49:38Z (GMT). No. of bitstreams: 2 Dissertação - João Neto Cronemberger Galvão - 2017.pdf: 3677244 bytes, checksum: 131ab2bd6a3da711a718560ca96c89b6 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) Previous issue date: 2017-02-17 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior - CAPES / Over the years, biometrics has become a valuable resource for human identification be- cause it is an affordable, safe and reliable technique. Various security entities throughout the world, public and private, are committed to the use of biometrics in security; both in access control and for identifying suspects. In addition, many crimes can be prevented with tools that allow crosschecking of biometric data. However, biometric systems cur- rently in use are developed and provided by companies as proprietary systems. For this reason, the creation of a free and open tool will bring more security, control and savings for the government. For this reason, the objective of this work is to create a prototype of a free and open tool, developed within the Web Services approach, associated to the development of an API that will aim at a standardization of biometrics services, conside- ring the exchange of data between distinct and independent biometric applications with a low level of coupling and interoperability between systems of different platforms and technologies, so that it is possible to add to the service and use of multiple biometric functionalities such as face recognition, voice, fingerprints, hand geometry, iris, or even a combination, among others, to perform a task of personal identification. / A cada dia que passa, a biometria vem se tornando um recurso valioso para identifica- ção humana, pois trata-se de uma técnica acessível, segura e confiável. Várias entidades de segurança, por todo o mundo, públicas e privadas, estão empenhadas na utilização da biometria na área de segurança, tanto no controle de acesso, quanto para identifica- ção de investigados. Além disso, diversos crimes podem ser evitados com ferramentas que possibilitam o cruzamento de dados biométricos. No entanto, a maioria dos sistemas biométricos em uso atualmente são desenvolvidos e fornecidos por empresas como siste- mas proprietários, desenvolvidos isoladamente, sem o compartilhamento de informações e base de dados, não atendendo, a contento, as necessidades de agentes governamentais no que se refere à escala, controle e economia no uso das aplicações de biometria. Por esta razão, o objetivo deste trabalho será a criação de um protótipo de uma ferramenta livre e aberta, desenvolvida dentro da abordagem de Serviços Web, associado ao desen- volvimento de uma API que visará a padronização dos serviços de biometria, tendo em vista o intercâmbio de dados entre aplicações biométricas distintas e independentes, com um nível reduzido de acoplamento e com interoperabilidade entre sistemas de diferentes plataformas e tecnologias, de modo que seja possível agregar ao serviço o uso de várias funcionalidades biométricas tais como: o reconhecimento de face, a voz, as impressões digitais, a geometria da mão, a íris, ou mesmo a combinação destas, dentre outras, para executar a tarefa de identificação pessoal.

Sigma energy app is a mobile application for subscribers to various energy subscriptions. The subscribers can use this mobile application to access information regarding their consumption, invoices and active subscriptions. The mobile application that was built consists of a GUI and a web API as middleman between the application and the database. / Sigma energy app är en mobilapplikation för abonnenter av diverse energiabonnemang. Med denna mobilapplikation kan abonnenterna direkt hämta information om sin förbrukning, fakturor och aktiva abonnemang. Mobiltelefonapplikationen som har konstruerats består av ett GUI samt av ett web-API som mellanhand mellan applikationen och databasen.

There is problem that every company has its own customer portal. This problem can be solved by creating a platform that gathers all customers’ portals in one place. For such platform, it is required a web API protocol that is fast, secure and has capacity for many users. Consequently, a survey of various web API protocols has been made by testing their performance and security. The task was to find out which web API protocol offered high security as well as high performance in terms of response time both at low and high load. This included an investigation of previous work to find out if certain protocols could be ruled out. During the work, the platform’s backend was also developed, which needed to implement chosen web API protocols that would later be tested. The performed tests measured the APIs’ connection time and their response time with and without load. The results were analyzed and showed that the protocols had both pros and cons. Finally, a protocol was chosen that was suitable for the platform because it offered high security and fast connection. In addition, the server was not affected negatively by the number of connections. Reactive REST was the web API protocol chosen for this platform. / Det finns ett problem i dagens samhälle gällande att varje företag har sin egen kundportal. Detta problem kan lösas genom att skapa en plattform som samlar alla kundportaler på samma plats. För en sådan plattform krävs det ett web API protokoll som är snabb, säker och har kapacitet för många användare. Därför har en undersökning om olika web API protokolls prestanda samt säkerhetstester gjorts. Arbetet gick ut på att ta reda på vilket web API protokoll som erbjuder hög säkerhet och hög prestanda i form av svarstid både vid låg och hög belastning. Det ingick också i arbetet att göra en undersökning av tidigare arbeten för att ta reda på om eventuella protokoll kunde uteslutas. Under arbetet utvecklades också plattformens backend som implementerade de olika web API protokollen för att sedan kunna utföra tester på dessa. Testerna som utfördes var svarstid både med och utan belastning, uppkopplingstid samt belastning. Resultaten analyserades och visade att protokollen hade både för- och nackdelar. Avslutningsvis valdes ett protokoll som var lämpad för plattformen eftersom den hade hög säkerhet samt snabbast uppkopplingstid. Dessutom påverkades inte servern negativt av antalet uppkopplingar. Reactive REST valdes som web API protokoll för denna plattform.

An Application Programming Interface (API) provides developers with a high-level framework that abstracts the underlying implementation of services. Using an API reduces the time developers spent on implementation, and it encourages collaboration and innovation from third-party developers. Making an API public has a risk: developers might use it inappropriately. Most APIs have a policy that states which behaviors are considered fraudulent. Detecting applications that fraudulently use an API is a challenging problem: it is unfeasible to review all applications that make requests. API providers aim to implement an automatic tool that accurately detects suspicious applications from all the requesting applications. In this thesis, we study the possibility of using machine learning techniques to detect fraud in Web APIs. We experiment with supervised learning methods (random forests and gradient boosting), clustering methods such as Density-Based Spatial Clustering of Applications with Noise (DBSCAN), and ensemble methods that combine the predictions of supervised learning methods and clustering methods. The dataset available contains data gathered when a developer creates an application and data collected when the application starts making HTTP requests. We derive a meaningful representation from the most important textual fields of the dataset using Sentence-BERT (S-BERT). Furthermore, we experiment with the predictive importance of the S-BERT embeddings. The method that achieves the best performance in the test set is an ensemble method that combines the results from the gradient boosting classifier and DBSCAN. Furthermore, this method performs better when using the S-BERT embeddings of the textual data of the applications, achieving an f1-score of 0.9896. / Ett API (Application Program Interface) ger utvecklare ett högnivåramverk som abstraherar den underliggande implementationen av tjänster. Användning av ett API reducerar tiden utvecklare lägger på implementation, och uppmuntrar samarbete med och innovation av tredjeparts-utvecklare. Att göra ett API publikt har ett risk: utvecklare kan utnyttja den på olämpliga sätt. De flesta API:erna har ett policy som beskriver beteenden som räknas som bedrägliga. Upptäckandet av applikationer som använder ett API på ett bedrägligt sätt är ett icke-trivialt problem, det är omöjligt att undersöka alla applikationer som skickar begäran till API:et. API leverantörerna siktar ständigt på att skapa ett automatiskt verktyg för att exakt upptäcka applikationer misstänkta för bedrägeri. I denna avhandling undersöks möjligheten av användning av maskininlärning för att upptäcka bedrägeri i Web API. Vi experimenterar med övervakad inlärningsmetoder (random forests och gradient boosting), klustring metoder som Density-Based Spatial Clustering of Applications with Noise (DBSCAN) och ensemble metoder som kombinerar prediktionerna av övervakad inlärningsmetoder och klustring metoder. Det tillgängliga datasetet innehåller data samlat när en utvecklare skapar en applikation och när den börjar skicka HTTP begäran. Vi härleder en meningsfull representation från de viktigaste textfälten i datasetet med hjälp av Sentence-BERT (SBERT). Dessutom experimenterar vi med den prediktiva betydelsen av S-BERT-inbäddningarna. Metoden som uppfyller den bästa prestandan i testsetet är ett ensemble metod som kombinerade resultaten från gradient boosting klassificeraren och DBSCAN. Denna metod presterar även bättre vid användning av S-BERT-inbäddnignarna av applikationernas textdata och därav uppnår ett f1-score på 0.9896.

The thesis deals with module extension in currently developing project called Time Project 5. Specifically, the Phases, Notification and External Interface module. The thesis is divided into four major chapters. The first chapter introduces theoretical background consisting of backend and frontend technology description. The second chapter serves as determination of customer's expectations in form of functional and nonfunctional requirements gathering. The major focus of the third chapter is on application architecture design of both server and client side together with subcomponents design. Additionally, this chapter is complemented by the data model and Time Project 5 application design. The last, and at the same time, major chapter reveals the actual implementation of mentioned subcomponents including further necessary support features.

The purpose of this thesis was to come up with a new architecture for an existing web based planning and administration tool at Ericsson. The main objective was to create a new architecture with a proof of concept implementation. To find out how the existing tool were being used we interviewed people with different roles within the company. We made observations as they performed their day-to-day activities in the tool. We then designed and implemented a new version of the tool. We came up with a database design that handles a very dynamic use of data types. On top of the database we created REST API to allow data to be easily consumed by a web interface and other internal systems at Ericsson. We also showed that the architecture we ended up with performed well even with a lot of objects in the database. We did also come up with a solution to allow people to work simultaneously with the same parts of the system without overwriting each other’s changes.