MINER: A Hybrid Data-Driven Approach for REST API Fuzzing

03/05/2023
by   Chenyang Lyu, et al.
0

In recent years, REST API fuzzing has emerged to explore errors on a cloud service. Its performance highly depends on the sequence construction and request generation. However, existing REST API fuzzers have trouble generating long sequences with well-constructed requests to trigger hard-to-reach states in a cloud service, which limits their performance of finding deep errors and security bugs. Further, they cannot find the specific errors caused by using undefined parameters during request generation. Therefore, in this paper, we propose a novel hybrid data-driven solution, named MINER, with three new designs working together to address the above limitations. First, MINER collects the valid sequences whose requests pass the cloud service's checking as the templates, and assigns more executions to long sequence templates. Second, to improve the generation quality of requests in a sequence template, MINER creatively leverages the state-of-the-art neural network model to predict key request parameters and provide them with appropriate parameter values. Third, MINER implements a new data-driven security rule checker to capture the new kind of errors caused by undefined parameters. We evaluate MINER against the state-of-the-art fuzzer RESTler on GitLab, Bugzilla, and WordPress via 11 REST APIs. The results demonstrate that the average pass rate of MINER is 23.42 on average and 142.86 reported all the newly found errors, and 7 of them have been confirmed as logic bugs by the corresponding vendors.

READ FULL TEXT

page 1

page 2

page 3

page 4

research
06/26/2018

REST-ler: Automatic Intelligent REST API Fuzzing

Cloud services have recently exploded with the advent of powerful cloud-...
research
09/08/2023

Adaptive REST API Testing with Reinforcement Learning

Modern web services increasingly rely on REST APIs. Effectively testing ...
research
12/31/2021

REST API Fuzzing by Coverage Level Guided Blackbox Testing

With the growth of web applications, REST APIs have become the primary c...
research
03/06/2022

foREST: A Tree-based Approach for Fuzzing RESTful APIs

Representational state transfer (REST) is a widely employed architecture...
research
11/29/2021

A Natural Language Processing and Deep Learning based Model for Automated Vehicle Diagnostics using Free-Text Customer Service Reports

Initial fault detection and diagnostics are imperative measures to impro...
research
02/22/2023

Microusity: A testing tool for Backends for Frontends (BFF) Microservice Systems

The microservice software architecture is more scalable and efficient th...

Please sign up or login with your details

Forgot password? Click here to reset