一句话：提出并评估智能 REST API 数据模糊测试技术，通过规范与响应学习生成请求体，在 Azure 服务中发现 17 个唯一 bug。
本文研究如何智能生成 REST API 请求中的数据载荷，以发现云服务中的数据处理 bug。作者利用 REST API 规范中定义的请求体数据模式，提出并评估了一系列数据模糊测试技术，包括结构模式模糊规则、多种规则组合、搜索启发式、从规范示例中提取数据值，以及从先前服务响应中在线学习数据值。通过实验比较这些技术，作者找出性能最佳的算法组合，并用其对多个 Microsoft Azure 云服务进行模糊测试。实验中发现数百次“Internal Server Error”服务崩溃，经分类整理为 17 个唯一 bug 并报告给 Azure 开发者。所有 bug 均可复现、已确认，且已修复或正在修复中。
The cloud runs on REST APIs. In this paper, we study how to intelligently generate data payloads embedded in REST API requests in order to find data-processing bugs in cloud services. We discuss how to leverage REST API specifications, which, by definition, contain data schemas for API request bodies. We then propose and evaluate a range of data fuzzing techniques, including structural schema fuzzing rules, various rule combinations, search heuristics, extracting data values from examples included in REST API specifications, and learning data values on-the-fly from previous service responses. After evaluating these techniques, we identify the top-performing combination and use this algorithm to fuzz several Microsoft Azure cloud services. During our experiments, we found 100s of “Internal Server Error” service crashes, which we triaged into 17 unique bugs and reported to Azure developers. All these bugs are reproducible, confirmed, and fixed or in the process of being fixed.
DOI 原文 ·
@inproceedings{paperbot5850,
title = {Intelligent REST API data fuzzing},
author = {Patrice Godefroid and Bo-Yuan Huang and Marina Polishchuk},
booktitle = {FSE},
year = {2020},
doi = {10.1145/3368089.3409719}
}