论文标题
静止API中的开放问题：工具的比较
Open Problems in Fuzzing RESTful APIs: A Comparison of Tools
论文作者
论文摘要
Restful API是一种在行业中广泛使用的Web服务。在过去的几年中，在研究社区中花费了很多精力来设计新颖的技术来自动模糊这些API，以发现其中的故障。许多真正的故障自动在各种静止的API中自动发现。但是，通常分析的模糊器将API视为黑框，并且对这些系统中实际涵盖的内容没有分析。因此，尽管这些模糊对从业者显然很有用，但我们不知道它们目前的局限性和实际有效性是什么。解决此问题是能够设计更好，更有效和有效技术的必要步骤。为了解决这个问题，在本文中，我们比较了18个开源的七个最先进的模糊器和一个工业静止的API。然后，我们分析了fuzzer未能生成测试的这些部分的源代码。该分析指出了这些当前模糊器的明确局限性，列出了研究界的具体挑战。
RESTful APIs are a type of web services that are widely used in industry. In the last few years, a lot of effort in the research community has been spent in designing novel techniques to automatically fuzz those APIs to find faults in them. Many real faults were automatically found in a large variety of RESTful APIs. However, usually the analyzed fuzzers treat the APIs as black-box, and no analysis of what is actually covered in these systems is done. Therefore, although these fuzzers are clearly useful for practitioners, we do not know what are their current limitations and actual effectiveness. Solving this is a necessary step to be able to design better, more efficient and effective techniques. To address this issue, in this paper we compare seven state-of-the-art fuzzers on 18 open-source and one industrial RESTful APIs. We then analyzed the source code of which parts of these APIs the fuzzers fail to generate tests for. This analysis points to clear limitations of these current fuzzers, listing concrete challenges for the research community to follow up on.
