Automated Test Input Generation for Testing Representational State Transfer (REST) Application Programming Interface (API) using Parameter Fuzzing

Fuzz testing has been widely used for generating inputs automatically to test the stability and security of RESTful web services. To be effective, fuzzing input generation needs to provide both valid and invalid input data. One way to automatically generate fuzzy inputs to test Representational State Transfer (REST) Application Programming Interface (API) is based on the data types and structures of the API parameters. However, even with such information, it is still challenging to automatically generate effective fuzzy inputs. Thus, we proposed a method to generate fuzzy inputs for API parameters according to their categories instead of generating the inputs randomly. An API parameter was classified into a corresponding category according to the parameter’s information first. Based on the classified category, associated rules were used to generate fuzzy inputs for the parameter automatically. The proposed method has been implemented and integrated into RESTler, a well-known open-source fuzzing tool for REST APIs. Experimental results showed that, as compared with random input generation, the proposed method had wider API status code coverage and better error detection results.