MICRoFuzz: An Efficient Fuzzing Framework for Microservices

Fuzzing is a widely adopted technique in the software industry to enhance security and software quality. However, most existing fuzzers are specifically designed for monolithic software architectures and face significant limitations when it comes to serving distributed Microservices applications (Apps). These limitations primarily revolve around issues of inconsistency, communication, and applicability which arise due to the differences in monolithic and distributed software architecture. This paper presents a novel fuzzing framework, called MICRO-Fuzz, specifically designed for Microservices. Mocking-Assisted Seed Execution, Distributed Tracing, Seed Refresh and Pipeline Parallelism approaches are adopted to address the environmental complex-ities and dynamics of Microservices and improve the efficiency of fuzzing. MICROFuzz has been successfully implemented and deployed in Antgroup
¹
, a prominent FinTech company. Its per-formance has been evaluated in three distinct industrial scenarios: normalized fuzzing, iteration testing, and taint verification. Throughout five months of operation, MICROFuzz has diligently analyzed a substantial codebase, consisting of 261 Apps with over 74.6 million lines of code (LOC). The framework's effectiveness is evident in its detection of 5,718 potential quality or security risks, with 1,764 of them confirmed and fixed as actual security threats by software specialists. Moreover, MICROFuzz significantly increased line coverage by 12.24% and detected new paths by 38.42% in the iteration testing.