ICST 2024
Mon 27 - Fri 31 May 2024 Canada
Mon 27 May 2024 11:00 - 11:30 at Room 3 - Session 2

As part of modernization efforts, it is not uncommon for enterprises to wrap existing or legacy algorithms using web APIs to make them available across the organization. For example, an algorithm written in C may be wrapped in a Java API and described using a standardized specification (e.g., SOAP, OpenAPI, GraphQL). As such, many fuzzers take advantage of these specifications for automated testing. However, these fuzzers are only able to test at the surface level as they usually generate inputs stochastically. This is especially problematic when testing code that has highly constrained execution paths. Random input generation is unlikely to penetrate tight constraints and may miss defects behind such constraints altogether. Concolic execution allows for solving constraints and maximizing branch coverage. In this paper, we present a framework that combines specification-based fuzzing with concolic fuzzing to go beyond the surface level and perform deeper fuzzing of web APIs in a systematic manner. In our evaluation, we show that our approach is able to achieve almost double the code coverage of the API fuzzing tool RESTler when applied to a tightly constrained system.

Mon 27 May

Displayed time zone: Eastern Time (US & Canada) change

11:00 - 12:30
Session 2NEXTA at Room 3
11:00
30m
Research paper
Automated Hybrid Fuzzing of Web APIs
NEXTA
Andrea Bogle The Aerospace Corporation, Tan Tran The Aerospace Corporation, Rafael Ceja The Aerospace Corporation, Joshua Sasaki The Aerospace Corporation, Riyadh Mahmood The Aerospace Corporation
11:30
30m
Short-paper
Improving security analysis rule set by relationship identification
NEXTA
Charles Lohest UCLouvain, Axel Legay Université Catholique de Louvain, Belgium
12:00
30m
Short-paper
TCPGraphix: A Visualization Tool for ML-Powered Test Case Prioritization Data Analysis
NEXTA
Yara Q Mahmoud Ontario Tech University, Akramul Azim Ontario Tech University, Md Asif Khan Ontario Tech University