2000 character limit reached
Security Testing of RESTful APIs With Test Case Mutation (2403.03701v1)
Published 6 Mar 2024 in cs.CR and cs.SE
Abstract: The focus of this paper is on automating the security testing of RESTful APIs. The testing stage of this specific kind of components is often performed manually, and this is yet considered as a long and difficult activity. This paper proposes an automated approach to help developers generate test cases for experimenting with each service in isolation. This approach is based upon the notion of test case mutation, which automatically generates new test cases from an original test case set. Test case mutation operators perform slight test case modifications to mimic possible failures or to test the component under test with new interactions. In this paper, we examine test case mutation operators for RESTful APIs and define 17 operators specialised in security testing. Then, we present our test case mutation algorithm. We evaluate its effectiveness and performance on four web service compositions.
- Integrity Protection Against Insiders in Microservice-Based Infrastructures: From Threats to a Security Framework, pages 573–588.
- Arcuri, A. (2018). Test suite generation with the many independent objective (mio) algorithm. Information and Software Technology, 104:195–206.
- Arcuri, A. (2019). Restful api automated test case generation with evomaster. ACM Trans. Softw. Eng. Methodol., 28(1).
- Random testing: Theoretical results and practical implications. IEEE transactions on Software Engineering, 38(2):258–277.
- CAPEC (2024). Common attack pattern enumeration and classification, https://capec.mitre.org/.
- CWE (2024). Common weakness enumeration, https://cwe.mitre.org/.
- Android testing crawler. In Piattini, M., da Cunha, P. R., de Guzmán, I. G. R., and Pérez-Castillo, R., editors, Quality of Information and Communications Technology - 12th International Conference, QUATIC, Ciudad Real, Spain, volume 1010 of Communications in Computer and Information Science, pages 313–326. Springer.
- TCM: Test Case Mutation to Improve Crash Detection in Android. In Proceedings of the 21st International Conference on Fundamental Approaches to Software Engineering, pages 264–280. Springer.
- A survey on model-based testing tools for test case generation. In Itsykson, V., Scedrov, A., and Zakharov, V., editors, Tools and Methods of Program Analysis, pages 77–89, Cham. Springer International Publishing.
- Towards security-aware mutation testing. In 2017 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW), pages 97–102.
- On a classification approach for soa vulnerabilities. In 2009 33rd Annual IEEE International Computer Software and Applications Conference, volume 2, pages 439–444.
- Masood, A. (2013). Cyber security for service oriented architectures in a web 2.0 world: An overview of soa vulnerabilities in financial services. In 2013 IEEE International Conference on Technologies for Homeland Security (HST), pages 1–6.
- Sok: Run-time security for cloud microservices. are we there yet? Comput. Secur., 127:103119.
- Test case generation based on mutations over user execution traces. Software Quality Journal, 28.
- Mutation testing advances: an analysis and survey. In Advances in Computers, volume 112, pages 275–378. Elsevier.
- Learning communicating state machines. In Tests and Proofs, page 112–128, Berlin, Heidelberg. Springer-Verlag.
- Phillips, I. C. C. (1987). Refusal testing. Theor. Comput. Sci., 50:241–284.
- Automated test case generation for service composition from event logs. In 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023 - Workshops, Luxembourg, September 11-15, 2023, pages 127–134. IEEE.
- Model reverse-engineering of Mobile applications with exploration strategies. In Ninth International Conference on Software Engineering Advances, ICSEA 2014, Nice, France.
- Testing software modelling tools using data mutation. In Proceedings of the 2006 International Workshop on Automation of Software Test, AST ’06, page 43–49, New York, NY, USA. Association for Computing Machinery.
- Testing web services with model-based mutation. pages 45–67.
- Securing vulnerable home iot devices with an in-hub security manager. In 2017 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops), pages 551–556.
- Good practices for security of internet of things in the context of smart manufacturing testing.
- Security testing of restful apis with test case mutation, companion site. https://github.com/JarodSue/Restful-API-test-case-mutation.
- Tretmans, J. (2008). Model Based Testing with Labelled Transition Systems, pages 1–38. Springer Berlin Heidelberg, Berlin, Heidelberg.
- On the nature of issues in five open source microservices systems: An empirical study. Proceedings of the 25th International Conference on Evaluation and Assessment in Software Engineering.
- Directed test suite augmentation: Techniques and tradeoffs. FSE ’10, page 257–266, New York, NY, USA. Association for Computing Machinery.
- Crash reproduction via test case mutation: Let existing test cases help. In Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2015, page 910–913, New York, NY, USA.
Collections
Sign up for free to add this paper to one or more collections.
Paper Prompts
Sign up for free to create and run prompts on this paper using GPT-5.