论文标题
腓热：基于语法的REST API模糊，并具有覆盖范围引导的反馈和基于学习的突变
Pythia: Grammar-Based Fuzzing of REST APIs with Coverage-guided Feedback and Learning-based Mutations
论文作者
论文摘要
本文介绍了Pythia，这是第一个通过覆盖范围引导的反馈来增强基于语法的模糊的模糊器，以及针对状态REST API模糊的基于学习的突变策略。毕田（Pythia）使用统计模型从结构有效的种子输入中学习目标REST API的常见用法模式。然后，它通过注入少量噪声偏离常见使用模式，同时仍保持句法有效性来产生基于学习的突变。毕田植物的突变策略有助于产生语法有效的测试用例，并且覆盖范围引导的反馈有助于确定更可能找到错误的测试用例。我们介绍了三个生产规模开源云服务的实验评估，表明Pythia在代码覆盖范围和发现的新错误中都超过了先验方法。使用毕曲娅，我们发现了29个新的错误，这些错误是向相应服务所有者报告的过程。
This paper introduces Pythia, the first fuzzer that augments grammar-based fuzzing with coverage-guided feedback and a learning-based mutation strategy for stateful REST API fuzzing. Pythia uses a statistical model to learn common usage patterns of a target REST API from structurally valid seed inputs. It then generates learning-based mutations by injecting a small amount of noise deviating from common usage patterns while still maintaining syntactic validity. Pythia's mutation strategy helps generate grammatically valid test cases and coverage-guided feedback helps prioritize the test cases that are more likely to find bugs. We present experimental evaluation on three production-scale, open-source cloud services showing that Pythia outperforms prior approaches both in code coverage and new bugs found. Using Pythia, we found 29 new bugs which we are in the process of reporting to the respective service owners.
