用强化学习自动测试REST API，发现更多漏洞且测试次数更少
APIRL: Deep Reinforcement Learning for REST API Fuzzing
- 用预训练的Transformer提取API响应上下文，指导智能测试
- 在真实API上比现有方法多发现37%的漏洞，测试用例减少40%
- 适合安全研究人员和自动化测试开发者使用
REST APIs已成为网络服务的核心组件，但常因逻辑缺陷导致服务器错误或安全漏洞。当前通过修改HTTP请求进行测试的方法，包括深度学习方案，受限于性能与精度，依赖无方向搜索或未能充分利用上下文信息。本文提出APIRL，一种全自动的深度强化学习工具，用于测试REST API。其关键创新在于利用预训练于结构化JSON数据的Transformer模块反馈，类似API响应中的模式，使APIRL能学习测试结果的细微差别，并泛化至未见的API端点。实验表明，APIRL在真实世界REST API中显著优于现有最先进方法，能发现更多漏洞，同时大幅减少所需测试用例数量。此外，通过详尽的消融研究，探讨了奖励函数及其他关键设计选择对学习策略的影响。
原文摘要 · Abstract (English)
REST APIs have become key components of web services. However, they often contain logic flaws resulting in server side errors or security vulnerabilities. HTTP requests are used as test cases to find and mitigate such issues. Existing methods to modify requests, including those using deep learning, suffer from limited performance and precision, relying on undirected search or making limited usage of the contextual information. In this paper we propose APIRL, a fully automated deep reinforcement learning tool for testing REST APIs. A key novelty of our approach is the use of feedback from a transformer module pre-trained on JSON-structured data, akin to that used in API responses. This allows APIRL to learn the subtleties relating to test outcomes, and generalise to unseen API endpoints. We show APIRL can find significantly more bugs than the state-of-the-art in real world REST APIs while minimising the number of required test cases. We also study how reward functions, and other key design choices, affect learnt policies in a thorough ablation study.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。