APIRL: Deep Reinforcement Learning for REST API Fuzzing

2024-12-20 · Myles Foley, Sergio Maffeis

REST APIs have become key components of web services. However, they often contain logic flaws resulting in server side errors or security vulnerabilities. HTTP requests are used as test cases to find and mitigate such issues. Existing methods to modify requests, including those using deep learning, suffer from limited performance and precision, relying on undirected search or making limited usage of the contextual information. In this paper we propose APIRL, a fully automated deep reinforcement learning tool for testing REST APIs. A key novelty of our approach is the use of feedback from a transformer module pre-trained on JSON-structured data, akin to that used in API responses. This allows APIRL to learn the subtleties relating to test outcomes, and generalise to unseen API endpoints. We show APIRL can find significantly more bugs than the state-of-the-art in real world REST APIs while minimising the number of required test cases. We also study how reward functions, and other key design choices, affect learnt policies in a thorough ablation study.

📄 PDF Abstract BibTeX arXiv:2412.15991

Code (0)

등록된 구현이 없습니다.

Tasks

Deep Reinforcement Learningreinforcement-learning Reinforcement Learning

Deep Reinforcement Fuzzing

2018-01-14 · Konstantin Böttinger, Patrice Godefroid, Rishabh Singh

Fuzzing is the process of finding security vulnerabilities in input-processing code by repeatedly testing the code with modified inputs. In this paper, we formalize fuzzing as a reinforcement learning problem using the c…

Q-Learning reinforcement-learning Reinforcement Learning Reinforcement Learning (RL)

R1-Fuzz: Specializing Language Models for Textual Fuzzing via Reinforcement Learning

2025-09-21 · Jiayi Lin, Liangcai Su, Junzhe Li, Chenxiong Qian arxiv

Fuzzing is effective for vulnerability discovery but struggles with complex targets such as compilers, interpreters, and database engines, which accept textual input that must satisfy intricate syntactic and semantic con…

Reinforcement Learning

FuzzerGym: A Competitive Framework for Fuzzing and Learning

2018-07-19 · William Drozd, Michael D. Wagner

Fuzzing is a commonly used technique designed to test software by automatically crafting program inputs. Currently, the most successful fuzzing algorithms emphasize simple, low-overhead strategies with the ability to eff…

Deep Reinforcement Learning Fault Detection OpenAI Gym reinforcement-learning+2

CovRL: Fuzzing JavaScript Engines with Coverage-Guided Reinforcement Learning for LLM-based Mutation

2024-02-19 · Jueon Eom, Seyeon Jeong, Taekyoung Kwon

Fuzzing is an effective bug-finding technique but it struggles with complex systems like JavaScript engines that demand precise grammatical input. Recently, researchers have adopted language models for context-aware muta…

reinforcement-learning Reinforcement Learning Vulnerability Detection

FuzzingRL: Reinforcement Fuzz-Testing for Revealing VLM Failures

2026-02-17 · Jiajun Xu, Jiageng Mao, Ang Qi, Weiduo Yuan 외 arxiv

Vision Language Models (VLMs) are prone to errors, and identifying where these errors occur is critical for ensuring the reliability and safety of AI systems. In this paper, we propose an approach that automatically gene…