{"id":"https://openalex.org/W4392652182","doi":"https://doi.org/10.1145/3652157","title":"Advanced White-Box Heuristics for Search-Based Fuzzing of REST APIs","display_name":"Advanced White-Box Heuristics for Search-Based Fuzzing of REST APIs","publication_year":2024,"publication_date":"2024-03-11","ids":{"openalex":"https://openalex.org/W4392652182","doi":"https://doi.org/10.1145/3652157"},"language":"en","primary_location":{"id":"doi:10.1145/3652157","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3652157","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3652157","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3652157","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5052735480","display_name":"Andrea Arcuri","orcid":"https://orcid.org/0000-0003-0799-2930"},"institutions":[{"id":"https://openalex.org/I2800207870","display_name":"H\u00f8yskolen Kristiania","ror":"https://ror.org/03gss5916","country_code":"NO","type":"education","lineage":["https://openalex.org/I2800207870"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Andrea Arcuri","raw_affiliation_strings":["Kristiania University College and Oslo Metropolitan University, Oslo, Norway"],"raw_orcid":"https://orcid.org/0000-0003-0799-2930","affiliations":[{"raw_affiliation_string":"Kristiania University College and Oslo Metropolitan University, Oslo, Norway","institution_ids":["https://openalex.org/I2800207870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100353083","display_name":"Man Zhang","orcid":"https://orcid.org/0000-0003-1204-9322"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Man Zhang","raw_affiliation_strings":["Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-1204-9322","affiliations":[{"raw_affiliation_string":"Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5041433839","display_name":"Juan Pablo Galeotti","orcid":"https://orcid.org/0000-0002-0747-8205"},"institutions":[{"id":"https://openalex.org/I151201029","display_name":"Consejo Nacional de Investigaciones Cient\u00edficas y T\u00e9cnicas","ror":"https://ror.org/03cqe8w59","country_code":"AR","type":"government","lineage":["https://openalex.org/I151201029","https://openalex.org/I4210123736","https://openalex.org/I4387155568"]},{"id":"https://openalex.org/I24354313","display_name":"Universidad de Buenos Aires","ror":"https://ror.org/0081fs513","country_code":"AR","type":"education","lineage":["https://openalex.org/I24354313"]}],"countries":["AR"],"is_corresponding":false,"raw_author_name":"Juan Galeotti","raw_affiliation_strings":["University of Buenos Aires, CONICET and Kristiania University College, Buenos Aires, Argentina"],"raw_orcid":"https://orcid.org/0000-0002-0747-8205","affiliations":[{"raw_affiliation_string":"University of Buenos Aires, CONICET and Kristiania University College, Buenos Aires, Argentina","institution_ids":["https://openalex.org/I151201029","https://openalex.org/I24354313"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":7.434,"has_fulltext":true,"cited_by_count":16,"citation_normalized_percentile":{"value":0.97627872,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"33","issue":"6","first_page":"1","last_page":"36"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9694808721542358},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8892838358879089},{"id":"https://openalex.org/keywords/heuristics","display_name":"Heuristics","score":0.6064818501472473},{"id":"https://openalex.org/keywords/white-box","display_name":"White box","score":0.6058250069618225},{"id":"https://openalex.org/keywords/black-box","display_name":"Black box","score":0.4562259316444397},{"id":"https://openalex.org/keywords/rest","display_name":"Rest (music)","score":0.44287109375},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.3726155757904053},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.3711787164211273},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.2702797055244446},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.25561195611953735},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.159234881401062}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9694808721542358},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8892838358879089},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.6064818501472473},{"id":"https://openalex.org/C180932941","wikidata":"https://www.wikidata.org/wiki/Q997233","display_name":"White box","level":2,"score":0.6058250069618225},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.4562259316444397},{"id":"https://openalex.org/C77265313","wikidata":"https://www.wikidata.org/wiki/Q879844","display_name":"Rest (music)","level":2,"score":0.44287109375},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3726155757904053},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3711787164211273},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.2702797055244446},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.25561195611953735},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.159234881401062},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C164705383","wikidata":"https://www.wikidata.org/wiki/Q10379","display_name":"Cardiology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3652157","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3652157","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3652157","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3652157","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3652157","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3652157","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure","score":0.6100000143051147}],"awards":[],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320335478","display_name":"Secretar\u00eda de Ciencia y T\u00e9cnica, Universidad de Buenos Aires","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4392652182.pdf","grobid_xml":"https://content.openalex.org/works/W4392652182.grobid-xml"},"referenced_works_count":85,"referenced_works":["https://openalex.org/W1526710119","https://openalex.org/W1578861446","https://openalex.org/W1674046048","https://openalex.org/W1977321274","https://openalex.org/W1985403010","https://openalex.org/W1993760289","https://openalex.org/W2011825780","https://openalex.org/W2042033151","https://openalex.org/W2045427795","https://openalex.org/W2071365726","https://openalex.org/W2072083761","https://openalex.org/W2085553299","https://openalex.org/W2100987397","https://openalex.org/W2101629181","https://openalex.org/W2110337982","https://openalex.org/W2115626531","https://openalex.org/W2131245056","https://openalex.org/W2142619464","https://openalex.org/W2270202525","https://openalex.org/W2293616642","https://openalex.org/W2295840463","https://openalex.org/W2494902551","https://openalex.org/W2579989956","https://openalex.org/W2626391746","https://openalex.org/W2760376440","https://openalex.org/W2768363122","https://openalex.org/W2790334838","https://openalex.org/W2804003629","https://openalex.org/W2805913971","https://openalex.org/W2888728013","https://openalex.org/W2914775513","https://openalex.org/W2941522337","https://openalex.org/W2955498974","https://openalex.org/W2955835447","https://openalex.org/W2968373634","https://openalex.org/W2979357014","https://openalex.org/W2982121747","https://openalex.org/W2997401484","https://openalex.org/W3001307185","https://openalex.org/W3004249941","https://openalex.org/W3038801694","https://openalex.org/W3043456590","https://openalex.org/W3047047526","https://openalex.org/W3047675717","https://openalex.org/W3047848029","https://openalex.org/W3105739932","https://openalex.org/W3106293840","https://openalex.org/W3113353684","https://openalex.org/W3119672550","https://openalex.org/W3119757615","https://openalex.org/W3126551690","https://openalex.org/W3141924267","https://openalex.org/W3170391117","https://openalex.org/W3174466001","https://openalex.org/W3177546869","https://openalex.org/W3202888839","https://openalex.org/W3204593724","https://openalex.org/W4207068811","https://openalex.org/W4210660460","https://openalex.org/W4211256124","https://openalex.org/W4213274161","https://openalex.org/W4220791610","https://openalex.org/W4224306538","https://openalex.org/W4282575795","https://openalex.org/W4282585420","https://openalex.org/W4284680450","https://openalex.org/W4284706564","https://openalex.org/W4287552959","https://openalex.org/W4300811928","https://openalex.org/W4313533616","https://openalex.org/W4321482783","https://openalex.org/W4323256277","https://openalex.org/W4366825970","https://openalex.org/W4376504003","https://openalex.org/W4378364617","https://openalex.org/W4384080199","https://openalex.org/W4384154515","https://openalex.org/W4384302810","https://openalex.org/W4385301220","https://openalex.org/W4385492587","https://openalex.org/W4385699319","https://openalex.org/W4386027284","https://openalex.org/W4386365560","https://openalex.org/W6912768993","https://openalex.org/W6931832626"],"related_works":["https://openalex.org/W2047881532","https://openalex.org/W1984273188","https://openalex.org/W2727407240","https://openalex.org/W154189287","https://openalex.org/W3033197410","https://openalex.org/W2777690624","https://openalex.org/W2601181618","https://openalex.org/W1855700431","https://openalex.org/W2385964753","https://openalex.org/W3016331820"],"abstract_inverted_index":{"Due":[0],"to":[1,47,118,142],"its":[2],"importance":[3],"and":[4,75],"widespread":[5],"use":[6],"in":[7,22,32,52,70,123,131,169],"industry,":[8],"automated":[9],"testing":[10],"of":[11,29,66,72,100,110,166,171],"REST":[12,101],"APIs":[13,154],"has":[14,35],"attracted":[15],"major":[16,84],"interest":[17],"from":[18,155],"the":[19,23,30,33,64,92,156,167],"research":[20,60],"community":[21],"last":[24],"few":[25],"years.":[26],"However,":[27],"most":[28],"work":[31],"literature":[34],"been":[36,45],"focused":[37],"on":[38,152],"black-box":[39,87],"fuzzing.":[40],"Although":[41],"existing":[42,53,94],"fuzzers":[43],"have":[44],"used":[46],"automatically":[48],"find":[49],"many":[50],"faults":[51],"APIs,":[54],"there":[55],"are":[56,82,137],"still":[57],"several":[58],"open":[59],"challenges":[61],"that":[62,96],"hinder":[63],"achievement":[65],"better":[67],"results":[68,168],"(e.g.,":[69],"terms":[71],"code":[73],"coverage":[74],"fault":[76],"finding).":[77],"For":[78],"example,":[79],"under-specified":[80,121,129],"schemas":[81,130],"a":[83,108],"issue":[85],"for":[86,115],"fuzzers.":[88],"Currently,":[89],"EvoMaster":[90,147],"is":[91],"only":[93],"tool":[95],"supports":[97],"white-box":[98,112],"fuzzing":[99],"APIs.":[102,173],"In":[103],"this":[104],"paper,":[105],"we":[106],"provide":[107],"series":[109],"novel":[111,135],"heuristics,":[113],"including":[114],"example":[116],"how":[117],"deal":[119],"with":[120],"constrains":[122],"API":[124],"schemas,":[125],"as":[126,128,139],"well":[127],"SQL":[132],"databases.":[133],"Our":[134],"techniques":[136],"implemented":[138],"an":[140],"extension":[141],"our":[143],"open-source,":[144],"search-based":[145],"fuzzer":[146],".":[148],"An":[149],"empirical":[150],"study":[151],"14":[153],"EMB":[157],"corpus,":[158],"plus":[159],"one":[160],"industrial":[161],"API,":[162],"shows":[163],"clear":[164],"improvements":[165],"some":[170],"these":[172]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":11},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-20T07:56:41.581041","created_date":"2025-10-10T00:00:00"}