Security Testing of RESTful APIs With Test Case Mutation

Sebastien Salva,Jarod Sue

2024-03-06

Abstract:The focus of this paper is on automating the security testing of RESTful APIs. The testing stage of this specific kind of components is often performed manually, and this is yet considered as a long and difficult activity. This paper proposes an automated approach to help developers generate test cases for experimenting with each service in isolation. This approach is based upon the notion of test case mutation, which automatically generates new test cases from an original test case set. Test case mutation operators perform slight test case modifications to mimic possible failures or to test the component under test with new interactions. In this paper, we examine test case mutation operators for RESTful APIs and define 17 operators specialised in security testing. Then, we present our test case mutation algorithm. We evaluate its effectiveness and performance on four web service compositions.

Cryptography and Security,Software Engineering

What problem does this paper attempt to address?

The paper primarily focuses on the issue of automating security testing for RESTful APIs, aiming to address the time-consuming and complex challenges faced during manual testing of such components. The paper proposes an automated approach based on test case mutation to assist developers in generating test cases and conducting experiments on each service individually. This method is implemented by automatically producing new test cases from an original set of test cases, where mutation operators slightly modify the test cases to simulate potential failures or new interactions with the component under test. The paper specifically concentrates on the security testing of RESTful APIs, defining 17 mutation operators dedicated to security testing, and introduces a test case mutation algorithm. Moreover, the method also considers the need to test RESTful APIs in an isolated environment, hence it generates mock components to simulate dependent services while creating new test cases. Researchers evaluated the effectiveness and performance of the method using four web service compositions for experimentation.

Specifically, the contributions of the paper include:

1. Researching and defining 17 mutation operators focused on the security testing of RESTful APIs;
2. Proposing an algorithm for generating mutated test cases, test scripts, and mock components;
3. Implementing the method and making available four RESTful API compositions along with log files for verification by others;
4. Assessing the effectiveness (number of generated mutated test cases, ability to discover new security vulnerabilities, or further coverage of service code) and performance on these four compositions (comprising 15 services).

The paper also discusses related work, comparing different approaches to white-box and black-box testing, and points out that the proposed mutation operators and algorithm are specifically designed for the security testing of RESTful APIs, filling a gap in existing research. Finally, the paper provides a detailed description of the design of mutation operators, the test case mutation algorithm, and the process of generating executable test cases and mock components.