Response relation model-driven approach for automated fuzz testing of RESTful Web APIs

As internet services evolve and mobile applications proliferate, RESTful APIs have become critical for modern web applications due to their simplicity and lightweight design. Fuzz testing assesses system stability and security by sending large amounts of random, invalid, or anomalous data to RESTful APIs. However, traditional fuzz testing focuses on input format and structure, ignoring the semantic meaning of inputs. This limits its ability to uncover logical vulnerabilities or business logic errors. Currently, fuzz testing aimed at detecting logical defects in RESTful APIs remains underexplored. To address this issue, the paper proposes a response relation model-driven approach for automated fuzz testing, which is the first method designed to target logical defects in RESTful APIs. Based on API types and parameter combinations, we have identified four response relation models to guide the generation of fuzz testing cases. These relationships help generate test cases and verify if system behavior aligns with expected results. We validated the effectiveness of our method on Spotify and YouTube services, successfully identifying 12 undetected logical errors. These errors are confirmed by API developers or reproduced by users. Results show that this approach is highly effective in detecting logical defects, offering greater precision than traditional fuzz testing methods and proving its practicality in real-world applications.