Problem
Research questions and friction points this paper is trying to address.
REST API
fuzzing
industrial integration
automated testing
software engineering practice
Fuzzing REST APIs in Industry: Necessary Features and Open Problems
🤖 AI Summary
This work addresses the high cost and heavy reliance on manual effort in industrial REST API testing, where existing academic fuzzing tools struggle to achieve practical deployment. Drawing on Volkswagen Group’s real-world practices from 2023 to 2026, we systematically evaluate and enhance the open-source search-based fuzzer EvoMaster. For the first time, we identify the critical features required for its successful industrial adoption and uncover several practical challenges. Our approach integrates empirical feedback from real-world API testing with insights from a user study involving 11 testing professionals across four companies. This dual perspective informs targeted improvements to the tool’s design, clarifies its industrial value proposition, and outlines a concrete pathway for future enhancements to bridge the gap between academic research and industrial applicability.
📝 Abstract
REST APIs are widely used in industry, in all different kinds of domains. An example is Volkswagen AG, a German automobile manufacturer. Established testing approaches for REST APIs are time consuming, and require expertise from professional test engineers. Due to its cost and importance, in the scientific literature several approaches have been proposed to automatically test REST APIs. The open-source, search-based fuzzer EvoMaster is one of such tools proposed in the academic literature. However, how academic prototypes can be integrated in industry and have real impact to software engineering practice requires more investigation. In this paper, we report on our experience in using EvoMaster at Volkswagen AG, as an EvoMaster user from 2023 to 2026. We share our learnt lessons, and discuss several features needed to be implemented in EvoMaster to make its use in an industrial context successful. Feedback about value in industrial setups of EvoMaster was given from Volkswagen AG about 4 APIs. Additionally, a user study was conducted involving 11 testing specialists from 4 different companies. We further identify several real-world research challenges that still need to be solved.
Innovation
Methods, ideas, or system contributions that make the work stand out.
REST API fuzzing
industrial adoption
EvoMaster
search-based testing
user study
🔎 Similar Papers
No similar papers found.
