Using Evolutionary Algorithms to Understand and Secure Web/Enterprise Systems

Informacje na temat projektu

EAST

Identyfikator umowy o grant: 864972

DOI

10.3030/864972

Data podpisania przez KE 9 Marca 2020

Data rozpoczęcia 1 Sierpnia 2020

Data zakończenia 31 Stycznia 2027

Finansowanie w ramach

• EXCELLENT SCIENCE - European Research Council (ERC)

Koszt całkowity

€ 2 000 000,00

Wkład UE

€ 2 000 000,00

Koordynowany przez

HOYSKOLEN KRISTIANIA - ERNST G. MORTENSENS STIFTELSE
Norway

CORDIS oferuje możliwość skorzystania z odnośników do publicznie dostępnych publikacji i rezultatów projektów realizowanych w ramach programów ramowych HORYZONT.

Odnośniki do rezultatów i publikacji związanych z poszczególnymi projektami 7PR, a także odnośniki do niektórych konkretnych kategorii wyników, takich jak zbiory danych i oprogramowanie, są dynamicznie pobierane z systemu OpenAIRE .

Rezultaty

Open Research Data Pilot (1)

Data Management Plan

"Information concerning the Data Management Plan is described in Annex 1 under ""Work Package 12"" 1. Making data Findable, 2. Making data openly Accessible, 3. Making data Interoperable, 4. Increase data Re-use, 5. Allocation of recourses and data security The data management plan will also have to specify if certain datasets remain closed and the reasons for not giving access should be given."

Publikacje

Peer reviewed articles (15)

White-box Fuzzing RPC-based APIs with EvoMaster: An Industrial Case Study

Autorzy: Man Zhang,Andrea Arcuri,Yonggang Li,Yang Liu,Kaiming Xue
Opublikowane w: ACM Transactions on Software Engineering and Methodology, 2023, ISSN 1049-331X
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3585009

Open Problems in Fuzzing RESTful APIs: A Comparison of Tools

Autorzy: Man Zhang, Andrea Arcuri
Opublikowane w: ACM Transactions on Software Engineering and Methodology, 2023, ISSN 1049-331X
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3597205

Enhancing Search-based Testing with Testability Transformations for Existing APIs

Autorzy: Andrea Arcuri, Juan Pablo Galeotti
Opublikowane w: ACM Transactions on Software Engineering and Methodology, Numer 31(1), 2021, Strona(/y) 1-34, ISSN 1049-331X
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3477271

Tools and benchmarks evolve: what is their impact on parameter tuning in SBSE experiments?

Autorzy: Amid Golmohammadi, Man Zhang, Andrea Arcuri
Opublikowane w: Empirical Software Engineering, Numer 31, 2026, ISSN 1382-3256
Wydawca: Kluwer Academic Publishers
DOI: 10.1007/s10664-025-10733-y

Random Testing and Evolutionary Testing for Fuzzing GraphQL APIs

Autorzy: Asma Belhadi, Man Zhang, Andrea Arcuri
Opublikowane w: ACM Transactions on the Web, 2023, ISSN 1559-1131
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3609427

JavaScript SBST Heuristics To Enable Effective Fuzzing of NodeJS Web APIs

Autorzy: Man Zhang, Asma Belhadi, Andrea Arcuri
Opublikowane w: ACM Transactions on Software Engineering and Methodology, 2023, ISSN 1049-331X
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3593801

Building an open-source system test generation tool: lessons learned and empirical analyses with EvoMaster

Autorzy: Andrea Arcuri; Man Zhang; Asma Belhadi; Bogdan Marculescu; Amid Golmohammadi; Juan Pablo Galeotti; Susruthan Seran
Opublikowane w: Software Quality Journal, Numer 1, 2023, ISSN 1573-1367
Wydawca: springer
DOI: 10.1007/s11219-023-09620-w

Technology adoption performance evaluation applied to testing industrial REST APIs

Autorzy: Alexander Poth, Olsi Rrjolli, Andrea Arcuri
Opublikowane w: Automated Software Engineering, Numer 32, 2025, ISSN 0928-8910
Wydawca: Kluwer Academic Publishers
DOI: 10.1007/s10515-024-00477-2

Fuzzing Microservices in Face of Intrinsic Uncertainties

Autorzy: Man Zhang, Tao Yue, Andrea Arcuri
Opublikowane w: ACM Transactions on Software Engineering and Methodology, 2026, ISSN 1049-331X
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3815580

Handling Web Service Interactions in Fuzzing with Search-Based Mock-Generation

Autorzy: Susruthan Seran, Man Zhang, Onur Duman, Andrea Arcuri
Opublikowane w: ACM Transactions on Software Engineering and Methodology, Numer 35, 2026, Strona(/y) 1-45, ISSN 1049-331X
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3731558

".NET/C# Instrumentation for Search-Based Software Testing"

Autorzy: Golmohammadi, A., Zhang, M., Arcuri, A
Opublikowane w: Software Quality Journal, 2023, ISSN 1573-1367
Wydawca: springer
DOI: 10.1007/s11219-023-09645-1

Tool report: EvoMaster—black and white box search-based fuzzing for REST, GraphQL and RPC APIs

Autorzy: Andrea Arcuri, Man Zhang, Susruthan Seran, Juan Pablo Galeotti, Amid Golmohammadi, Onur Duman, Agustina Aldasoro, Hernan Ghianni
Opublikowane w: Automated Software Engineering, Numer 32, 2025, ISSN 0928-8910
Wydawca: Kluwer Academic Publishers
DOI: 10.1007/s10515-024-00478-1

Advanced White-Box Heuristics for Search-Based Fuzzing of REST APIs

Autorzy: Andrea Arcuri, Man Zhang, Juan Galeotti
Opublikowane w: ACM Transactions on Software Engineering and Methodology, Numer 33, 2025, Strona(/y) 1-36, ISSN 1049-331X
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3652157

Testing RESTful APIs: A Survey

Autorzy: Amid Golmohammadi, Man Zhang, Andrea Arcuri
Opublikowane w: ACM Transactions on Software Engineering and Methodology, 2023, ISSN 1049-331X
Wydawca: Association for Computing Machinary, Inc.
DOI: 10.1145/3617175

Enhancing REST API fuzzing with access policy violation checks and injection attacks

Autorzy: Omur Sahin, Man Zhang, Andrea Arcuri
Opublikowane w: Journal of Systems and Software, Numer 243, 2026, Strona(/y) 113060, ISSN 0164-1212
Wydawca: Elsevier BV
DOI: 10.1016/j.jss.2026.113060

Other (9)

Causes and Effects of Fitness Landscapes in System Test Generation: A Replication Study

Autorzy: O. Sahin, M. Zhang, Andrea Arcuri
Opublikowane w: Arxiv, 2025
Wydawca: Arxiv
DOI: 10.48550/arxiv.2502.00169

Fuzzing Microservices: A Series of User Studies in Industry on Industrial Systems with EvoMaster

Autorzy: M. Zhang, Andrea Arcuri, Y. Li, K. Xue, Z Wang, J. Huo, W Huang
Opublikowane w: 2024
Wydawca: Arxiv
DOI: 10.48550/arxiv.2208.03988

Fuzzing REST APIs in Industry: Necessary Features and Open Problems

Autorzy: A. Arcuri, A. Poth, O. Rrjolli, P. Garrett, J. P. Galeotti.
Opublikowane w: 2026
Wydawca: Arxiv

Detecting and Mitigating Flakiness in REST API Fuzzing

Autorzy: M. Zhang, C. Shen, A. Arcuri, T. Yue.
Opublikowane w: 2026
Wydawca: Arxiv

Generating REST API Tests With Descriptive Names

Autorzy: P. Garrett, J. P. Galeotti, A. Arcuri, A. Poth, O. Rrjolli.
Opublikowane w: 2026
Wydawca: Arxiv

WFC/WFD: Web Fuzzing Commons, Dataset and Guidelines to Support Experimentation in REST API Fuzzing

Autorzy: O. Sahin, M. Zhang, A. Arcuri.
Opublikowane w: 2026
Wydawca: Arxiv

Validating HTTP Semantics in REST APIs With Constructed Call Sequence Scenarios

Autorzy: O. Sahin, A. Arcuri.
Opublikowane w: 2026
Wydawca: Arxiv

Using OAI Overlay to Enhance REST API Fuzzing

Autorzy: O. Sahin, M. Zhang, A. Poth, O. Rrjolli, A. Faes, P. Teng, K. Xue, W. Ma, A. Arcuri
Opublikowane w: 2026
Wydawca: Arxiv

Search-Based Software Engineering and AI Foundation Models: Current Landscape and Future Roadmap

Autorzy: H. Sartaj, S. Ali, P. Arcaini, A. Arcuri.
Opublikowane w: 2026
Wydawca: Arxiv

Conference proceedings (17)

Widening The Adoption of Web API Fuzzing: Docker, GitHub Action and Python Support for EvoMaster

Autorzy: Andrea Arcuri, Philip Garrett, Juan Pablo Galeotti, Man Zhang
Opublikowane w: Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, 2025, Strona(/y) 1084-1088
Wydawca: ACM
DOI: 10.1145/3696630.3728586

Human-Centered Evaluation of REST API Fuzzing Tools: Bridging Academia and Industry

Autorzy: Fanny Febriani Susilo
Opublikowane w: 2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2026, Strona(/y) 4137-4140
Wydawca: IEEE
DOI: 10.1109/ase63991.2025.00395

Detecting Server-Side Request Forgery (SSRF) Vulnerabilities In REST API Fuzz Testing

Autorzy: Susruthan Seran, Guru Bhandari, Andrea Arcuri
Opublikowane w: Proceedings of the 19th ACM/IEEE International Workshop on Search-Based and Fuzz Testing, 2026, Strona(/y) 23-30
Wydawca: ACM
DOI: 10.1145/3786155.3788581

EMB: A Curated Corpus of Web/Enterprise Applications And Library Support for Software Testing Research

Autorzy: Andrea Arcuri; Man Zhang; Amid Golmohammadi; Asma Belhadi; Juan P. Galeotti; Bogdan Marculescu; Susrutha Seran
Opublikowane w: ICST, 2023
Wydawca: ieee
DOI: 10.1109/icst57152.2023.00047

Seeding and Mocking in White-Box Fuzzing Enterprise RPC APIs: An Industrial Case Study

Autorzy: Man Zhang, Andrea Arcuri, Piyun Teng, Kaiming Xue, Wenhao Wang
Opublikowane w: Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, 2025, Strona(/y) 2024-2034
Wydawca: ACM
DOI: 10.1145/3691620.3695265

Search-Based Security Testing of Enterprise Microservices

Autorzy: Susruthan Seran
Opublikowane w: 2024 IEEE Conference on Software Testing, Verification and Validation (ICST), 2024, Strona(/y) 463-465
Wydawca: IEEE
DOI: 10.1109/icst60714.2024.00056

Search-Based Fuzzing For RESTful APIs That Use MongoDB

Autorzy: Hernan Ghianni, Man Zhang, Juan P. Galeotti, Andrea Arcuri
Opublikowane w: Proceedings of the 7th ACM/IEEE International Conference on Automation of Software Test, 2026, Strona(/y) 111-122
Wydawca: ACM
DOI: 10.1145/3793654.3793747

Evolutionary-based automated testing for GraphQL APIs

Autorzy: Asma Belhadi,Man Zhang,Andrea Arcuri
Opublikowane w: GECCO, 2022
Wydawca: ACM
DOI: 10.1145/3520304.3528952

An Empirical Evaluation of Search-Based Algorithms for White-Box Testing of REST APIs

Autorzy: F. Castagna, M. T. Shalmani, A. Golmohammadi, J. P. Galeotti, and A. Arcuri
Opublikowane w: 2026
Wydawca: International Colloquium on Theoretical Aspects of Computing (ICTAC)

Introducing Black-Box Fuzz Testing for REST APIs in Industry: Challenges and Solutions

Autorzy: Andrea Arcuri, Alexander Poth, Olsi Rrjolli
Opublikowane w: 2025 IEEE Conference on Software Testing, Verification and Validation (ICST), 2025, Strona(/y) 382-393
Wydawca: IEEE
DOI: 10.1109/icst62969.2025.10988923

Enhancing White-Box Search-Based Testing of RESTful APIs

Autorzy: Amid Golmohammadi
Opublikowane w: 2023 IEEE 34th International Symposium on Software Reliability Engineering Workshops (ISSREW), 2024, Strona(/y) 9-12
Wydawca: IEEE
DOI: 10.1109/issrew60843.2023.00034

JavaScript Instrumentation for Search-Based Software Testing: A Study with RESTful APIs

Autorzy: Man Zhang; Asma Belhadi; Andrea Arcuri
Opublikowane w: ICST, 2022
Wydawca: IEEE
DOI: 10.1109/icst53961.2022.00022

Multi-Phase Taint Analysis for JSON Inference in Search-Based Fuzzing

Autorzy: Susruthan Seran, Onur Duman, Andrea Arcuri
Opublikowane w: 2025 IEEE/ACM International Workshop on Search-Based and Fuzz Testing (SBFT), 2026, Strona(/y) 35-42
Wydawca: IEEE
DOI: 10.1109/sbft66712.2025.00015

Fuzzing for Detecting Access Policy Violations in REST APIs

Autorzy: Andrea Arcuri, Omur Sahin, Man Zhang
Opublikowane w: 2025 IEEE 36th International Symposium on Software Reliability Engineering (ISSRE), 2026, Strona(/y) 130-141
Wydawca: IEEE
DOI: 10.1109/issre66568.2025.00025

EvoMaster at REST League 2026 Tool Competition

Autorzy: Andrea Arcuri, Man Zhang, Susruthan Seran, Juan P. Galeotti, Amid Golmohammadi, Philip Garrett, Omur Sahin, Mohsen Taheri Shalmani, Franco Castagna, Iva Kertusha, Fanny Febriani Susilo, Guru Prasad Bhandari, Gebremariam Assres, Jefferson Seide Molléri
Opublikowane w: Proceedings of the 19th ACM/IEEE International Workshop on Search-Based and Fuzz Testing, 2026, Strona(/y) 52-53
Wydawca: ACM
DOI: 10.1145/3786155.3795705

Search-Based White-Box Fuzzing of Web Frontend Applications

Autorzy: Iva Kertusha
Opublikowane w: 2024 IEEE 35th International Symposium on Software Reliability Engineering Workshops (ISSREW), 2024, Strona(/y) 95-98
Wydawca: IEEE
DOI: 10.1109/issrew63542.2024.00054

Online Machine Learning Prediction of Failed  Calls to Enhance REST API Fuzzing

Autorzy: M. T. Shalmani, A. Golmohammadi, J. P. Galeotti, A. Arcuri.
Opublikowane w: 2026
Wydawca: International Conference on the Quality of Information and Communications Technology (QUATIC).

Book chapters (2)

Search-Based Mock Generation of External Web Service Interactions

Autorzy: Susruthan Seran, Man Zhang, Andrea Arcuri
Opublikowane w: Lecture Notes in Computer Science, Search-Based Software Engineering, 2023, Strona(/y) 52-66
Wydawca: Springer Nature Switzerland
DOI: 10.1007/978-3-031-48796-5_4

On the Impact of Tool Evolution and Case Study Size on SBSE Experiments: A Replicated Study with EvoMaster

Autorzy: Amid Golmohammadi, Man Zhang, Andrea Arcuri
Opublikowane w: Lecture Notes in Computer Science, Search-Based Software Engineering, 2023, Strona(/y) 108-122
Wydawca: Springer Nature Switzerland
DOI: 10.1007/978-3-031-48796-5_8