{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T21:10:00Z","timestamp":1782940200720,"version":"3.54.5"},"reference-count":59,"publisher":"Association for Computing Machinery (ACM)","issue":"2","funder":[{"name":"European Research Council","award":["864972"],"award-info":[{"award-number":["864972"]}]},{"name":"State Key Laboratory of Complex and Critical Software Environment","award":["CCSE-2024ZX-01"],"award-info":[{"award-number":["CCSE-2024ZX-01"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2026,2,28]]},"abstract":"<jats:p>\n                    Testing large and complex enterprise software systems can be a challenging task. This is especially the case when the functionality of the system depends on interactions with other external services over a network (e.g., external web services accessed through REST API calls). Although several techniques in the research literature have been shown to be effective at generating test cases in a good number of different software testing contexts, dealing with external services is still a major research challenge. In industry, a common approach is to\n                    <jats:italic toggle=\"yes\">mock<\/jats:italic>\n                    external web services for testing purposes. However, generating and configuring\n                    <jats:italic toggle=\"yes\">mock<\/jats:italic>\n                    web services can be a very time-consuming task, e.g., external services may not be under the control of the same developers of the tested application, making it challenging to identify the external services and simulate various possible responses.\n                  <\/jats:p>\n                  <jats:p>\n                    In this article, we present a novel search-based approach aimed at\n                    <jats:italic toggle=\"yes\">fully automated<\/jats:italic>\n                    mocking of external web services as part of white-box, search-based fuzzing. We rely on code instrumentation to detect all interactions with external services, and how their response data is parsed. We then use such information to enhance a search-based approach for fuzzing. The tested application is automatically modified (by manipulating DNS lookups) to rather interact with instances of mock web servers. The search process not only generates inputs to the tested applications but also automatically configures responses in those mock web server instances, aiming at maximizing code coverage and fault-finding. An empirical study on four open source REST APIs from EMB, and one industrial API from an industry partner, shows the effectiveness of our novel techniques (i.e., in terms of line coverage and fault detection).\n                  <\/jats:p>","DOI":"10.1145\/3731558","type":"journal-article","created":{"date-parts":[[2025,4,23]],"date-time":"2025-04-23T10:35:11Z","timestamp":1745404511000},"page":"1-45","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Handling Web Service Interactions in Fuzzing with Search-Based Mock-Generation"],"prefix":"10.1145","volume":"35","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1800-060X","authenticated-orcid":false,"given":"Susruthan","family":"Seran","sequence":"first","affiliation":[{"name":"Kristiania University of Applied Sciences, Oslo, Norway"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1204-9322","authenticated-orcid":false,"given":"Man","family":"Zhang","sequence":"additional","affiliation":[{"name":"Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2489-8981","authenticated-orcid":false,"given":"Onur","family":"Duman","sequence":"additional","affiliation":[{"name":"Glasgow Caledonian University, Glasgow, United Kingdom of Great Britain and Northern Ireland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0799-2930","authenticated-orcid":false,"given":"Andrea","family":"Arcuri","sequence":"additional","affiliation":[{"name":"Kristiania University of Applied Sciences, Oslo, Norway and Oslo Metropolitan University, Oslo, Norway"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,1,21]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"[n.d.]. AFL. Retrieved from https:\/\/github.com\/google\/AFL"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9570-9"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2018.05.003"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/3293455"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2020.3013820"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1002\/stvr.1486"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/2642937.2642986"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/2786805.2786828"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2017.19"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3391533"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/3477271"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.21105\/joss.02153"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11219-023-09620-w"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3652157"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICST57152.2023.00047"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-024-00478-1"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3691620.3695511"},{"key":"e_1_3_2_19_2","unstructured":"DNS Cache Manipulator. [n.d.] DNS Cache Manipulator. Retrieved from https:\/\/github.com\/alibaba\/java-dns-cache-manipulator"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59762-7_8"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/2025113.2025179"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3363824"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/2093548.2093564"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11219-023-09645-1"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1145\/3617175"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409679"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2004.1265732"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/AST.2017.2"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00218"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534401"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510457.3513029"},{"key":"e_1_3_2_32_2","first-page":"287","volume-title":"Extreme Programming Examined","author":"Mackinnon Tim","year":"2000","unstructured":"Tim Mackinnon, Steve Freeman, and Philip Craig. 2000. Endo-testing: unit testing with mock objects. Extreme Programming Examined (2000), 287\u2013301."},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/DICTAP.2012.6215346"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2946563"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3491038"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1109\/IWAST.2009.5069054"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE52982.2021.00034"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3473932"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/QSIC.2014.19"},{"key":"e_1_3_2_41_2","first-page":"360","article-title":"An analysis of public REST web service APIs","author":"Neumann Andy","year":"2018","unstructured":"Andy Neumann, Nuno Laranjeiro, and Jorge Bernardino. 2018. An analysis of public REST web service APIs. IEEE Transactions on Services Computing (2018), 360\u2013465.","journal-title":"IEEE Transactions on Services Computing"},{"key":"e_1_3_2_42_2","volume-title":"Building Microservices","author":"Newman Sam","year":"2021","unstructured":"Sam Newman. 2021. Building Microservices. O\u2019Reilly Media, Inc."},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/3324884.3418930"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/3476105"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICST46399.2020.00062"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-38791-8_2"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2021.107246"},{"key":"e_1_3_2_48_2","volume-title":"Proceedings of the International Symposium on Search Based Software Engineering (SSBSE)","author":"Seran Susruthan","year":"2023","unstructured":"Susruthan Seran, Man Zhang, and Andrea Arcuri. 2023. Search-based mock generation of external web service interactions. In Proceedings of the International Symposium on Search Based Software Engineering (SSBSE). Springer, 52\u201366."},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2017.61"},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE51524.2021.9678586"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2002.1003449"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/SBFT59156.2023.00026"},{"key":"e_1_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/3464940"},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597205"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.1145\/3585009"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1145\/3593801"},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-020-09937-1"},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-022-00120-1"},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.1145\/3512345"},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCOM.1980.1094702"}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3731558","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,21]],"date-time":"2026-01-21T16:32:13Z","timestamp":1769013133000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3731558"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,21]]},"references-count":59,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2026,2,28]]}},"alternative-id":["10.1145\/3731558"],"URL":"https:\/\/doi.org\/10.1145\/3731558","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,21]]},"assertion":[{"value":"2024-10-02","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-04-07","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-01-21","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}