Search

Automatically crafting test scenarios for REST APIs helps deliver more reliable and trustworthy web-oriented systems. However, current black-box testing approaches rely heavily on the information available in the API's formal documentation, i.e., the OpenAPI Specification (OAS for short). While useful, the OAS mostly covers syntactic aspects of the API (e.g., producer-consumer relations between operations, input value properties, and additional constraints in natural language), and it lacks a deeper understanding of the API business logic. Missing semantics include implicit ordering (logic dependency) between operations and implicit input-value constraints. These limitations hinder the ability of black-box testing tools to generate truly effective test cases automatically. This paper introduces DeepREST, a novel black-box approach for automatically testing REST APIs. It leverages deep reinforcement learning to uncover implicit API constraints, that is, constraints hidden from API documentation. Curiosity-driven learning guides an agent in the exploration of the API and learns an effective order to test its operations. This helps identify which operations to test first to take the API in a testable state and avoid failing API interactions later. At the same time, experience gained on successful API interactions is leveraged to drive accurate input data generation (i.e., what parameters to use and how to pick their values). Additionally, DeepREST alternates exploration with exploitation by mutating successful API interactions to improve test coverage and collect further experience. Our empirical validation suggests that the proposed approach is very effective in achieving high test coverage and fault detection and superior to a state-of-the-art baseline.

The emergence of 6G-enabled Internet of Vehicles (IoV) promises to revolutionize mobility and connectivity, integrating vehicles into a mobile Internet-of-Things (IoT)-oriented wireless sensor network (WSN). 5G technologies and mobile edge computing further support this vision by facilitating real-time connectivity and empowering massive access to the Internet. In this context, IoT-oriented WSNs play a crucial role in intelligent transportation systems, offering affordable alternatives for traffic monitoring and management. This paper's contribution is twofold: (i) surveying state-of-the-art model-based techniques for efficient sensor selection in traffic flow monitoring, emphasizing challenges of sensor placement; and (ii) advocating for data-driven methodologies to enhance sensor deployment efficacy and traffic modeling accuracy. Further considerations underscore the importance of data-driven approaches for adaptive transportation systems aligned with the IoV paradigm., Comment: 5 pages, 0 figures, submitted to the EuCNC & 6G Summit, Antwerp, Belgium, 3-6 June, 2024

In the contemporary security landscape, the incorporation of photonics has emerged as a transformative force, unlocking a spectrum of possibilities to enhance the resilience and effectiveness of security primitives. This integration represents more than a mere technological augmentation; it signifies a paradigm shift towards innovative approaches capable of delivering security primitives with key properties for low-power systems. This not only augments the robustness of security frameworks, but also paves the way for novel strategies that adapt to the evolving challenges of the digital age. This paper discusses the security layers and related services that will be developed, modeled, and evaluated within the Horizon Europe NEUROPULS project. These layers will exploit novel implementations for security primitives based on physical unclonable functions (PUFs) using integrated photonics technology. Their objective is to provide a series of services to support the secure operation of a neuromorphic photonic accelerator for edge computing applications., Comment: 6 pages, 4 figures

This study looked into how effective a Musical Brain-Computer Interface (MBCI) can be in providing feedback about synchrony between two people. Using a double EEG setup, we compared two types of musical feedback; one that adapted in real-time based on the inter-brain synchrony between participants (Neuroadaptive condition), and another music that was randomly generated (Random condition). We evaluated how these two conditions were perceived by 8 dyads (n = 16) and whether the generated music could influence the perceived connection and EEG synchrony between them. The findings indicated that Neuroadaptive musical feedback could potentially boost synchrony levels between people compared to Random feedback, as seen by a significant increase in EEG phase-locking values. Additionally, the real-time measurement of synchrony was successfully validated and musical neurofeedback was generally well-received by the participants. However, more research is needed for conclusive results due to the small sample size. This study is a stepping stone towards creating music that can audibly reflect the level of synchrony between individuals., Comment: 6 pages, 4 figures

This special session paper introduces the Horizon Europe NEUROPULS project, which targets the development of secure and energy-efficient RISC-V interfaced neuromorphic accelerators using augmented silicon photonics technology. Our approach aims to develop an augmented silicon photonics platform, an FPGA-powered RISC-V-connected computing platform, and a complete simulation platform to demonstrate the neuromorphic accelerator capabilities. In particular, their main advantages and limitations will be addressed concerning the underpinning technology for each platform. Then, we will discuss three targeted use cases for edge-computing applications: Global National Satellite System (GNSS) anti-jamming, autonomous driving, and anomaly detection in edge devices. Finally, we will address the reliability and security aspects of the stand-alone accelerator implementation and the project use cases., Comment: 10 pages, 2 figures, conference

Mass assignment is one of the most prominent vulnerabilities in RESTful APIs. This vulnerability originates from a misconfiguration in common web frameworks, such that naming convention and automatic binding can be exploited by an attacker to craft malicious requests writing confidential resources and (massively) overriding data, that should be read-only and/or confidential. In this paper, we adopt a black-box testing perspective to automatically detect mass assignment vulnerabilities in RESTful APIs. Execution scenarios are generated purely based on the OpenAPI specification, that lists the available operations and their message format. Clustering is used to group similar operations and reveal read-only fields, the latter are candidate for mass assignment. Then, interaction sequences are automatically generated by instantiating abstract testing templates, trying to exploit the potential vulnerabilities. Finally, test cases are run, and their execution is assessed by a specific oracle, in order to reveal whether the vulnerability could be successfully exploited. The proposed novel approach has been implemented and evaluated on a set of case studies written in different programming languages. The evaluation highlights that the approach is quite effective in detecting seeded vulnerabilities, with a remarkably high accuracy., Comment: To be published in the proceedings of the 45th IEEE/ACM International Conference on Software Engineering (ICSE 2023)