DualMine：静态-动态REST API约束发现与双重验证
DualMine: Static-Dynamic REST API Constraint Discovery with Dual Validation
浏览论文内容
中文总结 AI 辅助
DualMine提出混合框架，结合静态规范挖掘与动态不变量挖掘，通过双重验证和反例引导细化，在39个真实API上提升约束质量并检测48个故障。
中文摘要 AI 辅助
REST API约束捕获API响应的语义属性，对于自动化测试预言生成至关重要，但难以可靠地发现。静态方法从API规范和文档中推断约束，但其结果可能受到不完整、模糊或过时规范的影响。动态方法从执行轨迹中挖掘不变量，但其结果依赖于执行覆盖率，并可能包含仅在观察到的执行中成立的巧合属性。本文提出了DualMine，一个用于REST API约束发现的混合框架，集成了基于规范的约束挖掘与运行时不变量挖掘。它首先使用基于LLM的静态挖掘器从OpenAPI规范中提取候选约束，并使用动态不变量挖掘从请求-响应轨迹中提取候选约束。然后执行不对称双重验证：运行时证据用于验证或反驳规范派生的约束，而规范感知的LLM推理用于过滤不合理的日志派生不变量，同时不丢弃合理的未文档化行为。最后，通过执行有针对性的API调用来解决不确定、重叠或冲突的约束，应用反例引导的细化。我们在39个真实世界的REST API上评估了DualMine，并将其与最先进的纯静态、纯动态和约束发现方法进行比较。结果表明，它通过减少不支持的约束、保留单独方法遗漏的互补约束来提高发现约束的质量，这有助于检测48个真实的REST API故障。
英文摘要
REST API constraints capture semantic properties of API responses and are essential for automated test oracle generation, but they are difficult to discover reliably. Static approaches infer constraints from API specifications and documentation, but their results may be affected by incomplete, ambiguous, or outdated specifications. Dynamic approaches mine invariants from execution traces, but their results depend on execution coverage and may include coincidental properties that hold only for the observed executions. This paper presents DualMine, a hybrid framework for REST API constraint discovery that integrates specification-based constraint mining with runtime invariant mining. It first extracts candidate constraints from OpenAPI specifications using an LLM-based static miner and from request-response traces using dynamic invariant mining. It then performs asymmetric dual validation: runtime evidence is used to validate or refute specification-derived constraints, while specification-aware LLM reasoning is used to filter implausible log-derived invariants~without discarding plausible undocumented behaviors. Finally, it applies counterexample-guided refinement by performing targeted API executions to resolve uncertain, overlapping, or conflicting constraints. We evaluate DualMine on 39 real-world REST APIs and compare it against state-of-the-art static-only, dynamic-only, and constraint discovery approaches. The results show that it improves the quality of discovered constraints by reducing unsupported constraints, retaining complementary constraints missed by individual approaches, which helps detect 48 real REST API faults.
发表机构
- University of Science, VNU-HCM（胡志明市国立大学科学大学）
- Universidad de Sevilla（塞维利亚大学）
- University of Texas at Dallas（德克萨斯大学达拉斯分校）
- Katalon LLC（Katalon有限责任公司）
机构由 AI 辅助整理，请以论文原文为准。
