Graph-Driven LLM-Augmented Stateful API Fuzzing for OWASP API Top 10

Abstract

Security testing of REST APIs remains difficult because real-world OpenAPI specifications are often incomplete, many flaws are inherently stateful, and prevailing stateful fuzzers optimize for structural exploration rather than OWASP-aligned risk. This paper presents APIGFUZZ, a graph-driven, OWASP-aware black-box REST API fuzzing framework that builds an operation-level parameter-flow graph from OpenAPI specifications and lightweight semantic field classification. The graph recovers producer-consumer dependencies between operations, including low-confidence create-then-access relations when response schemas are weak, and drives deterministic generation of short stateful request sequences. On top of it, the framework applies OWASP-aligned test templates and a multi-oracle panel combining status-code anomalies, authorization and sequence invariants, schema deviations, and dedicated checks for categories invisible to 5xx-only baselines such as rate limiting and injection. Large language models are used only outside the hot loop: for offline rule inference and as an optional fallback classifier for ambiguous parameters, preserving determinism and reproducibility. On vAPI 1.3 and c{api}tal, APIGFUZZ finds 33 unique bugs on vAPI under a 30-minute budget (21 oracle-only beyond 5xx detection), covers 8 of 10 OWASP API Top-10 categories, and surfaces a rate-limiting flaw on the hardened c{api}tal backend that the baselines miss.