Determining Effective Runtime Budgets for REST API Fuzzing

Develop adaptive and principled stopping criteria or guidelines for selecting the duration of REST API fuzzing runs with EvoMaster and similar tools, balancing result quality and resource usage.

Background

Selecting how long to run a fuzzer is a key practical decision in large-scale industrial settings where resources must be managed efficiently.

The authors explicitly state that they have no answer to how long a fuzzer should be run (seconds, minutes, or hours), indicating the lack of established guidance for runtime budgeting.

References

One of the first questions when using a fuzzer is for how long to run it. Should it be for just 30 seconds? 1 hour? or 48 hours? We have no answer for this.

— Fuzzing REST APIs in Industry: Necessary Features and Open Problems  (2604.01759 - Arcuri et al., 2 Apr 2026) in Section RQ2: Implemented Features, Subsection “Computational Resources”