Spec2SeqFuzz: A Category Prediction-Guided Approach for Stateful Multi-Step REST API Fuzzing

REST APIs have become a dominant interface for modern web applications and cloud services, and a growing body of work has studied automated testing and reproducible error discovery for such systems. Prior approaches have explored dependency inference, cross-request value reuse, and, more recently, learning- or LLM-based test generation. However, deep stateful multi-step reproducible error discovery remains difficult in practice because sequence construction is still often performed directly in the endpoint space, reusable runtime artifacts are not always tightly coupled with sequence expansion, and online LLM-driven generation may introduce cost and instability. We present Spec2SeqFuzz, a stateful multi-step fuzzing framework for REST API systems. The central idea is to guide online exploration in a compact category space rather than directly in the full endpoint space. Spec2SeqFuzz uses LLMs only in an offline pre-processing stage to normalize public multi-step PoCs, classify OpenAPI endpoints into a transferable category taxonomy, and construct training data for next-category prediction. During online fuzzing, the framework predicts the next likely API category from the executed prefix and observed response feedback, maps the predicted categories back to concrete endpoints, and combines this guidance with black-box endpoint fuzzing, proxy-based payload collection, and snapshot-assisted state restoration. We implemented a prototype and evaluated it on GitLab and WordPress, using MINER as the primary reproduced baseline in our current study. The results show that Spec2SeqFuzz is promising for both multi-step and single-endpoint error discovery on these two targets. Following the terminology used in MINER, we report reproducible errors rather than treating every triggered failure as a confirmed security vulnerability. Across the two targets, Spec2SeqFuzz discovers more reproducible multi-step errors than MINER, while the ablation results further suggest that category guidance, payload reuse, and depth-first stateful exploration are important to the final error-discovery performance.