DTester: Diversity-Driven Test Case Generation for Web Applications

被引:1
作者
Wu, Shumei [1 ]
Chang, Zexing [1 ]
Zhang, Zhanwen [1 ]
Li, Zheng [1 ]
Liu, Yong [1 ]
机构
[1] Beijing Univ Chem Technol, Coll Informat Sci & Technol, Beijing 100000, Peoples R China
基金
中国国家自然科学基金;
关键词
Web application; test case generation; genetic algorithm optimization; diversity metric; vulnerable path; VULNERABILITIES;
D O I
10.1142/S0218194023500559
中图分类号
TP18 [人工智能理论];
学科分类号
081104 ; 0812 ; 0835 ; 1405 ;
摘要
Search-based Test Case Generation (TCG) for web applications suffers from unstable performance and suboptimal test suite problems due to diversity loss. However, previous diversity metrics mainly only focus on client-side models or server-side code, which are prone to low robustness and poor generalization in practical applications. We propose a diversity-driven TCG method DTester, which can maximize behavior exploration and minimize the test suite size while covering more server-side vulnerable paths. Three diversity metrics (i.e. phenotypic coupling, intent coupling and competitiveness) are proposed to measure the underlying relationship between test cases from user behavior, code logic and test execution history. Moreover, a 3-dimensional weight graph is designed to model association among metrics, which provides fine-grained guidance for the genetic algorithm to generate diverse test cases from the client-side behavior model. Our empirical evaluation on five web applications shows that DTester can efficiently and robustly generate better test suites than the state-of-the-art TCG method. The maximum improvement is 85%, 60%, 716% and 88% in efficiency, test suite size, diversity and robustness.
引用
收藏
页码:357 / 390
页数:34
相关论文
共 52 条
[21]   An automated model-based approach to repair test suites of evolving web applications [J].
Imtiaz, Javaria ;
Iqbal, Muhammad Zohaib ;
Khan, Muhammad Uzair .
JOURNAL OF SYSTEMS AND SOFTWARE, 2021, 171
[22]  
Jan S, 2019, EMPIR SOFTW ENG, V24, P3696, DOI 10.1007/s10664-019-09707-8
[23]   Automatic Generation of Tests to Exploit XML Injection Vulnerabilities in Web Applications [J].
Jan, Sadeeq ;
Panichella, Annibale ;
Arcuri, Andrea ;
Briand, Lionel .
IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 2019, 45 (04) :335-362
[24]   A Search-based Testing Approach for XML Injection Vulnerabilities in Web Applications [J].
Jan, Sadeeq ;
Nguyen, Cu D. ;
Arcuri, Andrea ;
Briand, Lionel .
2017 10TH IEEE INTERNATIONAL CONFERENCE ON SOFTWARE TESTING, VERIFICATION AND VALIDATION (ICST), 2017, :356-366
[25]   An integrated search-based approach for automatic testing from extended finite state machine (EFSM) models [J].
Kalaji, Abdul Salam ;
Hierons, Robert Mark ;
Swift, Stephen .
INFORMATION AND SOFTWARE TECHNOLOGY, 2011, 53 (12) :1297-1318
[26]  
LEVENSHT.VI, 1965, DOKL AKAD NAUK SSSR+, V163, P845
[27]  
Liu J., 24 AS PAC SOFTW ENG, P683
[28]   Adaptive Random Testing for XSS Vulnerability [J].
Lv, Chengcheng ;
Zhang, Long ;
Zeng, Fanping ;
Zhang, Jian .
2019 26TH ASIA-PACIFIC SOFTWARE ENGINEERING CONFERENCE (APSEC), 2019, :63-69
[29]  
Marchetto Alessandro, 2008, 2008 First IEEE International Conference on Software Testing, Verification and Validation (ICST '08), P121, DOI 10.1109/ICST.2008.22
[30]   Detecting and Removing Web Application Vulnerabilities with Static Analysis and Data Mining [J].
Medeiros, Iberia ;
Neves, Nuno ;
Correia, Miguel .
IEEE TRANSACTIONS ON RELIABILITY, 2016, 65 (01) :54-69