SMRL: A Metamorphic Security Testing Tool for Web Systems

被引：5
|
作者：
Mai, Phu X. [1 ]
Goknil, Arda [1 ]
Pastore, Fabrizio [1 ]
Briand, Lionel C. [1 ,2 ]
机构：
[1] Univ Luxembourg, SnT, Luxembourg, Luxembourg
[2] Univ Ottawa, Ottawa, ON, Canada
来源：
2020 ACM/IEEE 42ND INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING: COMPANION PROCEEDINGS (ICSE-COMPANION 2020) | 2020年
基金：
欧洲研究理事会;
关键词：
D O I：
10.1145/3377812.3382152
中图分类号：
TP31 [计算机软件];
学科分类号：
081202 ; 0835 ;
摘要：
We present a metamorphic testing tool that alleviates the oracle problem in security testing. The tool enables engineers to specify metamorphic relations that capture security properties of Web systems. It automatically tests Web systems to detect vulnerabilities based on those relations. We provide a domain-specific language accompanied by an Eclipse editor to facilitate the specification of metamorphic relations. The tool automatically collects the input data and transforms the metamorphic relations into executable Java code in order to automatically perform security testing based on the collected data. The tool has been successfully evaluated on a commercial system and a leading open source system (Jenkins). Demo video: https://youtu.be/9kx6u9LsGxs.
引用
收藏
页码：9 / 12
页数：4
相关论文
共 50 条
  • [1] Metamorphic Security Testing for Web Systems
    Mai, Phu X.
    Pastore, Fabrizio
    Goknil, Arda
    Briand, Lionel
    2020 IEEE 13TH INTERNATIONAL CONFERENCE ON SOFTWARE TESTING, VALIDATION AND VERIFICATION (ICST 2020), 2020, : 186 - 197
  • [2] Metamorphic Testing for Web System Security
    Chaleshtari, Nazanin Bayati
    Pastore, Fabrizio
    Goknil, Arda
    Briand, Lionel C.
    IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 2023, 49 (06) : 3430 - 3471
  • [3] An Active Testing Tool for Security Testing of Distributed Systems
    Aouadi, Mohamed H. E.
    Toumi, Khalifa
    Cavalli, Ana
    PROCEEDINGS 10TH INTERNATIONAL CONFERENCE ON AVAILABILITY, RELIABILITY AND SECURITY ARES 2015, 2015, : 735 - 740
  • [4] Special section on testing and security of Web systems
    Marchetto, Alessandro
    International Journal on Software Tools for Technology Transfer, 2008, 10 (06) : 473 - 476
  • [5] Metamorphic Testing of RESTful Web APIs
    Segura, Sergio
    Parejo, Jose A.
    Troya, Javier
    Ruiz-Cortes, Antonio
    PROCEEDINGS 2018 IEEE/ACM 40TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING (ICSE), 2018, : 882 - 882
  • [6] Metamorphic Testing and Web Element Localization
    Le Traon, Yves
    Xie, Tao
    SOFTWARE TESTING VERIFICATION & RELIABILITY, 2024, 34 (07):
  • [7] Metamorphic Testing of RESTful Web APIs
    Segura, Sergio
    Parejo, Jose A.
    Troya, Javier
    Ruiz-Cortes, Antonio
    IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 2018, 44 (11) : 1083 - 1099
  • [8] METAMORPHIC TESTING ON NUCLIDE INVENTORY TOOL
    Li, Meng
    Yan, Shiyu
    Yang, Xiaohua
    Liu, Jie
    PROCEEDINGS OF THE 2020 INTERNATIONAL CONFERENCE ON NUCLEAR ENGINEERING (ICONE2020), VOL 3, 2020,
  • [9] Testing Web Enabled Simulation at Scale Using Metamorphic Testing
    Ahlgren, John
    Berezin, Maria Eugenia
    Bojarczuk, Kinga
    Dulskyte, Elena
    Dvortsova, Inna
    George, Johann
    Gucevska, Natalija
    Harman, Mark
    Lomeli, Maria
    Meijer, Erik
    Sapora, Silvia
    Spahr-Summers, Justin
    2021 IEEE/ACM 43RD INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING: SOFTWARE ENGINEERING IN PRACTICE (ICSE-SEIP 2021), 2021, : 140 - 149
  • [10] Automated security testing for web applications on industrial automation and control systems
    Pfrang, Steffen
    Borcherding, Anne
    Meier, David
    Beyerer, Juergen
    AT-AUTOMATISIERUNGSTECHNIK, 2019, 67 (05) : 383 - 401
12345