A formal evaluation of data flow path selection criteria

Clarke, Lori A.; Podgurski, Andy; Richardson, Debra J.; Zeil, Steven J.

doi:10.1109/32.41326

Cited by 189 publications

(106 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The ESG model of the example firewall rules is given in Figure 5. It can be seen in the figure that the node r 7 subsumes r 1 , r 6 subsumes r 2 , r 3 , r 4 and r 5 and r 8 subsumes r 6 , r 7 .…”

Section: Case Studymentioning

confidence: 99%

“…The studies based on data flow testing [7,8,10,11] have been restricted to testing data dependencies that exist within a procedure which requires information about the flow of data including calls and returns across procedure boundaries. Intra-procedural data flow tests focus on source code by building and searching program's def-use graph and determine the dependencies or definition use pairs.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Directed Acyclic Graph Modeling of Security Policies for Firewall Testing

Tuğlular

Kaya

Müftüoğlu

et al. 2009

2009 Third IEEE International Conference on Secure Software Integration and Reliability Improvement

View full text Add to dashboard Cite

IntroductionFirewalls, which act as the most important defense mechanism of network security, have to be tested to validate that they work as specified. The firewall specification is mainly composed of intended security policy and allowed network protocols, which are usually the main focus of an attacker. The intended security policy consists of firewall rules, which configure the firewall behavior, and allowed network protocols. These constitute an important part of firewall's internal infrastructure which can be described as packet capture, decision making on the packet under consideration, and packet release. Decision making operation is carried out with respect to firewall policy and network protocols. The security policy is external to the firewall like a configuration file, whereas packet checking with respect to network protocols is implemented in the firewall software.Since the firewall policy is considered as a specification and can be represented by a formal model, we propose a model-based testing approach for firewalls. The novelty of this approach is using DAG model for firewall testing. This paper proposes modeling of firewall rules and generating test cases using DAGs. Since event sequence graphs (ESG) are directed graphs, we applied its test case generation algorithm to the DAG representation of firewall rules. Then test packets derived from generated test cases are sent to the firewall to analyze its behavior.Next section summarizes related work before Section 3 outlines background and the test generation algorithm. The core of the paper, Section 4, presents our firewall testing approach. Sections 5 and 6 include implementation details of the approach and a case study on a firewall. Section 7 concludes the paper and outlines our research work planned. Related WorkA firewall controls network traffic to and from a computer, based on a security policy. Although systematic testing was an omitted area in firewall studies and relative literature, recent studies on

show abstract

Section: Case Studymentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Directed Acyclic Graph Modeling of Security Policies for Firewall Testing

Tuğlular

Kaya

Müftüoğlu

et al. 2009

2009 Third IEEE International Conference on Secure Software Integration and Reliability Improvement

View full text Add to dashboard Cite

show abstract

“…Logical relationships among coverage measures have been derived statically in the form of subsumption hierarchies [6]. The dynamic characteristics of code coverage measures which are manifested upon code execution have also been examined by some researchers.…”

Section: Introductionmentioning

confidence: 99%

The marginal value of increased testing: an empirical analysis using four code coverage measures

Gokhale¹,

Mullen²

2006

J. Braz. Comp. Soc.

View full text Add to dashboard Cite

show abstract

“…They analyze techniques based on their theoretical groundwork, studying the effectiveness of codebased [9], [10], [13], [19], [23], [24], [36], [37] Empirical studies without subjects aim to investigate techniques from the angle of practice and inductive reasoning by simulating technique application. They address different aspects of V&V techniques [27].…”

Section: Introductionmentioning

confidence: 99%

Comparing the Effectiveness of Equivalence Partitioning, Branch Testing and Code Reading by Stepwise Abstraction Applied by Subjects

Juristo

Vegas

Solari

et al. 2012

2012 IEEE Fifth International Conference on Software Testing, Verification and Validation

View full text Add to dashboard Cite

Abstract-Some verification and validation techniques have been evaluated both theoretically and empirically. Most empirical studies have been conducted without subjects, passing over any effect testers have when they apply the techniques. We have run an experiment with students to evaluate the effectiveness of three verification and validation techniques (equivalence partitioning, branch testing and code reading by stepwise abstraction). We have studied how well able the techniques are to reveal defects in three programs. We have replicated the experiment eight times at different sites. Our results show that equivalence partitioning and branch testing are equally effective and better than code reading by stepwise abstraction. The effectiveness of code reading by stepwise abstraction varies significantly from program to program. Finally, we have identified project contextual variables that should be considered when applying any verification and validation technique or to choose one particular technique.

show abstract

A formal evaluation of data flow path selection criteria

Cited by 189 publications

References 19 publications

Directed Acyclic Graph Modeling of Security Policies for Firewall Testing

Directed Acyclic Graph Modeling of Security Policies for Firewall Testing

The marginal value of increased testing: an empirical analysis using four code coverage measures

Comparing the Effectiveness of Equivalence Partitioning, Branch Testing and Code Reading by Stepwise Abstraction Applied by Subjects

Contact Info

Product

Resources

About