Automatic generation of model based tests for a class of security properties

Masson, Pierre-Alain; Julliand, Jacques; Plessis, Jean-Chritophe; Jaffuel, Eddie; Debois, Georges

doi:10.1145/1291535.1291537

Cited by 8 publications

(1 citation statement)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Also, as a difference with the above cited approaches, we have showed in a previous work [8] how the test purposes can be automatically computed, by modelling the test needs as syntactic transformation rules that transform regular expressions. The tool Tobias [7], that unfolds in a combinatorial way tests expressed as regular expressions, could be used to unfold our test patterns.…”

Section: Resultsmentioning

confidence: 99%

Generating security tests in addition to functional tests

Julliand

Masson

Tissot

2008

Proceedings of the 3rd International Workshop on Automation of Software Test

Self Cite

View full text Add to dashboard Cite

This paper is about generating security tests, in addition to functional tests previously generated by a model-based testing approach. The method that we present re-uses the functional model and the adaptation layer developed for the functional testing, and relies on an additional security model. We propose to compute the tests by using some test purposes as guides for the tests to be extracted from the models. We see a test purpose as the combination of a security property and a test need issued from the know-how of a security engineer. We propose a language based on regular expressions for the expression of such test purposes. We illustrate our approach with experiments on IAS.

show abstract

Section: Resultsmentioning

confidence: 99%

Generating security tests in addition to functional tests

Julliand

Masson

Tissot

2008

Proceedings of the 3rd International Workshop on Automation of Software Test

Self Cite

View full text Add to dashboard Cite

show abstract

Scenario‐based testing using symbolic animation of B models

Dadeau

Castillos

Tissot

2012

Software Testing Verif & Rel

View full text Add to dashboard Cite

SUMMARY This article presents a model‐based test generation technique, from user‐defined scenarios, for behavioral models expressed as B machines. Scenarios are expressed using a customized formalism, based on regular expressions, that makes it possible to describe sequences of operation calls possibly reaching specific states of the system. A symbolic animation engine, simulating the execution of a model using constraint logic programming, is then exploited to play the unfolded scenarios on the model and to instantiate the test cases, providing the expected results used to establish the conformance verdict. This approach is tool supported by a research prototype and has been successfully applied in an industrial context of a smart card applet. This tool is extended by a scenario generator, which automatically generates testing strategies for exercising user‐defined properties, written using specific patterns. Copyright © 2012 John Wiley & Sons, Ltd.

show abstract

Model-based security testing: a taxonomy and systematic classification

Felderer

Zech

Breu

et al. 2015

Softw. Test. Verif. Reliab.

View full text Add to dashboard Cite

Model-based security testing relies on models to test whether a software system meets its security requirements. It is an active research field of high relevance for industrial applications, with many approaches and notable results published in recent years. This article provides a taxonomy for model-based security testing approaches. It comprises filter criteria (i.e. model of system security, security model of the environment and explicit test selection criteria) as well as evidence criteria (i.e. maturity of evaluated system, evidence measures and evidence level). The taxonomy is based on a comprehensive analysis of existing classification schemes for model-based testing and security testing. To demonstrate its adequacy, 119 publications on model-based security testing are systematically extracted from the five most relevant digital libraries by three researchers and classified according to the defined filter and evidence criteria. On the basis of the classified publications, the article provides an overview of the state of the art in model-based security testing and discusses promising research directions with regard to security properties, coverage criteria and the feasibility and return on investment of model-based security testing. 120 M. FELDERER ET AL. 9126 [4] defining security as a functional quality characteristic. However, it seems desirable that security testing directly targets the previous security properties, as opposed to taking the detour of functional tests of security mechanisms. This view is supported by the ISO/IEC 25010 [2] standard that revises ISO/IEC 9126 and introduces security as a new quality characteristic that is not included in the characteristic functionality any more.Because the former kind of (non-functional) security properties describes all executions of a system, this kind of security testing is intrinsically hard. Because testing cannot show the absence of faults, an immediately useful perspective directly considers the violation of these properties. This has resulted in the development of specific testing techniques such as penetration testing that simulates attacks to exploit vulnerabilities. Penetration tests are difficult to craft because tests often do not directly cause observable security exploits, and because the testers must think like an attacker [5], which requires specific expertise. During penetration testing, testers build a mental model of security properties, security mechanisms and possible attacks against the system and its environment. It seems intuitive that security testing can benefit from specifying these security test models in an explicit and processable way. Security test models provide guidance for the systematic and effective specification and documentation of security test objectives and security test cases, as well as for their automated generation and evaluation.The variant of testing that relies on explicit models that encode information on the system under test and/or its environment is called model-based testing (MBT) [6,7]. Especially in ...

show abstract

Automatic generation of model based tests for a class of security properties

Cited by 8 publications

References 21 publications

Generating security tests in addition to functional tests

Generating security tests in addition to functional tests

Scenario‐based testing using symbolic animation of B models

Model-based security testing: a taxonomy and systematic classification

Contact Info

Product

Resources

About