GUI-Based Testing of Boundary Overflow Vulnerability

Tuğlular, Tuğkan; Müftüoğlu, Can Arda; Kaya, O.; Belli, Fevzi; Linschulte, Michael

doi:10.1109/compsac.2009.189

Cited by 4 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The tools sqlmap and Wapiti did not detect the vulnerability, although according to the previously mentioned security test tool evaluation 7 both tools found all SQL injection vulnerabilities. Our presented approach did, however, find it.…”

Section: A Security Test Tool Benchmarkmentioning

confidence: 99%

See 1 more Smart Citation

Generic Approach for Security Error Detection Based on Learned System Behavior Models for Automated Security Tests

Schanes

Hubler

Fankhauser

et al. 2013

2013 IEEE Sixth International Conference on Software Testing, Verification and Validation Workshops

View full text Add to dashboard Cite

Abstract-The increasing complexity of software and IT systems creates the necessity for research on technologies addressing current key security challenges. To meet security requirements in IT infrastructures, a security engineering process has to be established. One crucial factor contributing to a higher level of security is the reliable detection of security vulnerabilities during security tests. In the presented approach, we observe the behavior of the system under test and introduce machine learning methods based on derived behavior metrics. This is a generic method for different test targets which improves the accuracy of the security test result of an automated security testing approach. Reliable automated determination of security failures in security test results increases the security quality of the tested software and avoids costly manual validation.

show abstract

Section: A Security Test Tool Benchmarkmentioning

confidence: 99%

“…Various possible behavior aspects can be monitored for such security tests to automatically detect security errors. Monitoring the Graphical User Interface (GUI) is shown by Tuglular et al [7]. Antunes and Vieira [8] presented an approach for monitoring the SUT during penetration tests to detect injection vulnerabilities.…”

Section: Related Workmentioning

confidence: 99%

Generic Approach for Security Error Detection Based on Learned System Behavior Models for Automated Security Tests

Schanes

Hubler

Fankhauser

et al. 2013

2013 IEEE Sixth International Conference on Software Testing, Verification and Validation Workshops

View full text Add to dashboard Cite

show abstract

“…Equivalence class partitioning and boundary value approaches support the test case generation process [1,2]. This paper is an extension of our preliminary work [26], where we introduced algorithms for detection and correction of boundary overflow vulnerabilities through static analysis. The novelty of the present paper stems from following:…”

Section: Introductionmentioning

confidence: 99%

Event-Based Input Validation Using Design-by-Contract Patterns

Tuğlular

Müftüoğlu

Belli

et al. 2009

2009 20th International Symposium on Software Reliability Engineering

Self Cite

View full text Add to dashboard Cite

This paper proposes an approach for validation of numerical inputs based on graphical user interfaces (GUI) that are modeled and specified by event sequence graphs (ESG). For considering complex structures of input data, ESGs are augmented by decision tables and patterns of design by contract (DbC IntroductionInput validation testing chooses test data that attempt to show the presence or absence of specific faults pertaining to input tolerance [16]. This paper focuses on numerical input validation testing of graphical user interfaces (GUI). Our approach for input validation suggests to specify user interface requirements and to convert this specification into a model from which valid and invalid test cases can be generated [3]. For specification of user-system interactions we choose an event-based formal model, where the inputs and events are merged and assigned to the vertices of an event transition diagram, called event sequence graph (ESG); arcs visualize the sequence relation of the events. An ESG is a simple albeit powerful formalism for capturing the behavior of interactive systems. However, modeling complex boundary restrictions on input data as well as dependencies among them inflates the ESG model of a system under consideration (SUC). To overcome this problem, we refine the nodes of the underlying ESG by decision tables, which visualize Boolean algebraic constraints on input data [4]. Decision table augmented ESG is supplemented with design by contract (DbC) patterns so that decision table rules for numerical input validation are refined to pre-condition rules. Based on these concepts, test data are generated. Equivalence class partitioning and boundary value approaches support the test case generation process [1,2]. This paper is an extension of our preliminary work [26], where we introduced algorithms for detection and correction of boundary overflow vulnerabilities through static analysis. The novelty of the present paper stems from following:(i) Theoretical background is extended by incorporating ESGs.(ii) Concept of DbC patterns have also been formalized. Especially pre-condition pattern of DbC plays an important role in refining decision tables for input validation. The formalism we introduce in Section 3.3 enables to considerably improve test case generation algorithm.(iii) The tool we introduced in our preliminary work is improved. Our tool now adds an exception handling mechanism, which we built on DbC concept, instead of a simple if statement wherever necessary.(iv) For validation of the approach we tested three open source port scanners, developed in C++, in a local 20th International Symposium on Software Reliability Engineering 978-0-7695-3878-5/09 $26.00

show abstract

“…When the structure of a GUI is modified, test cases from the original GUI's suite are either reusable or unusable on the modified GUI. We developed algorithms to (1) automatically determine the usable and unusable test cases from a test suite after a GUI modification, (2) determine the unusable test cases that can be repaired so that they can execute on the modified GUI, and (3) use repairing transformations to repair the test cases. The challenges of repairing sequences were fewer in the context of regression testing because we used the differences between the two versions' EFGs to drive the repairs.…”

Section: A Gui Testingmentioning

confidence: 99%

“…Black-box testing of programs with Graphical User Interfaces (or GUIs) can be achieved by executing sequences of events based on a model of the GUI [1], [2]. Test cases define sequences of behavior; i.e., these are subsets of the specifications of behavior for the program.…”

Section: Introductionmentioning

confidence: 99%

Repairing GUI Test Suites Using a Genetic Algorithm

Huang

Cohen

Memon

2010

2010 Third International Conference on Software Testing, Verification and Validation

View full text Add to dashboard Cite

Abstract-Recent advances in automated functional testing of Graphical User Interfaces (GUIs) rely on deriving graph models that approximate all possible sequences of events that may be executed on the GUI, and then use the graphs to generate test cases (event sequences) that achieve a specified coverage goal. However, because these models are only approximations of the actual event flows, the generated test cases may suffer from problems of infeasibility, i.e., some events may not be available for execution causing the test case to terminate prematurely. In this paper we develop a method to automatically repair GUI test suites, generating new test cases that are feasible. We use a genetic algorithm to evolve new test cases that increase our test suite's coverage while avoiding infeasible sequences. We experiment with this algorithm on a set of synthetic programs containing different types of constraints and for test sequences of varying lengths. Our results suggest that we can generate new test cases to cover most of the feasible coverage and that the genetic algorithm outperforms a random algorithm trying to achieve the same goal in almost all cases.

show abstract

GUI-Based Testing of Boundary Overflow Vulnerability

Cited by 4 publications

References 10 publications

Generic Approach for Security Error Detection Based on Learned System Behavior Models for Automated Security Tests

Generic Approach for Security Error Detection Based on Learned System Behavior Models for Automated Security Tests

Event-Based Input Validation Using Design-by-Contract Patterns

Repairing GUI Test Suites Using a Genetic Algorithm

Contact Info

Product

Resources

About