Similarity testing for role-based access control systems

Abstract

Context: Access control systems demand rigorous verification and validation approaches, otherwise, they can end up with security breaches. Finite state machines based testing has been successfully applied to RBAC systems and enabled to obtain effective test cases, but very expensive. To deal with the cost of these test suites, test prioritization techniques can be applied to improve fault detection along test execution. Recent studies have shown that similarity functions can be very efficient at prioritizing test cases. This technique is named similarity testing and assumes the hypothesis that resembling test cases tend to have similar fault detection capabilities. Thus, there is no gain from similar test cases, and fault detection ratio can be improved if test diversity increases. Objective: In this paper, we propose a similarity testing approach for RBAC systems named RBAC similarity and compare to simple dissimilarity and random prioritization. RBAC similarity combines the dissimilarity degree of pairs of test cases with their relevance to the RBAC policy under test to maximize test diversity and the coverage of its constraints. Method: Five RBAC policies and fifteen test suites were prioritized using each of the three test prioritization techniques and compared using the Average Percentage Faults Detected metric. Results: Our results showed that the combination of the dissimilarity degree to the relevance of a test case to RBAC policies in the RBAC similarity can be more effective than random prioritization and simple dissimilarity, by itself, in most of the cases. Conclusion: The RBAC similarity criterion is suitable as a test prioritization criteria for test suites generated from finite state machine models specifying RBAC systems.

Learning by sampling: learning behavioral family models from software product lines

“…Studies in software testing have shown that similar test cases tend to have equivalent fault detection capabilities, and no additional gain should be expected when these are simultaneously executed [27]. To mitigate these issues, similarity metrics have been used as test prioritization criteria [137,27] for access control systems [23,40] and SPLs [61,4].…”

“…For every missing transition, we added a self-loop transitions returning 0. This process was hand-crafted by the first author of this paper, who has former experience in modeling software systems for model-based testing [39,40] and automata learning [41]. Moreover, this process was partially automated using Bash and Python scripts that are included in our lab package.…”