Search

Web APIs are integral to modern web development, enabling service integration and automation. Ensuring their performance and functionality is critical, yet performance testing is less explored due to the difficulty in detecting performance bugs. This paper presents a response time-guided genetic algorithm (GA) fuzzing approach to uncover web API performance latency in a black-box setting. Unlike traditional random input generation, our method uses GA to refine inputs through crossover and mutation, guided by response time-based fitness. We propose two seed generation methods: pairwise combinatorial testing using Mircosoft's Pairwise Independent Combinatorial Testing (PICT) and randomly paired combinations. We compared our method with classic random fuzzing. Experiments on five real-world web APIs show that our approach significantly outperforms classic random fuzzing, identifying inputs with response times 1.5 to 26.3 times longer. Additionally, PICT-generated seeds demonstrated superior performance compared to randomly-paired combinations in 2 out of 5 APIs. Our findings highlight the potential of GA-based fuzzing to reveal web API performance latency, advocating for further research in this area. [ABSTRACT FROM AUTHOR]

Software is a part of most complex systems used for different purposes in today's world. The reliability of these systems must be verified before putting them to use, because their malfunction may lead to catastrophic failure, the loss of human lives, or huge costs. Software reliability can be verified by performing black‐box testing, without knowledge of the complex internal structure of these systems. In this work, an embedded IoT alarm system for detection of intruders and potential robbery is proposed. It is composed of three subsystems: embedded IoT, web‐server, and mobile phone subsystems. Cause‐effect graphing technique was applied for generating three types of black‐box test suites, by using the forward‐propagation and two different minimization algorithms. These test suites were used for black‐box testing the system, which was performed after injecting a maximum of 12 faults into the system in 100 iterations. The resulting software quality and reliability metrics showed that the forward‐propagation algorithm always achieves maximum fault detection rate (FDR), and this algorithm should be used when the highest demand for reliability must be met. The optimized minimization should only be used in cases where testing is very expensive, because it did not find faults in all testing iterations. The basic optimization retained high FDR, while reducing the impact of the minimized test suite and achieved a significant increase of test effect coverage values. [ABSTRACT FROM AUTHOR]

The software development life cycle includes software testing as a critical step. Oracle testing is necessary to determine if a particular test case detects an error because the purpose of testing is to ensure that the application adheres to its specifications. This test leads to the consumption of time and cost and may lead to errors in which the tester falls. This research aims to present a proposed system based on the automation of the Oracle test using intelligent techniques. The model was trained using the random forest algorithm and using the convolutional neural network. This proposed system is considered one of the box techniques. Test blacks that depend on the output of the system being tested.

Researchers and domain experts usually require the help of software packages for black-box testing complex systems using cause–effect graphs. However, there are only a few available packages for this purpose with limited functionalities. The existing software tools are either commercial, not disclosed by their authors at all or use technologies that are obsolete. ETF-RI-CEG-Advanced is a graphical desktop software tool that simplifies the process of black-box testing software by using the cause–effect graphing technique. The tool improves the graphical specification of cause–effect graphs by adding the usage of a feasibility module for repairing mistakes. Its main functionalities include the full feasible test suite generation, application of two minimization algorithms, and calculating the relevant software quality metrics.

Cause-effect graphing is a commonly used black-box technique with many applications in practice. It is important to be able to create accurate cause-effect graph specifications from system requirements before converting them to test case tables used for black-box testing. In this paper, a new graphical software tool for creating cause-effect graph specifications is presented. The tool uses standardized graphical notation for describing different types of nodes, logical relations and constraints, resulting in a visual representation of the desired cause-effect graph which can be exported for later usage and imported in the tool. The purpose of this work is to make the cause-effect graph specification process easier for users in order to solve some of the problems which arise due to the insufficient amount of understanding of cause-effect graph elements. The proposed tool was successfully used for creating cause-effect graph specifications for small, medium and large graphs. It was also successfully used for performing different types of tasks by users without any prior knowledge of the functionalities of the tool, indicating that the tool is easy to use, helpful and intuitive. The results indicate that the usage of standardized notation is easier to understand than non-standardized approaches from other tools.

The types of the testing methods were analyzed from the side of development. If changes are made to the code, even minor ones, bugs can appear anywhere in the system. The cost of fixing bugs increases with the time they are discovered. Using effective web testing can prevent unexpected costs. Modern web applications are indeed a place where all the type of the testing is vital for the high-quality product. At the moment, traditional front and back office applications are increasingly moving from desktop computers to web interfaces, so testing web applications is becoming extremely relevant. Thus, learning what to automate and how is an important component of successful web application testing. Web application testing is a software practice that is designed to ensure quality by verifying that the functionality of a particular web application works correctly or according to fixed requirements. Web testing makes it possible to find bugs at any point in time, before release or on a daily basis. On the one hand there are wide range of tools that could be used to pursue this goal by means of using best decisions present for now but on the other hand there are essential advantages and disadvantages present in these tools, which are all in the approach to it, so there are always cons and pros of using one or another. For now, despite on having the ability to test using both black and white box testing it looks like the second one is not the best choice. There are several points on each board for both of them, but black box approach that is being represented with react testing library is more successful and efficient way to cover and application with high- and low-level tests, that could be easily maintained and understood. But white box testing is now the most used decision due to the historic development of the industry. So, it also has some great features and could be chosen to be used on the project, but it should be precise choice with the understanding of all the consequences standing behind.

When it comes to web services, RESTful web APIs have become the de facto standard since 2000. Those APIs expose back-end data, so it is crucial that they are robust, secure, and reliable to keep sensitive data protected. Although existing tools for automating APIs test case generation have shown significant potential, they are limited in their applicability since they focus solely on random inputs through fuzzing. Using only API specifications, it is impractical to describe personalized and specific test case workflows. This paper introduces RapiTest, an open-source continuous black-box testing application for RESTful web APIs. It takes advantage of the API specification to automatically generate tests, but also makes use of a new DSL named Test Specification Language (TSL), to create rich test cases. The RapiTest web application allows the setup of several predefined verifications, regarding security and correctness of the responses, while running the tests at regular intervals, such as every 24 hours. In this way, the API can be monitored continuously to ensure it is running correctly. [ABSTRACT FROM AUTHOR]

Cause-effect graphing is a commonly used black-box technique with many applications in practice. It is important to be able to create accurate cause-effect graph specifications from system requirements before converting them to test case tables used for black-box testing. In this paper, a new graphical software tool for creating cause-effect graph specifications is presented. The tool uses standardized graphical notation for describing different types of nodes, logical relations and constraints, resulting in a visual representation of the desired cause-effect graph which can be exported for later usage and imported in the tool. The purpose of this work is to make the cause-effect graph specification process easier for users in order to solve some of the problems which arise due to the insufficient amount of understanding of cause-effect graph elements. The proposed tool was successfully used for creating cause-effect graph specifications for small, medium and large graphs. It was also successfully used for performing different types of tasks by users without any prior knowledge of the functionalities of the tool, indicating that the tool is easy to use, helpful and intuitive. The results indicate that the usage of standardized notation is easier to understand than nonstandardized approaches from other tools. [ABSTRACT FROM AUTHOR]

Cause-effect graphs are a popular black-box testing technique. The most commonly used approach for generating test cases from cause-effect graph specifications uses backward-propagation of forced effect activations through the graph in order to get the values of causes for the desired test case. Many drawbacks have been identified when using this approach for different testing requirements. Several algorithms for automatically generating test case suites from cause-effect graph specifications have been proposed. However, many of these algorithms do not solve the main drawbacks of the initial back-propagation approach and offer only minor improvements for specific purposes. This work proposes two new algorithms for deriving test cases from cause-effect graph representations. Forward-propagation of cause values is used for generating the full feasible test case suite, whereas multiple effect activations are taken into account for reducing the feasible test case suite size. Evaluation of the test case suites generated by using the proposed algorithms was performed by using the newly introduced test effect coverage and fault detection rate effectiveness metrics. The evaluation shows that the proposed algorithms work in real time even for a very large number of cause nodes. The results also indicate that the proposed algorithm for generating all feasible test cases generates a larger test case suite, whereas the proposed algorithm for test case suite minimization generates a smaller test case subset than the originally proposed approaches while ensuring the maximum effect coverage, fault detection rate effectiveness and a better test effect coverage ratio.

Web applications have been a significant target for successful security breaches in the last few years. They are currently secured, as a primary method, by searching for their vulnerabilities with specialized tools referred to as Web Application Vulnerability Scanners (WVS’s). Although, these dynamic approaches of testing have some advantages, there is still a scarcity of studies that explore their features and detection capabilities in a systematic way. This article reports findings from a Systematic Literature Review (SLR) to look into the characteristics and effectiveness of the most frequently used WVS’s. A total of 90 research papers were carefully evaluated. Thirty (30) WVS’s were collected and reported, with only 12 having at least one quantitative assessment of effectiveness. These 12 WVS’s were evaluated by 15 original evaluation studies. We found that these evaluations tested mostly only two of the Open Web Application Security Project (OWASP) Top Ten vulnerability types: SQL injection (SQLi) (13/15) and Cross-Site Scripting (XSS) (8/15). Additionally, only one work evaluated six of the OWASP Top Ten vulnerability types and for only one scanner. We also found that the reported detection rates were highly dissimilar between these 15 evaluations. Based on these surprising results we suggest avenues for future directions.

The number of electronic control units (ECU) installed in vehicles is increasingly high. Manufacturers must improve the software quality and reduce cost by proposing innovative techniques. This research proposes a technique being able to generate not only test-cases in real time but to decide the best means to run them (hardware-in-the-loop simulations or prototype vehicles) to reduce the cost and software testing time. It is focused on the engine ECU software which is one of the most complex software installed in vehicles. This software is coded by using Simulink® models. Two genetic algorithms (GAs) were coded. The first one is in charge of choosing which parts of the Simulink® models should be validated by using hardware-in-the-loop (HIL) simulations and by using prototype vehicles. The second one tunes the inputs of the software module (SM) under validation to cover these parts of the Simulink® models. The usage of dynamic-linked libraries (dlls) is described to deal with the issues linked to SM interactions when running HIL simulations. GAs found at least 7 more bugs than traditional techniques and improved the functional and code coverage by between 3 and 11% for functional coverage and by between 1.4 and 7% for code coverage depending on the SM complexity. The validation time is reduced by 11.9% compared to traditional techniques. GAs perform better than traditional techniques improving software quality and reducing costs and validation time. The usage of dlls allows testing the software in real time as described in this study. [ABSTRACT FROM AUTHOR]

RESTful APIs (or REST APIs for short) represent a mainstream approach to design and develop web APIs using the REpresentational State Transfer architectural style. Black‐box testing, which assumes only the access to the system under test with a specific interface, is the only viable option when white‐box testing is impracticable. This is the case for REST APIs: their source code is usually not (or just partially) available, or a white‐box analysis across many dynamically allocated distributed components (typical of a micro‐services architecture) is computationally challenging. This paper presents RestTestGen, a novel black‐box approach to automatically generate test cases for REST APIs, based on their interface definition (an OpenAPI specification). Input values and requests are generated for each operation of the API under test with the twofold objective of testing nominal execution scenarios and error scenarios. Two distinct oracles are deployed to detect when test cases reveal implementation defects. While this approach is mainly targeting the research community, it is also of interest to developers because, as a black‐box approach, it is universally applicable across different programming languages, or in the case external (compiled only) libraries are used in a REST API. The validation of our approach has been performed on more than 100 of real‐world REST APIs, highlighting the effectiveness of the approach in revealing actual faults in already deployed services. [ABSTRACT FROM AUTHOR]

In order to meet the ever-increasing needs of health care, as well as helping patients who need continuous care after being discharged from the hospital and making modern medical technology better serve humans, the design of electronic medical records for continuous care patients, especially those with malignant tumors, is investigated. In the research process, the idea of Browser/Server (B/S) framework is adopted, and the corresponding electronic medical record system is designed based on the targets and the overall structure of the system; afterward, the black-box testing and white-box testing are carried out to test the functions, reliability, and stability of the designed electronic medical record system; in addition, combined with other research results, the feasibility of the design is proved. It can be seen that the electronic medical record system designed for patients who need continuous care in the study is absolutely feasible, which can be further researched and improved with the development of electronic medical records; therefore, it would make greater contributions to both patients and hospitals in the future.

A denial‐of‐service (DoS) attack is a serious attack that targets web applications. According to Imperva, DoS attacks in the application layer comprise 60% of all the DoS attacks. Nowadays, attacks have grown into application‐ and business‐layer attacks, and vulnerability‐analysis tools are unable to detect business‐layer vulnerabilities (logic‐related vulnerabilities). This paper presents the business‐layer dynamic application security tester (BLDAST) as a dynamic, black‐box vulnerability‐analysis approach to identify the business‐logic vulnerabilities of a web application against DoS attacks. BLDAST evaluates the resiliency of web applications by detecting vulnerable business processes. The evaluation of six widely used web applications shows that BLDAST can detect the vulnerabilities with 100% accuracy. BLDAST detected 30 vulnerabilities in the selected web applications; more than half of the detected vulnerabilities were new and unknown. Furthermore, the precision of BLDAST for detecting the business processes is shown to be 94%, while the generated user navigation graph is improved by 62.8% because of the detection of similar web pages.

In the past decades, a significant increase has been observed in cyberattacks on the web-based systems used for financial purposes. Such individual systems often contain security weaknesses, called vulnerabilities that can be exploited for malicious purposes. The exploitation of such vulnerabilities can result in disclosure and manipulation of sensitive data as well as have destructive effects. To protect such systems, security testing is required on a periodic basis. Various detection and assessment techniques have been suggested by developers and researchers to address these security issues. In this paper, we survey the contributions of academia in the field of security testing for software applications and communication systems. A comprehensive review and in-depth analysis of the existing literature testing approaches has been performed to analyze their effectiveness and applicability under various scenarios. Further, we discuss various techniques used for conducting various security assessments. We follow the widely used method by Kitchenham and Charters for conducting a comprehensive systematic literature review process. Also, we propose a taxonomy for security testing techniques consisting of three main categories (Identification, Testing, and Reporting) and 17 subcategories consisting of specific security testing techniques (e.g., Black-box testing, risk assessment). Further, we assign a distinctive category from our taxonomy to each published paper in the security testing area, based on the material presented/discussed in the paper. [ABSTRACT FROM AUTHOR]

• Artefact wiping and Trial obfuscation attacks are not noticed by forensic tools. • Compression bomb kills all tools while as Sparse file spares only OSForensics. • Encryption and Steganography attacks are identified by forensic tools but no evidence is retrieved. • TSK and FTK fail to locate Slack spaces, while as FTK also fails to locate HPA/DCO. This paper investigates whether computer forensic tools (CFTs) can extract complete and credible digital evidence from digital crime scenes in the presence of file system anti-forensic (AF) attacks. The study uses a well-established six stage forensic tool testing methodology based on black-box testing principles to carry out experiments that evaluate four leading CFTs for their potential to combat eleven different file system AF attacks. Results suggest that only a few AF attacks are identified by all the evaluated CFTs, while as most of the attacks considered by the study go unnoticed. These AF attacks exploit basic file system features, can be executed using simple tools, and even attack CFTs to accomplish their task. These results imply that evidences collected by CFTs in digital investigations are not complete and credible in the presence of AF attacks. The study suggests that practitioners and academicians should not absolutely rely on CFTs for evidence extraction from a digital crime scene, highlights the implications of doing so, and makes many recommendations in this regard. The study also points towards immediate and aggressive research efforts that are required in the area of computer forensics to address the pitfalls of CFTs. [ABSTRACT FROM AUTHOR]

The growing complexity of circuit boards makes manufacturing test increasingly expensive. In order to reduce test cost, a number of test selection methods have been proposed in the literature. However, only few of these methods can be applied to black-box test-cost reduction. In this article, we propose a novel black-box test selection method based on Bayesian networks (BNs), which extract the strong relationship among tests. First, the problem of reducing the black-box test cost is formulated as a constrained optimization problem. Next, multiple structure learning and transfer learning algorithms are implemented to construct BN models. Based on these BN models, we propose an iterative test selection method with a new metric, Bayesian index, for test-cost reduction. In addition, averaging strategies are applied to enhance the reduction performance. Finally, a robust model selection framework is proposed to select the optimal BN model for test-cost reduction. Two case studies with production test data demonstrate that when no prior information is provided, our proposed approach effectively reduces the test cost by up to 14.7%, compared to the state-of-the-art greedy algorithm. Moreover, our proposed approach further reduces the test cost by up to 7.1% when prior information is provided from similar products. [ABSTRACT FROM AUTHOR]

In order to meet the ever-increasing needs of health care, as well as helping patients who need continuous care after being discharged from the hospital and making modern medical technology better serve humans, the design of electronic medical records for continuous care patients, especially those with malignant tumors, is investigated. In the research process, the idea of Browser/Server (B/S) framework is adopted, and the corresponding electronic medical record system is designed based on the targets and the overall structure of the system; afterward, the black-box testing and white-box testing are carried out to test the functions, reliability, and stability of the designed electronic medical record system; in addition, combined with other research results, the feasibility of the design is proved. It can be seen that the electronic medical record system designed for patients who need continuous care in the study is absolutely feasible, which can be further researched and improved with the development of electronic medical records; therefore, it would make greater contributions to both patients and hospitals in the future. [ABSTRACT FROM AUTHOR]

Copyright of FBIM Transactions is the property of University Union - Nikola Tesla, Faculty of Business & Law and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

This article presents a design-to-test (DTT) approach for enhancing black-box complete conformance testing of programmable controllers, where their specifications can be modeled as finite state machines. Given an automation system, the testing objective is to check whether its implemented controllers conform to the expected behavior with regard to the specification models. The DTT approach analyzes the specification models and, if necessary, automatically modifies them at the cost of limited design overhead, so that the testability of the final implemented controllers can be ensured/improved. By design, this approach also guarantees that the behavior of implemented controllers remains unchanged during normal execution (i.e., when not connected to a test bench). [ABSTRACT FROM AUTHOR]

Test oracles differentiate between the correct and incorrect system behavior. Automation of test oracles for visual output systems mainly involves image comparison, where a snapshot of the output is compared with respect to a reference image. Hereby, the captured snapshot can be subject to variations such as scaling and shifting. These variations lead to incorrect evaluations. Existing approaches employ computer vision techniques to address a specific set of variations. In this article, we introduce ADVISOR, an adjustable framework for test oracle automation of visual output systems. It allows the use of a flexible combination and configuration of computer vision techniques. We evaluated a set of valid configurations with a benchmark dataset collected during the tests of commercial digital TV systems. Some of these configurations achieved up to 3% better overall accuracy with respect to state-of-the-art tools. Further, we observed that there is no configuration that reaches the best accuracy for all types of image variations. We also empirically investigated the impact of significant parameters. One of them is a threshold regarding image matching score that determines the final verdict. This parameter is automatically tuned by offline training. We evaluated runtime performance as well. Results showed that differences among the ADVISOR configurations and state-of-the-art tools are in the order of seconds per image comparison. [ABSTRACT FROM AUTHOR]

A denial‐of‐service (DoS) attack is a serious attack that targets web applications. According to Imperva, DoS attacks in the application layer comprise 60% of all the DoS attacks. Nowadays, attacks have grown into application‐ and business‐layer attacks, and vulnerability‐analysis tools are unable to detect business‐layer vulnerabilities (logic‐related vulnerabilities). This paper presents the business‐layer dynamic application security tester (BLDAST) as a dynamic, black‐box vulnerability‐analysis approach to identify the business‐logic vulnerabilities of a web application against DoS attacks. BLDAST evaluates the resiliency of web applications by detecting vulnerable business processes. The evaluation of six widely used web applications shows that BLDAST can detect the vulnerabilities with 100% accuracy. BLDAST detected 30 vulnerabilities in the selected web applications; more than half of the detected vulnerabilities were new and unknown. Furthermore, the precision of BLDAST for detecting the business processes is shown to be 94%, while the generated user navigation graph is improved by 62.8% because of the detection of similar web pages. [ABSTRACT FROM AUTHOR]

Prof. Soeparwi veterinary hospital is one of the medical institutions focused on providing medical services for animals. In its daily operations, the flow of informations among various departments has yet to be supported by management information systems (MIS) which enables efficiency of business process and a better management of the data. Previous researches have been conducted to develop MIS, which resulted in three independent MIS for managing registration, medical records, and patient bills. Each MIS is using their own database to store the data, thus causing duplicates of information and inconsistencies, and also increasing complexity in accessing the data. The goal of this research is to re-design the said database into a single database that will be used by various MIS. Three independent databases are merged by applying a technique that uses linguistic information as the basis for the matchingcalled linguistic-based schema matching. This methods accuracy is evaluated by calculating precision, recall, and F-measurewhich we obtained scores of above 50% for all three indicators. Requirement analysis is performed to further develop the database for supporting further needs of the hospital. The new database system is tested using black-box technique under few test cases to see if its functionality corresponds with the specifications defined. Result of this test proves that the new database could handle valid, invalid, and redundant inputs as expected by a score of 100% success rate.