A Natural Language Programming Approach for Requirements-Based Security Testing

Abstract

To facilitate communication among stakeholders, software security requirements are typically written in natural language and capture both positive requirements (i.e., what the system is supposed to do to ensure security) and negative requirements (i.e., undesirable behavior undermining security). In this paper, we tackle the problem of automatically generating executable security test cases from security requirements in natural language (NL). More precisely, since existing approaches for the generation of test cases from NL requirements verify only positive requirements, we focus on the problem of generating test cases from negative requirements. We propose, apply and assess Misuse Case Programming (MCP), an approach that automatically generates security test cases from misuse case specifications (i.e., use case specifications capturing the behavior of malicious users). MCP relies on natural language processing techniques to extract the concepts (e.g., inputs and activities) appearing in requirements specifications and generates executable test cases by matching the extracted concepts to the members of a provided test driver API. MCP has been evaluated in an industrial case study, which provides initial evidence of the feasibility and benefits of the approach.

Automatic Generation of Acceptance Test Cases From Use Case Specifications: An NLP-Based Approach

“…Future work includes the extension of UMTG to deal with different types of testing problems and the identification of solutions to further the scalability of the strategy due to constraint solving for very large systems. We are currently working on UMTG-inspired approaches for security testing of Web systems [33], [34]. We also aim to address scalability issues by evaluating the feasibility of adopting alternative solving approaches, including SMT solvers [126], answer set programming [127], higher-order relational constraint solving [128], and the combination of constraint solving and search-based optimization [95], [129].…”

“…It enables the extraction of behavioral information by reducing imprecision and incompleteness in use case specifications. RUCM has been successfully applied in many domains (e.g., [23], [24], [25], [26], [27], [28], [29], [30], [31], [32], [33], [34], [35]). It has been previously evaluated through controlled experiments and showed to be usable and beneficial with respect to making use case specifications less ambiguous and more amenable to precise analysis and design [12].…”

Towards an Automated Model-Based Test Generation Approach from Controlled Natural Language Specifications Written in Arabic

“…The technique is aided by an application that allows natural language specifications to be automatically translated into Statechart models. In [34], the authors addressed the problem of automatically creating executable security test scenarios from natural language security requirements.…”

MCP: A Security Testing Tool Driven by Requirements

“…MCP is the tool supporting our approach for automatically generating security vulnerability test cases from misuse case specifications, described in a recent conference paper [20]. Fig.…”