An exploration of statistical models for automated test case generation

Abstract

In this paper, we develop methods that use logged user data to build models of a web application. Logged user data captures dynamic behavior of an application that can be useful for addressing the challenging problems of testing web applications. Our approach automatically builds statistical models of user sessions and automatically derives test cases from these models. We provide several alternative modeling approaches based on statistical machine learning methods. We investigate the effectiveness of the test suites generated from our methods by performing a preliminary study that evaluates the generated test cases. The results of this study demonstrate that our techniques are able to generate test cases that achieve high coverage and accurately model user behavior. This study provides insights into improving our methods and motivates a larger study with a more diverse set of applications and testing metrics.

Improved Bug Reporting and Reproduction through Non-intrusive GUI Usage Monitoring and Automated Replaying

“…To cope with these issues a usage-based framework is suggested. Usage-based testing has successfully been applied to other event driven software, like Web applications [4,12,14] and to a lesser degree also GUI testing [2]. The testing framework is based upon the integration of three mechanism and the resulting synergy effects: 1) GUI usage monitoring; 2) replaying of usage logs; 3) stochastical usage models.…”

Precise interface identification to improve testing and analysis of web applications

“…Since web application make extensive use of databases, this technique could be used together with our wam-se-based test-input generation to achieve additional coverage on parts of the code that are dependent on responses to SQL queries. A final group of techniques [7,8,16,20,21] use captured user session data and logs to model a web application and generate realistic test cases. These approaches are not able to provide any guarantees of completeness since they are limited to analyzing only parts of the application interaction they have observed.…”

Penetration Testing with Improved Input Vector Identification

“…This function also sets two hidden input fields in the form: "userAction" is set to "provideAddress," and "login" is set to the user-chosen login. When the user submits this form, the condition at line 14 is true, so the servlet retrieves the address and login fields (lines [15][16] and updates the entry in the database with the supplied information (lines [17][18][19]. At this point, the registration is done.…”

“…Early techniques relied on developer-provided specifications [1,15,18], which does not fit well into the usage scenario of penetration testing, where oftentimes the vulnerabilities are found in IVs that are unknown or untested by the developers. Several techniques [6,7,16,19] use session data and user logs to identify relevant information about the monitored web applications. These techniques have limitations similar to those associated with web crawlers, as they can only analyze parts of a web application that have been visited.…”