Automatic Generation of Test Drivers for Model Inference of Web Applications

Abstract

Abstract-In the "Internet of Services" (IoS) vision of the Internet, applications are developed as services using the web standards. Model-based testing combined with active model inference is one of the methods to test the applications pretty automatically, in particular to look for vulnerabilities. But one part still needs to be written manually, the test driver. It contains an abstraction of the real application and the methods to interact with the system at abstract and concrete level. We propose a generic abstraction of the web applications and an approach to generate the corresponding test driver automatically using a crawler to identify the needed information. Keywords: model inference, test driver generation, crawling method, web application I. MODEL INFERENCEIn the IoS (Internet of services) vision, information is provided to the user as a service. Applications which were developed as a single block are now built by assembling components provided by various service providers. The complexity of this kind of application, its architecture and the fact that most of the time a formal model is not available, make model-based testing and verification difficult and timeconsuming.However, in a testing context, partial models can actually be retrieved, even for black box components, from observation gathered in the testing process. Model inference -that is, methods to automatically derive models from observation of the behaviors -can seriously help to test services by providing models of the components automatically.Model inference is commonly divided into two categories: active and passive inference. Passive learning learns only from a given set of observations whereas active learning is free to interact with the tested system. In the case of web applications, we are free to interact with it through its web interface. As active learning converges faster, has better results than passive learning and is usable for website, it is the best choice. Angluin's well-known algorithm (L*) [1] is in the active learning category and can infer a deterministic finite automaton (DFA). This algorithm has often been used as a base for developing enhanced model inference algorithms. A. Extended ModelsWeb-based applications use a lot of structured messages to communicate. This makes application behavior mainly dependent on the inputs and outputs (I/O) and not only on the states. Basing the alphabet on the I/O value pairs would produce a large number of transitions and states and it would be highly inefficient. In order to use adapted models, we must have an efficient model which considers inputs and outputs, which may be structured.

hW-inference: A heuristic approach to retrieve models through black box testing

“…web applications, smart card applications) there can be automated derivation of such drivers (e.g. in SIMPA, implemented through a preliminary web crawling approach as in Hossen et al (2013)).…”

Model-Based Testing of Web Application: An SLR

“…An algorithm, Finite State Machines [34]. Finite State Machine that is parametrized, FSM that is extended [22]. Ontologies, FSM [35].…”

Overview and open issues on penetration test

“…Hossen et al [73] propose an approach for generating test driver using a crawler that identifies the needed information. The article is a study directed to the context of model-based testing and model inference and not for penetration testing.…”