Evaluating test characteristics and effectiveness of FSM-based testing methods on RBAC systems

Damasceno, Carlos Diego Nascimento; Masiero, Paulo César; Simão, Adenilso da Silva

doi:10.1145/2973839.2973849

Cited by 7 publications

(14 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although very effective, FSM-based testing of RBAC systems tends to generate a large number of test cases regardless the methods used (Damasceno et al 2016 (Yoo and Harman 2012). These techniques reduce time effort, but they may not work effectively, since they may also omit important test cases able to detect certain faults (Ouriques 2015).…”

Section: Test Case Prioritizationmentioning

confidence: 99%

“…According to Damasceno et al (2016), a larger number of test cases tends to be generated regardless the FSM-based testing methods for RBAC systems. Thus, the higher the number of states and transitions of FSM(P) increase, the greater the test suites are concerning the number of resets, total test suite length, and average test case length.…”

Section: Experimental Evaluationmentioning

confidence: 99%

“…Fifteen test suites were taken from a previous study (Damasceno et al 2016) where test characteristics (i.e., number of resets, test suite length, and avg. test case length) and effectiveness were analyzed based on the FSM(P) characteristics (i.e., numbers of states, and transitions).…”

Section: Experimental Evaluationmentioning

confidence: 99%

“…test case length) and effectiveness were analyzed based on the FSM(P) characteristics (i.e., numbers of states, and transitions). These test suites were generated from five RBAC policies specified as FSM(P) models using the RBAC-BT software (Damasceno et al 2016) and implementations of the W (Chow 1978), HSI (Petrenko and Bochmann 1995), and SPY Fig. 6 Comparison of test prioritization techniques -schematic overview (Simão et al 2009) methods.…”

Section: Experimental Evaluationmentioning

confidence: 99%

“…Previous investigations using random FSMs have shown that recent test generation methods (e.g., SPY (Simão et al 2009)), compared to traditional methods (e.g., W (Chow 1978) and HSI (Petrenko and Bochmann 1995)), tend to rely on fewer and longer test cases, reducing the overall test cost without impacting test effectiveness (Endo and Simao 2013). In the RBAC domain, although very effective and less costly, recent test generation methods still tend to output large amounts of test cases (Damasceno et al 2016). Thus, there is a need for additional steps during software testing, such as test prioritization .…”

mentioning

confidence: 99%

See 4 more Smart Citations

Similarity testing for role-based access control systems

Damasceno

Masiero

Simão

2018

J Softw Eng Res Dev

Self Cite

View full text Add to dashboard Cite

Context: Access control systems demand rigorous verification and validation approaches, otherwise, they can end up with security breaches. Finite state machines based testing has been successfully applied to RBAC systems and enabled to obtain effective test cases, but very expensive. To deal with the cost of these test suites, test prioritization techniques can be applied to improve fault detection along test execution. Recent studies have shown that similarity functions can be very efficient at prioritizing test cases. This technique is named similarity testing and assumes the hypothesis that resembling test cases tend to have similar fault detection capabilities. Thus, there is no gain from similar test cases, and fault detection ratio can be improved if test diversity increases. Objective: In this paper, we propose a similarity testing approach for RBAC systems named RBAC similarity and compare to simple dissimilarity and random prioritization. RBAC similarity combines the dissimilarity degree of pairs of test cases with their relevance to the RBAC policy under test to maximize test diversity and the coverage of its constraints. Method: Five RBAC policies and fifteen test suites were prioritized using each of the three test prioritization techniques and compared using the Average Percentage Faults Detected metric. Results: Our results showed that the combination of the dissimilarity degree to the relevance of a test case to RBAC policies in the RBAC similarity can be more effective than random prioritization and simple dissimilarity, by itself, in most of the cases. Conclusion: The RBAC similarity criterion is suitable as a test prioritization criteria for test suites generated from finite state machine models specifying RBAC systems.

show abstract

Section: Test Case Prioritizationmentioning

confidence: 99%

Section: Experimental Evaluationmentioning

confidence: 99%

Section: Experimental Evaluationmentioning

confidence: 99%

Section: Experimental Evaluationmentioning

confidence: 99%

mentioning

confidence: 99%

See 3 more Smart Citations

Similarity testing for role-based access control systems

Damasceno

Masiero

Simão

2018

J Softw Eng Res Dev

Self Cite

View full text Add to dashboard Cite

show abstract

Learning by sampling: learning behavioral family models from software product lines

2021

Self Cite

View full text Add to dashboard Cite

Family-based behavioral analysis operates on a single specification artifact, referred to as family model, annotated with feature constraints to express behavioral variability in terms of conditional states and transitions. Family-based behavioral modeling paves the way for efficient model-based analysis of software product lines. Family-based behavioral model learning incorporates feature model analysis and model learning principles to efficiently unify product models into a family model and integrate the behavior of various products into a behavioral family model. Albeit reasonably effective, the exhaustive analysis of product lines is often infeasible due to the potentially exponential number of valid configurations. In this paper, we first present a family-based behavioral model learning techniques, called FFSM Diff . Subsequently, we report on our experience on learning family models by employing product sampling. Using 105 products of six product lines expressed in terms of Mealy machines, we evaluate the precision of family models learned from products selected from different settings of the T-wise product sampling criterion. We show that product sampling can lead to models as precise as those learned by exhaustive analysis and hence, reduce the costs for family model learning.

show abstract