Leveraging user-session data to support Web application testing

Abstract

Abstract-Web applications are vital components of the global information infrastructure, and it is important to ensure their dependability. Many techniques and tools for validating Web applications have been created, but few of these have addressed the need to test Web application functionality and none have attempted to leverage data gathered in the operation of Web applications to assist with testing. In this paper, we present several techniques for using user session data gathered as users operate Web applications to help test those applications from a functional standpoint. We report results of an experiment comparing these new techniques to existing white-box techniques for creating test cases for Web applications, assessing both the adequacy of the generated test cases and their ability to detect faults on a point-of-sale Web application. Our results show that user session data can be used to produce test suites more effective overall than those produced by the white-box techniques considered; however, the faults detected by the two classes of techniques differ, suggesting that the techniques are complementary.

A Log-Based Trace and Reply Tool Integrating Software and Infrastructure

“…Elmam et al proposed web application test techniques using session data [6]. The session data is gathered as users operate web applications.…”

A survey on Test Suite Reduction frameworks and tools

“…User session testing is increasingly adopted for web application's testing (Di Lucca and Fasolino, 2006). It mainly focuses on selecting user session data such as sequence of user actions with the web application, which are recorded in web server logs (Elbaum et al, 2005, Akhunzada et al, 2015b. Collected user session data may contain significant redundancy, since common scenarios of application execution are achieved by the users.…”

Penetration Testing with Improved Input Vector Identification

“…Early techniques relied on developer-provided specifications [1,15,18], which does not fit well into the usage scenario of penetration testing, where oftentimes the vulnerabilities are found in IVs that are unknown or untested by the developers. Several techniques [6,7,16,19] use session data and user logs to identify relevant information about the monitored web applications. These techniques have limitations similar to those associated with web crawlers, as they can only analyze parts of a web application that have been visited.…”