Robustness Inside Out Testing

Katz, Deborah; Zizyte, Milda; Hutchison, Casidhe; Guttendorf, David; Lanigan, Patrick E.; Sample, Eric; Koopman, Philip; Wagner, Michael; Goues, Claire Le

doi:10.1109/dsn-s50200.2020.00013

Cited by 6 publications

(2 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Robustness testing approaches [16], [22] typically make use of fault injection, in which faults are deliberately introduced into the system (e.g., to evaluate fault tolerance mechanisms [23]). A typical case found across different works [11], [22], [24]- [26] is the corruption of parameters in order to activate implementation faults (i.e., trying to trigger failures), which is also known in the literature as error injection [23].…”

Section: Related Workmentioning

confidence: 99%

“…Robustness testing became popular mostly due to its application to operating systems (OS) by Koopman et al [5], Krop et al [22], Shelton et al [27] among others [28]- [30], but its application to many other different types of systems (which hold different specificities) has been the object of research in numerous domains. Robustness testing techniques can be found, in general, applied to communication systems [7]- [9], embedded systems [10]- [12], [31], middleware [13]- [15], [32], web applications [17], [33], COTS [34]- [36], autonomous and adaptive systems [16], [25], [26], [37], and SOAP web services [18]- [20], [24], [38].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A Black Box Tool for Robustness Testing of REST Services

2021

View full text Add to dashboard Cite

REST services are nowadays being used to support many businesses, with most major companies exposing their services via REST interfaces (e.g., Google, Amazon, Instagram, and Slack). In this type of scenarios, heterogeneity is prevalent and software is sometimes exposed to unexpected conditions that may activate residual bugs, leading service operations to fail. Such failures may lead to financial or reputation losses (e.g., information disclosure). Although techniques and tools for assessing robustness have been thoroughly studied and applied to a large diversity of domains, REST services still lack practical approaches that specialize in robustness evaluation. In this paper, we present a tool (named bBOXRT) for performing robustness tests over REST services, solely based on minimal information expressed in their interface descriptions. We used bBOXRT to evaluate an heterogeneous set of 52 REST services that comprise 1,351 operations and fit in distinct categories (e.g., public, private, in-house). We were able to disclose several different types of robustness problems, including issues in services with strong reliability requirements and also a few security vulnerabilities. The results show that REST services are being deployed preserving software defects that harm service integration, and also carrying security vulnerabilities that can be exploited by malicious users.

show abstract