面向Web服务器端敏感路径的客户端扩展有限状态机测试生成

Client-side extended finite state machine test case generation based on the server-side sensitive path coverage for web applications

为对Web应用进行有效的测试,本文提出了一种面向Web应用服务器端敏感路径覆盖的客户端扩展有限状态机测试用例生成方法。针对Web应用客户端扩展有限状态机模型,以Web应用服务器端的敏感路径覆盖为目标,利用Memetic演化算法实现客户端扩展有限状态机模型的测试用例自动生成,对Web应用进行测试。同时,为解决由模型生成的抽象测试用例不可直接执行的问题,提出了一种基于Selenium的测试脚本自动构建方法,通过分析扩展有限状态机模型迁移的特征,利用谱聚类算法实现迁移聚类,依据映射规则将聚类之后的迁移映射为测试脚本,形成迁移脚本库,将抽象测试用例转换为可执行的测试用例。实验结果表明:基于Selenium的测试脚本自动构建能有效地将抽象测试用例转化为可执行的测试脚本;面向Web服务器端敏感路径的客户端扩展有限状态机测试用例生成方法能有效地实现Web服务器端敏感路径的覆盖,对服务器端的敏感路径进行测试。

To enable an effective security test for web applications,we propose a client-side extended finite state machine(EFSM)test case generation approach based on the server-side sensitive path coverage for web applications.According to the EFSM model of clients,this approach takes the server-side sensitive path coverage as a goal and uses the memetic evolutionary algorithm to realize the automatic generation of abstract test cases for web application.Moreover,to solve the unexecutable problem of abstract test cases generated by the model,an automatic construction method of test scripts based on Selenium is proposed.This method proposes an automatic test-script construction method based on Selenium.It employs the spectral clustering algorithm to realize group transitions by analyzing the feature of transitions on the EFSM model.Then,the transition after grouping is mapped onto a test script,forming a script library.As a result,abstract test cases can be converted into actual executable test cases.Experimental results show that the selenium-based automated test-script construction method can solve unexecutable abstract test cases,and the test case generation approach can effectively achieve the server-side sensitive path coverage.