Model Checking-Based Testing of Web Applications

A formal model representing the navigation behavior of a Web application as the Kripke structure is proposed and an approach that applies model checking to test case generation is presented. The Object Relation Diagram as the object model is employed to describe the object structure of a Web application design and can be translated into the behavior model. A key problem of model checking-based test generation for a Web application is how to construct a set of trap properties that intend to cause the violations of model checking against the behavior model and output of counterexamples used to construct the test sequences. We give an algorithm that derives trap properties from the object model with respect to node and edge coverage criteria.

AWeb Application Fingerprint Recognition Method Based on Machine Learning

Web application fingerprint recognition is an effective security technology designed to identify and classify web applications,thereby enhancing the detection of potential threats and attacks.Traditional fingerprint recognition methods,which rely on preannotated feature matching,face inherent limitations due to the ever-evolving nature and diverse landscape of web applications.In response to these challenges,this work proposes an innovative web application fingerprint recognition method founded on clustering techniques.The method involves extensive data collection from the Tranco List,employing adjusted feature selection built upon Wappalyzer and noise reduction through truncated SVD dimensionality reduction.The core of the methodology lies in the application of the unsupervised OPTICS clustering algorithm,eliminating the need for preannotated labels.By transforming web applications into feature vectors and leveraging clustering algorithms,our approach accurately categorizes diverse web applications,providing comprehensive and precise fingerprint recognition.The experimental results,which are obtained on a dataset featuring various web application types,affirm the efficacy of the method,demonstrating its ability to achieve high accuracy and broad coverage.This novel approach not only distinguishes between different web application types effectively but also demonstrates superiority in terms of classification accuracy and coverage,offering a robust solution to the challenges of web application fingerprint recognition.

Method for test case selection and execution of web application regression testing

In order to improve the efficiency of regression testing in web application,the control flow graph and the greedy algorithm are adopted.This paper considers a web page as a basic unit and introduces a test case selection method for web application regression testing based on the control flow graph.This method is safe enough to the test case selection.On the base of features of request sequence in web application,the minimization technique and the priority of test cases are taken into consideration in the process of execution of test cases in regression testing for web application.The improved greedy algorithm is also raised resulting in optimization of execution of test cases.The experiments indicate that the number of test cases which need to be retested is reduced,and the efficiency of execution of test cases is also improved.

Testing Forms in Web Applications Automatically

Forms enhance both the dynamic and interactive abilities of Web applications and the system complexity. And it is especially important to test forms completely and thoroughly. Therefore, this paper discusses how to carry out the form testing by different methods in the related testing phases. Namely, at first, automatically abstracting forms in the Web pages by parsing the HTML documents; then, ohtai ning the testing data with a certain strategies, such as by requirement specifications, by mining users＇ hefore input informarion or by recording meehanism; and next executing the testing actions automatically due to the well formed test cases; finally, a case study is given to illustrate the convenient and effective of these methods.

Testing and Evaluation for Web Usability Based on Extended Markov Chain Model

As the increasing popularity and complexity of Web applications and the emergence of their new characteristics, the testing and maintenance of large, complex Web applications are becoming more complex and difficult. Web applications generally contain lots of pages and are used by enormous users. Statistical testing is an effective way of ensuring their quality. Web usage can be accurately described by Markov chain which has been proved to be an ideal model for software statistical testing. The results of unit testing can be utilized in the latter stages, which is an important strategy for bottom-to-top integration testing, and the other improvement of extended Markov chain model (EMM) is to present the error type vector which is treated as a part of page node. this paper also proposes the algorithm for generating test cases of usage paths. Finally, optional usage reliability evaluation methods and an incremental usability regression testing model for testing and evaluation are presented. Key words statistical testing - evaluation for Web usability - extended Markov chain model (EMM) - Web log mining - reliability evaluation CLC number TP311. 5 Foundation item: Supported by the National Defence Research Project (No. 41315. 9. 2) and National Science and Technology Plan (2001BA102A04-02-03)Biography: MAO Cheng-ying (1978-), male, Ph.D. candidate, research direction: software testing. Research direction: advanced database system, software testing, component technology and data mining.

Vulnerability Testing of HTTP based on Vulnerability-testing Oriented Petri Net(VOPN)

Vulnerability-testing Oriented Petri Net （VOPN）, a vulnerability testing model for communication protocol is brought forward first, which is combined Petri Net system with protocol Syntax analysis. Then vulnerability testing of implementation of HTTP protocol based on VOPN is made and the process is analyzed to prove the feasibility of the model.

Web应用防火墙识别、绕过与加固技术的综述

Web应用在信息技术领域的重要性与日俱增,其安全性正在成为网络防护的核心议题。Web应用防火墙(Web Application Firewall,WAF)作为关键防线,承担着识别与阻止恶意流量的重任,从而确保Web应用的安全运行。鉴于此,首先深入探讨了WAF识别技术及绕过策略,旨在通过系统性的分析,提炼出有效的WAF自动测试策略与加固方法。其次,聚焦于理解和模拟攻击者的绕过技巧,生成具有针对性的测试案例,从而帮助WAF开发者及早发现产品中潜在的漏洞,优化识别算法,提升对各类恶意请求的抵御能力。最后,期望能为WAF的设计与优化提供理论指导和实践依据,推动Web应用安全防护技术的进一步发展。

A Method for Modeling the Virtual Instrument Automatic Test System Based on the Petri Net

Virtual instrument is playing the important role in automatic test system. This paper introduces a composition of a virtual instrument automatic test system and takes the VXIbus based a test software platform which is developed by CAT lab of the UESTC as an example. Then a method to model this system based on Petri net is proposed. Through this method, we can analyze the test task scheduling to prevent the deadlock or resources conflict. At last, this paper analyzes the feasibility of this method.

基于Concolic Testing的动态Web页面测试研究

传统的软件测试技术对于动态Web程序并不完全适用,针对动态Web程序的特性,探讨适合的测试方法十分必要。文章分析了动态Web应用的特点与测试现状,简要介绍了Concolic Testing思想,并把Concolic Testing测试技术应用于Web应用动态内容页的测试,给出了具体的、具有针对性的测试算法,并以实例进行了验证。

Support for development and test of web application:A tree-oriented model

Building an abstract model of the web application is the chief task of software test based on model, which is an efficient way for testing the web application. One problem with current web application test technologies is the lack of tools for modeling the whole web software, especially the lack of support for describing web application from the view of action and function. This paper is concerned with providing the support for development and test of the web application. The presented novel model, named component-based and tree-oriented web application development model （CBTOWADM）, abstracts the web application as a tree based on its system function and business process. CBTOWADM not only simplifies the design and development of the web application, but also acts as the model middleware for software test. The basic model definition, the system framework and the application in software test of CBTOWADM is described.

An Agent-Based Framework for Automated Testing of Web-Based Systems

Parallel to the considerable growth in applications of web-based systems, there are increasing demands for methods and tools to assure their quality. Testing these systems, due to their inherent complexities and special characteristics, is complex, time-consuming and challenging. In this paper a novel multi-agent framework for automated testing of web-based systems is presented. The main design goals have been to develop an effective and flexible framework that supports different types of tests and utilize different sources of information about the system under test to automate the test process. A prototype of the proposed framework has been implemented and is used to perform some experiments. The results are promising and prove the overall design of the framework.

Web Testing Generation: A Stream <i>X-Machine</i>Based Approach

To ensure the quality of Web applications, Web testing is one of the effective methods. The testing is a process of revealing errors that is used to give confidence that the implementation of a Web application meets its original specification. This work proposes a Web testing framework based on Stream X-Machines (SXMs), which provides a way to derive test cases for a Web application. It starts from constructing the SXM model, from which a test translator is employed to extract the test paths and then translates them into an XML-style test specification, which is the input of test engine. The test engine generates test cases and then executes them, and finally produces test report. This testing method is a significant contribution to informed research.

构建Web Application测试模型

随着W eb应用软件的飞速发展,作为保证W eb质量和可靠性的重要手段,W eb测试受到了人们越来越多的重视。分析了一些典型的W eb测试模型,提出了一种基于Petri网的W eb链接模型。

一种面向对象的Web Application测试模型

为了保证Web应用的质量和可靠性,需要不断加强对Web应用软件的测试研究。Web应用软件的有效测试依赖于对其进行充分的分析和理解,提出良好的测试模型,并基于测试模型提出测试策略和测试方法。提出了一种面向对象的Web应用软件测试模型WATM,并且基于WATM提出了测试用例的设计和选择的方法,从而更好地支持Web应用软件的导航测试和状态行为测试。

数据访问对.NET Web应用程序性能测试的影响

针对数据库和XML文件不同数据源类型及数据的不同访问机制对.NET Web应用程序性能测试的影响进行分析,通过ACT测试工具得出了实例系统的性能测试数据,说明数据访问对.NET Web应用程序性能测试影响的主要因素.

Coverage criteria and test requirement reduction for component-based web application

In order to analyze and test the component-based web application and decide when to stop the testing process, the concept of coverage criteria and test requirement reduction approach are proposed. First, four adequacy criteria are defined and subsumption relationships among them are proved. Then, a translation algorithm is presented to transfer the test model into a web application decision-to-decision graph（WADDGraph）which is used to reduce testing requirements. Finally, different sets of test requirements can be generated from WADDGraph by analyzing subsumption and equivalence relationships among edges based on different coverage criteria, and testers can select different test requirements according to different testing environments. The case study indicates that coverage criteria follow linear subsumption relationships in real web applications. Test requirements can be reduced more than 55% on average based on different coverage criteria and the size of test requirements increases with the increase in the complexity of the coverage criteria.

应用.NET框架命名空间技术实现Web测试自动化

目前支持Web的自动化测试工具普遍存在价格偏高、测试脚本可重用性差、代码维护工作量过大等缺点。为解决这一问题提出了应用.NET框架命名空间(NameSpace)技术实现Web应用程序测试的自动化方法。该方法不使用任何第三方测试工具,通过编写简单、易维护的C#.NET代码,对Web程序接口进行信息抽取与调用,以实现测试的自动化运行。

大规模Web应用的SQL注入攻击威胁检测研究

Web应用程序运行中容易受到SQL常规注入、二阶注入或盲注攻击影响,带来Web系统数据、用户隐私或敏感数据的安全威胁。为降低SQL注入对系统漏洞攻击影响,提出一种用于Web应用程序、服务器端的模糊测试漏洞检测技术,建立了模糊测试的SQL注入漏洞检测模型框架,使用漏洞检测框架的信息收集模块、模糊检测模块,按照关键字编码、大小写混合编码、结构化查询(Structured Query Language,SQL)语句注释、重组绕过等检测流程完成0级、1级、2级漏洞的参数查询和分级检测。最后利用ASP.NET、Microsoft Visual Studio、IIS服务器等软硬件搭建实验环境,对基于模糊测试技术SQL注入漏洞检测模型进行实验论证,仿真实验结果得出:基于模糊测试法的SQL注入漏洞检测模型,相比于程序切片(chopping)技术的Web应用源代码SQL注入攻击检测方法而言,在不同分级漏洞检测中的确认、检测效果更优(达到90%以上)。

基于Web应用前端行为模型的测试用例生成

基于Web应用前端模型的测试用例生成是Web应用测试的重要过程,但现有的大多数针对Web应用的模型都只关注Web页面及其事件,忽略了事件触发条件和后续动作。为了更准确地描述现代Web应用程序的动态行为,文中定义了一种新的Web应用前端行为模型(Front-end Behavior Model, FBM)。由于模型中迁移的触发条件可能存在内部变量,即迁移之间存在依赖关系,使得生成的测试用例不能按照输入序列执行,从而影响测试效果。为此,提出了一种优化分组遗传算法来实现可执行迁移路径FTP的自动生成,该算法考虑FTP生成问题的特点,对染色体初始化和适应度函数做出合理的设计,加入修补算子调整个体长度生成了满足迁移覆盖的FTP,并且通过引入自适应的遗传算子和模拟退火接收机制来减少迭代次数,从而加快求解速度。实验结果表明,该算法能够在更高的求解效率的基础上有效保证迁移路径的可行性以及覆盖率。