Software Testing Models Against Information Security Requirements
Alexey Markov
对软件测试模型进行了综述和分类。对模型的选择提出了建议
An overview and classification of software testing models are done. Recommendations on the choice of models are proposed
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
继续探索
In recent years, the World Economic Forum has identified software security as the most significant technological risk to the world's population, as software-intensive systems process critical data and provide critical services. This raises the question of the extent to which German companies are addressing software security in developing and operating their software products. This paper reports on the results of an extensive study among developers, product owners, and managers to answer this question. Our results show that ensuring security is a multi-faceted challenge for companies, involving…
Secure software engineering is a fundamental activity in modern software development. However, while the field of security research has been advancing quite fast, in practice, there is still a vast knowledge gap between the security experts and the software development teams. After all, we cannot expect developers and other software practitioners to be security experts. Understanding how software development teams incorporate security in their processes and the challenges they face is a step towards reducing this gap. In this paper, we study how financial services companies ensure the security…
The Social Psychology of Software Security (Psycurity)
本文提出将社会心理学原理融入安全软件工程，通过分析二者关系、借鉴其他安全领域的社会心理学研究，识别当前软件安全研究空白并提出研究问题，以推动构建更稳健安全的软件系统。
Studying the Feasibility and Importance of Software Testing: An Analysis
软件测试是软件质量保证的关键要素，代表了对规格、设计和编码的最终审查。软件测试是通过运行软件来测试软件的功能性和正确性的过程。软件测试通常出于以下两个原因之一而执行：缺陷检测和可靠性评估。将软件测试应用于缺陷检测的问题在于，软件只能提示缺陷的存在，而不能提示缺陷的不存在（除非测试是详尽的）。将软件测试应用于可靠性估计的问题是用于选择测试用例的输入分布可能是有缺陷的。软件测试的关键是试图找到失败的模式-这需要在所有可能的输入上对代码进行详尽的测试。软件测试，取决于所采用的测试方法，可以在开发过程中的任何时候实施。
Security holds an important role in a software. Most people are not aware of the significance of security in software system and tend to assume that they will be fine without security in their software systems. However, the lack of security features causes to expose all the vulnerabilities possible to the public. This provides opportunities for the attackers to perform dangerous activities to the vulnerable insecure systems. This is the reason why many organizations are reported for being victims of system security attacks. In order to achieve the security requirement, developers must take tim…
To avoid software vulnerabilities, organizations are shifting security to earlier stages of the software development, such as at code review time. In this paper, we aim to understand the developers' perspective on assessing software security during code review, the challenges they encounter, and the support that companies and projects provide. To this end, we conduct a two-step investigation: we interview 10 professional developers and survey 182 practitioners about software security assessment during code review. The outcome is an overview of how developers perceive software security during c…
Model-Based Security Testing
安全测试的目的是验证与保密性、完整性、身份验证、授权、可用性和不可否认性等安全属性相关的软件系统需求。虽然安全测试技术已经存在了很多年，但很少有方法可以在更高的抽象级别上指定测试用例，以便能够指导测试识别和规范以及自动化测试生成。基于模型的安全测试（MBST）是一个相对较新的领域，特别致力于系统和有效的规范和文档的安全测试目标，安全测试用例和测试套件，以及它们的自动或半自动生成。特别是，安全建模和测试生成方法的组合仍然是一个挑战，在研究和工业应用的高度兴趣。MBST包括安全功能测试、基于模型的模糊测试、面向风险和威胁的测试以及安全测试模式的使用。本文提供了一个调查MBST技术和相关的模型，以及新的方法和工具，正在开发中的欧洲ITEA2项目钻石的样本。
Software Security Mapping Framework: Operationalization of Security Requirements
针对现有框架难将抽象安全原则转化为可执行实践的问题，本研究提出分层的软件安全映射框架，结合KAOS建模建立目标与操作的追溯关联，配套工具与机器可读模型，经案例验证可助力安全合规与风险应对。
In this paper, I describe a recent practical experience where JUnit was used for testing security bugs in addition to functional bugs. Perl scripts were also used during the exploration phase. The application being tested was mature, but insecure.
Security testing verifies that the data and the resources of software systems are protected from attackers. Unfortunately, it suffers from the oracle problem, which refers to the challenge, given an input for a system, of distinguishing correct from incorrect behavior. In many situations where potential vulnerabilities are tested, a test oracle may not exist, or it might be impractical due to the many inputs for which specific oracles have to be defined. In this paper, we propose a metamorphic testing approach that alleviates the oracle problem in security testing. It enables engineers to spec…
State-of-the-Art in Software Security Visualization: A Systematic Review
本文系统综述了软件安全可视化研究，构建了包含图形、符号、矩阵和隐喻四类的分类体系，并指出开发适应安全态势演变的创新可视化技术对增强威胁检测和指导未来研究至关重要。
Implementing software security practices is a critical concern in modern software development. Industry practitioners, security tool providers, and researchers have provided standard security guidelines and sophisticated security development tools to ensure a secure software development pipeline. But despite these efforts, there continues to be an increase in the number of vulnerabilities that can be exploited by malicious hackers. There is thus an urgent need to understand why developers still introduce security vulnerabilities into their applications and to understand what can be done to mot…
A Comprehensive Study on Automated Testing with the Software Lifecycle
本文综述了自动化测试在软件生命周期中的作用，分析其相较手动测试在效率、成本和质量评估方面的优势与差异，并探讨自动化测试工具的适用场景。
Managing Security Issues in Software Containers: From Practitioners Perspective
本文通过两项半结构化访谈研究，从软件工程从业者视角分析容器化项目中的安全挑战与管理方法，并识别出增强容器安全的技术与非技术使能因素。
Security testing aims at verifying that the software meets its security properties. In modern Web systems, however, this often entails the verification of the outputs generated when exercising the system with a very large set of inputs. Full automation is thus required to lower costs and increase the effectiveness of security testing. Unfortunately, to achieve such automation, in addition to strategies for automatically deriving test inputs, we need to address the oracle problem, which refers to the challenge, given an input for a system, of distinguishing correct from incorrect behavior. In t…
Information protection is becoming a focal point for designing, creating and implementing software applications within highly integrated technology environments. The use of a safe coding technique in the software development process is required by many industrial IT security standards and policies. Despite current cyber protection measures and best practices, vulnerabilities still remain strong and become a huge threat to every developed software. It is crucial to understand the position of secure software development for security management, which is affected by causes such as human security-…
Software components for on-board architectures in the space domain are increasingly reliant on Commercial Off-The-Shelf (COTS), Open Source (OSS) or other third party software products. However, these software components often have not been built with mission critical requirements in mind. Development project teams incorporating these products have limited knowledge of or control over the processes applied during the design, implementation, testing and maintenance of selected COTS/OSS software products. These constraints generate uncertainty of potential software induced failures. Moreover, th…
Context: Scientific software plays an important role in critical decision making, for example making weather predictions based on climate models, and computation of evidence for research publications. Recently, scientists have had to retract publications due to errors caused by software faults. Systematic testing can identify such faults in code. Objective: This study aims to identify specific challenges, proposed solutions, and unsolved problems faced when testing scientific software. Method: We conducted a systematic literature survey to identify and analyze relevant literature. We identifie…
Background: Research software plays an important role in solving real-life problems, empowering scientific innovations, and handling emergency situations. Therefore, the correctness and trustworthiness of research software are of absolute importance. Software testing is an important activity for identifying problematic code and helping to produce high-quality software. However, testing of research software is difficult due to the complexity of the underlying science, relatively unknown results from scientific algorithms, and the culture of the research software community. Aims: The goal of thi…
Survey on software testing techniques in cloud computing
云计算是互联网发展的下一个阶段。它依靠资源共享来实现网络的一致性。它作为一种新的计算标准正在影响着包括软件测试在内的多个不同的研究领域。有各种软件技术用于测试应用程序。它不仅改变了计算资源的获取方式，也改变了计算服务、技术和解决方案的管理和交付方式，同时也给软件测试带来了新的问题、挑战和需求。云中的软件测试可以减少对硬件和软件资源的需求，并为传统的软件测试过程提供灵活有效的替代方案。本文概述了云测试和基于云的应用的趋势、机遇、挑战、问题和需求。
Communicating on Security within Software Development Issue Tracking
本研究聚焦软件开发中非安全专家使用问题追踪工具的安全沟通问题，通过界面分析和用户研究发现现有工具缺乏安全相关界面，提出加入类CVSS提问可改善安全交互。
Position: How Regulation Will Change Software Security Research
本文认为新兴安全法规将改变软件安全研究，主张软件工程领域提供合规工具并加强法律学者与计算机科学家的合作，以弥合监管要求与代码级工程之间的差距。
Integrating security into agile software development is an open issue for research and practice. Especially in strongly regulated industries, complexity increases not only when scaling agile practices but also when aiming for compliance with security standards. To achieve security compliance in a large-scale agile context, we developed S2C-SAFe: An extension of the Scaled Agile Framework that is compliant to the security standard IEC~62443-4-1 for secure product development. In this paper, we present the framework and its evaluation by agile and security experts within Siemens' large-scale pro…
Testing Research Software: An In-Depth Survey of Practices, Methods, and Tools
本研究深入调查了研究软件的测试实践、挑战与工具使用情况，发现开发者面临测试用例设计与输出正确性评估等主要挑战且对现有工具不熟悉，指出需提供定制化标准测试工具与资源支持以改进测试过程。
Testing Is Not Boring: Characterizing Challenge in Software Testing Tasks
本文通过调研软件测试专业人员，刻画测试任务中的挑战性来源及其影响，指出适度的创造力、学习与时间压力可提升动机，而挑战不足或负荷过高则带来挫败与疏离。
Context: With the rising complexity and scale of software systems, there is an ever-increasing demand for sophisticated and cost-effective software testing. To meet such a demand, there is a need for a highly-skilled software testing work-force (test engineers) in the industry. To address that need, many university educators worldwide have included software-testing education in their software engineering (SE) or computer science (CS) programs. Objective: Our objective in this paper is to summarize the body of experience and knowledge in the area of software-testing education to benefit the rea…
Today's software systems like cyber-physical production systems or big data systems have to process large volumes and diverse types of data which heavily influences the quality of these so-called data-intensive systems. However, traditional software testing approaches rather focus on functional behavior than on data aspects. Therefore, the role of data in testing has to be rethought and specific testing approaches for data-intensive software systems are required. Thus, the aim of this chapter is to contribute to this area by (1) providing basic terminology and background on data-intensive soft…
Industry Expectations and Skill Demands in Quantum Software Testing
本研究分析了量子软件测试领域的行业需求与技能要求，揭示了传统软件质量保证与实验验证的结合，强调校准、控制及混合量子-经典验证的重要性。
Myths and Facts about a Career in Software Testing: A Comparison between Students' Beliefs and Professionals' Experience
本研究比较了本科生对软件测试职业的信念与专业人士的实际经验，发现测试职业更令人兴奋且回报丰厚，呼吁学术界与行业合作纠正学生认知。
As software systems are becoming more pervasive, they are also becoming more susceptible to failures, resulting in potentially lethal combinations. Software testing is critical to preventing software failures but is, arguably, the least understood part of the software life cycle and the toughest to perform correctly. Adequate research has been carried out in both the process and technology dimensions of testing, but not in the human dimensions. This paper attempts to fill in the gap by exploring the human dimension, i.e., trying to understand the motivation of software professionals to take up…
Sentiment Overflow in the Testing Stack: Analysing Software Testing Posts on Stack Overflow
本文通过挖掘和分析Stack Overflow上的情感帖子，从从业者角度调查软件测试背景，发现不安全感、绝望和渴望等情感会影响其对测试的态度，并与项目复杂度等因素相关。
A Survey on Software Testing Techniques using Genetic Algorithm
软件行业的总体目标是确保向最终用户交付高质量的软件。为了保证软件的高质量，需要对软件进行测试。测试确保软件满足用户规范和要求。然而，软件测试领域存在许多需要解决的潜在问题，例如测试用例的有效生成、测试用例的优先级排序等。这些问题需要测试的努力，时间和成本。已经提出了不同的技术和方法来处理这些问题。利用进化算法自动生成测试一直是许多研究人员感兴趣的领域。遗传算法（GA）就是这样一种进化算法。在这篇研究论文中，我们提出了一个调查的GA方法来解决软件测试过程中遇到的各种问题。
This study attempts to understand motivators and de-motivators that influence the decisions of software students to take up and sustain software testing careers across three different Asian countries, i.e., China, India, and Malaysia. The re-search question can be framed as How many software students across different Asian geographies are keen to take up testing careers, and what are the reasons for their choices? Towards an answer, we developed a cross-sectional but simple survey-based instrument. In this work, we investigated how software students perceived the software testing role. The res…
Secure development process is a procedure taken by developers to ensure the programs developed are following the general security standards and will always be up to date so that the outcomes are well secured and obedient. As a software developer, it is very crucial to implement and develop a highly secured and reliable program for clients and users. In this current digital world where everything is advancing faster than we can ever think of, most of the old security policies can no longer be implemented alone. The consequences and impacts that could be brought upon a company are really huge if…
Best Practices for Facing the Security Challenges of Internet of Things Devices Focusing on Software Development Life Cycle
本研究针对物联网设备日益增长的安全威胁，提出了聚焦于安全软件开发生命周期的最佳实践指南，旨在提高威胁意识并为保护物联网软件及处理漏洞提供坚实基础。
Searching publications on software testing
本说明涉及检索出版物，其中的实用概念的测试进行的实践中的软件测试是正式的，一个理论关于软件测试的基础上，这样一个正式的介绍，或它是证明了这样一个理论的基础上，有坚实的理由测试软件的情况下，在原则上其他形式的分析可以使用。本说明报告了搜寻的方式和主要结果。这篇文章的信息是软件测试的基础在某些方面还不完整。
Model-Based Testing of Safety Critical Real-Time Control Logic Software
本文介绍了作者在安全关键的实时的【形】控制逻辑软件的基于模型的测试方面的经验。它描述了相应的工业设置的细节，并讨论了在这些设置中使用基于UniTESK模型的测试技术的技术细节。最后，我们讨论了安全关键软件开发过程的未来可能的方向和基于模型的测试技术在其中的地位。
Automated Software Testing Using Metahurestic Technique Based on An Ant Colony Optimization
软件测试是软件开发生存周期中重要而有价值的一部分。由于时间，成本和其他情况，详尽的测试是不可行的，这就是为什么有必要自动化的软件测试过程。状态转换测试（STT）是实时的、嵌入式的、基于Web的软件系统中常用的测试方法。本文的目的是提出一种算法，通过应用蚁群优化技术，生成最佳和最小的测试序列的行为规格说明的软件。本文提出的方法生成测试序列，以获得完整的软件覆盖率。本文还讨论了基于转换的测试的两种元启发式技术（遗传算法和蚁群优化）之间的比较
Software testing is vital to improve software quality. However, software tester role is stigmatized, partly due to misperception and partly due to the treatment of the testing process within the software industry. The present study analyses this situation aiming to explore what might inhibit an individual from taking up a software testing career. In order to investigate this issue, we surveyed 132 senior students pursuing degrees in information systems, information and communication technology, computer science, computer engineering, software engineering, and other closely-related disciplines …
What Pakistani Computer Science and Software Engineering Students Think about Software Testing?
本研究通过调查88名巴基斯坦计算机科学与软件工程专业学生，分析软件测试职业不受欢迎的原因，发现测试角色兼具社会污名与技术属性。
A Survey of Third-Party Library Security Research in Application Software
本文综述了应用软件中第三方库的使用、生态系统、检测与防御加固研究，总结了现有成果与未来方向，旨在帮助开发者防范安全风险并促进软件生态健康发展。
Static Application Security Testing (SAST) is a popular quality assurance technique in software engineering. However, integrating SAST tools into industry-level product development and security assessment poses various technical and managerial challenges. In this work, we reported a longitudinal case study of adopting SAST as a part of a human-driven security assessment for an open-source e-government project. We described how SASTs are selected, evaluated, and combined into a novel approach for software security assessment. The approach was preliminarily evaluated using semi-structured interv…
Humor in Software Testing Education
本研究通过引入幽默元素到软件测试作业中，发现幽默能显著提升学生的情感参与、归属感和创造性思维，尤其对女生效果更明显。
Requirements Engineering, Software Testing and Education: A Systematic Mapping
本文通过系统性映射研究，梳理教育情境中需求工程与软件测试被结合探讨的方式。
A Blockchain-Based Framework for Distributed Agile Software Testing Life Cycle
针对分布式敏捷测试中的信任、追溯、安全及单元测试缺失问题，提出基于私有 Ethereum 与智能合约的 TestingPlus 框架，以支持透明验收测试和公平支付验证。
This paper attempts to understand motivators and de-motivators that influence the decisions of software professionals to take up and sustain software testing careers across four different countries, i.e. Canada, China, Cuba, and India. The research question can be framed as "How many software professionals across different geographies are keen to take up testing careers, and what are the reasons for their choices?" Towards that, we developed a cross-sectional but simple survey-based instrument. In this study we investigated how software testers perceived and valued what they do and their envir…
Applying FCA toolbox to Software Testing
软件测试使用各种不同的工具来增强定义被测系统质量的复杂过程。形式概念分析（FCA）为我们提供了从一组对象及其属性导出形式本体的算法。使用FCA可以大大提高测试用例生成的效率。此外，基于FCA的机器学习系统支持回归测试结果的分析。
Software testing is one of the crucial supporting processes of software life cycle. Unfortunately for the software industry, the role is stigmatized, partly due to misperception and partly due to treatment of the role in the software industry. The present study aims to analyse this situation to explore what inhibit an individual from taking up a software testing career. In order to investigate this issue, we surveyed 82 senior students taking a degree in information technology, information and communication technology, and computer science at two Malaysian universities. The subjects were asked…
Elevating Software Quality in Agile Environments: The Role of Testing Professionals in Unit Testing
本文采用基于调查的研究方法，探讨了工业背景下测试工程师参与单元测试的情况，发现测试专业人员通过与开发人员合作制定详尽测试用例并培养相互学习文化，有助于提升敏捷环境下软件项目的整体质量。
Context: While many companies conduct their software testing activities in-house, many other companies outsource their software testing needs to other firms who act as software testing service providers. As a result, Testing as a Service (TaaS) has emerged as a strong service industry in the last several decades. In the context of software testing services, there could be various challenges (e.g., during the planning and service delivery phases) and, as a result, the quality of testing services is not always as expected. Objective: It is important, for both providers and also customers of test…
Context: Software testing plays an essential role in product quality improvement. For this reason, several software testing models have been developed to support organizations. However, adoption of testing process models inside organizations is still sporadic, with a need for more evidence about reported experiences. Aim: Our goal is to identify results gathered from the application of software testing models in organizational contexts. We focus on characteristics such as the context of use, practices applied in different testing process phases, and reported benefits & drawbacks. Method: We pe…
Research software is often developed by individual researchers or small teams in parallel to their research work. The more people and research projects rely on the software in question, the more important it is that software updates implement new features correctly and do not introduce regressions. Thus, developers of research software must balance their limited resources between implementing new features and thoroughly testing any code changes. We present the processes we use for developing the distributed integration framework RCE at DLR. These processes aim to strike a balance between autom…
The "4W+1H" of Software Supply Chain Security Checklist for Critical Infrastructure
针对关键基础设施领域现有软件供应链安全实践碎片化、适配性不足的问题，本文通过多源文献综述，采用“4W+1H”方法梳理十大类安全实践并映射多维度属性，最终形成含80个问题的多层级安全清单，填补了领域适配性空白。
Several disastrous security attacks can be attributed to delays in patching software vulnerabilities. While researchers and practitioners have paid significant attention to automate vulnerabilities identification and patch development activities of software security patch management, there has been relatively little effort dedicated to gain an in-depth understanding of the socio-technical aspects, e.g., coordination of interdependent activities of the patching process and patching decisions, that may cause delays in applying security patches. We report on a Grounded Theory study of the role of…
DDTS: A Practical System Testing Framework for Scientific Software
许多科学软件项目对其代码的测试不充分，或者根本没有测试。尽管其众所周知的好处，采用常规测试往往并不容易。开发团队可能对建立有效的测试过程、编写测试软件或处理日益复杂的测试用例有疑问。它们可能需要在受限的HPC平台上运行（和测试）。他们几乎肯定会面临时间和预算的压力，这可能会使测试在他们的待办事项列表的底部徘徊。本文介绍了DDTS，一个用于构建测试套件应用程序的框架，旨在满足科学软件项目的需求。DDTS旨在简化严格测试的引入，并随着需求的成熟而缓解成长的烦恼。它将测试问题分解为实用、直观的阶段;易于配置和扩展;可移植且适用于HPC平台;并利用并行性。DDTS目前用于自动化回归和开发人员预提交测试，用于具有不同测试需求的几个科学软件项目。
This preprint specifies supplementary material and the results of a comparative, syntactic, and semantic study of terms for three software testing glossaries. The three software testing glossaries are: the ISO 29119-1, Concepts and definitions standard, the Standard Glossary of Terms used in Software Testing (version 3.5) by the International Software Testing Qualifications Board (ISTQB), and the glossary provided by the Test Maturity Model integration (TMMi) Foundation. First, we categorized the glossaries terms by analyzing their given semantics into 8 categories, namely: test project, strat…
Digital transformation is a hot topic in the current global environment as a large number of organizations have been working to adopt digital solutions. Software engineering has also emerged to be a more important role as a large number of systems, either traditional or smart, are dependent on the software that collects, store, and process data. The role of software engineers has also become crucial in digital transformation. In this regard, this paper aims to examine the trends of software engineering and the role of software engineers in digital transformation. In addition to this, this pape…
This paper presents the core principles of reliability in software engineering - outlining why reliability testing is critical and specifying the process of measuring reliability. The paper provides insight for both novice and experts in the software engineering field for assessing failure intensity as well as predicting failure of software systems. Measurements are conducted by utilizing information from an operational profile to further enhance a test plan and test cases, all of which this paper demonstrates how to implement.
Non Homogeneous Poisson Process Model based Optimal Modular Software Testing using Fault Tolerance
在软件开发过程中，我们会遇到各种模块。提出了软件不同模块优先级的思想，使重要模块优先测试。这种方法是可取的，因为由于时间和成本的限制，不可能对每个模块进行回归测试。本文讨论了在非齐次Poisson过程的基础上，对软件的几个模块进行优先级排序所需的参数，给出了测试时间和成本最优的度量。
Context: Software security patch management purports to support the process of patching known software security vulnerabilities. Given the increasing recognition of the importance of software security patch management, it is important and timely to systematically review and synthesise the relevant literature on this topic. Objective: This paper aims at systematically reviewing the state of the art of software security patch management to identify the socio-technical challenges in this regard, reported solutions (i.e., approaches, tools, and practices), the rigour of the evaluation and the indu…
扫码添加微信好友，提出您的宝贵建议 👇
💡 备注请填写：网站反馈
发表机构由 AI 从论文文本抽取，如发现错误，欢迎反馈修正建议。