GENERATING COVERAGE METRICS FOR BLACK-BOX TESTING

摘要

Generating coverage metrics for black-box testing includes performing static analysis of a program code to be tested. The static analysis includes identifying variables whose value depends on inputs of the program code. Code blocks are inserted into the program code to be tested. The code blocks insert vulnerabilities into the code at locations where the variables are modified. The code blocks violate one or more properties to be tested. A testing scan is applied to the program code and vulnerabilities are located by the test. A coverage metric is output based on the ratio of the located vulnerabilities to the total number of inserted vulnerabilities in the program code.

主权项

1. A method for generating coverage metrics for black-box testing, comprising:
performing static analysis of a program code to be tested, wherein the static analysis includes identifying variables whose value depends on inputs of the program code; inserting code blocks into the program code to be tested, wherein the code blocks insert vulnerabilities into the code at locations where the variables are modified and wherein the code blocks violate one or more properties to be tested; applying a testing scan to the program code and determining a number of vulnerabilities located by the test; and outputting a coverage metric based on the ratio of the located vulnerabilities to the total number of inserted vulnerabilities in the program code.