ToCaMS 2020

Systematic and holistic approaches for handling variability throughout and beyond engineering are required in many industrial domains. Products for these domains are often safety-critical and require significant effort in validation and verification, particular testing. This talks will introduce how pure::variants, our Variant Management product, assists/supports testing of Product Lines. We will also look at ideas how to exploit variability information beyond what is possible in todays commercial solutions for Product Line Engineering. Despite being a talk given virtually and possible technical challenges, my intention is to interact with the scientific experts in the field ( aka you) during this talk.

Danilo Beuche

Leipzig University

Reported vulnerabilities have grown significantly over the recent years, with SQL injection (SQLi) being one of the most prominent, especially in web applications. For these, such increase can be explained by the integration of multiple software parts (e.g., various plugins and modules), often developed by different organizations, composing thus web application variants. Machine Learning has the potential to be a great ally on finding vulnerabilities, aiding experts by reducing the search space or even by classifying programs on their own. However, previous work usually does not consider SQLi or utilizes techniques hard to scale. Moreover, there is a clear gap in vulnerability detection with machine learning for PHP, the most popular server-side language for web applications. This paper presents a Deep Learning model able to classify PHP slices as vulnerable (or not) to SQLi. As slices can belong to any variant, we propose the use of an intermediate language to represent the slices and interpret them as text, resorting to well-studied Natural Language Processing (NLP) techniques. Preliminary results of the use of the model show that it can discover SQLi, helping programmers and precluding attacks that would eventually cost a lot to repair.

Link to Publication: https://doi.org/10.1109/ICSTW50294.2020.00083

Ana Fidalgo

LASIGE, Faculdade de Ciências da Universidade de Lisboa

Portugal

Ibéria Medeiros

LaSIGE, Faculdade de Ciências da Universidade de Lisboa

Portugal

Paulo Antunes

LASIGE, Faculdade de Ciências da Universidade de Lisboa

Portugal

Nuno Neves

DI FC UL

Portugal

Combinatorial test design is one common test design methods. In its original version, it lacks support for product lines and variants. In this work we propose an enhanced combinatorial test design considering product variants. We show how to integrate the proposal into a commercial test design tool for the classification tree method.

Link to Publication: https://doi.org/10.1109/ICSTW50294.2020.00085

Vladimir Schmidt

Expleo Germany GmbH, Berlin

Germany

Peter M. Kruse

Expleo Group

Germany

Cloud providers offer a wide variety of services to their tenants. Providers share large scale infrastructures to host their services and use configurable software customized with configurations to meet different tenant requirements. These configurations are often the main source of errors. Moreover, they undergo frequent changes, therefore, systems’ compliance to requirements needs to be re-evaluated frequently using regression testing. The problem of regression test case selection has been extensively addressed in the literature, however, existing approaches do not tackle the problem from the configuration perspective. In this paper, we propose a configuration-based method for regression test suite reduction for cloud systems. Our method targets a set of faults summarized in a fault model, and it relies on a classification of configuration parameters based on their relation to the deployment environment. Our idea is that the relation of the configuration parameters to the environment can be explored to reduce the regression test suite.

Link to Publication: https://doi.org/10.1109/ICSTW50294.2020.00084

Oussama Jebbar

Gina Cody School of Engineering and Computer Science, Concordia University, Montreal

Canada

Mohamed Aymen Saied

Concordia University

Ferhat Khendek

 Concordia University

Maria Toeroe

Ericsson Inc, Montreal

Canada