Detecting Integer Bugs without Oracle Based on Metamorphic Testing Technique

Abstract:

Integer bugs are considered to be the rising threat to mission-critical software. For the oracle problem, testers always ignore integer bugs unless program throws an exception obviously. In this paper, we propose a general procedure based on metamorphic testing to detect integer bugs without oracle and a strategy of the metamorphic relation selection as the complement to T.Y.Chen’ one. The experiment result shows that our approach can detect some invisible mission-critical software failures caused by integer bugs, which are difficult to be found in conventional formal method.

• Periodical: Applied Mechanics and Materials (Volumes 121-126)
• Pages: 1961-1965
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.121-126.1961
• Online since: October 2011
• Authors: Song Huang, Meng Yu Ji, Zhan Wei Hui, Yi Ting Duanmu
• Keywords: Integer Bugs, Metamorphic Testing, Mission-Critical Software, Test Oracle

References

[1] David Brumley, Tzi-cker Chiueh and Robert Johnson. RICH: Automatically Protecting Against Integer-Based Vulnerabilities. In Proceedings of the 14th Annual Network and Distributed System Security, Symposium ( NDSS07). (2007).

[2] Robert C. Sercord. Secure Coding in C and C++. Addison Wesley& Person Education Asia Limited, p.116, (2006).

[3] Fanping Zeng, Liangliang Mao, Zhide Chen and Qing Cao. Mutation-based Testing of Integer Overflow Vulnerabilities. In Proceedings. The 5th International Conference on Wireless Communications, Networking and Mobile Computing. WiCOM (Sept. 24-26, 2009. Beijing, China) , IEEE , (2009).

DOI: 10.1109/wicom.2009.5302048

[4] T. Y. Chen, S. C. Cheung, and S.M. Yiu. Metamorphic testing: a new approach for generating next test cases. Technical Report HKUST-CS98-01, Dept. of Computer Science, Hong Kong Univ. of Science and Technology, (1998).

[5] T.Y. Chen, F. C Kuo, T.H. Tse and Zhi Quan Zhou. Metamorphic Testing and Beyond. In Proceedings of the International Workshop on Software Technology and Engineering Practice (STEP 2003), (2003).

DOI: 10.1109/step.2003.18

[6] Guowei Dong, Shizhong Wu, Guisi Wang, Tao Guo and Yonggang Huang, Security Assurance with Metamorphic Testing and Genetic Algorithm. In Proceeding of IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology, (2010).

DOI: 10.1109/wi-iat.2010.101

[7] Chen T Y, Huang D H and Tse T H. Case studies on the selection of useful relations in metamorphic testing. In Proceeding of the 4th Ibero-American Symposium on Software Engineering and Knowledge Engineering(JIISIC 2004), Polytechnic University of Madrid, Madrid Spain, p.569.

[8] Arnaud Gotlieb. TCAS software verification using Constraint Programming. The Knowledge Engineering Review, 00(0), p.1–15, (2009).

[9] Wu P, Shi XC, Tang JJ, Lin HM and Chen TY. Metamorphic testing and special case testing: A case study. Journal of Software, 16(7): p.1210−1220, (2005).

DOI: 10.1360/jos161210