Proposing SQL Statement Coverage Metrics

DMCA

Proposing SQL Statement Coverage Metrics (2008)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Ben Smith , Yonghee Shin , Laurie Williams

Venue:	in Software Engineering for Secure Systems (SESS2008), colocated with ICSE 2008
Citations:	3 - 2 self

BibTeX

@INPROCEEDINGS{Smith08proposingsql,
    author = {Ben Smith and Yonghee Shin and Laurie Williams},
    title = {Proposing SQL Statement Coverage Metrics},
    booktitle = {in Software Engineering for Secure Systems (SESS2008), colocated with ICSE 2008},
    year = {2008},
    pages = {49--56}
}

OpenURL

Abstract

An increasing number of cyber attacks are occurring at the application layer when attackers use malicious input. These input validation vulnerabilities can be exploited by (among others) SQL injection, cross site scripting, and buffer overflow attacks. Statement coverage and similar test adequacy metrics have historically been used to assess the level of functional and unit testing which has been performed on an application. However, these currently-available metrics do not highlight how well the system protects itself through validation. In this paper, we propose two SQL injection input validation testing adequacy metrics: target statement coverage and input variable coverage. A test suite which satisfies both adequacy criteria can be leveraged as a solid foundation for input validation scanning with a blacklist. To determine whether it is feasible to calculate values for our two metrics, we perform a case study on a web healthcare application and discuss some issues in implementation we have encountered. We find that the web healthcare application scored 96.7 % target statement coverage and 98.5 % input variable coverage.

Keyphrases

sql statement coverage metric input variable coverage web healthcare application target statement coverage similar test adequacy metric cyber attack solid foundation cross site scripting application layer adequacy metric malicious input case study sql injection overflow attack statement coverage currently-available metric input validation vulnerability test suite sql injection input validation input validation

DMCA