There is, I think, something ethereal about i —the square root of minus one. I remember first hearing about it at school. It seemed an odd beast at that time—an intruder hovering on the edge of reality.

Usually familiarity dulls this sense of the bizarre, but in the case of i it was the reverse: over the years the sense of its surreal nature intensified. It seemed that it was impossible to write mathematics that described the real world in …

I and i

物件導向軟體之架構(Object-Oriented Software Construction)探討

We present a new tool, named DART, for automatically testing software that combines three main techniques: (1) automated extraction of the interface of a program with its external environment using static source-code parsing; (2) automatic generation of a test driver for this interface that performs random testing to simulate the most general environment the program can operate in; and (3) dynamic analysis of how the program behaves under random testing and automatic generation of new test inputs to direct systematically the execution along alternative program paths. Together, these three techniques constitute Directed Automated Random Testing, or DART for short. The main strength of DART is thus that testing can be performed completely automatically on any program that compiles -- there is no need to write any test driver or harness code. During testing, DART detects standard errors such as program crashes, assertion violations, and non-termination. Preliminary experiments to unit test several examples of C programs are very encouraging.

/pdf/dart-directed-automated-random-testing-eurqznyu0u.pdf

DART: directed automated random testing

Knowledge Management

In unit testing, a program is decomposed into units which are collections of functions. A part of unit can be tested by generating inputs for a single entry function. The entry function may contain pointer arguments, in which case the inputs to the unit are memory graphs. The paper addresses the problem of automating unit testing with memory graphs as inputs. The approach used builds on previous work combining symbolic and concrete execution, and more specifically, using such a combination to generate test inputs to explore all feasible execution paths. The current work develops a method to represent and track constraints that capture the behavior of a symbolic execution of a unit with memory graphs as inputs. Moreover, an efficient constraint solver is proposed to facilitate incremental generation of such test inputs. Finally, CUTE, a tool implementing the method is described together with the results of applying CUTE to real-world examples of C code.

/pdf/cute-a-concolic-unit-testing-engine-for-c-348f3tgo6g.pdf

CUTE: a concolic unit testing engine for C

31 Introduction 42 What is Malware? 4 2.1 Who are the Users and Creators of Malware? . . . . . . . . . . . . . . . 6 3 The Malware Detector 64 Malware Detection Techniques 7 4.1 Anomaly-based Detection . . . . . . . . . . . . . . . . . . . . . . . . . . 94.1.1 Dynamic Anomaly-based Detection . . . . . . . . . . . . . . . . 104.1.2 Static Anomaly-based Detection . . . . . . . . . . . . . . . . . . 154.1.3 Hybrid Anomaly-based Detection . . . . . . . . . . . . . . . . . . 164.2 Speciﬁcation-based Detection . . . . . . . . . . . . . . . . . . . . . . . . 184.2.1 Dynamic Speciﬁcation-based Detection . . . . . . . . . . . . . . 184.2.2 Static Speciﬁcation-based Detection . . . . . . . . . . . . . . . . 264.2.3 Hybrid Speciﬁcation-based Detection . . . . . . . . . . . . . . . 284.3 Signature-based detection . . . . . . . . . . . . . . . . . . . . . . . . . . 314.3.1 Dynamic Signature-based Detection . . . . . . . . . . . . . . . . 334.3.2 Static Signature-based Detection . . . . . . . . . . . . . . . . . . 344.3.3 Hybrid Signature-based Detection . . . . . . . . . . . . . . . . . 38

A Survey of Malware Detection Techniques

This paper presents the SWaT testbed, a modern industrial control system (ICS) for security research and training SWaT is currently in use to (a) understand the impact of cyber and physical attacks on a water treatment system, (b) assess the effectiveness of attack detection algorithms, (c) assess the effectiveness of defense mechanisms when the system is under attack, and (d) understand the cascading effects of failures in one ICS on another dependent ICS SWaT consists of a 6-stage water treatment process, each stage is autonomously controlled by a local PLC The local fieldbus communications between sensors, actuators, and PLCs is realized through alternative wired and wireless channels While the experience with the testbed indicates its value in conducting research in an active and realistic environment, it also points to design limitations that make it difficult for system identification and attack detection in some experiments

SWaT: a water treatment testbed for research and training on ICS security

This paper presents a dataset to support research in the design of secure Cyber Physical Systems (CPS). The data collection process was implemented on a six-stage Secure Water Treatment (SWaT) testbed. SWaT represents a scaled down version of a real-world industrial water treatment plant producing 5 gallons per minute of water filtered via membrane based ultrafiltration and reverse osmosis units. This plant allowed data collection under two behavioral modes: normal and attacked. SWaT was run non-stop from its “empty” state to fully operational state for a total of 11-days. During this period, the first seven days the system operated normally i.e. without any attacks or faults. During the remaining days certain cyber and physical attacks were launched on SWaT while data collection continued. The dataset reported here contains the physical properties related to the plant and the water treatment process, as well as network traffic in the testbed. The data of both physical properties and network traffic contains attacks that were created and generated by our research team.

A Dataset to Support Research in the Design of Secure Water Treatment Systems

Basic ApproachFoundations of Software Testing is the premiere example-based text and reference for establishing sound engineering practices in test generation, selection, minimization and enhancement, for software projects ranging from the most simple to the highly complex, to those used by government agencies such as the FAA. Foundations of Software Testing also covers data-flow based adequacy and mutation-based adequacy, which are the most powerful of the available test adequacy criteria. It distills knowledge developed by hundreds of testing researchers and practitioners from all over the world and brings it to readers in an easy to understand form.Test generation, selection, priortization and assessment lie at the foundation of all technical activities that arise in a test process. Appropriate deployment of the elements of this strong foundation enables the testing of different types of software applications, including Object Oriented systems, Web services, graphical user interfaces, embedded systems, as well as properties relating to security, performance, and reliability. With over 200 examples and exercises of mathematical, step-by-step approaches, Foundations describes a wide variety of testing techniqes, including finite state models, combinatorial designs, and minimization for regression testing.Table of ContentsPart I: PRELIMINARIES1. Basics of Software TestingPart II: TEST GENERATION2. Test Generation from Requirements3. Test Generation from Finite-State Models4. Test Generation from Combinatorial Designs5. Test Selection, Minimization and Prioritization for Regression TestingPart III: TEST ADEQUACY ASSESSMENT AND ENHANCEMENT6. Test-Adequacy: Assessment Using Control Flow and Data Flow7. Test Adequacy Assessment Using Program MutationAbout the AuthorAditya P. Mathur is Professor and Head, Department of Computer Science, at Purdue University. He is one of the founders of the department of Computer Science at BITS, Pilani, India where he designed, developed, and taught the first course on microprocessors to undergraduate students from his seminal book Introduction to Microprocessors. Dr. Mathur has been a prolific researcher with over 100 published works in international journals and conferences. His key contributions include a multilingual computer, the saturation effect in software testing, a theory of software cybernetics, and novel techniques for the estimation of software reliability.Students, practitioners, and researchers will find this book an excellent source of simple to advanced techniques to use and improve their knowledge of and expertise in software testing.Praise for Foundations of Software Testing:"The book describes techniques in a lucid manner with great clarity with the help of numerous examples. Illustration of the techniques through appropriate examples makes the book very easy to study and assimilate the deep concepts and thus a unique book in the area of software testing.", Ashish Kundu, Graduate Student, Department of Computer Science, Purdue University." As a teacher of software testing and validation, I had to search for books that can be used as references in my class and I found that "Foundations of Software Testing" is the best one for at least the following reasons:- It covers a wide range of concepts related to software testing.- It introduces the different concepts smoothly with examples illustrating them. This helps students a lot in understanding the ideas behind each concept introduced.- The exercises at the end of each chapter test if the students understood the concepts properly and as expected.- The references of the book and the discussion at the end of each chapter both give the reader an opportunity to learn more. The slides are well prepared and organized. This facilitates the task of the professor when lecturing.", Professor Abdeslam En-nouaary, Concordia University."This book teaches software testing as a science and not as an art. It not only presents an engineering approach for handling different testing tasks but, also sets up the formal framework for the presented technique. Thus when compared to other books on testing it can be readily used as a resource by both practitioners and researchers which in my view is the real strength of this book.Initially I thought that there is still much that can be added to this book, but seeing the list of chapters that would be added in subsequent volumes I believe that for the complete set of volumes it would be very difficult to suggest drastic improvements.", Ammar Masood, Graduate student, Department of Electrical and Computer Engineering, Purdue University."So far, I like your book. Plenty of definitions and terminology that is clearly presented." Christine Ayers, undergraduate student, UT Dallas.

Foundations of Software Testing

Size and code coverage are important attributes of a set of tests. When a program P is executed on elements of the test set T, we can observe the fault detecting capability of T for P. We can also observe the degree to which T induces code coverage on P according to some coverage criterion. We would like to know whether it is the size of T or the coverage of T on P which determines the fault detection effectiveness of T for P. To address this issue we ask the following question: While keeping coverage constant, what is the effect on fault detection of reducing the size of a test set? We report results from an empirical study using the block and all-uses criteria as the coverage measures.

Aditya P. Mathur

Papers

A Survey of Malware Detection Techniques

SWaT: a water treatment testbed for research and training on ICS security

A Dataset to Support Research in the Design of Secure Water Treatment Systems

Foundations of Software Testing

Effect of test set minimization on fault detection effectiveness