Abstract:The security of an application is critical for its success, as breaches cause loss for organizations and individuals. Search-based software security testing (SBSST) is the field that utilizes metaheuristics to generate test cases for the software testing for some pre-specified security test adequacy criteria This paper conducts a systematic literature review to compare metaheuristics and fitness functions used in software security testing, exploring their distinctive capabilities and impact on vulnerability detection and code coverage. The aim is to provide insights for fortifying software systems against emerging threats in the rapidly evolving technological landscape. This paper examines how search-based algorithms have been explored in the context of code coverage and software security testing. Moreover, the study highlights different metaheuristics and fitness functions for security testing and code coverage. This paper follows the standard guidelines from Kitchenham to conduct SLR and obtained 122 primary studies related to SBSST after a multi-stage selection process. The papers were from different sources journals, conference proceedings, workshops, summits, and researchers' webpages published between 2001 and 2022. The outcomes demonstrate that the main tackled vulnerabilities using metaheuristics are XSS, SQLI, program crash, and XMLI. The findings have suggested several areas for future research directions, including detecting server-side request forgery and security testing of third-party components. Moreover, new metaheuristics must also need to be explored to detect security vulnerabilities that are still unexplored or explored significantly less. Furthermore, metaheuristics can be combined with machine learning and reinforcement learning techniques for better results. Some metaheuristics can be designed by looking at the complexity of security testing and exploiting more fitness functions related to detecting different vulnerabilities.

Systematization of Vulnerability Discovery Knowledge: Review Protocol

A systematic literature review of software vulnerability detection

System Security Assurance: A Systematic Literature Review

Data Preparation for Software Vulnerability Prediction: A Systematic Literature Review

Advancing Understanding of Vulnerability Assessment in Process Industries: A Systematic Review of Methods and Approaches

On Vulnerability and Security Log analysis: A Systematic Literature Review on Recent Trends

Ecosystem Vulnerability Review: Proposal of an Interdisciplinary Ecosystem Assessment Approach

Vulnerability discovery based on source code patch commit mining: a systematic literature review

Review of Applications of Vulnerability Assessments to Saltmarsh, Beach, and Mixed Shoreline Systems

A Survey on Software Vulnerability Exploitability Assessment

Microservice Vulnerability Analysis: A Literature Review with Empirical Insights

A metric for software vulnerabilities classification

A Historical and Statistical Studyof the Software Vulnerability Landscape

Literature review on vulnerability detection using NLP technology

Half-Day Vulnerabilities: A study of the First Days of CVE Entries

Knowledge-based Risk Management: A Systematic Literature Review

Software Vulnerability Analysis Using CPE and CVE

A Comparative Analysis of Vulnerability Management Tools: Evaluating Nessus, Acunetix, and Nikto for Risk Based Security Solutions

Smart Contract Vulnerabilities, Tools, and Benchmarks: An Updated Systematic Literature Review

A systematic literature review on software security testing using metaheuristics

Systematic Security Guideline Framework through Intelligently Automated Vulnerability Analysis