Abstract:This issue contains two papers. The first paper focuses on combinatorial testing, and the second one focuses on model checking. The first paper, ‘Combinatorial methods for dynamic grey-box SQL injection testing’ by Bernhard Garn, Jovan Zivanovic, Manuel Leithner and Dimitris E. Simos, concerns combinatorial testing for SQL injection. Code injections attacks, and in particular SQL injection (SQLi) attacks, are still among the most critical threats for web applications. These attacks rely on exploiting vulnerabilities, which must be actively chased to deploy a secure system. Leveraging combinatorial testing, the authors propose novel attack grammars to generate SQLi attacks against MySQL-compatible databases. One originality of this contribution resides in dynamically optimizing and improving the attack grammars to the context. This context-sensitive adaptation technique is supported by a prototype tool named SQLInjector+ and is validated and benchmarked on a representative set of web applications under test. The contribution is accompanied by a nice addition to the field: a simple framework called WAFTF for testing the filtering techniques of web application firewalls such as ModSecurity. (Recommended by Yves Le Traon) The second paper, ‘Comprehensive evaluation of file systems robustness with SPIN model checking’ by Jingcheng Yuan, Toshiaki Aoki and Xiaoyun Guo, presents a study that comprehensively evaluates the robustness of file systems using a model checking approach, covering the majority of the mainstream file system types and both single-thread and multi-thread modes. In particular, to abstract real file systems, the authors developed Promela models optimized to avoid state explosion during model checking and used an SPIN model checker to check these models for detecting corner-case errors during an unexpected power outage. The authors analysed counterexamples generated by model checking to determine an improved file system model that is capable of preventing errors in most mainstream file system types and then rechecked the improved file system model and verified the absence of all critical errors. (Recommended by Moonzoo Kim)

Model Checking Java Concurrent Programs

Effective code coverage in compositional systematic dynamic testing

Checking Method of Large-scale Concurrent Program Model

Parallel Software Model Checking

jpf-concurrent: An extension of Java PathFinder for java.util.concurrent

Experimental Evaluation of Statistical Model Checking Methods for Probabilistic Timing Analysis of Multiprocessor Systems

Survey and Analysis of Debugging Concurrecy Bug

Combining Model Learning and Model Checking to Analyze Java Libraries

Verifying Parallel Low-Level Programs for Multi-core Processor

Online Model Checking for Dependable Real-Time Systems

Methods to Model-Check Parallel Systems Software

Fixing, Preventing, and Recovering from Concurrency Bugs

A Fully Parallel Approach of Model Checking Via Probe Machine

Source-oriented Software Model Checking and Its Implementation

OBJ-D:An Object-centric Concurrency Bug Detection Framework for Java

Abstraction-based model checking programs

Towards Code Generation from Design Models.

Slicing Concurrent Java Programs

Survey for Stochastic Model Checking

Combinatorial Testing and Model Checking

Model Checking in Bits and Pieces