Abstract:This issue contains two papers. The first paper focuses on combinatorial testing, and the second one focuses on model checking. The first paper, ‘Combinatorial methods for dynamic grey-box SQL injection testing’ by Bernhard Garn, Jovan Zivanovic, Manuel Leithner and Dimitris E. Simos, concerns combinatorial testing for SQL injection. Code injections attacks, and in particular SQL injection (SQLi) attacks, are still among the most critical threats for web applications. These attacks rely on exploiting vulnerabilities, which must be actively chased to deploy a secure system. Leveraging combinatorial testing, the authors propose novel attack grammars to generate SQLi attacks against MySQL-compatible databases. One originality of this contribution resides in dynamically optimizing and improving the attack grammars to the context. This context-sensitive adaptation technique is supported by a prototype tool named SQLInjector+ and is validated and benchmarked on a representative set of web applications under test. The contribution is accompanied by a nice addition to the field: a simple framework called WAFTF for testing the filtering techniques of web application firewalls such as ModSecurity. (Recommended by Yves Le Traon) The second paper, ‘Comprehensive evaluation of file systems robustness with SPIN model checking’ by Jingcheng Yuan, Toshiaki Aoki and Xiaoyun Guo, presents a study that comprehensively evaluates the robustness of file systems using a model checking approach, covering the majority of the mainstream file system types and both single-thread and multi-thread modes. In particular, to abstract real file systems, the authors developed Promela models optimized to avoid state explosion during model checking and used an SPIN model checker to check these models for detecting corner-case errors during an unexpected power outage. The authors analysed counterexamples generated by model checking to determine an improved file system model that is capable of preventing errors in most mainstream file system types and then rechecked the improved file system model and verified the absence of all critical errors. (Recommended by Moonzoo Kim)

Intelligent Modeling and Verification

SAT-Based Software Verification

Recent Advances in Program Verification Through Computer Algebra.

Model Checking of vGOAL

Modeling, Optimization, and Verification for Complex Systems

Verifying Programs Using Abstraction and Theorem Proving.

Competent Predicate Abstraction in Model Checking.

Abstraction-based model checking programs

Finite Countermodel Based Verification for Program Transformation (A Case Study)

Graded CTL Model Checking for Test Generation

A formal verification method: model checking

Combinatorial Testing and Model Checking

MITL Model Checking via Generalized Timed Automata and a New Liveness Algorithm

Program Verification By Reduction To Semi-Algebraic Systems Solving

Evaluating the Ability of Large Language Models to Generate Verifiable Specifications in VeriFast

An Infinite Needle in a Finite Haystack: Finding Infinite Counter-Models in Deductive Verification

OCTAL: Graph Representation Learning for LTL Model Checking

Heuristic-Guided Abstraction Refinement

Integrating Evolutionary Computation with Abstraction Refinement for Model Checking

Don't Trust: Verify -- Grounding LLM Quantitative Reasoning with Autoformalization

Linear-time Temporal Logic with Team Semantics: Expressivity and Complexity