Testing Programs to Detect Malicious Faults
Program testing has traditionally been of two kinds: for fault finding (debugging), and for establishing operational reliability (confidence). We investigate the question of using traditional methods to determine the dependability of a program, under two assumptions: (1) the only sources of failure are inadvertent mistakes in design, coding, etc., and the program developers cooperate in trying to eliminate such faults. (2) the source of failure is sabotage — malicious code is inserted in the program and cleverly concealed. Paradoxically, it appears to be easier to detect sabotage than subtle unintentional mistakes, in the off-line situation where the sabotage takes place during development, and must be detected prior to program release. Furthermore, the very situations that can make traditional testing a nightmare, for example, real-time constraints, actually may help a tester trying to detect sabotage.
KeywordsFault Tree Trojan Horse Malicious Code Path Testing Illicit Action
Unable to display preview. Download preview PDF.
- D. Gelperin and W. Hetzel, “The growth of software testing,” CACM, vol. 31, pp. 687–695, June 1988.Google Scholar
- R. Hamlet, “Editor’s introduction, special section on software testing,” CACM, vol. 31, pp. 662–667, June 1988.Google Scholar
- G. Myers, The Art of Software Testing. Wiley, 1979.Google Scholar
- J. Goodenough and S. Gerhart, “Toward a theory of test data selection,” IEEE Trans. Software Engineering, vol. SE-2, pp. 156–173, 1976.Google Scholar
- D. Parnas, A. van Schouwen, and S. Kwan, “Evaluation of safety-critical software,” CACM, vol. 33, pp. 636–648, June 1990.Google Scholar
- M. K. Joseph, “Architectural issues in fault-tolerant, secure computing systems,” Tech. Rep. CSD-880047, UCLA.Google Scholar
- M. Blum, “Designing programs to check their work,” Tech. Rep. TR88-009, International Computer Science Institute, Berkeley, November 1988.Google Scholar
- J. M. Voas and L. J. Morell, “Applying sensitivity analysis estimates to a minimum failure probability for software testing,” in Proc. 8th Pacific Northwest Software Quality Conference, pp. 362-371, October 1990.Google Scholar
- A. Babbitt and S. Powell, “Building prototype testing tools,” in Proc. 8th Pacific Northwest Software Quality Conference, pp. 264-280, October 1990.Google Scholar