Search

Risk-based testing (RBT) is a type of test that helps identify product risks from the start of development, incorporating techniques that allow them to be identified and classified according to their impact and probability to create test cases for those selected requirements. However, in software development organizations the identified risks are related to the planning or cost of the project to guarantee product delivery and do not consider other risks as input for the creation of test cases and quality evaluation. of the product. Therefore, the objective of systematic mapping is based on identifying and determining the state of the art of publications related to RBT used in the software industry, in addition to metrics that incorporate or evaluate the performance of these types of tests and their benefits. The results show the proposals found on the software industry RBT and the importance of use as other types of software testing. Also, we present a preview of the Framework to support the RBT in global software development. [ABSTRACT FROM AUTHOR]

Regression testing aims to ensure the quality of a software after modification. However, re-executing the entire test suite in regression testing is a time-consuming, costly, and tedious process that often requires additional budget and time. Thus, limited resources always result in early termination and poor quality software. Test case prioritization aims to improve regression testing by re-scheduling the test cases in a manner that could increase the fault detection rate. Risk-based testing has gained popularity in the area of software testing. However, most of the existing methods compute risk values manually, which makes these methods tiresome, laborious, and slow. In this paper, we propose a semi-automatic risk-based test case prioritization approach based on software modification information and methods (functions) invocation relationship. The objective of this research is to make risk-based testing more systematic and flexible by automating the risk assessment process, and find high-risk faults early. The proposed approach utilizes the requirements modification information, complexity, and size of the methods as the risk indicating factors. We applied an automated procedure to extract these risk factors and compute the risk values of the system methods. The proposed approach is empirically evaluated with two software applications with multiple versions in terms of its fault detection rate, both overall and in risky modules. The experimental results suggest that our proposed approach improves test efficiency by spotting defects early overall and even earlier in the high-risk modules than existing state-of-the-art approaches. [ABSTRACT FROM AUTHOR]

Group testing (i.e., testing multiple subjects simultaneously with a single test) is essential for classifying a large population of subjects as positive or negative for a binary characteristic (e.g., presence of a disease). We study optimal group testing designs under subject-specific risk characteristics and imperfect tests, considering classification accuracy-, efficiency- and equity-based objectives, and characterize important structural properties of optimal testing designs. These properties allow us to model the testing design problems as partitioning problems, develop efficient algorithms, and derive insights on equity versus accuracy trade-off. One of our models reduces to a constrained shortest path problem, for a special case of which we develop a polynomial-time algorithm. We also show that determining an optimal risk-based Dorfman testing scheme that minimizes the expected number of tests is tractable, resolving an open conjecture. We demonstrate the value of optimal risk-based testing schemes with a case study of public health screening. [ABSTRACT FROM AUTHOR]

This article introduces a new method for knowledge-based security testing by logic programming and the related tool implementation for model-based non-functional security testing of web applications. Our method helps to overcome the current prevalent focus on functional instead of non-functional (or negative) requirements as well as the required high level of security knowledge when performing non-functional security testing. It addresses issues like considering non-functional requirements for testing, managing the virtually infinite amount of negative security test cases, advancing non-functional security testing away from its prevalent penetration testing-like style, and making non-functional security testing feasible for testers that are not experts in security via a security knowledge base. The method and its model-based tool implementation are evaluated in two studies, which show the method's effectiveness in detecting vulnerabilities in web applications and thus, also its value in making software system more secure. [ABSTRACT FROM AUTHOR]

Copyright of Lámpsakos is the property of Fundacion Universitaria Luis Amigo, Facultad de Ingenierias and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Incarcerated populations tend to be disproportionately affected by HIV and sexually transmitted infections (STIs), and men who have sex with men (MSM) are an especially high-risk subset of these populations. Despite the Centers for Disease Control and Prevention’s recommendations for universal HIV screening, a lack of resources and high inmate turnover make it difficult to implement such guidelines in jails. From September 2013 to May 2016, the Infection Control Unit of the Los Angeles County Jail used existing resources to implement a voluntary, risk-based HIV educational and screening program targeting MSM inmates during early incarceration. The results revealed a high percentage of previously unknown HIV infections (8.5% = 57 of the 671 tested) and some unknown non-HIV STI cases. In the absence of resources for universal HIV screening, the risk-based approach is a sustainable and cost-effective approach for improving HIV surveillance in the correctional setting. [ABSTRACT FROM AUTHOR]

Risk-based testing is a frequently used testing approach which utilizes identified risks of a software system to provide decision support in all phases of the testing process. Risk assessment, which is a core activity of every risk-based testing process, is often done in an ad hoc manual way. Software quality assessments, based on quality models, already describe the product-related risks of a whole software product and provide objective and automation-supported assessments. But so far, quality models have not been applied for risk assessment and risk-based testing in a systematic way. This article tries to fill this gap and investigates how the information and data of a quality assessment based on the open quality model QuaMoCo can be integrated into risk-based testing. We first present two generic approaches showing how quality assessments based on quality models can be integrated into risk-based testing and then provide the concrete integration on the basis of the open quality model QuaMoCo. Based on five open source products, a case study is performed. Results of the case study show that a risk-based testing strategy outperforms a lines of code-based testing strategy with regard to the number of defects detected. Moreover, a significant positive relationship between the risk coefficient and the associated number of defects was found. [ABSTRACT FROM AUTHOR]

Risk orientation in testing is an important means to balance quality, time-to-market, and cost of software. Especially for small and medium enterprises (SME) under high competitive and economic pressure, risk orientation can help to focus testing activities on critical areas of a software product. Although several risk-based approaches to testing are available, the topic has so far not been investigated in the context of SME, where risks are often associated with business critical issues. This article fills the gap and explores the state of risk orientation in the testing processes of SME. Furthermore, it compares the state of risk-based testing in SME to the situation in large enterprises. The article is based on a multiple case study conducted with five SME. A previous study on risk-based testing in large enterprises is used as reference for investigating the differences between risk orientation in SME and large enterprises. The findings of our study show that a strong business focus, the use of informal risk concepts, as well as the application of risk knowledge to reduce testing cost and time are key differences of risk-based testing in SME compared to large enterprises. [ABSTRACT FROM AUTHOR]

In intra-EU trade, the health status of animals is warranted by issuing a health certificate after clinical inspection in the exporting country. This certificate cannot provide guarantee of absence of infection, especially not for diseases with a long incubation period and no overt clinical signs such as bovine tuberculosis (bTB). The Netherlands are officially free from bTB since 1999. However, frequent reintroductions occurred in the past 15 years through importation of infected cattle. Additional testing (AT) of imported cattle could enhance the probability of detecting an imported bTB infection in an early stage. The goal of this study was to evaluate the effectiveness of risk-based AT for bTB in cattle imported into The Netherlands. A generic stochastic import risk model was developed that simulates introduction of infection into an importing country through importation of live animals. Main output parameters are the number of infected animals that is imported ( N inf ), the number of infected animals that is detected by testing ( N det ), and the economic losses incurred by importing infected animals (loss). The model was parameterized for bTB. Model calculations were optimized to either maximize N det or to minimize loss. Model results indicate that the risk of bTB introduction into The Netherlands is very high. For the current situation in which Dutch health checks on imported cattle are limited to a clinical inspection of a random sample of 5–10% of imported animals, the calculated annual N inf = 99 (median value). Random AT of 8% of all imported cattle results in N det = 7 (median value), while the median N det = 75 if the sampling strategy for AT is optimized to maximize N det . However, in the latter scenario, loss is more than twice as large as in the current situation, because only calves are tested for which cost of detection is higher than the expected gain of preventing a possible outbreak. When optimizing the sampling strategy for AT to minimize loss, only breeding and production cattle are selected for AT resulting in N det = 1 (median value). Loss is; however, reduced by 75% if compared to the current situation. We conclude that the effectiveness of AT can greatly be improved by risk-based sampling. The optimal sampling strategy for risk-based AT for bTB is highly dependent on the objective of AT. If economic losses are to be contained, AT should focus on breeding and production cattle originating from high-risk countries. [ABSTRACT FROM AUTHOR]

In many development projects, testing has to be conducted under severe pressure due to limited resources and a challenging time schedule. Risk-based testing, which utilizes identified risks of the system for testing purposes, has a high potential to improve testing as it helps to optimize the allocation of resources and provides decision support for management. But for many organizations, the integration of a risk-based approach into established testing activities is a challenging task, and there are several options to do so. In this article, we analyze how risk is defined, assessed, and applied to support and improve testing activities in projects, products, and processes. We investigate these questions empirically by a multiple case study of currently applied risk-based testing activities in industry. The case study is based on three cases from different backgrounds, i.e., a test project in context of the extension of a large Web-based information system, product testing of a measurement and diagnostic equipment for the electrical power industry, as well as a test process of a system integrator of telecommunication solutions. By analyzing and comparing these different industrial cases, we draw conclusions on the state of risk-based testing and discuss possible improvements. [ABSTRACT FROM AUTHOR]

Testing accounts for a relevant part of the production cost of complex or critical software systems. Nevertheless, time and resources budgeted to testing are often underestimated with respect to the target quality goals. Test managers need engineering methods to perform appropriate choices in spending testing resources, so as to maximize the outcome. We present a method to dynamically allocate testing resources to software components minimizing the estimated number of residual defects and/or the estimated residual defect density. We discuss the application to a real-world critical system in the homeland security domain. We describe a support tool aimed at easing industrial technology transfer by hiding to practitioners the mathematical details of the method application. [ABSTRACT FROM AUTHOR]

In this paper, we show how our approach to active continuous quality control (ACQC), which employs learning technology to automatically maintain test models along the whole life cycle, can be extended to include risk analysts for supporting risk-based testing. Key to this enhancement is the tailoring of ACQC's characteristic automata learning-based model extraction to prioritize critical aspects. Technically, risk analysts are provided with an abstract modeling level tailored to design test components (learning symbols) that encompass data-flow constraints reflecting a given risk profile. The resulting alphabet models are already sufficient to steer the ACQC process in a fashion that increases the risk coverage, while it at the same time radically reduces the testing effort. We illustrate our approach by means of case studies with Springer's Online Conference Service (OCS) which show the impact of the risk prioritization on the performance: risk-based regression testing tailored for system migration and for pure functional evolution. [ABSTRACT FROM AUTHOR]

Risk analysis and testing are conducted for different purposes. Risk analysis and testing nevertheless involve processes that may be combined to the benefit of both. We may use testing to support risk analysis and risk analysis to support testing. This paper surveys literature on the combined use of risk analysis and testing. First, the existing approaches are identified through a systematic literature review. The identified approaches are then classified and discussed with respect to main goal, context of use and maturity level. The survey highlights the need for more structure and rigor in the definition and presentation of approaches. Evaluations are missing in most cases. The paper may serve as a basis for examining approaches for the combined use of risk analysis and testing, or as a resource for identifying the adequate approach to use. [ABSTRACT FROM AUTHOR]

Software testing has often to be done under severe pressure due to limited resources and a challenging time schedule facing the demand to assure the fulfillment of the software requirements. In addition, testing should unveil those software defects that harm the mission-critical functions of the software. Risk-based testing uses risk (re-)assessments to steer all phases of the test process to optimize testing efforts and limit risks of the software-based system. Due to its importance and high practical relevance, several risk-based testing approaches were proposed in academia and industry. This paper presents a taxonomy of risk-based testing providing a framework to understand, categorize, assess, and compare risk-based testing approaches to support their selection and tailoring for specific purposes. The taxonomy is aligned with the consideration of risks in all phases of the test process and consists of the top-level classes risk drivers, risk assessment, and risk-based test process. The taxonomy of risk-based testing has been developed by analyzing the work presented in available publications on risk-based testing. Afterwards, it has been applied to the work on risk-based testing presented in this special section of the International Journal on Software Tools for Technology Transfer. [ABSTRACT FROM AUTHOR]

Risk-based testing has a high potential to improve the software development and test process as it helps to optimize the allocation of resources and provides decision support for the management. But for many organizations, its integration into an existing test process is a challenging task. In this article, we provide a comprehensive overview of existing work and present a generic testing methodology enhancing an established test process to address risks. On this basis, we develop a procedure on how risk-based testing can be introduced in a test process and derive a stage model for its integration. We then evaluate our approach for introducing risk-based testing by means of an industrial study and discuss benefits, prerequisites and challenges to introduce it. Potential benefits of risk-based testing identified in the studied project are faster detection of defects resulting in an earlier release, a more reliable release quality statement as well as the involved test-process optimization. As necessary prerequisites for risk-based testing, we identified an inhomogeneous distribution of risks associated with the various parts of the tested software system as well as consolidated technical and business views on it. Finally, the identified challenges of introducing risk-based testing are reliable risk assessment in the context of complex systems, the availability of experts for risk assessment as well as established tool supports for test management. [ABSTRACT FROM AUTHOR]

Testing is necessary to ensure the quality of web services that are loosely coupled, dynamic bound and integrated through standard protocols. Exhaustive testing of web services is usually impossible due to unavailable source code, diversified user requirements and large number of possible service combinations delivered by the open platform. This paper proposes a risk-based approach for selecting and prioritizing test cases for testing service-based systems. We specially address the problem in the context of semantic web services. Semantic web services introduce semantics to service integration and interoperation using ontology models and specifications. Semantic errors are considered more difficult to detect than syntactic errors. Due to the complexity of conceptual uniformity, it is hard to ensure the completeness, consistency and unified quality of ontology model. A failure of the semantic service-based software may result from many factors such as misused data, unsuccessful service binding, and unexpected usage scenarios. This work analyzes the two factors of risk estimation: failure probability and importance, from three aspects: ontology data, service and composite service. With this approach, test cases are associated to semantic features, and are scheduled based on the risks of their target features. Risk assessment is used to control the process of Web Services progressive group testing, including test case ranking, test case selection and service ruling out. This paper discusses the control architecture and adaptive measurement mechanism for adaptive group testing. As a statistical testing technique, the proposed approach aims to detect, as early as possible, the problems with highest impact on the users. [ABSTRACT FROM AUTHOR]

This paper extends a theory of risk-based test planning that was outlined in a previous paper, introduces techniques to facilitate it, explains their practical application, and highlights opportunities for research to enquire into their feasibility and efficacy. Copyright © 2004 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

If software cannot be tested exhaustively, it must be tested selectively. But, on what should selection be based in order to maximize test effectiveness? It seems sensible to concentrate on the parts of the software where the risks are greatest, but what risks should be sought and how can they be identified and analysed? ‘Risk-based testing’ is a term in current use, for example in an accredited test-practitioner's course syllabus, but there is no broadly accepted definition of the phrase and no literature or body of knowledge to underpin the subject implied by it. Moreover, there has so far been no suggestion that it requires an understanding of the subject of risk. This paper examines what is implied by risk-based testing, shows that its practice requires an understanding of risk, and points to the need for research into the topic and the development of a body of knowledge to underpin it. Copyright © 2004 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]