A systematic classification of security regression testing approaches

作者：Felderer Michael^*; Fourneret Elizabeta

来源：International Journal on Software Tools for Technology Transfer, 2015, 17(3): 305-319.

DOI：10.1007/s10009-015-0365-2

• Regression testing
• Security testing
• Security regression testing
• Software evolution
• Security engineering
• Software testing
• Classification
• Survey

The openness of modern IT systems and their permanent change make it challenging to keep these systems secure. A combination of regression and security testing called security regression testing, which ensures that changes made to a system do not harm its security, are therefore of high significance and the interest in such approaches has steadily increased. In this article we present a systematic classification of available security regression testing approaches based on a solid study of background and related work to sketch which parts of the research area seem to be well understood and evaluated, and which ones require further research. For this purpose we extract approaches relevant to security regression testing from computer science digital libraries based on a rigorous search and selection strategy. Then, we provide a classification of these according to security regression approach criteria: abstraction level, security issue, regression testing techniques, and tool support, as well as evaluation criteria, for instance evaluated system, maturity of the system, and evaluation measures. From the resulting classification we derive observations with regard to the abstraction level, regression testing techniques, tool support as well as evaluation, and finally identify several potential directions of future research.

• 出版日期2015-6