GENERATING COVERAGE METRICS FOR BLACK-BOX TESTING

摘要

Generating coverage metrics for black-box testing includes performing static analysis of a program code to be tested. The static analysis includes identifying variables whose value depends on inputs of the program code. Code blocks are inserted into the program code to be tested. The code blocks insert vulnerabilities into the code at locations where the variables are modified. The code blocks violate one or more properties to be tested. A testing scan is applied to the program code and vulnerabilities are located by the test. A coverage metric is output based on the ratio of the located vulnerabilities to the total number of inserted vulnerabilities in the program code.