Information security is a critical issue in the context of complex and interconnected nowadays IT Systems. Innovative testing approaches are demanded to verify whether the main security characteristics are provided in the systems. The conceptual formalization level required by security test processes can be supplied by semantic technologies. STEP-ONE is the Security TEst Process supported by ONtology Environment; its foundations come from largely accepted testing processes and security testing standards. The STPO (Security Testing Process Ontology) formalizes and makes explicit the main concepts of the domain. We present a conceptual characterization of STEP-ONE and describe a usage scenario to illustrate how the proposal can be applied. The main contributions are the conceptual process and the ontology. Our proposal is meant to be applied for the evaluation of IT systems with respect to security characteristics as well as to make systematic the security testing activities.

A new technique and tool are presented for test data generation for path testing. They are based on the dynamic technique and on a Genetic Algorithm, which evolves a population of input data towards reaching and solving the predicates along the program paths. We improve the performance of test data generation by using past input data to compose the initial population for the search. An experiment was done to assess the performance of the techniques compared to that of random data generation.

A tool and techniques are presented for test data generation and identification of a path's likely unfeasibility in structural software testing. The tool is based on the dynamic technique and search using genetic algorithms. Our work introduces a new fitness function that combines control and data flow dynamic information to improve the process of search for test data. The unfeasibility issue is addressed by monitoring the genetic algorithm's search progress. An experiment shows the validity of the developed solutions and the benefit of using the tool.