Tamer Salman

Dynamic test data generation for data intensive applications

There are many cases where the development and testing of data-intensive applications need to be supported without the prior existence of data. Our work presents a dynamic test data generation framework for testing such applications. This capability is important, when the data is confidential and cannot be given to the test person for security reasons or when the application is in its development phase and real data does not yet exist. The proposed solution dynamically intercepts queries made by the application under test and creates appropriate data based on user requirements. This approach does not require access to the source code of the application under test, which could also be confidential. Data generation can be controlled to achieve desired data and query result patterns, including realistic data or data with higher test quality. The paper concludes with experiments that demonstrate the coverage and performance aspects of the solution.

Identifying malicious activities from system execution traces

Every day, massive amounts of system events from software agents deployed at endpoint devices across the world are received by the IBM Trusteer security group. The software associated with each event is verified with respect to third-party malware inspection services such as VirusTotal. Unfortunately, many events are associated with software that is unrecognized by inspection services. As a result, it is impossible to manually investigate and react to all of them. Traditional quantitative analysis is nearly useless because benign anomalies and attacks are indiscernible. We developed a system that continuously and automatically processes streaming data to help identify suspicious activity. The data comprises low-level traces of process activity. Each streamed activity is augmented with a signature that heuristically biases the degree of suspicion associated with the activity. The system then flags activities that are unknown to inspection services and likely to be malicious. It extracts behavioral and statistical information from the events, builds a predictive model based on supervised learning, and ranks the events suspected of being malicious. We tested the system using VirusTotal on three months of historical data. The results showed we were able to predict more than two thirds of the malicious events unknown at that time, with less than a 2% false positive rate.

Using a High-Level Test Generation Expert System for Testing In-Car Networks

The rising size and complexity of in-car networks call for more advanced and scalable verification solutions. We propose a verification methodology for in-car networks based on a system level test generator tool used for creating massive random biased stimuli, and on coverage and checking monitors. The test generator is an expert system based on an ontology of testing knowledge. A significant challenge is the continuous nature of the stimuli needed to represent the physical environment and the state of the internal components controlled by the vehicles electronic systems. We report on applying our methodology to an example in-car network simulator.

Development and Verification of Complex Hybrid Systems Using Synthesizable Monitors

Using simulation monitors that are formally defined and automatically synthesized is already part of the standard methodology of hardware design and verification. However, this is not yet the case in the domain of systems engineering for cyber-physical systems. The growing trend towards model-based systems engineering is making the use of simulation monitors more relevant and possible. Recent related work focuses almost exclusively on the aspects of requirements specification. In this work, we explain how monitors can play a much more pervasive role in systems engineering, going beyond merely checking requirements. We describe how monitors can be used along the entire product lifecycle, from early design alternative analysis to final field testing. This work also covers the special considerations that must be addressed when designing a monitor specification language, specifically in the context of systems engineering. Our focus is on the practical issues related to the use of monitors and describes a prototype monitor specification and synthesis platform applied to the hybrid simulation of an automotive subsystem.

A new test-generation methodology for system-level verification of production processes

The continuing growth in the complexity of production processes is driven mainly by the integration of smart and cheap devices, such as sensors and custom hardware or software components. This naturally leads to higher complexity in fault detection and management, and, therefore to a higher demand for sophisticated quality control tools. A production process is commonly modeled prior to its physical construction to enable early testing. Many simulation platforms were developed to assess the widely varying aspects of the production process, including physical behavior, hardware-software functionality, and performance. However, the efficacy of simulation for the verification of modeled processes is still largely limited by manual operation and observation. We propose a massive random-biased, ontology-based, test-generation methodology for system-level verification of production processes. The methodology has been successfully applied for simulation-based processor hardware verification and proved to be a cost-effective solution. We show that it can be similarly beneficial in the verification of production processes and control.