# Maximizing Test Coverage for Security Threats Using Optimal Test Data Generation
## 1 Introduction  
Software testing is a time-consuming but vital activity that tries to raise the quality of software [1]. The prime goal of software testing is to ensure that the delivered product is bug-free. However, due to the constraints of the testing project's budget, manpower, and testing time, it would be unrealistic to expect perfect and faultless software to successfully complete the project. Therefore, it is essential to manage the testing cost to reduce the overall development budget and time [2]. As a result, rather than spending a large budget pursuing a flawless software system, most software developers would make a compromised testing plan [3]. Test coverage is an important indicator of software testing [4]. Offering data on various coverage item aids in evaluating the success of the testing process. The hardest part of maximizing test coverage is coming up with appropriate test data [5]. Moreover, generating test data to achieve 100% coverage is labor-intensive and expensive. A greater number of tests also necessitates a longer test period and greater tester memory. Test development becomes more challenging due to the growing number of tests required to fulfil adequate coverage criteria [6]. Selecting a portion of tests from a large baseline test set becomes critical when it is impossible to apply all the tests due to test time or tester memory limitations. It is clear from theliterature that testing accounts for more than 40% of project costs [7]. Instead of covering all the entities in the tested program, test data can be aimed toward covering the optimal set to reduce the testing effort [8]. Reducing the amount of data utilized for testing is one method of minimizing this cost. Test data optimization can maximize test coverage, yet reduce maintenance cost, for both black-box and white-box testing. Our research goal is to maximize test coverage through optimal test data generation at the design level for security threat mitigation. Early security threat detection and corresponding mitigation leads to a reduction in maintenance costs, especially in the case of large software systems [9]. Time and cost can be saved if the security defects are caught in the early stage of the development, but it is most costly if the defects are found later. It also causes damage to the organizations financially or in terms of data loss or user inconvenience. Following on the motivational work of early testing [10], we have used the mal-activity diagram for our experiment with constraints specified in object constraint language (OCL). UML models with specified constraints in OCL are precise, comprehensive, and consistent [11]. These constraints were derived from basic and alternate flow given in the structured misuse case description and were modeled in the mal-activity diagram. However, to complete the UML model, constraints can only be specified in formal constraint language, i.e., object constraint language (OCL). The modified condition/decision coverage (MC/DC) methodology is one widely used method for generating the optimum test data for code coverage [12]. Through optimal test data generation, we aim to maximize test coverage in our study. Achieving 100% test coverage can be thought of as maximizing test coverage, since it is noted in the literature that the method used to generate test data to reach 100% coverage is laborious and expensive. This study concludes that achieving 100% test coverage is not realistic or feasible. Use cases outline functional specifications; however, they are unable to allow the modeling of security threats. To model security threats and identify misuse cases, the use case diagram is developed. Since a use case model simply specifies the necessary capabilities, the textual description often captures the core of the use case. This textual description plays a vital role while representing a misuse case. Diagrams of misuse cases and the textual descriptions of those diagrams give developers essential security-related details.