# Improving the Safety and Security of Software Systems by Mediating SAP Verification
## 2 Background
### Software Performance Verification
#### 2.2.1 Performance Verification Techniques  
To determine if performance is sufficient, an organization must first set milestones. Then, it should measure the metrics that fall within these milestones and estimate the outcome by comparing the actual and projected results. Metrics help an organization in the following ways:  
* They serve as a foundation for the testing;
* They aid in the tracking of a project's progress;
* A QA team may use metrics to describe and quantify a problem to discover a solution;* Metrics tracking over time helps the organization to compare test results and evaluate the effect of code changes. Which performance metrics do a QA team need to track? It depends on the nature of the software under testing. Some commonly used parameters in performance metrics include response time, request per second, user transactions, error rate, wait time, average load time, peak response time, concurrent users, throughput, CPU utilization, memory utilization, and total user sessions. Performance metrics need to be used very carefully; some principles of using performance metrics effectively are listed as follows:
* Assemble an exhaustive set of performance criteria by first identifying the specific business goals of your customer;
* A feature must be given an appropriate measure of success for it to be considered successful;
* If a software user receives a high performance, reliability, and functionality level, metrics should reflect this;
* Track metrics over time by doing repeated performance tests;
* Run each software item through its paces one at a time. Perform database, service, and other checks. Once the milestone is set, the organization may apply various manual and automated ways to evaluate software performance. Below, we discuss some of the standard techniques of performance verification.  
Log inspection or monitoring helps to detect malicious behavior, collect events across different platforms, inspect error and informational events, and create and maintain audit trails [22]. Thus, it is a valuable measure of evaluating software performance.  
Response Time Test  
The response time verification technique measures the time between a user's request and a server's, application's, website's, or device's response. For example, if a user asks an application to load a particular web page, the response time is how long it takes the program to respond. Response time assists developers in assessing if software and websites are functional and responsive enough to be delivered as a final product [23]. A faster response  
Figure 3: An insight into performance verification.  
time ensures customer satisfaction and higher ratings for software or websites. Slower response times may indicate faults, hardware difficulties, or connection concerns. The response time verification consists of four main steps: identifying response time parameters, performing response time tests, recording the findings, and identifying errors or successes.  
Another crucial performance verification technique of an application's performance, in addition to log inspection and response times, is resource consumption. A performance test is a technique to keep track of how active particular computer system resources are [22; 24]. The critical consideration of resource consumption includes four main elements: CPU, memory, disk, and network.  
Throughput  
The number of transactions created over time during a test is referred to as \"throughput\". It is also known as the maximum capacity that an application can support. Before beginning a performance test run, it is typical to set a throughput target, requiring the application to handle a certain number of requests per hour [25]. The formula for the throughput is as given in Equation (1)  
\[\text{Throughput}=\frac{(\text{number of requests})}{(\text{total time})} \tag{1}\]  
After obtaining an overview of related terms, in the next section we provide the existing studies on software SAP verification in order to obtain a picture of the current state-of-the-art.