# Maximizing Test Coverage for Security Threats Using Optimal Test Data Generation
## 4 Experiment Design  
This study aims to maximize test coverage for security threats using Optimal Test Data Generation. One of the most common ways to model security threats is through the misuse case. To achieve our research goal, we undertake an experiment to generate optimal test data at a design level. In the experiment, test data was generated through (MC/DC) and decision coverage from the mal-activity diagram, with test conditions extracted for seven constraints. Overall, this study contributes to the field of software security by providing a methodology for generating optimal test data at the design level for security threats. Moreover, test data generated from OCL constraints eliminated the challenge of inconsistent acceptance test case design due to its reliance upon human judgment. The steps of the proposed methodology are as follows:  
1. Identify security authentication and authorization threats. 2. Design the structured misuse case description. 3. Draw mal-activity from the structured misuse case description. 4. Specify constraints in the mal-activity diagram using OCL. 5. Transform constraints into Boolean expression. 6. Transform Boolean expression into Truth Table Expression. 7. Generate possible test data: 7.1 through MC/DC (modified condition decision coverage). 7.2 through decision coverage (D/C). 8. Compare and find optimal test data generated through MC/DC and D/C
9. Design test cases for generated optimal test data. In Figure 1 as mentioned below, above steps are mapped according to the methodology flow. **Step 1:** Elicitation/Extraction of Security Requirements i.e., authentication and authorization  
In the context of software development, security requirements refer to the set of features and functionalities that ensure that the software system is secure and protected against unauthorized access, data breaches, and other types of cyber-attacks. The first step in developing a secure software system is to elicit or extract the security requirements. \"Elicitation/Extraction of Security Requirements\" refers to the process of identifying and defining these security requirements. In Table 1, Authentication and Authorization were addressed. **Step 2:** Structured Misuse Case Description  
The structured misuse case description is provided in the following Table 2. \begin{table}
\begin{tabular}{l l l} \hline
**Elicitation of Security Requirement** & **Goal** & **Sub-Goal** \\ \hline The application should authenticate the User & Security & Authentication \\ using a valid username and Password. & & Security & Authorization \\ \hline Authorization codes should be set up and & & \\ modified only by the System Administrator. & & Security & Authorization \\ \hline \end{tabular}
\end{table} 
Table 1: Identification of Security Threats. Figure 1: Proposed Methodology. **Step 3:** Designing the Mal-Activity Diagram  
In this step, the mal-activity diagram is designed for the Structured Misuse case description. Structured Misuse case descriptions are modeled into the mal-activity diagram to identify the inputs and triggers. Figure 2 illustrates the mal-activity diagram modeled from the structured misuse description.