# Maximizing Test Coverage for Security Threats Using Optimal Test Data Generation
## 4 Experiment Design
### Acceptance Test Case Design  
Acceptance test cases through the structured misuse case description (SMCD) will be designed from the above mal-activity diagram shown in Figure 1. Test data is essential as it is used to execute test cases [35]. We use the equivalence class partitioning technique to generate test data as referred to in [36]. We have two scenarios in the above activity diagram, and test cases will be designed for both scenarios. In the first scenario, users enter their username and password to login. The IP of the system will be blocked for more than three invalid attempts from the same IP. When the login and password are valid and the user has made fewer than three attempts, the system will create a verification code. The user will enter the verification code that was delivered to the email address in the second scenario. If the code entered is authentic, the system will log the user in; otherwise, they must repeat scenario 1 until they obtain the code. The acceptance test scenarios for incorrect usernames, passwords, Captchas, and login attempts are shown.  
For this situation, we will now create a test case. Username Valid Class: {A-Z}, {a-z} and Invalid Class: {0-9}, {!@##%&*0}[][]], Password Valid Class: {A-Z},{a-z}, {0-9},{!@#$%&*0};[][]] and Invalid Class: {A-Z},{a-z} Captcha Valid Class: {A-Z},{a-z},{0-9} and Invalid class: {0#$%&*0};[][]]) Login Attempts Valid Class:{0 < attempt \(\leq\) 3} and Invalid Class: {attempt > 3}.  
In the following Table 7, an acceptance test case is designed for the structured Misuse case description.  
The designed test cases for the identified test combinations have been effective in detecting errors, while no other test combinations were found to be as effective other than those mentioned in MC/DC. This result has given us satisfaction with our approach and answered our question that MC/DC has generated test data with optimal test conditions and it was also proved after the test case design. Results from the experiment and test case design concludes that the test data generated for MC/DC is optimal and consistent at the design level as proved by the formal activity diagram.  
\begin{table}
\begin{tabular}{l l l} \hline \hline \multicolumn{1}{c}{**Constraint No.**} & \multicolumn{1}{c}{**Test Scenario**} & \multicolumn{1}{c}{**Constraint**} \\ \hline \multirow{3}{*}{8} & Invalid Username & self. Username = ‘Invalid’ \(\wedge\) self. \\  & Unsuccessful login & Password = ‘valid’ \(\wedge\) (self.captcha = ‘valid’ \(\wedge\) self.attempts \(<\) 3) \\ \hline \multirow{3}{*}{12} & Unsuccessful Login due to & self. Username = ‘valid’ \(\wedge\) self. Password = ‘Invalid’ \(\wedge\) (self.captcha = ‘valid’ \(\wedge\) self.attempts \(<\) 3) \\  & invalid Password & self.atternpts \(<\) 3)) \\ \hline \multirow{3}{*}{14} & Unsuccessful Login due to & self. Username = ‘valid’ \(\wedge\) self. Password \\  & invalid Captcha & self.atternpts \(<\) 3)) \\ \hline \multirow{3}{*}{15} & Unsuccessful Login due to & self. Username = ‘valid’ \(\wedge\) self. Password \\  & more than three & = ‘valid’ \(\wedge\) (self.captcha = ‘valid’ \(\wedge\) self.attempts \(>\) 3)) \\  & login attempts & self.atternpts \(>\) 3)) \\ \hline \multirow{3}{*}{16} & \multirow{3}{*}{Successful Login} & self. Username = ‘valid’ \(\wedge\) self. Password \\  & Successful Login & = ‘valid’ \(\wedge\) (self.captcha = ‘valid’ \(\wedge\) self.attempts \(<\) 3))) \\ \hline \hline \end{tabular}
\end{table}
Table 6: Identified Test Combination for MC/DC.