![](bg2.png)
et al., 2005)) called vulnerabilities patterns. This for-
mal model leads to define vulnerabilities and finally
test verdicts without ambiguity. Then, from vulner-
ability patterns, our method performs both the auto-
matic test case generation and execution. The orig-
inality of this work resides in the test case genera-
tion. First, partial class diagrams and partial IOSTS
specifications are generated from component com-
piled classes and configuration files. These class dia-
grams and specifications are used to determine the na-
ture of each component and represent the functional
behaviours that should be observed from each com-
ponent after the receipt of an intent (in reference to
the Android documentation (Android, 2013)). These
items help refine and reduce the test case generation.
For instance, vulnerability patterns dedicated to Ac-
tivity components shall be only applied on the Activ-
ities of an application. IOSTS test cases are derived
from a combination of vulnerability patterns with par-
tial specifications.
The paper is structured as follows: Section 2 gives
IOSTS definitions and notations to be used through-
out the paper. Vulnerability patterns are defined in
Section 3. Finally, the testing methodology is de-
scribed in Section 4 and we conclude in Section 5.
2 MODEL DEFINITION AND
NOTATIONS
We shall consider the input/output Symbolic Transi-
tion Systems (IOSTS) model (Frantzen et al., 2005)
to generate partial specifications of Android compo-
nents and to express vulnerabilities. Below, we recall
the definition of an IOSTS extension, called IOSTS
suspension, which also expresses quiescence i.e., the
authorised deadlocks observed from a location. For
an IOSTS S, quiescence is modelled by a new ac-
tion !δ and an augmented IOSTS denoted S
δ
, obtained
by adding a self-loop labelled by !δ for each location
where no output action may be observed.
Definition 1 (IOSTS Suspension). A deterministic
IOSTS suspension S
δ
is a tuple < L,l0,V,V0, I,Λ,
→>, where:
• L is the finite set of locations, l0 the initial loca-
tion,
• V is the finite set of internal variables, I is the
finite set of parameters. We denote D
v
the domain
in which a variable v takes values. The internal
variables are initialised with the assignment V0
on V, which is assumed to be unique,
• Λ is the finite set of symbolic actions a(p), with
p = (p
1
,..., p
k
) a finite list of parameters in I
k
(k ∈
N), p is assumed unique. Λ = Λ
I
∪ Λ
O
∪ {!δ}: Λ
I
represents the set of input actions, (Λ
O
) the set of
output actions,
• → is the finite transition set. A transition
(l
i
,l
j
,a(p),G,A), from the location l
i
∈ L to l
j
∈
L, denoted l
i
a(p),G,A
−−−−−→ l
j
is labelled by an action
a(p) ∈ Λ. G is a guard over (p ∪ V ∪ T(p ∪ V))
which restricts the firing of the transition. T(p∪
V) is a set of functions that return boolean values
only (a.k.a. predicates) over p∪V. Internal vari-
ables are updated with the assignment function A
of the form (x := A
x
)
x∈V
A
x
is an expression over
V ∪ p ∪ T(p∪V)
• for any location l ∈ L and for all pair of tran-
sitions (l, l
1
,a(p),G
1
,A
1
), (l,l
2
,a(p),G
2
,A
2
) la-
belled by the same action, G
1
∧ G
2
is unsatisfi-
able.
An IOSTS is also associated to an ioLTS (In-
put/Output Labelled Transition System) to formulate
its semantics. Intuitively, the ioLTS semantics corre-
sponds to a valued automaton without symbolic vari-
able, which is often infinite: the ioLTS states are la-
belled by internal variable valuations while transitions
are labelled by actions and parameter valuations. The
semantics of an IOSTS S =< L,l0,V,V0, I,Λ,→> is
the ioLTS JSK =< Q, q
0
,
∑
,→> composed of valued
states in Q = L× D
V
, q
0
= (l0,V0) is the initial one,
∑
is the set of valued symbols and → is the transition
relation. The complete definition of ioLTS semantics
can be found in (Frantzen et al., 2005). For an IOSTS
transition l
1
a(p),G,A
−−−−−→ l
2
, we obtain an ioLTS transition
(l
1
,v)
a(p),θ
−−−→ (l
2
,v
′
) with v a set of valuations over
the internal variable set, if there exists a parameter
value set θ such that the guard G evaluates to true
with v ∪ θ. Once the transition is executed, the in-
ternal variables are assigned with v
′
derived from the
assignment A(v ∪ θ). Runs and traces of an IOSTS
can now be defined from its semantics:
Definition 2 (Runs and Traces). For an IOSTS S =
< L,l0,V,V0,I,Λ,→>, interpreted by its ioLTS se-
mantics JSK =< Q,q
0
,
∑
,→>, a run q
0
α
0
...α
n−1
q
n
is an alternate sequence of states and valued actions.
Run(S) = Run(JSK) is the set of runs found in JSK.
Run
F
(S) is the set of runs of S finished by a state in
F × D
V
⊆ Q, with F a location set in L.
It follows that a trace of a run r is defined as
the projection proj
∑
(r) on actions. Traces
F
(S) =
Traces
F
(JSK) is the set of traces of all runs finished
by states in F × D
V
.
Below, we recall the definition of the parallel com-
position which is a classical state-machine operation
used to represent the parallel execution of two sys-
SECRYPT2013-InternationalConferenceonSecurityandCryptography
356