  Although the security testing of Web systems can be automated by generating
crafted inputs, solutions to automate the test oracle, i.e., distinguishing
correct from incorrect outputs, remain preliminary. Specifically, previous work
has demonstrated the potential of metamorphic testing; indeed, security
failures can be determined by metamorphic relations that turn valid inputs into
malicious inputs. However, without further guidance, metamorphic relations are
typically executed on a large set of inputs, which is time-consuming and thus
makes metamorphic testing impractical. We propose AIM, an approach that
automatically selects inputs to reduce testing costs while preserving
vulnerability detection capabilities. AIM includes a clustering-based black box
approach, to identify similar inputs based on their security properties. It
also relies on a novel genetic algorithm able to efficiently select diverse
inputs while minimizing their total cost. Further, it contains a
problem-reduction component to reduce the search space and speed up the
minimization process. We evaluated the effectiveness of AIM on two well-known
Web systems, Jenkins and Joomla, with documented vulnerabilities. We compared
AIM's results with four baselines. Overall, AIM reduced metamorphic testing
time by 84% for Jenkins and 82% for Joomla, while preserving vulnerability
detection. Furthermore, AIM outperformed all the considered baselines regarding
vulnerability coverage.
