Literature Review of Mobile Applications Testing on Cloud from Information Security Perspective
---
paper_title: Cloud Computing – Issues, Research and Implementations

paper_content:

"Cloud" computing – a relatively recent term, builds on decades of research in virtualization, distributed computing, utility computing, and more recently networking, web and software services. It implies a service oriented architecture, reduced information technology overhead for the end-user, great flexibility, reduced total cost of ownership, on-demand services and many other things. This paper discusses the concept of “cloud” computing, some of the issues it tries to address, related research topics, and a “cloud” implementation available today.
---
paper_title: Efficient and secure data storage operations for mobile cloud computing

paper_content:

In a mobile cloud computing system, lightweight wireless communication devices extend cloud services into the sensing domain. A common mobile cloud secure data service is to inquiry the data from sensing devices. The data can be collected from multiple requesters, which may drain out the power of sensing devices quickly. Thus, an efficient data access control model is desired. To this end, we present a comprehensive security data inquiry framework for mobile cloud computing. Our solution focuses on the following two research directions: First, we present a novel Privacy Preserving Cipher Policy Attribute-Based Encryption (PP-CP-ABE) to protect sensing data. Using PP-CP-ABE, light-weight devices can securely outsource heavy encryption and decryption operations to cloud service providers, without revealing the data content. Second, we propose an Attribute Based Data Storage (ABDS) system as a cryptographic group-based access control mechanism. Our performance assessments demonstrate the security strength and efficiency of the presented solution in terms of computation, communication, and storage.
---
paper_title: Cloud Based Testing: Need of Testing in Cloud Platforms

paper_content:

Cloud computing is delivery of service rather than product. Cloud testing is a form of software testing in which web applications that use cloud computing environments. Cloud computing in general defined as delivering of services to clients based on internet it delivers services are like resources, software, information etc. Cloud-testing leverages cloud computing resources and models to enable all aspects of load-testing in a highly cost-effective manner. Cloud computing is a new approach of distributed computing where it uses cloud infrastructures for automatically supporting the user requirements. Testing is performed in three distinct areas of cloud they are infrastructure, platform and service. Cloud infrastructure will help to identify configuration and optimization opportunities for each cloud vendor. In this paper we discuss about cloud based testing and need of testing in cloud computing. Systems can be scaled to a high factor at a low operational cost. Cloud testing solutions are compatible with multiple form factors. The Cloud enables accessible testing assets globally at any time.
---
paper_title: A Model of Cloud Based Application Environment for Software Testing

paper_content:

Cloud computing is an emerging platform of service computing designed for swift and dynamic delivery of assured computing resources. Cloud computing provide Service-Level Agreements (SLAs) for guaranteed uptime availability for enabling convenient and on-demand network access to the distributed and shared computing resources. Though the cloud computing paradigm holds its potential status in the field of distributed computing, cloud platforms are not yet to the attention of majority of the researchers and practitioners. More specifically, still the researchers and practitioners community has fragmented and imperfect knowledge on cloud computing principles and techniques. In this context, one of the primary motivations of the work presented in this paper is to reveal the versatile merits of cloud computing paradigm and hence the objective of this work is defined to bring out the remarkable significances of cloud computing paradigm through an application environment. In this work, a cloud computing model for software testing is developed.
---
paper_title: Demo: a programming cloud of smartphones

paper_content:

In this demonstration we present SmartLab1, an exciting experimental testbed of approximately 40+ real Android Smartphones, plus emulated devices, deployed at the Department of Computer Science building at the University of Cyprus. SmartLab provides a public, permanent testbed for the development and testing of smartphone network applications via an intuitive web-based interface. Registered users can upload and install Android executables (APKs) on a number of Android smartphones, capture their output, reboot the devices, create concurrent interactive jobs using MonkeyRunner scripts, interact with the remote devices and many other exciting features. SmartLab aims to facilitate research in smartphone network programming environments, communication protocols, system design, and applications.
---
paper_title: Software testing of mobile applications: Challenges and future research directions

paper_content:

While mobile applications are becoming so extraordinarily adopted, it is still unclear if they deserve any specific testing approach for their verification and validation. This paper wants to investigate new research directions on mobile applications testing automation, by answering three research questions: (RQ1) are mobile applications (so) different from traditional ones, so to require different and specialized new testing techniques?, (RQ2) what are the new challenges and research directions on testing mobile applications?, and (RQ3) which is the role automation may play in testing mobile applications?. We answer those questions by analyzing the current state of the art in mobile applications development and testing, and by proposing our view on the topic.
---
paper_title: Software Testing Models Against Information Security Requirements

paper_content:

An overview and classification of software testing models are done. Recommendations on the choice of models are proposed
---
paper_title: Cloud Based Testing: Need of Testing in Cloud Platforms

paper_content:

Cloud computing is delivery of service rather than product. Cloud testing is a form of software testing in which web applications that use cloud computing environments. Cloud computing in general defined as delivering of services to clients based on internet it delivers services are like resources, software, information etc. Cloud-testing leverages cloud computing resources and models to enable all aspects of load-testing in a highly cost-effective manner. Cloud computing is a new approach of distributed computing where it uses cloud infrastructures for automatically supporting the user requirements. Testing is performed in three distinct areas of cloud they are infrastructure, platform and service. Cloud infrastructure will help to identify configuration and optimization opportunities for each cloud vendor. In this paper we discuss about cloud based testing and need of testing in cloud computing. Systems can be scaled to a high factor at a low operational cost. Cloud testing solutions are compatible with multiple form factors. The Cloud enables accessible testing assets globally at any time.
---
paper_title: Rethinking antivirus: Executable analysis in the network cloud

paper_content:

Antivirus software installed on each end host in an organization has become the de-facto security mechanism used to defend against unwanted executables. We argue that the executable analysis currently provided by host-based antivirus software can be more efficiently and effectively provided as an in-cloud network service. Instead of running complex analysis software on every end host, we suggest that each end host run a lightweight process to acquire executables entering a system, send them into the network for analysis, and then run or quarantine them based on a threat report returned by the network service. An executable analysis service run inside an enterprise network or by a service provider could integrate antivirus software, behavioral simulation, and other analysis engines from multiple vendors providing better detection of malware and simplify client software enabling deployment on a broader range of devices. To explore this idea we construct a prototype composed of a Windows based host agent and an in-cloud analysis service and evaluate it using a diverse dataset of 5066 unique malicious executables. By correlating information between multiple detection engines, our system provides over 98% detection coverage of the malicious executables using eight antivirus engines and two behavioral engines compared to a 54% to 86% detection rate using the latest commercial antivirus products.
---
paper_title: CloudAV: N-Version Antivirus in the Network Cloud

paper_content:

Antivirus software is one of the most widely used tools for detecting and stopping malicious and unwanted files. However, the long term effectiveness of traditional host-based antivirus is questionable. Antivirus software fails to detect many modern threats and its increasing complexity has resulted in vulnerabilities that are being exploited by malware. This paper advocates a new model for malware detection on end hosts based on providing antivirus as an in-cloud network service. This model enables identification of malicious and unwanted software by multiple, heterogeneous detection engines in parallel, a technique we term 'N-version protection'. This approach provides several important benefits including better detection of malicious software, enhanced forensics capabilities, retrospective detection, and improved deployability and management. To explore this idea we construct and deploy a production quality in-cloud antivirus system called CloudAV. CloudAV includes a lightweight, cross-platform host agent and a network service with ten antivirus engines and two behavioral detection engines. We evaluate the performance, scalability, and efficacy of the system using data from a real-world deployment lasting more than six months and a database of 7220 malware samples covering a one year period. Using this dataset we find that CloudAV provides 35% better detection coverage against recent threats compared to a single antivirus engine and a 98% detection rate across the full dataset. We show that the average length of time to detect new threats by an antivirus engine is 48 days and that retrospective detection can greatly minimize the impact of this delay. Finally, we relate two case studies demonstrating how the forensics capabilities of CloudAV were used by operators during the deployment.
---
paper_title: A Distributed Spatial Cloaking Protocol for Location Privacy

paper_content:

Pasting lemma is proved in Isabelle/HOL. General topology is formalized to express Pasting lemma. Topology definitions and proofs are written in a computer language so that they can be formally verified by machine. We formalize general topology in Isabelle/HOL to find out reasoning mechanisms general topology. Our personal motivation to prove this lemma is to explore applications of different knowledge domains.
---
paper_title: In-Device Spatial Cloaking for Mobile User Privacy Assisted by the Cloud

paper_content:

Spatial cloaking has been proposed and studied to protect mobile user privacy when using location based services (LBS). Traditional spatial cloaking methods are carried out by a trusted proxy known as location trusted server (LTS) to generate a region that contains at least k users for every request. The LTS is assumed to know the location of all users at all times, and perform the cloaking for all user requests. There are a number of disadvantages of relying on a single service for privacy preservation, including the scalability concern and the appropriate worry that this service “knows too much”. To ameliorate this single-service problem, in-device spatial cloaking may be more desirable. However, the sticky problem is that the device does not know, at the time of the request, the locations of all other users, which are necessary to obtain an appropriate cloaked region. With cloud services, it may be appropriate to assume that user-density information is available from cloud servers. These servers may collect user location information for different regions, or may use sophisticated method to estimate user densities for different places. When a request needs to be anonymized, the device goes to the cloud to acquire appropriate user density information to perform spatial cloaking. In this operating environment, traditional spatial cloaking methods such as Casper [9] need to be modified in order to guarantee safety. This paper proposes and studies a new algorithm and reports performance evaluation of the new algorithm and its optimized version, aiming at provably safe cloaking with minimized communication cost. Experimental results show that the new algorithms work well in the realistic evaluation environment.
---
paper_title: k-Anonymity: A Model for Protecting Privacy

paper_content:

Consider a data holder, such as a hospital or a bank, that has a privately held collection of person-specific, field structured data. Suppose the data holder wants to share a version of the data with researchers. How can a data holder release a version of its private data with scientific guarantees that the individuals who are the subjects of the data cannot be re-identified while the data remain practically useful? The solution provided in this paper includes a formal protection model named k-anonymity and a set of accompanying policies for deployment. A release provides k-anonymity protection if the information for each person contained in the release cannot be distinguished from at least k-1 individuals whose information also appears in the release. This paper also examines re-identification attacks that can be realized on releases that adhere to k- anonymity unless accompanying policies are respected. The k-anonymity protection model is important because it forms the basis on which the real-world systems known as Datafly, µ-Argus and k-Similar provide guarantees of privacy protection.
---
paper_title: Efficient and secure data storage operations for mobile cloud computing

paper_content:

In a mobile cloud computing system, lightweight wireless communication devices extend cloud services into the sensing domain. A common mobile cloud secure data service is to inquiry the data from sensing devices. The data can be collected from multiple requesters, which may drain out the power of sensing devices quickly. Thus, an efficient data access control model is desired. To this end, we present a comprehensive security data inquiry framework for mobile cloud computing. Our solution focuses on the following two research directions: First, we present a novel Privacy Preserving Cipher Policy Attribute-Based Encryption (PP-CP-ABE) to protect sensing data. Using PP-CP-ABE, light-weight devices can securely outsource heavy encryption and decryption operations to cloud service providers, without revealing the data content. Second, we propose an Attribute Based Data Storage (ABDS) system as a cryptographic group-based access control mechanism. Our performance assessments demonstrate the security strength and efficiency of the presented solution in terms of computation, communication, and storage.
---
paper_title: Securing elastic applications on mobile devices for cloud computing

paper_content:

Cloud computing provides elastic computing infrastructure and resources which enable resource-on-demand and pay-as-you-go utility computing models. We believe that new applications can leverage these models to achieve new features that are not available for legacy applications. In our project we aim to build elastic applications which augment resource-constrained platforms, such as mobile phones, with elastic computing resources from clouds. An elastic application consists of one or more weblets, each of which can be launched on a device or cloud, and can be migrated between them according to dynamic changes of the computing environment or user preferences on the device. This paper overviews the general concept of this new application model, analyzes its unique security requirements, and presents our design considerations to build secure elastic applications. As first steps we propose a solution for authentication and secure session management between weblets running device side and those on the cloud. We then propose secure migration and how to authorize cloud weblets to access sensitive user data such as via external web services. We believe some principles in our solution can be applied in other cloud computing scenarios such as application integration between private and public clouds in an enterprise environment.
---
paper_title: Efficient and secure data storage operations for mobile cloud computing

paper_content:

In a mobile cloud computing system, lightweight wireless communication devices extend cloud services into the sensing domain. A common mobile cloud secure data service is to inquiry the data from sensing devices. The data can be collected from multiple requesters, which may drain out the power of sensing devices quickly. Thus, an efficient data access control model is desired. To this end, we present a comprehensive security data inquiry framework for mobile cloud computing. Our solution focuses on the following two research directions: First, we present a novel Privacy Preserving Cipher Policy Attribute-Based Encryption (PP-CP-ABE) to protect sensing data. Using PP-CP-ABE, light-weight devices can securely outsource heavy encryption and decryption operations to cloud service providers, without revealing the data content. Second, we propose an Attribute Based Data Storage (ABDS) system as a cryptographic group-based access control mechanism. Our performance assessments demonstrate the security strength and efficiency of the presented solution in terms of computation, communication, and storage.
---
paper_title: Cloud Based Testing: Need of Testing in Cloud Platforms

paper_content:

Cloud computing is delivery of service rather than product. Cloud testing is a form of software testing in which web applications that use cloud computing environments. Cloud computing in general defined as delivering of services to clients based on internet it delivers services are like resources, software, information etc. Cloud-testing leverages cloud computing resources and models to enable all aspects of load-testing in a highly cost-effective manner. Cloud computing is a new approach of distributed computing where it uses cloud infrastructures for automatically supporting the user requirements. Testing is performed in three distinct areas of cloud they are infrastructure, platform and service. Cloud infrastructure will help to identify configuration and optimization opportunities for each cloud vendor. In this paper we discuss about cloud based testing and need of testing in cloud computing. Systems can be scaled to a high factor at a low operational cost. Cloud testing solutions are compatible with multiple form factors. The Cloud enables accessible testing assets globally at any time.
---
paper_title: Mobility Can Help: Protect User Identity with Dynamic Credential

paper_content:

Security becomes a prominent issue for mobile cloud computing since valuable information moves to the cloud. An important security problem is how the users identify themselves to the cloud. If an attacker is capable of faking or stealing user credentials, such as passwords and digital certificates, current security measures are not sufficient to safe-guard user’s valuable information in the cloud. This paper proposes a set of light weight algorithms to generate dynamic credential to defend against such powerful attackers. Many communication randomness, like the user mobility, were commonly believed harmful for security. In this paper, they are converted to helpful elements to generate dynamic credentials. Dynamic credential introduces interesting security properties.
---
paper_title: Vision: automated security validation of mobile apps at app markets

paper_content:

Smartphones and "app" markets are raising concerns about how third-party applications may misuse or improperly handle users' privacy-sensitive data. Fortunately, unlike in the PC world, we have a unique opportunity to improve the security of mobile applications thanks to the centralized nature of app distribution through popular app markets. Thorough validation of apps applied as part of the app market admission process has the potential to significantly enhance mobile device security. In this paper, we propose AppInspector, an automated security validation system that analyzes apps and generates reports of potential security and privacy violations. We describe our vision for making smartphone apps more secure through automated validation and outline key challenges such as detecting and analyzing security and privacy violations, ensuring thorough test coverage, and scaling to large numbers of apps.
---

Title: Literature Review of Mobile Applications Testing on Cloud from Information Security Perspective

Section 1: Cloud Computing
Description 1: Discusses the objective of cloud computing in expanding test capabilities and the architecture and service models relevant to cloud computing.

Section 2: Service Models
Description 2: Details the various service models of cloud computing such as IaaS, PaaS, SaaS, and TaaS, focusing on their application in testing mobile applications.

Section 3: Concept of MCC
Description 3: Introduces the concept of Mobile Cloud Computing (MCC), its definition, benefits, limitations, and the specific focus on information security issues for mobile applications.

Section 4: Literature Survey
Description 4: Provides a comprehensive survey of existing literature on cloud computing technologies, mobile cloud computing architecture, applications, and issues concerning security and privacy.

Section 5: Mobile Application Testing on Cloud
Description 5: Elaborates on Mobile Testing as a Service (Mobile TaaS), the levels and scope of testing provided by the cloud, and specific testing strategies including the architecture of TaaS platforms.

Section 6: Features of Cloud Based Testing
Description 6: Highlights the main features and services provided by cloud-based testing platforms, including testing anytime availability, authentication, digital rights management, and more.

Section 7: Different Views of Cloud Based Testing
Description 7: Explains different perspectives of cloud-based testing from vendors, users, and clients and their interaction with cloud-based applications.

Section 8: Need of Testing on Cloud
Description 8: Discusses the reasons for adopting cloud testing, such as cost efficiency, assured availability, and the need for testing diverse computing platforms.

Section 9: Focussed Security Issues During Testing MCC
Description 9: Addresses the major security concerns in MCC, including user privacy, data secrecy, and specific threats like malicious codes and privacy issues linked to GPS-enabled phones.

Section 10: A Survey on Security Framework for MCC
Description 10: Surveys various security frameworks and schemes proposed for protecting data and applications in MCC, including energy-efficient integrity verification and policy-based authentication mechanisms.

Section 11: Tools and Techniques for Testing Mobile Apps on Cloud
Description 11: Lists and describes various tools and techniques used for automated mobile application testing on the cloud, emphasizing security validation tools and remote mobile testing systems.

Section 12: Challenges of Cloud Based Testing of Mobile Applications
Description 12: Identifies and discusses key challenges in cloud-based mobile application testing, such as dependency on the Internet, information security, and testing across multiple layers.

Section 13: Conclusions and Future Work
Description 13: Summarizes the findings on cloud computing and mobile application testing, and proposes future work directions focusing on the development and enhancement of testing tools and addressing security concerns.

Section 14: Open Issues
Description 14: Identifies open issues based on the literature review, including intrusion detection, privacy preservation, mobile security, and general cloud security.