2024· International Journal Of Engineering And Computer Science· 0 citations
TL;DR
A comprehensive framework for integrating Load & Performance Testing and Security Testing into the software development lifecycle of enterprise-grade applications is presented, addressing scalability bottlenecks, throughput degradation under concurrent load, and security vulnerabilities that emerge specifically under high-traffic conditions.
Abstract
Non-functional testing (NFT) encompasses critical quality assurance disciplines that determine the operational viability of large-scale software systems in production environments. This paper presents a comprehensive framework for integrating Load & Performance Testing (LPT) and Security Testing (ST) into the software development lifecycle of enterprise-grade applications. The proposed framework addresses scalability bottlenecks, throughput degradation under concurrent load, and security vulnerabilities that emerge specifically under high-traffic conditions. We examine industry-standard methodologies, tool ecosystems (Apache JMeter, Gatling, OWASP ZAP, Burp Suite), and architectural patterns for testing pipelines. A multi-phase testing workflow is introduced, covering smoke tests through soak tests and encompassing OWASP Top 10 validation and CVSS-scored vulnerability assessments. Empirical analysis across three enterprise application domains demonstrates that integrated NFT strategies reduce production incidents by 67% and security breaches by 54% compared to siloed testing approaches. The framework is designed for continuous integration and delivery pipelines, enabling automated quality gates for production deployment.
The use of DevSecOps seeks to ensure that the functionality of securing software is incorporated throughout the software development life cycle, but the difference between the theoretical model and the empirically proven version, specifically for multi-tier web applications, remains wide. This research proposes the evaluation of a “proxy” DevSecOps pipeline, defined as an automated intermediary architecture that decouples intensive security scanning from the primary build flow to prevent bottlenecks. Designed specifically for multi-tier PHP-based web applications, the model leverages infrastructure as code (Terraform) and Static Application Security Testing (SAST) to ensure that security validation remains continuous without impeding the integration speed. This research utilized the Terraform model on the Amazon Web Services cloud platform, with three EC2 instances and Jenkins integration, and the use of many tools for the testing process, divided into the following experiments for DevSecOps functionality measurement: the first for the baseline efficiency process, the dynamic scaling process, the validation test for the fail-safe mechanism, and the accuracy process for the vulnerabilities’ detection. This research indicates that the process exhibited stability and consistency for the average execution times, which took 122.08 ± 1.69 s, and low values for the 5.04% additional cost for concurrent executions. The 100% activation process for the fail-safe mechanism for the injection of vulnerabilities indicates that the process took 41.82% of the total pipeline execution time, demonstrating that security validation is the most time-intensive part of the automated proxy workflow, and the low costs of 0.0047 dollars for the entire process, specifically for the infrastructure aspect. The false positives for the process were measured as 10–15%, and the low costs for the entire process, which took 0.56–0.58 s for the total process.
Abderrahim Rida, A. Bakhil, Ayoub Ait Lahcen· Future Internet· 0 citations
Large Language Models (LLMs) are now deployed at an unprecedented scale across many critical sectors, rapidly transitioning from experimental AI tools to embedded components of production software systems. This accelerated adoption, often enabled by low-code integrations, has lowered technical barriers while simultaneously expanding the attack surface of modern applications, particularly when deployments occur without sufficient domain-specific security expertise. In many cases, security maturity has not progressed at the same pace as capability expansion, creating systemic exposure across confidentiality, integrity, and availability dimensions. To provide structured clarity amid this rapid growth, this paper presents a comparative and standards-aligned analysis of LLM security risks and defense mechanisms grounded in the OWASP GenAI Top-10 (2025). We systematically examine each vulnerability class, map representative attack patterns to primary mitigation strategies, evaluate their security property impact, and analyze practical limitations and implementation trade-offs. In addition, we introduce a severity-based assessment to prioritize risks according to operational and systemic impact, offering a quantitative perspective on defensive readiness. Our findings indicate that current mitigation strategies are predominantly reactive, concentrated at inference time, and unevenly distributed across the LLM lifecycle. Controls addressing training pipelines, supplychain dependencies, and autonomous system behaviors remain comparatively less mature and less standardized. By integrating vulnerability classification, defense mapping, severity prioritization, and trade-off analysis within a unified framework, this study provides actionable guidance for strengthening secure, resilient, and standards-driven LLM deployment in high-stakes environments.
Md Abdul Barek, Md Bajlur Rashid, A. K. I. Riad et al.· Annual International Compute...· 0 citations
Overall, this survey provides a structured characterization of the current state of AIware testing research and identifies key structural challenges that must be addressed to support lifecycle-aware, reliable AIware systems.
K. Gonzalez, Mariam El Mezouar· AIware· 0 citations
OpenAPI specifications are the primary input for black-box testing tools in microservice systems (MSS), yet prior work shows these specifications are often incomplete, inconsistent, or incorrect. Despite this, most studies on OpenAPI-based black-box testing assume correct specifications and evaluate tool performance. We address this gap by introducing a literature-grounded taxonomy of six OpenAPI specification fault classes. We inject faults at five severity levels, and evaluate the resulting mutated specifications on two microservice benchmarks, TrainTicket and SocialNetwork, using three testing tools: EvoMaster, RESTler, and Schemathesis. We measure the impact of these faults using code coverage, specification coverage, request/response quality, and behavioral diversity. Our results show that specification faults cause strong and heterogeneous degradation patterns across testing tools and systems. Faults in method semantics cause broad degradation across all metrics, while others, such as modifications to response codes, remain weak. Relaxations of schema constraints cause hidden degradation, with no impact on code and specification coverage but a large impact on request/response quality. These findings demonstrate that specification quality directly shapes black-box API testing effectiveness. Also, code and specification coverage-only evaluations can understate the impact of specification faults on black-box testing in MSS and should be complemented by request/response quality and behavioral diversity.
Hamza Bin Mazhar, Yuqing Wang, M. Mantyla· 0 citations
The rapid expansion of the life cycle for software deployment has required a move from traditional, manual security analysis to automated and integrated assurance frameworks. This study examines the effectiveness of integrating assurance, real-time threat detection, and automated certification gates right into the Continuous Integration and Continuous Deployment pipeline. The analysis is based on a synthetic dataset comprising values from 429 different builds, which is used to study the agreement between automated gating mechanisms and lower vulnerability escape rates. We used a standard tool chain consisting of Jenkins for orchestration, SonarQube for static analysis, and Splunk for log aggregation to emulate a high-velocity enterprise environment. The system seeks to reduce technical debt and potential security risks without impeding deployment velocity by enforcing stringent quality gates that prevent non-compliant artifacts from being promoted. The study highlights the quantitative effects of these controls on success build rates and on the exposure of hidden threats during staging. The results reveal that, despite an initial slowdown in delivery velocity, the incorporation of automated certification gates considerably reduces critical severity incident rates. Implications: The results indicate how to make system changes in response to data for those attempting to put DevSecOps into practice while maintaining the speed and integrity of their systems.
Sauhard Bhatt, Satyanarayana Gadiraju· 2026 6th International Confe...· 0 citations
At present, the contradiction between the speed of delivering changes and the operational stability of software systems acts as a fundamental constraint for DevOps practices. In this study, the subject of analysis is the decisive significance of a high level of test coverage in continuous integration and delivery (CI/CD) pipelines, with a particular emphasis on how microservice architectural patterns determine the scalability of verification processes. The study relies on a mixed methodology that combines quantitative processing of metrics from the State of DevOps 2024–2025 (DORA) reports and the SonarQube State of Code with qualitative analysis of industrial cases from Netflix, Uber, and Meituan. It is demonstrated that although high test coverage (above 80%) is a necessary but not sufficient condition for reducing defect density, in the context of hyperscalable distributed systems it turns into a critical bottleneck in the absence of shift-right strategies, including automated canary analysis (ACA). A separate section is devoted to the 2024 Paradox of Engineering Productivity, where the introduction of AI assistants accelerated the generation of software code but simultaneously led to a 7,2% decrease in delivery stability. In conclusion, the concept of productive coverage is formulated, shifting the center of gravity from gross quantitative test indicators to their semantic significance for business-critical scenarios, and practical recommendations are proposed for reconfiguring CI pipelines in order to minimize economic losses caused by brittle tests.
Evgenii Lvov· International Journal of Mod...· 0 citations