Metamorphic Relation Prediction for Security Vulnerability Testing of Online Banking Applications

Software is essential in modern systems, and reliable testing of it is crucial due to the Oracle problem, which refers to the difficulties in distinguishing correct software behavior. Testing outputs from various inputs in online banking applications is complex and costly, making full automation necessary for efficiency and cost reduction. Metamorphic Testing (MT) addresses this by generating test inputs and evaluating outputs based on Metamorphic Relations (MRs), which dictate output changes with input modifications. However, identifying MRs has traditionally been manual and time-consuming. This paper presents an automated MT approach for online banking applications with vulnerabilities from the OWASP top 10. We created a prediction model using graph representations to automate MR detection, providing a catalog of 8 system-agnostic MRs for enhanced security testing. Results indicate that most MRs achieve prediction scores over 80%, demonstrating the practical effectiveness of this approach for improving online banking security through automated metamorphic testing.