2024· International Journal Of Engineering And Computer Science· 0 citations
TL;DR
A comprehensive framework for integrating Load & Performance Testing and Security Testing into the software development lifecycle of enterprise-grade applications is presented, addressing scalability bottlenecks, throughput degradation under concurrent load, and security vulnerabilities that emerge specifically under high-traffic conditions.
Abstract
Non-functional testing (NFT) encompasses critical quality assurance disciplines that determine the operational viability of large-scale software systems in production environments. This paper presents a comprehensive framework for integrating Load & Performance Testing (LPT) and Security Testing (ST) into the software development lifecycle of enterprise-grade applications. The proposed framework addresses scalability bottlenecks, throughput degradation under concurrent load, and security vulnerabilities that emerge specifically under high-traffic conditions. We examine industry-standard methodologies, tool ecosystems (Apache JMeter, Gatling, OWASP ZAP, Burp Suite), and architectural patterns for testing pipelines. A multi-phase testing workflow is introduced, covering smoke tests through soak tests and encompassing OWASP Top 10 validation and CVSS-scored vulnerability assessments. Empirical analysis across three enterprise application domains demonstrates that integrated NFT strategies reduce production incidents by 67% and security breaches by 54% compared to siloed testing approaches. The framework is designed for continuous integration and delivery pipelines, enabling automated quality gates for production deployment.
This research proposes the evaluation of a “proxy” DevSecOps pipeline, defined as an automated intermediary architecture that decouples intensive security scanning from the primary build flow to prevent bottlenecks and demonstrates that security validation is the most time-intensive part of the automated proxy workflow.
Abderrahim Rida, A. Bakhil, Ayoub Ait Lahcen· Future Internet· 0 citations
Large Language Models (LLMs) are now deployed at an unprecedented scale across many critical sectors, rapidly transitioning from experimental AI tools to embedded components of production software systems. This accelerated adoption, often enabled by low-code integrations, has lowered technical barriers while simultaneously expanding the attack surface of modern applications, particularly when deployments occur without sufficient domain-specific security expertise. In many cases, security maturity has not progressed at the same pace as capability expansion, creating systemic exposure across confidentiality, integrity, and availability dimensions. To provide structured clarity amid this rapid growth, this paper presents a comparative and standards-aligned analysis of LLM security risks and defense mechanisms grounded in the OWASP GenAI Top-10 (2025). We systematically examine each vulnerability class, map representative attack patterns to primary mitigation strategies, evaluate their security property impact, and analyze practical limitations and implementation trade-offs. In addition, we introduce a severity-based assessment to prioritize risks according to operational and systemic impact, offering a quantitative perspective on defensive readiness. Our findings indicate that current mitigation strategies are predominantly reactive, concentrated at inference time, and unevenly distributed across the LLM lifecycle. Controls addressing training pipelines, supplychain dependencies, and autonomous system behaviors remain comparatively less mature and less standardized. By integrating vulnerability classification, defense mapping, severity prioritization, and trade-off analysis within a unified framework, this study provides actionable guidance for strengthening secure, resilient, and standards-driven LLM deployment in high-stakes environments.
Md Abdul Barek, Md Bajlur Rashid, A. K. I. Riad et al.· Annual International Compute...· 0 citations
Overall, this survey provides a structured characterization of the current state of AIware testing research and identifies key structural challenges that must be addressed to support lifecycle-aware, reliable AIware systems.
K. Gonzalez, Mariam El Mezouar· AIware· 0 citations
This work introduces a literature-grounded taxonomy of six OpenAPI specification fault classes, injects faults at five severity levels, and evaluates the resulting mutated specifications on two microservice benchmarks, TrainTicket and SocialNetwork, using three testing tools: EvoMaster, RESTler, and Schemathesis.
Hamza Bin Mazhar, Yuqing Wang, M. Mantyla· 0 citations
The rapid expansion of the life cycle for software deployment has required a move from traditional, manual security analysis to automated and integrated assurance frameworks. This study examines the effectiveness of integrating assurance, real-time threat detection, and automated certification gates right into the Continuous Integration and Continuous Deployment pipeline. The analysis is based on a synthetic dataset comprising values from 429 different builds, which is used to study the agreement between automated gating mechanisms and lower vulnerability escape rates. We used a standard tool chain consisting of Jenkins for orchestration, SonarQube for static analysis, and Splunk for log aggregation to emulate a high-velocity enterprise environment. The system seeks to reduce technical debt and potential security risks without impeding deployment velocity by enforcing stringent quality gates that prevent non-compliant artifacts from being promoted. The study highlights the quantitative effects of these controls on success build rates and on the exposure of hidden threats during staging. The results reveal that, despite an initial slowdown in delivery velocity, the incorporation of automated certification gates considerably reduces critical severity incident rates. Implications: The results indicate how to make system changes in response to data for those attempting to put DevSecOps into practice while maintaining the speed and integrity of their systems.
Sauhard Bhatt, Satyanarayana Gadiraju· 2026 6th International Confe...· 0 citations
The concept of productive coverage is formulated, shifting the center of gravity from gross quantitative test indicators to their semantic significance for business-critical scenarios, and practical recommendations are proposed for reconfiguring CI pipelines in order to minimize economic losses caused by brittle tests.
Evgenii Lvov· International Journal of Mod...· 0 citations