White-box, black-box and grey-box testing

Lecture



To better understand approaches to software testing, you need, of course, to know what kinds and types of testing exist in principle. Let's start by looking at the basic types of testing that define a high-level classification of tests.

The highest level in the hierarchy of testing approaches is the concept of a type, which can cover several related testing techniques at once. In other words, a single type of testing can correspond to several of its kinds. Let's begin by considering a few types of testing that differ in knowledge of the internal structure of the object under test.

1. Black-box, gray-box and white-box models

Black box — a term used to denote a system whose internal structure and mechanism of operation are very complex, unknown, or unimportant for the purposes of a given task. «The black box method» — a method of studying such systems in which, instead of examining the properties and relationships of a system's component parts, one studies the reaction of the system as a whole to changing conditions. The black box approach took shape in the exact sciences (in cybernetics, systems engineering and physics) in the 1920—1940s and was later adopted by other sciences (for example, by behavioral psychology).

Black-box testing or behavioral testing — a strategy (method) of testing the functional behavior of an object (program, system) from the point of view of the outside world, in which no knowledge of the internal structure (code) of the object under test is used. In other words, black-box testing is carried out by testers who do not have access to the application's source code. A strategy refers to the systematic methods of selecting and creating tests for a test suite. The strategy of behavioral testing proceeds from technical requirements and their specifications.

Gray-box testing is a combination of white-box testing and black-box testing. The goal of this testing is to find defects related to incorrect structure or incorrect use of applications.

In mathematics, statistics and computer modeling, a gray box model combines a partial theoretical structure with data to complete the model. The theoretical structure can range from information about the smoothness of the results to models that only need parameter values from data or existing literature. Thus, almost all models are «gray box» models, as opposed to « black box» models, where no model form is assumed, or « white box» models, which are purely theoretical. Some models take a particular form, such as linear regression or a neural network. They have special methods of analysis. In particular, linear regression methods are far more efficient than most nonlinear methods. A model can be deterministic or stochastic (i.e., contain random components) depending on its intended use.

White-box testing (eng. white-box testing), also glass-box testing (eng. glass-box testing), structural testing (eng. structural testing) — testing that takes into account the internal mechanisms of a system or component (ISO/IEC/IEEE 24765).

It usually includes testing of branches, paths, statements (see code coverage). During testing, inputs are chosen to execute different parts of the code and expected results are determined. This resembles in-circuit testing (eng.).

White-box, black-box and grey-box testing

Black Box black-box testing method

Summary: We don't know how the system under test is built.

Black-box testing, also known as specification-based testing or behavior testing, is a testing technique based on working exclusively with the external interfaces of the system under test.

According to ISTQB:

2. Black-box testing is:

  • – testing, both functional and non-functional, that does not assume knowledge of the internal structure of a component or system.
  • – test design based on the black-box technique – a procedure for writing or selecting test cases based on the analysis of the functional or non-functional specification of a component or system without knowledge of its internal structure.

Why exactly «black box»? For the tester, the program under test is like a black opaque box whose contents they cannot see. The goal of this technique is to find errors in the following categories:

  • – incorrectly implemented or missing functions;
  • – interface errors;
  • – errors in data structures or in the organization of access to external databases;
  • – behavior errors or insufficient system performance;

Thus, we have no idea about the structure and internal design of the system. We need to concentrate on what the program does, not on how it does it.

Example of black-box testing:

A tester tests a website without knowing the specifics of its implementation, using only the input fields and buttons provided by the developer. The source of the expected result is the specification.

Since this is a type of testing, by definition it can include other kinds of it. Black-box testing can be either functional or non-functional. Functional testing involves checking the operation of the system's functions, while non-functional testing checks, accordingly, the general characteristics of our program.

The black-box technique is applicable at all levels of testing (from unit to acceptance), for which a specification exists. For example, when carrying out system or integration testing, requirements or a functional specification will form the basis for writing test cases.

Test design techniques based on the use of the black box include:

  • – equivalence classes;
  • – boundary value analysis;
  • – decision tables;
  • – state transition diagrams;
  • – all-pairs testing.

Advantages of the black-box method:

  • – testing is performed from the end user's perspective and can help detect inaccuracies and contradictions in the specification;
  • – the tester does not need to know programming languages or go deep into the details of the program's implementation;
  • – testing can be performed by specialists independent of the development department, which helps avoid bias;
  • – you can start writing test cases as soon as the specification is ready.

Disadvantages of the black-box method:

  • – only a very limited number of program execution paths are tested;
  • – without a clear specification (which is rather the reality on many projects) it is quite difficult to write effective test cases;
  • – some tests may turn out to be redundant if they have already been performed by the developer at the unit testing level;

The opposite of the black-box technique is white-box testing, which will be discussed below.

Test development methods using the black box

Typical black-box test development methods include:

  • Decision table testing
  • All-pairs testing
  • Equivalence partitioning
  • Boundary value analysis
  • Cause-effect graphing
  • Error guessing
  • State transition testing
  • Use case testing
  • User story testing
  • Domain analysis
  • Syntax testing
  • Combinatorial technique

3. White Box white-box testing method

Summary: We know all the implementation details of the program under test.

White-box testing (also: transparent, open, glass-box; code-based or structural testing) – a software testing method that assumes the internal structure/design/implementation of the system is known to the tester. We choose input values based on knowledge of the code that will process them. In the same way, we know what the result of that processing should be. Knowledge of all the features of the program under test and its implementation is mandatory for this technique. White-box testing means going deeper into the internal structure of the system, beyond its external interfaces.

According to ISTQB:

white-box testing is:

  • – testing based on the analysis of the internal structure of a component or system.
  • – test design based on the white-box technique – a procedure for writing or selecting test cases based on the analysis of the internal structure of a system or component.

Why «white box»? For the tester, the program under test is a transparent box whose contents they can see perfectly well.

Example of white-box testing:

A tester, who is usually a programmer, studies the implementation of the code of an input field on a web page, determines all the provided (both correct and incorrect) and non-provided user inputs, and compares the actual result of the program's execution with the expected one. In this case, the expected result is determined precisely by how the program's code is supposed to work.

White-box testing is similar to the work of a mechanic who studies a car's engine to understand why it won't start.

The white-box technique is applicable at different levels of testing – from unit to system level, but it is mainly used for the implementation of unit testing of a component by its author.

Levels and methods of testing using the white box

  1. Unit testing. White-box testing is performed during unit testing to make sure the code works properly before it is integrated with previously tested code. White-box testing during unit testing potentially reveals many defects at an early stage and helps eliminate defects that arise later, after the code is integrated with the rest of the application, and therefore reduces the impact of errors at later stages of development.
  2. Integration testing. White-box testing at this level is written to check the interaction of interfaces with each other. Testing at the unit level made it possible to make sure that each piece of code is tested and works appropriately in an isolated environment, while integration verifies correct behavior in an open environment using white-box testing for any interface interactions known to the programmer.
  3. Regression testing. White-box testing during regression testing is the use of reworked white-box test cases at the unit and integration testing level.

Advantages of the white-box method:

  • – testing can be performed at early stages: there is no need to wait for the user interface to be created;
  • – more thorough testing can be carried out, covering a large number of program execution paths.

Disadvantages of the white-box method:

  • – performing white-box testing requires a large amount of specialized knowledge
  • – when using test automation at this level, maintaining test scripts can turn out to be quite costly if the program changes frequently.

Comparison of Black Box and White Box

White-box, black-box and grey-box testing

4. Grey Box, gray-box testing method

Summary: We know only some of the implementation details of the system under test.

Gray-box testing is a software testing method that involves a combination of White Box and Black Box approaches. That is, the internal structure of the program is known to us only partially. It assumes, for example, access to the internal structure and algorithms of the software's operation in order to write the most effective test cases, but the testing itself is carried out using the black-box technique, that is, from the user's point of view.

This testing technique is also called the translucent box method: we see some things, and we don't see others.

Example of using the gray-box method:

The tester studies the program's code in order to better understand the principles of its operation and to explore possible paths of its execution. This knowledge will help write a test case that is sure to check a specific piece of functionality.

The gray-box technique is applicable at different levels of testing – from unit to system level, but it is mainly applied at the integration level to check the interaction of different modules of the program.

Methods used in gray-box testing

Cem Kaner defines «gray-box testing as involving inputs and outputs, but the test design is based on information about the code or the operation of the program that is normally not visible to the tester». The methods of gray-box testing include:

  • Matrix testing: contains a report on the status of the project.
  • Regression testing: involves rerunning test cases when new changes are made.
  • Pattern testing: checking a good application for its design, architecture and patterns.
  • Orthogonal array testing: used as a subset of all possible combinations.

Advantages of gray-box testing

  • Offers combined benefits: since «gray-box» testing is a combination of «white-box» and «black-box» testing, it provides the benefits of both tests.
  • Non-intrusive: it is based on the functional specification, the architectural representation, but not on the source code or binary files, which would also make it invasive.
  • Intelligent test development: the «gray-box» tester handles an intelligent testing scenario, such as handling of data types, communication protocol, exception handling.
  • Unbiased testing: despite all the above-mentioned advantages and capabilities, gray-box testing maintains the boundaries between the tester and the developer.

Disadvantages of gray-box testing

  • Partial code coverage: in gray-box testing, the source code or binary files are unavailable due to limited access to the internal or structural parts of the application, which results in limited ability to traverse code paths.
  • Defect identification: in distributed applications, it is difficult to link defect identification. Nevertheless, gray-box testing is a benefit that makes it possible to determine how appropriate it is for these systems to generate exceptions and how well those exceptions are handled in distributed systems that have a web-service environment.

See also

  • Abstraction
  • [[b9449]]
  • [[b13801]]
  • [[b13802]]
  • Quantum oracle
  • White-box cryptography
  • Computer experiment
  • Computer simulation
  • Design of experiments
  • Gray-box testing
  • Mathematical model
  • Nonlinear system identification
  • Parameter estimation
  • Research design
  • Scientific modeling
  • Modeling
  • Statistical model
  • System dynamics
  • System identification
  • System implementation
  • Systems theory
  • ABX test
  • Acceptance testing
  • Blind experiment
  • Boundary testing
  • Fuzz testing
  • Gray-box testing
  • Metasploit Project
  • Sanity check
  • Smoke testing
  • Software performance testing
  • Software testing
  • Load testing
  • Test automation
  • Unit testing
  • Web application security scanner
  • White hat hacker
  • Monkey testing

Comments

To leave a comment

If you have any suggestion, idea, thanks or comment, feel free to write. We really value feedback and are glad to hear your opinion.
To reply

Lectures and tutorial on "Quality Assurance"

Terms: Quality Assurance