Security-Oriented Metamorphic Relations

• Security-oriented metamorphic relations are defined as formal input/output relationships that detect vulnerabilities by transforming benign inputs into potentially malicious ones.
• They utilize logical structures and mappings to taxonomies like OWASP and CWE, enabling automated testing for web applications and smart contracts.
• Frameworks such as MST-wi and AIM optimize MR-based testing, reducing runtime by up to 80% while maintaining high detection accuracy.

Security-oriented metamorphic relations (MRs) are formalized input/output relationships that encode essential security properties of software systems, particularly web applications and smart contracts. These MRs enable automated detection of security vulnerabilities by structuring test oracles as relational properties over pairs of executions. Rather than relying on hard-coded expected outputs, security-oriented MRs define transformations that render benign inputs into potentially malicious ones, with a corresponding predicate (“oracle relation”) over their outputs. A violation of the MR typically signals a concrete security vulnerability. The approach directly addresses the oracle problem in security testing and has been applied across multiple domains, including web systems and blockchain smart contracts (Mai et al., 2019, Chaleshtari et al., 2022, Li, 2023, Chaleshtari et al., 2024).

1. Formal Structure of Security-Oriented Metamorphic Relations

Security-driven metamorphic relations are specified as logical implications over input-output pairs. For a system $f:X \to Y$, the MR takes the form:

$\forall x \in X.\ P(x) \implies R(f(x), f(T(x)))$

where:

• $x$ is a source input (e.g., a user interaction trace, transaction, or request sequence)
• $P(x)$ is a semantic precondition determining applicability (e.g., “after login” or “file parameter present”)
• $T(x)$ is a transformation generating a “malicious” or follow-up input (e.g., injecting payloads, switching roles)
• $R(\cdot, \cdot)$ is the oracle relation expressing a necessary security property at the output level

A metamorphic violation ($\lnot R$) indicates a likely vulnerability of a specific class. Such MRs are system-agnostic and can be encoded for automation, enabling coverage of large vulnerability classes without manually specifying output oracles for each test instance (Mai et al., 2019, Chaleshtari et al., 2022, Chaleshtari et al., 2024).

2. Taxonomy and Encoding of Security MRs

Security-oriented MRs are grouped according to standard vulnerability taxonomies (OWASP, CWE) and security design principles. Table 1 summarizes representative MR classes and their targeted CWE mappings, as formalized in the MST-wi and AIM frameworks (Chaleshtari et al., 2022, Chaleshtari et al., 2024):

MR Category	Canonical CWE(s)	Example MR Formalism / Intent
Authorization Bypass	CWE-286, CWE-863	Direct URL (non-GUI) → expect error/differ
Path Traversal	CWE-22	inject “../” in file param → expect reject
XSS	CWE-79	inject script tag → output must not render
Session Fixation	CWE-384	re-login/switch user → new sessionID
Information Disclosure	CWE-200, CWE-668	access hidden URL/file → error/different
Password Policy	CWE-262, CWE-521	force weak/expired password → must reject

MR formalizations typically reference transformations on input parameters, authentication state, or environmental factors (e.g., protocol, channel, session context). For example, the authorization-bypass schema MR states:

$$MR_{286}: \forall x \in I.\; \forall y.\; [\neg \text{isSupervisorOf}(u', \text{userOf}(x,y)) \wedge \text{afterLogin}(x,y) \wedge \neg \text{reachableViaGUI}(u', \text{urlOf}(x,y)) ] \implies [\text{isError}(O(x), y) \vee \text{different}(O(x), O(x'))]$$

where $x'$ is a direct GET request as user $u'$ to a URL only reachable by a supervisor (Chaleshtari et al., 2024).

3. Application Domains and Toolchain Automation

Security-oriented MRs have been operationalized in frameworks such as MST-wi and AIM for web applications, and in tailored approaches for smart contracts (Chaleshtari et al., 2022, Chaleshtari et al., 2024, Li, 2023). In these settings, the MR-driven workflow encompasses:

• Specification: Authoring MRs in a domain-specific language (SMRL/Xbase for MST-wi)
• Input Generation: Automated crawling (e.g., Crawljax) and mutational fuzzing to collect diverse source sequences
• Transformation: Systematic derivation of follow-up (“malicious”) inputs via prescribed MR transformations
• Oracle Automation: Checking the relational predicate ($R$) between outputs; automation eliminates manual oracle construction
• Failure Reporting: Violation indicates a vulnerability; engineers may inspect paired inputs/outputs for confirmation

The approach covers a significant portion of the OWASP testing surface—39% of activities not automated by traditional tools—and maps to at least 45% of design-principle-related CWE types (Chaleshtari et al., 2022). MST-wi provides a catalog of 76 system-agnostic MRs; earlier work established 22 foundational MRs, covering authentication, authorization, session handling, input validation, cryptography, and logging (Mai et al., 2019, Chaleshtari et al., 2022).

4. Minimization and Optimization in MR-based Security Testing

Execution of all MRs across all inputs is computationally intensive. AIM addresses this by employing clustering and many-objective optimization to select a minimal input set covering all MR precondition patterns, thus preserving vulnerability detection capability while mitigating runtime (Chaleshtari et al., 2024):

• Clustering over output and action patterns identifies equivalence classes, enabling representative selection
• Genetic Algorithms (e.g., MOCCO) minimize total action count while maximizing MR coverage
• Objective Surrogates estimate the marginal cost of covering uncovered MR subclasses
• Soundness is formally retained: every MR is exercised at least once on a relevant input

Empirical results (Jenkins, Joomla) indicate that AIM reduces metamorphic security testing time by approximately 80% without loss of vulnerability coverage (Chaleshtari et al., 2024).

5. Security MRs in Smart Contracts

Metamorphic security testing has been generalized to smart contracts, capturing blockchain-specific vulnerabilities. The MR suite in (Li, 2023) addresses:

• Gas Manipulation: Varying gas allocation to detect reentrancy (MR1.1, MR1.2)
• Account-Type Switching: Varying EOA/CA sender to trigger logic asymmetries or fallback anomalies (MR2.1, MR2.2, MR2.3)
• Oracle: Equality of status/gas/balance between source and follow-up; any divergence signals a security defect

Experimental evaluation on 67 contracts demonstrated 100% true positive rate and 0% false discovery—higher than state-of-the-art static and fuzzing-based tools (Li, 2023).

6. Formal Properties, Limitations, and Empirical Results

Security-oriented MRs are sound by construction for their targeted CWE classes; any violation implies a true security problem. They are typically not complete for general security: the catalog is finite and covers only those MRs formalized (e.g., not all possible logic flaws, covert channels, or side channels). Deterministic preconditions ensure semantic validity.

Empirically, the MST-wi and AIM pipelines achieved sensitivities of 75–100% and specificity $\approx$99.5% across major open-source and proprietary systems. MR-based approaches find numerous vulnerabilities missed by static or traditional dynamic analysis (e.g., SonarQube, ZAP), especially in authorization, input validation, and session management categories (Chaleshtari et al., 2022, Chaleshtari et al., 2024).

7. Generalization and Future Directions

The core principle—encoding attacker- or misconfiguration-derived anomaly patterns as metamorphic relations, and automating dynamic mutation and oracle checking—has applicability across software artifacts beyond web and blockchain domains. Extensions under discussion include:

• Hybrid MR + static analysis, to expand coverage to weaknesses not directly observable via I/O
• Richer MR DSLs supporting advanced session/cookie manipulations, API interactions, and multi-user/model concurrency
• Domain adaptation to microservices, mobile-backend APIs, and machine learning system robustness evaluation

The metamorphic relation paradigm provides a scalable path toward alleviating the oracle bottleneck for security testing, and is expected to remain central as software complexity and attack surface expand (Chaleshtari et al., 2022, Li, 2023, Chaleshtari et al., 2024).