Fuzzy test method, device and system

Abstract

The invention relates to a fuzzy test method, device and system. The method comprises the following steps: taking a state machine coverage rate and execution frequency data of the state machine coverage rate as parameters of an energy distribution algorithm, and selecting DOM-format to-be-mutated seed data; inputting the DOM-format to-be-mutated seed data into a fuzzifier to obtain DOM-format mutation data; inputting the DOM format variation data into a tested machine to obtain a test execution result; wherein the test execution result comprises an execution log of the tested machine. By adopting the method, the test efficiency can be improved.

Description

technical field [0001] The present application relates to the technical field of software testing, in particular to a fuzzing testing method, device and system. Background technique [0002] With the development of economy and information technology, modern industrial control information systems are facing more and more security threats. For example, industrial control systems will face various variants of ransomware, hidden Trojan horse viruses and various hackers. invasion. Fuzzy security testing technology is a kind of security testing application technology. Fuzzy security testing technology constructs the abnormality that may occur in the software by fuzzy constructing the malformed input data in the software, such as system crashes, etc., so as to accurately locate the existence of faults in the software. security risks. Fuzzy security testing technology has the characteristics of traversing all inputs because fuzzy testing itself has the characteristics of traversin...

AI Technical Summary

Problems solved by technology

[0003] Existing fuzz testing scenarios include black-box testing scenarios, gray-box testing scenarios and white-box testing scenarios. In black-box testing scenarios, existing black-box testing is also called functional testing. It detects whether each function is It can be used normally. In the test, the program is regarded as a black box that cannot be opened, and the program interface is tested without considering the internal structure and internal characteristics of the program. It only checks whether the program function is in accordance with the requirements specification. According to the normal use of the regulations, it is judged whether the program can properly receive the input data and generate correct output information. Some existing black-box tests use code coverage as the parameter selection seed, and testing the program interface through the seed can improve the test efficiency. However, In many application environments such as remote testing, code coverage cannot be obtained, resulting in low testing efficiency

Images