A fuzz testing method, device and system

Abstract

The present application relates to a fuzz testing method, device and system. The method includes: using the state machine coverage rate and the execution frequency data of the state machine coverage rate as parameters of the energy distribution algorithm, and selecting the DOM format to be mutated seed data; DOM format mutation data; input the DOM format mutation data into the machine under test to obtain a test execution result; wherein the test execution result includes the execution log of the machine under test. Using this method can improve the test efficiency.

Description

technical field [0001] The present application relates to the technical field of software testing, and in particular, to a fuzzing testing method, device and system. Background technique [0002] With the development of economy and information technology, modern industrial control information systems are faced with more and more security threats. For example, industrial control systems will face various variants of ransomware, Trojan horse viruses that hide in the depths, and various types of hackers. invasion. Fuzzy security testing technology is a kind of security testing application technology. Fuzzy security testing technology constructs the abnormal input data in the software by fuzzing, so as to construct the possible abnormality of the software, such as system crash, so as to accurately locate the existence in the software. security risks. Fuzzy security testing technology has the characteristic of traversing all inputs because fuzzing testing itself has the charact...

AI Technical Summary

Problems solved by technology

[0003] Existing fuzz testing scenarios include black-box testing scenarios, gray-box testing scenarios and white-box testing scenarios. In black-box testing scenarios, existing black-box testing is also called functional testing. It detects whether each function is It can be used normally. In the test, the program is regarded as a black box that cannot be opened, and the program interface is tested without considering the internal structure and internal characteristics of the program. It only checks whether the program function is in accordance with the requirements specification. According to the normal use of the regulations, it is judged whether the program can properly receive the input data and generate correct output information. Some existing black-box tests use code coverage as the parameter selection seed, and testing the program interface through the seed can improve the test efficiency. However, In many application environments such as remote testing, code coverage cannot be obtained, resulting in low testing efficiency

Images