Automatic use case construction method and system for private protocol test

Abstract

The invention discloses an automatic use case construction method and system for private protocol testing, and relates to the technical field of communication protocol testing. Comprising the following steps: step 1, identifying a field structure, a state conversion rule and a dependency relationship of a private protocol through traffic sniffing and deep packet analysis; step 2, dynamically generating a test case set covering a normal scene, a boundary scene and an abnormal scene based on a reinforcement learning algorithm in combination with a protocol state machine and a historical test result; and step 3, injecting the generated test flow in the simulation environment, monitoring response data of the target system in real time, calculating and adjusting an evaluation value, and adjusting a generation strategy of the test case according to the value. Through adaptive execution and multi-dimensional anomaly analysis in the simulation environment, the test strategy is adjusted in real time, logic errors, resource leakage and security vulnerabilities are accurately recognized, efficient robustness verification of the private protocol is achieved, and the test efficiency and protocol security are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication protocol testing, in particular to an automatic case construction method and system for private protocol testing. BACKGROUND

[0002] Private communication protocols are widely used in industrial control, Internet of Things devices and special communication scenarios due to their closed and customized characteristics, but such protocols lack public specifications, bringing many challenges to testing and verification. Traditional private protocol testing relies on manual reverse analysis of protocol format and manual writing of test cases, which is not only inefficient but also difficult to cover complex scenarios in protocol interaction. Due to the lack of unified standards, testers need to derive protocol rules through repeated trial and error, resulting in long testing cycles and high labor costs. At the same time, manually designed test cases are often limited to normal scenarios, with insufficient coverage of boundary conditions (such as field critical values, state transition edge cases) and abnormal scenarios (such as illegal field combinations, malicious attack traffic), making it difficult to expose deep logical errors and security vulnerabilities in the protocol.

[0003] In addition, existing testing methods lack dynamic adjustment mechanisms, with fixed test case generation strategies that cannot optimize coverage based on historical test results, resulting in a high proportion of redundant test cases and low vulnerability discovery efficiency. The analysis of test responses relies heavily on manual comparison, making it difficult to quantitatively identify hidden problems such as resource leaks and permission bypasses, severely restricting the robustness and security verification effect of private protocols. Therefore, an automatic case construction method for private protocol testing is proposed to solve these problems. SUMMARY

[0004] Technical problems to be solved To solve the problems in the background art, the present application provides an automatic case construction method and system for private protocol testing.

[0005] Technical scheme To achieve the above purpose, the present application is implemented by the following technical scheme: an automatic case construction method for private protocol testing, comprising: Step 1: Identify the field structure, state transition rules and dependency relationships of the private protocol through traffic sniffing and deep packet analysis; Step 2: Based on the reinforcement learning algorithm, combine the protocol state machine and historical test results to dynamically generate a test case set covering normal scenarios, boundary scenarios and abnormal scenarios; Step 3: Inject the generated test traffic into the simulation environment, monitor the response data of the target system in real time, calculate the adjustment evaluation value and adjust the generation strategy of the test cases according to the value; The adjustment evaluation value is obtained and calculated as follows: the number of valid triggers of test cases generated by the same strategy, the number of consecutive invalidities, and the time interval between the last execution and the current time are counted, and the adjustment evaluation value is calculated based on the above parameters. The adjustment evaluation value is obtained as follows: In the formula, represents the adjustment evaluation value, represents the number of valid triggers, represents the number of consecutive invalidities, represents the time interval between the last execution and the current time, is a decay constant; Step four, using semantic analysis and machine learning models, calculating the vulnerability evaluation value of the monitored response data, and automatically identifying logical errors, resource leaks and security vulnerabilities in the private protocol based on the value.

[0006] Preferably, the specific steps of identifying the field structure, state transition rule and dependency relationship of the private protocol are as follows: identifying the field boundary based on entropy value analysis, modeling the state transition probability, and constructing the dependency relationship graph between fields.

[0007] Preferably, the specific steps of dynamically generating the test case set covering normal scenarios, boundary scenarios and abnormal scenarios are as follows: using a hybrid generation strategy, including generating abnormal field combinations based on syntax variation, covering normal scenarios by traversing protocol state machine paths based on model checking, covering boundary scenarios by simulating attack traffic through a generative adversarial network, and dynamically adjusting the priority of each strategy according to historical test results by combining a reinforcement learning algorithm.

[0008] Preferably, the adjustment evaluation value is obtained and calculated as follows: the number of valid triggers of test cases generated by the same strategy, the number of consecutive invalidities, and the time interval between the last execution and the current time are counted, and the adjustment evaluation value is calculated based on the above parameters.

[0009] Preferably, the vulnerability evaluation value is obtained and calculated as follows: extracting the logical error feature value, resource leak feature value and security vulnerability matching value of the response data, and calculating the vulnerability evaluation value by combining a high-risk feature library.

[0010] Preferably, the logical error feature value is obtained as follows: extracting protocol rules from the dependency relationship graph, parsing the response data and comparing the rules to count the number of logical conflicts, and normalizing the number of conflicts to obtain the logical error feature value.

[0011] Preferably, the resource leakage characteristic value acquisition step is as follows: the CPU usage and memory occupation of the target system are collected by a system probe, preprocessed and input into a pre-trained anomaly detection model, and the fluctuation anomaly probability is output as the resource leakage characteristic value.

[0012] Preferably, the security vulnerability matching value acquisition step is as follows: a vulnerability feature library is constructed based on the abnormal behavior knowledge base, the message structure features and system behavior features of the response data are extracted, and the maximum similarity to the vulnerability feature library is calculated as the security vulnerability matching value through a feature matching algorithm.

[0013] Preferably, the high-risk feature library construction step is as follows: the feature parameters of logical errors, resource leaks and security vulnerabilities are extracted based on historical vulnerability cases in the abnormal behavior knowledge base, and a high-risk feature library is formed.

[0014] An automatic case construction system for private protocol testing, comprising: A data analysis module for identifying the field structure, state transition rules and dependency relationship of the private protocol through traffic sniffing and deep packet analysis; A case generation module for dynamically generating a test case set covering normal scenarios, boundary scenarios and abnormal scenarios based on a reinforcement learning algorithm, in combination with a protocol state machine and historical test results; An adaptive execution module for injecting the generated test traffic in a simulation environment, monitoring the response data of the target system in real time, calculating an adjustment evaluation value and adjusting the generation strategy of the test case according to the value; The adjustment evaluation value acquisition and calculation step is as follows: the effective trigger times, continuous invalid times and time interval between the last execution and the current of the test case generated by the same strategy are counted, and the adjustment evaluation value is calculated through the above parameters; The adjustment evaluation value is obtained in the following manner: In the formula, The adjustment evaluation value is represented by, The effective trigger times are represented by, The continuous invalid times are represented by, The time interval between the last execution and the current is represented by, The decay constant is represented by; An anomaly analysis module for calculating a vulnerability evaluation value for the monitored response data using a semantic analysis and machine learning model, and automatically identifying logical errors, resource leaks and security vulnerabilities in the private protocol based on the value.

[0015] Advantages The present application has the following advantages: (1) The automatic case construction method and system for private protocol testing can realize efficient and robust verification of the private protocol by real-time adjustment of the test strategy and accurate identification of logical errors, resource leaks and security vulnerabilities through adaptive execution and multi-dimensional abnormality analysis in the simulation environment, and significantly improve the test efficiency and protocol security.

[0016] (2) The automatic case construction method and system for private protocol testing can solve the problems of incomplete case coverage and dependence on manual modeling in traditional testing by identifying protocol core features through traffic sniffing and deep packet analysis, dynamically generating a test case set covering normal, boundary and abnormal scenarios in combination with a reinforcement learning algorithm, and improving the systematicness and integrity of the test.

[0017] Of course, implementing any product of the present application does not necessarily require all the advantages described above. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 The flowchart of the automatic case construction method for private protocol testing according to the present application; Figure 2 The structural diagram of the automatic case construction system for private protocol testing according to the present application. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0020] The embodiments of the present application provide a technical solution: an automatic case construction method for private protocol testing, as shown in Figure 1 , comprising: Step 1: Identify the field structure, state transition rules and dependency relationship of the private protocol through traffic sniffing and deep packet analysis; Step 2: Dynamically generate a test case set covering normal, boundary and abnormal scenarios based on a reinforcement learning algorithm in combination with a protocol state machine and historical test results; Step 3: Inject the generated test traffic in the simulation environment, monitor the response data of the target system in real time, calculate the evaluation value and adjust the generation strategy of the test case according to the value; Step 4: Calculate the vulnerability evaluation value of the monitored response data using semantic analysis and machine learning models, and automatically identify logical errors, resource leaks and security vulnerabilities in the private protocol based on the value.

[0021] Specifically, the specific steps of identifying the field structure, state transition rule and dependency relationship of the private protocol are as follows: identifying the field boundary based on entropy value analysis, modeling the state transition probability, and constructing the dependency relationship graph between fields.

[0022] Specifically, the specific steps of dynamically generating the test case set covering the normal scene, boundary scene and abnormal scene are as follows: The syntax rules (field format, length constraint, value range) of the private protocol are structurally parsed, and the "legal feature library" of the core field (such as the temperature field needs to be -40~125℃, and the length field needs to be consistent with the actual data byte number) is sorted out. Abnormal field combinations are generated through random mutation operators: Randomly select fields (such as temperature, length, and instruction), perform "boundary replacement" on field values (such as changing the temperature to 130℃), perform "illegal tampering" on field length (such as changing the length field to 5 when the actual data is 8 bytes), insert special characters (such as ; and %) in string fields, and force to disturb the field order (such as moving the authentication field to the data field), generate abnormal messages containing "field conflict, format error, and logical contradiction", and cover the abnormal scene in protocol interaction (such as executing control instructions without authentication, and data length mismatch leading to parsing error).

[0023] The state machine model of the private protocol is constructed, and the full flow state transition rules of the protocol from "initial state" to "termination state" are determined: the "unauthenticated → authentication in progress → authenticated → data transmission → instruction response → close connection" core state is defined, the "allowed operation" in each state (such as unauthenticated state can only receive authentication instructions, and authenticated state can execute data read and write) is marked, and the "trigger condition" of state transition (such as authentication success needs to carry correct token, and data transmission needs to complete initialization first) is sorted out. Through depth-first traversal algorithm, test cases conforming to the protocol specification are generated one by one: starting from the initial state, following the "authentication → data transmission → instruction response" normal path, generating interaction messages strictly conforming to the protocol process (carrying legal token, field length matching, and correct state code); covering all "legal state transition branches" (such as authentication failure returns error code, and data transmission timeout triggers retransmission); ensuring that the test cases contain "the complete life cycle of normal protocol interaction" (from connection establishment to closing), covering the normal scene.

[0024] The normal protocol interaction traffic (typical interaction messages covering the whole life cycle of the protocol) collected in the simulation environment is used as the training sample to construct a generative adversarial network (GAN): the generator learns the distribution of the protocol field (such as the probability distribution of the temperature field-40-125℃, the linkage relationship between the length field and the data volume); the discriminator distinguishes between normal traffic and attack traffic, and after multiple rounds of adversarial training, the generator outputs “near boundary condition” attack messages: generate length critical messages (such as the protocol specifies the upper limit of the length to be 100 bytes, generate 99 / 101 byte messages); generate permission critical instructions (such as carrying special permission markers but not fully meeting the authorization conditions); generate threshold critical data (such as the humidity field 90% threshold value, the temperature field-40℃ boundary value), covering the “boundary scenarios” of protocol interaction (field values reach the legal threshold edge, permission marker critical state).

[0025] The reinforcement learning algorithm (Q-learning) is introduced, and the “reward-priority” linkage mechanism is established with “vulnerability discovery rate, scenario coverage rate” as the reward signal: define the “reward function”, when the test cases generated by a certain strategy discover new vulnerabilities (such as authentication bypass, buffer overflow) or cover unverified scenario branches, give positive rewards (+0.1 weight), specifically, increase the weight by 10% (such as the initial weight of the fuzzy test is 30%, after adjustment, it is 33%) based on the original strategy weight, while reducing the weight of other strategies in proportion, to ensure that the total weight remains 100%; design a “priority adjustment mechanism”, if the fuzzy test strategy discovers more than 3 vulnerabilities in the near future, its generation weight is increased from 30% to 40%, and if the state machine traversal strategy has covered 90% of the normal scenarios, its weight is reduced from 40% to 30%; update the strategy weight after each test, so that the test case set ‘dynamically adapts to the protocol vulnerability distribution’—strategies with high vulnerability occurrence are given priority, and strategies that have covered scenarios are reduced in frequency, achieving dynamic adaptation of strategies.

[0026] Specifically, the acquisition and calculation of the adjustment evaluation value are as follows: the number of valid triggers of the test cases generated by the same strategy, the number of consecutive invalid triggers, and the time interval between the last execution and the current time are counted, and the adjustment evaluation value is calculated based on the above parameters; The adjustment evaluation value is obtained as follows: In the formula, represents the adjustment evaluation value, which is specifically used to quantify the “current value priority” of the test case for private protocol testing, and the higher the value, the more likely it is that the test case will discover protocol problems and needs to be generated in priority in subsequent testing, represents the number of valid triggers, which is specifically the total number of times that the test cases generated by the strategy trigger “protocol abnormal response” or “new state path” in historical execution, represents the number of consecutive invalid times, specifically the number of times when the test case is executed recently in a continuous manner without triggering an exception or exploring a new state path, represents the time interval between the last execution and the current time, specifically the interval between the last execution time of the test case generated by the strategy and the current time, in minutes, is set to 30, which is used to control the decay effect of the time interval on the evaluation value. The longer the interval, the more obvious the decay of the evaluation value due to the exponential term .

[0027] Specifically, the acquisition and calculation of the vulnerability evaluation value are as follows: the logical error feature value, the resource leakage feature value and the security vulnerability matching value of the response data are extracted, and a feature vector is constructed based on the logical error feature value, the resource leakage feature value and the security vulnerability matching value, which is used to quantify the vulnerability risk dimension of the private protocol response data. The Euclidean distance between the current feature vector and all cases in the high-risk feature library is calculated in combination with the high-risk feature library, the minimum distance value is taken, and the distance maximum value is calculated to obtain the vulnerability evaluation value. The acquisition method of the vulnerability evaluation value is as follows: In the formula, represents the vulnerability evaluation value, and the larger the value, the higher the vulnerability risk, represents the minimum distance, specifically the minimum Euclidean distance between the current feature vector and the high-risk feature library, represents the maximum case distance value, specifically the maximum Euclidean distance between all cases in the high-risk feature library, wherein The setting of is used to avoid the denominator being 0.

[0028] The acquisition step of the logical error feature value is as follows: three types of core rules of the private protocol are automatically extracted from the dependency graph. The field constraint rule specifies the field format requirement, the string type field must not appear in the numerical field; the length matching standard is specified, the data length field must be consistent with the actual data byte number; the value range boundary is limited, the temperature field must not exceed-40℃~125℃. The state transition rule divides the allowed operations of the protocol in different interaction stages, and the control instruction must not be received in the uncompleted authentication state, and the error code must be returned in the fault state. The field association rule defines the linkage logic between multiple fields, and the dehumidification instruction flag bit must be 1 when the humidity is greater than 90%; the response delay must not exceed 100ms when the alarm level is "emergency".

[0029] Deep analysis is performed on the monitored target system response data, including return messages, status codes, and interaction logs. Specific values of each field are extracted from the messages, such as temperature = 130°C, humidity = 95%, and dehumidification flag = 0. The current state of the protocol is obtained from the status log, such as unauthenticated, and the execution result, such as no error after receiving the control instruction.

[0030] The parsed response data is compared with the extracted protocol rules one by one, and the total number of logical conflicts is counted. The data length field in the response is = 10, but the actual data byte number is = 15, triggering 1 field constraint conflict; successfully receiving the control instruction in the unauthenticated state, triggering 1 state transition conflict; humidity = 95% and dehumidification flag = 0, triggering 1 field association conflict.

[0031] Based on the number of protocol fields and the complexity of state transition, the maximum threshold of logical conflict is preset (such as 5 times for a protocol containing more than 10 core fields), and if it exceeds this value, it is determined as a serious logical anomaly. The logical error feature value is calculated by ratio: the actual conflict number is the numerator, the maximum threshold is the denominator, and the ratio of the two is calculated; if the ratio is greater than 1, the logical error feature value is 1; if the ratio is less than 0, the logical error feature value is 0; otherwise, the calculated ratio is directly taken as the logical error feature value. In this way, the actual conflict number is normalized to the interval [0, 1], forming a quantifiable logical error feature value.

[0032] The resource leakage feature value is obtained as follows: deploy system probes to collect the CPU usage and memory occupancy of the target system in real time. Set the probe to continuously monitor at a fixed frequency (such as 1 time / second), and the collection period covers the execution period of the test case and the 30 seconds after the execution ends, capturing the dynamic changes of resource usage.

[0033] Preprocessing is performed on the collected CPU and memory data: Identify and eliminate abnormal fluctuation points to avoid interference with the true resource leakage determination; Strictly match the CPU usage and memory occupancy by timestamp to ensure that the resource data at the same time form a corresponding relationship, facilitating the analysis of the two linkage anomalies; Extract the resource data 30 seconds before the test case execution, and take the average value as the resource baseline value, representing the resource consumption level during normal protocol interaction.

[0034] Input the preprocessed resource data into the pre-trained anomaly detection model (the model is trained based on historical normal interaction resource data of similar private protocols, and has learned the normal fluctuation range of CPU and memory). The model learns the resource fluctuation rules during normal protocol interaction and identifies resource usage behaviors that deviate from the normal pattern.

[0035] The model directly outputs the fluctuation anomaly probability as a resource leakage feature value, with a value range of [0, 1]. The higher the probability, the greater the possibility of resource anomaly consumption. Through the process, the abnormal state of resource use is converted into a quantifiable feature value.

[0036] The security vulnerability matching value is obtained as follows: based on the abnormal behavior knowledge base, the feature patterns of known security vulnerabilities are sorted out, and a vulnerability feature library is constructed. For common buffer overflow, authentication bypass, and instruction injection vulnerabilities of private protocols, the core features of each type of vulnerability are extracted: Buffer overflow: define features such as "message length exceeds the upper limit specified by the protocol", "return code fixed as 0x05", and "memory address field appears illegal overwrite mark"; Authentication bypass: clearly define features such as "no authentication token carried but successfully performs privileged operation", "status code returns 200", and "log record has no permission check behavior"; Instruction injection: summarize features such as "message contains special characters", "system log appears syntax error prompt", and "execution result is completely inconsistent with instruction expectation".

[0037] Feature extraction is performed on the response data monitored during the test process: Message structure features: analyze the length of the message, the specific values of each field, whether it contains special symbols (such as %, $), and whether the field order conforms to the default rules of the protocol; System behavior features: collect the status code returned by the target system, protocol state changes, and system log information.

[0038] Call the cosine similarity or edit distance algorithm to compare the extracted response features with the feature patterns of each vulnerability in the vulnerability feature library one by one: If comparing buffer overflow vulnerabilities, calculate the difference ratio of response message length and "protocol specified upper limit", and whether the return code matches 0x05, etc., to generate a matching score; If comparing authentication bypass vulnerabilities, check 'whether no token executes operation' and 'whether the status code returns normally (such as returns 200 without authentication)', etc., to output the corresponding matching degree; If comparing instruction injection vulnerabilities, detect features such as special characters in the message and system log syntax errors, and count the matching degree.

[0039] After traversing all vulnerability types, the maximum similarity value is selected, which is directly used as the security vulnerability matching value, with a value range of [0, 1]. The closer the value is to 1, the more consistent the response data is with the known security vulnerability features, indicating that the private protocol has a higher risk of corresponding security vulnerabilities, which quantifies the potential threat of security vulnerabilities.

[0040] Specifically, the construction steps of the high-risk feature library are as follows: Based on the historical vulnerability cases precipitated in the abnormal behavior knowledge base, the core parameters of the private protocol vulnerability cases covering logical errors, resource leaks, and security vulnerabilities are extracted one by one. For logical error analysis, the field conflict type, state jump contradiction point, and system response are analyzed; for resource leak analysis, the CPU peak fluctuation range, memory occupation growth trend, and abnormal duration are extracted; for security vulnerability analysis, the trigger condition, exploitation path, and feature mode are sorted out; The extracted parameters are standardized. Numerical features are normalized to the interval [0, 1] by formula, enumeration features are converted into one-hot encoding, and text features are converted into numerical vectors with the help of a word vector model. The features are stored according to 'case ID + feature type + standardized parameter', and an index is established for retrieval by vulnerability type and feature parameter range, thereby constructing a high-risk feature library.

[0041] An automatic case construction system for private protocol testing, as shown in Figure 2 , includes: A data analysis module for identifying the field structure, state transition rules, and dependencies of the private protocol through traffic sniffing and deep packet analysis; A case generation module for dynamically generating a test case set covering normal, boundary, and abnormal scenarios based on reinforcement learning algorithms, combined with protocol state machines and historical test results; An adaptive execution module for injecting generated test traffic in a simulation environment, monitoring the response data of the target system in real time, calculating and adjusting the evaluation value, and adjusting the generation strategy of the test cases according to the value; In the simulation environment, 100 normal protocol interaction cases are executed, and the fluctuation range and peak frequency of CPU and memory are collected; The baseline data is stored in the normal resource feature library as the basis for judging resource leaks; An anomaly analysis module for calculating a vulnerability evaluation value using semantic analysis and machine learning models on the monitored response data, and automatically identifying logical errors, resource leaks, and security vulnerabilities in the private protocol based on the value; After the anomaly analysis module identifies logical errors, resource leaks, and security vulnerabilities, it synchronously generates vulnerability scenario labels (e.g., logical error-field conflict, security vulnerability-authentication bypass) and pushes them to the case generation module in real time through a strategy synchronization interface; the case generation module triggers the vulnerability scenario special case generation process, supplements test cases covering similar scenarios according to the labels, and marks them as high-priority for execution; After receiving the vulnerability scenario labels, the adaptive execution module temporarily increases the injection intensity of the corresponding scenario test traffic by 50% (e.g., from 10 cases per second to 15 cases per second), and extends the monitoring time (additional monitoring for 60 seconds after execution ends), ensuring the integrity of vulnerability reproduction and repair verification.

[0042] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other presenters can develop. That is, although the present application is described in terms of particular embodiments and illustrative figures, it should be apparent that the application can be varied in a multitude of ways. Such apparent variations are intended to be encompassed by the present application, which is defined by the scope of the following claims and their equivalents. For example, those skilled in the art will recognize that elements from the illustrative embodiments can be interchanged or rearranged (e.g., without departing from the scope of the application) to suit particular situations and / or requirements.

[0043] The preferred embodiments of the application disclosed above are only for helping to explain the present application. The preferred embodiments do not describe all the details of the present application, nor limit the present application to only the specific embodiments described. It is obvious that many modifications and variations can be made according to the contents of the present specification. The present specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present application, so that those skilled in the art can well understand and utilize the present application. The present application is limited only by the scope of the claims and their full range of equivalents.

Claims

1. A method for constructing automated use cases for private protocol testing, characterized in that: include: Step 1: Identify the field structure, state transition rules, and dependencies of the private protocol through traffic sniffing and deep message analysis; Step 2: Based on the reinforcement learning algorithm, the protocol state machine and historical test results are combined to dynamically generate a set of test cases covering normal scenarios, boundary scenarios, and abnormal scenarios; Step 3: Inject the generated test traffic into the simulation environment, monitor the response data of the target system in real time, calculate the adjustment evaluation value and adjust the test case generation strategy according to the value; The steps of obtaining and calculating the adjustment evaluation value are as follows: counting the number of valid triggers, the number of consecutive invalid triggers and the time interval between the last execution and the current execution of the test case generated by the same strategy, and calculating the adjustment evaluation value based on the above parameters; The adjustment evaluation value is obtained as follows: Where, Indicates the adjusted evaluation value. Indicates the number of effective triggers, Indicates the number of consecutive invalid times. Indicates the time interval between the last execution and the current one. is the decay constant; Step 4: Use semantic analysis and machine learning models to calculate the vulnerability assessment value of the monitored response data, and automatically identify logical errors, resource leaks and security vulnerabilities in private protocols based on this value.

2. The method for constructing an automated use case for private protocol testing according to claim 1, wherein: The specific steps of identifying the field structure, state transition rules and dependency relationships of the private protocol are as follows: identifying field boundaries based on entropy analysis, modeling state transition probabilities, and constructing a dependency graph between fields.

3. The method for constructing an automated use case for private protocol testing according to claim 1, wherein: The specific steps for dynamically generating a set of test cases covering normal scenarios, boundary scenarios, and abnormal scenarios are as follows: adopting a hybrid generation strategy, including generating abnormal field combinations through fuzz testing based on syntax variation, traversing protocol state machine paths based on model checking to cover normal scenarios, and simulating attack traffic through adversarial generation networks to cover boundary scenarios. At the same time, combining reinforcement learning algorithms to dynamically adjust the priority of each strategy based on historical test results.

4. The method for constructing an automated use case for private protocol testing according to claim 1, wherein: The steps of obtaining and calculating the vulnerability assessment value are as follows: extracting the logical error feature value, resource leakage feature value and security vulnerability matching value of the response data, and calculating the vulnerability assessment value in combination with the high-risk feature library.

5. The method for constructing an automated use case for private protocol testing according to claim 4, characterized in that: The steps for obtaining the logical error characteristic value are as follows: extracting protocol rules from the dependency graph, parsing the response data and comparing the rules to count the number of logical conflicts, and normalizing the number of conflicts to obtain the logical error characteristic value.

6. The method for constructing an automated use case for private protocol testing according to claim 4, wherein: The steps for obtaining the resource leakage characteristic value are as follows: the CPU usage and memory occupancy of the target system are collected through a system probe, and after preprocessing, they are input into a pre-trained anomaly detection model, and the fluctuation anomaly probability is output as the resource leakage characteristic value.

7. The method for constructing an automated use case for private protocol testing according to claim 4, wherein: The steps for obtaining the security vulnerability matching value are as follows: constructing a vulnerability feature library based on the abnormal behavior knowledge base, extracting the message structure characteristics and system behavior characteristics of the response data, and calculating the maximum similarity with the vulnerability feature library through a feature matching algorithm as the security vulnerability matching value.

8. The method for constructing an automated use case for private protocol testing according to claim 4, wherein: The steps for constructing the high-risk feature library are as follows: based on historical vulnerability cases in the abnormal behavior knowledge base, characteristic parameters of logic errors, resource leaks and security vulnerabilities are extracted to form a high-risk feature library.

9. An automated use case construction system for private protocol testing, used to implement the automated use case construction method for private protocol testing according to any one of claims 1 to 8, characterized in that: include: Data parsing module, used to identify the field structure, state transition rules and dependencies of private protocols through traffic sniffing and deep message parsing; The use case generation module is used to dynamically generate a set of test cases covering normal scenarios, boundary scenarios, and abnormal scenarios based on the reinforcement learning algorithm, combined with the protocol state machine and historical test results; An adaptive execution module, which is used to inject generated test traffic into the simulation environment, monitor the response data of the target system in real time, calculate the adjustment evaluation value and adjust the test case generation strategy according to the value; The steps of obtaining and calculating the adjustment evaluation value are as follows: counting the number of valid triggers, the number of consecutive invalid triggers and the time interval between the last execution and the current execution of the test case generated by the same strategy, and calculating the adjustment evaluation value based on the above parameters; The adjustment evaluation value is obtained as follows: Where, Indicates the adjusted evaluation value. Indicates the number of effective triggers, Indicates the number of consecutive invalid times. Indicates the time interval between the last execution and the current one. is the decay constant; The anomaly analysis module is used to calculate the vulnerability assessment value of the monitored response data using semantic analysis and machine learning models, and automatically identify logical errors, resource leaks and security vulnerabilities in private protocols based on this value.

Images