Firewall device audit function testing method and system based on graphical application

Abstract

The present application provides a firewall device audit function test method and system based on graphical applications, which are applied to test execution devices. The method includes: creating an audit policy for graphical applications in the firewall device under test; controlling the terminal device to operate the graphical application to run the graphical application; obtaining the test report file generated by the terminal device; judging whether the graphical application runs successfully according to the test report; if the graphical application runs successfully, obtaining the audit log data generated by the firewall device under test; judging whether the audit log data complies with the audit policy; if the audit log data complies with the audit policy, the firewall device under test passes the audit function test. The firewall device audit function test method provided by the present application can realize the automated test of the audit function of the firewall device, without the need for manual operation of the graphical application, saving human resources and time, and improving the efficiency of the firewall device audit function test.

Description

Technical Field

[0001] The present application relates to the technical field of device performance testing, and in particular to a method and system for testing the audit function of a firewall device based on a graphical application. Background Art

[0002] A firewall device is a device that organically combines various software and hardware for security management and screening to help terminal device networks build a relatively isolated protection barrier between their internal and external networks to protect user data and information security. Firewall devices have audit functions. When an audit policy is configured for a certain terminal device IP address / port / user / protocol / application / behavior, the Internet behavior of all terminal device application software attached to the firewall device will be monitored. If one or more features of the application software's Internet behavior match the audit policy, the application software's Internet behavior will be recorded in the log or sent to the log server for filing. In order to ensure that the firewall device can accurately audit the Internet behavior of the application software in the terminal device according to the audit policy, the audit function of the firewall device needs to be tested.

[0003] At present, the audit function test of firewall equipment requires manual operation of application software, and after the audit of the firewall equipment is completed, it is necessary to manually check the audit log to determine the results of the audit function test. For the audit of graphical applications, it is difficult to operate and control the graphical application because it is impossible to control the operation of the graphical application with the operation interface through remote automation. Therefore, using the existing audit function test method of firewall equipment, relying solely on manual work to complete these audit function tests will be a huge project with a large number of repetitive tasks, which is not only time-consuming and labor-intensive, but also inefficient, and will waste a lot of human resources and costs. Summary of the invention

[0004] The present application provides a firewall device audit function testing method and system based on graphical application, so as to solve the problem that the existing method of manually testing the firewall device audit function consumes a lot of manpower and time during the testing process, resulting in low efficiency of the firewall device audit function testing.

[0005] In a first aspect, the present application provides a firewall device audit function testing method based on a graphical application, which is applied to a test execution device, wherein the test execution device is connected to a firewall device under test and a terminal device respectively, wherein the firewall device under test is connected to the terminal device, and wherein a graphical application is installed on the terminal device, wherein the graphical application is an application that displays a user operation interface in a graphical manner; the method comprises:

[0006] Creating an audit policy for the graphical application in the firewall device under test, wherein the audit policy is a monitoring rule for the graphical application;

[0007] Controlling the terminal device to operate the graphical application to run the graphical application;

[0008] Obtaining a test report file generated by the terminal device, wherein the test report file is used to record the operation data of the graphical application;

[0009] Determining whether the graphical application runs successfully according to the test report;

[0010] If the graphical application runs successfully, then obtaining audit log data generated by the firewall device under test, wherein the audit log data is used to record monitoring data of the graphical application running according to the audit policy;

[0011] Determining whether the audit log data complies with the audit policy;

[0012] If the audit log data complies with the audit policy, the firewall device under test passes the audit function test.

[0013] In combination with the first aspect, in a possible implementation manner, the method of controlling the terminal device to operate the graphical application to run the graphical application includes:

[0014] Creating an execution script from the test execution device to the terminal device, wherein the execution script is used to call an application operation library file, and the application operation library file is preset in the terminal device;

[0015] A trigger instruction is sent from the test execution device to the terminal device, wherein the trigger instruction is used to trigger a preset scheduled task in the terminal device to run the execution script, and the application operation library file is called through the execution script to implement operations on the graphical application.

[0016] In conjunction with the first aspect, in a possible implementation manner, a method for operating the graphical application includes:

[0017] On the terminal device, obtaining a target control image and a user operation interface image of the graphical application, wherein the target control image is pre-stored in the terminal device and is the control image to be operated by the execution script;

[0018] On the terminal device, determine whether the target control image exists in the user operation interface image; if the target control image exists in the user operation interface image, obtain the position information of the target control image in the user operation interface image; if the position information of the target control image is successfully obtained, perform the operation corresponding to the execution script according to the position information, and the result of this operation is successful operation; if the position information of the target control image cannot be found, the result of this operation is failed operation.

[0019] On the terminal device, after all the operation steps are executed, a test report file is generated, and the test report file includes the result of each operation step.

[0020] In combination with the first aspect, in a possible implementation manner, the application operation library file includes: multiple application classes, and operation methods corresponding to the application classes.

[0021] In combination with the first aspect, in a possible implementation manner, before the step of obtaining the test report file generated by the terminal device, the step further includes:

[0022] Determining, from the test execution device, whether the graphical application in the terminal device has finished running;

[0023] If the graphical application is finished running, a test report file generated by the terminal device is obtained from the test execution device.

[0024] In conjunction with the first aspect, in a possible implementation manner, the step of determining whether the graphical application has finished running includes:

[0025] Obtaining a file list of the terminal device from the test execution device;

[0026] Determine whether the file list includes a test report file;

[0027] If the file list includes the test report file, the running of the graphical application ends.

[0028] In conjunction with the first aspect, in a possible implementation manner, the step of determining whether the graphical application runs successfully according to the test report includes:

[0029] Traversing the statement information in the test report;

[0030] Determine whether there is a failed statement in the statement information;

[0031] If the execution failure statement does not exist in the statement information, the graphical application executes successfully.

[0032] In combination with the first aspect, in a possible implementation manner, after the step of obtaining the test report file generated by the terminal device, the method further includes:

[0033] The test report file and the execution script in the terminal device are deleted from the test execution device.

[0034] In combination with the first aspect, in a possible implementation manner, after the step of obtaining the audit log data generated by the firewall device under test, the method further includes:

[0035] The audit policy and the audit log data in the firewall device under test are deleted from the test execution device.

[0036] In a second aspect, the present application further provides a firewall device audit function test system based on a graphical application, which is applied to a test execution device, wherein the test execution device is connected to the firewall device under test, and the firewall device under test is connected to a terminal device, and a graphical application is installed on the terminal device, wherein the graphical application is an application that displays a user operation interface in a graphical manner; the system comprises:

[0037] A creation module, used to create an audit policy for the graphical application in the firewall device under test, wherein the audit policy is a monitoring rule for the graphical application;

[0038] A control module, used for controlling the terminal device to operate the graphical application so as to run the graphical application;

[0039] A first acquisition module, used to acquire a test report file generated by the terminal device, wherein the test report file is used to record the operation data of the graphical application;

[0040] A first judgment module, used for judging whether the graphical application runs successfully according to the test report;

[0041] A second acquisition module, configured to acquire audit log data generated by the firewall device under test if the graphical application runs successfully, wherein the audit log data is used to record monitoring data of the graphical application running according to the audit policy;

[0042] The second judgment module is used to judge whether the audit log data complies with the audit policy; if the audit log data complies with the audit policy, the firewall device under test passes the audit function test.

[0043] In combination with the second aspect, in a possible implementation manner, the system further includes: a first deletion module, configured to delete the test report file and the execution script in the terminal device.

[0044] In conjunction with the second aspect, in a possible implementation, the system further includes: a second deletion module, which is used to delete the audit policy and the audit log data in the firewall device under test. From the above technical solution, it can be seen that the present application provides a firewall device audit function test method and system based on a graphical application, the method is applied to a test execution device, the test execution device is connected to the firewall device under test, the firewall device under test is connected to a terminal device, the terminal device is installed with a graphical application, and the graphical application is an application that displays a user operation interface in a graphical manner. The method includes: creating an audit policy for the graphical application in the firewall device under test, wherein the audit policy is a monitoring rule for the graphical application; controlling the terminal device to operate the graphical application to run the graphical application; obtaining a test report file generated by the terminal device, wherein the test report file is used to record the running data of the graphical application; judging whether the graphical application runs successfully according to the test report; if the graphical application runs successfully, obtaining audit log data generated by the firewall device under test, wherein the audit log data is used to record the monitoring data of the running of the graphical application according to the audit policy; judging whether the audit log data complies with the audit policy; if the audit log data complies with the audit policy, the firewall device under test passes the audit function test.

[0045] The firewall device audit function test method provided by the present application first creates an audit policy for the graphical application in the firewall device under test. Then, the terminal device is automatically controlled to run the graphical application in a manner that displays the user operation interface, and whether the graphical application runs successfully is determined based on the test report file generated by the terminal device. Finally, if the graphical application runs successfully, the audit log data of the firewall device under test is obtained to determine whether the audit log data complies with the audit policy, thereby realizing the automated test of the audit function of the firewall device. In this way, there is no need to manually operate the graphical application during the firewall device audit function test, which saves human resources and time and improves the efficiency of the firewall device audit function test. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A schematic diagram of an application scenario for a firewall device audit function test provided in an embodiment of the present application;

[0048] Figure 2A flowchart of a method for testing the audit function of a firewall device based on a graphical application provided in an embodiment of the present application;

[0049] Figure 3 A flow chart of a method for controlling a terminal device to operate a graphical application provided in an embodiment of the present application;

[0050] Figure 4 A schematic diagram of creating a planned task provided in an embodiment of the present application;

[0051] Figure 5 A flowchart of a method for operating a graphical application provided in an embodiment of the present application;

[0052] Figure 6 A schematic diagram of a target control image provided in an embodiment of the present application;

[0053] Figure 7 A flowchart of a method for determining whether a graphical application is running successfully provided in an embodiment of the present application;

[0054] Figure 8 A flowchart of a method for determining whether a graphical application has been completed provided in an embodiment of the present application;

[0055] Fig. 9 A schematic diagram of the structure of a firewall device audit function test system based on a graphical application provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The following embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following embodiments do not represent all implementations consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application as detailed in the claims.

[0057] Based on the exemplary embodiments described in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the claims attached to this application. In addition, although the disclosure in this application is introduced according to one or several exemplary examples, it should be understood that each aspect of the disclosure can also constitute a complete implementation method separately.

[0058] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0059] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise indicated. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, for example, they can be implemented according to orders other than those given in the diagrams or descriptions of the embodiments of this application.

[0060] In addition, the terms "include" and "have" and any variations thereof are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to those components expressly listed but may include other components not expressly listed or inherent to such products or devices.

[0061] The term "module" as used in this application refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0062] A firewall device is a device that organically combines various software and hardware for security management and screening to help terminal device networks build a relatively isolated protection barrier between their internal and external networks to protect user data and information security. Firewall devices have audit functions. When an audit policy is configured for a certain terminal device IP address / port / user / protocol / application / behavior, the Internet behavior of all terminal device application software attached to the firewall device will be monitored. If one or more features of the application software's Internet behavior match the audit policy, the application software's Internet behavior will be recorded in the log or sent to the log server for filing. In order to ensure that the firewall device can accurately audit the Internet behavior of the application software in the terminal device according to the audit policy, the audit function of the firewall device needs to be tested.

[0063] Currently, the audit function test of firewall equipment requires manual installation and operation of application software, and after the firewall equipment audit is completed, manual review of the audit log is required to determine the results of the audit function test. For the audit of graphical applications on Windows system terminal devices, it is difficult to operate and control graphical applications because it is impossible to remotely control the operation of graphical applications with operation interfaces.

[0064] The main reasons include: graphical applications that need to be audited, such as instant messaging software, file transfer, stock finance, community applications, etc. Most graphical applications are not standard Windows form structures, and it is difficult to automate and control them through traditional Windows APIs. At present, the remote automation control methods for Windows terminal devices include PowerShell remote management (through WinRM) and SSH connection (through OpenSSH). However, these two methods can only remotely control the Windows command line. Even if the graphical application is opened by executing a script through the command line, it runs without an interface in the form of a background process. It cannot run with an interface like a local program because it is difficult to operate and control these graphical applications.

[0065] Therefore, using the existing audit function testing method of firewall equipment, the audit test of firewall equipment for graphical applications can only rely solely on manual completion. These audit function tests will be a huge project with a large number of repetitive tasks, which is not only time-consuming and labor-intensive, but also inefficient and will waste a lot of human resources and costs.

[0066] Based on the above problems, the present application provides a method and system for testing the audit function of a firewall device based on a graphical application, so as to solve the problem that the existing method for manually testing the audit function of a firewall device cannot remotely and automatically control the operation of the graphical application, and the testing process consumes a lot of manpower and time, resulting in low efficiency of the firewall device audit function test.

[0067] In a first aspect, the present application provides a firewall device audit function testing method based on a graphical application, which is applied to a test execution device. Figure 1 , Figure 1 A schematic diagram of an application scenario for a firewall device audit function test provided in an embodiment of the present application, such as Figure 1As shown, the test execution device is connected to the firewall device under test and the terminal device respectively, and the firewall device under test is connected to the terminal device. In some embodiments, the test execution device can be connected to the firewall device under test through ssh, and the test execution device can be connected to the terminal device through winrm (Windows RemoteManagement, i.e. Windows remote management, allowing remote users to use tools and scripts to manage Windows servers and obtain data). It should be noted that in some embodiments, there are two network cards (such as network card 1 and network card 2) on the terminal device, wherein the default route points to the gateway of the firewall device (via network card 1), and there is a dedicated route pointing to the test execution device (via network card 2). The communication between the terminal device and the test execution device takes the dedicated route (via network card 2), and the terminal device connects to the Internet or other addresses through the default route (via network card 1). A graphical application is installed on the terminal device, and the graphical application is an application that displays the user operation interface in a graphical manner, such as: instant messaging software, file transfer, stock finance, community applications, etc.

[0068] In some embodiments, a test case script for a graphical application is provided in the test execution device. The test case script can be used to describe the execution process of the test. Taking the instant messaging software QQ as an example, the following steps S1-S2 need to be executed in the test case script:

[0069] S1: Log in to the firewall device under test and create an audit policy for the instant messaging software QQ.

[0070] S2: Call a function (the input parameters of the function include graphical application operation steps), open the instant messaging software QQ on the terminal device, log in the user information, and send the message "hello" from one QQ user to another QQ user. Since the terminal device is connected to the firewall device under test, this action will be monitored and audited. After the message is sent, close the instant messaging software QQ.

[0071] S3: Search for the corresponding audit log on the firewall device under test to confirm whether the audit function is effective.

[0072] See also Figure 2 , Figure 2 A flowchart of a method for testing the audit function of a firewall device based on a graphical application is provided in an embodiment of the present application, such as Figure 2 As shown, the firewall device audit function testing method provided by the present application specifically includes the following steps S101-S107:

[0073] S101: creating an audit policy for the graphical application in the firewall device under test, wherein the audit policy is for monitoring the graphical application.

[0074] In this embodiment, it is first necessary to create an audit policy for the graphical application in the firewall device under test, and the firewall under test monitors the graphical application according to the audit policy. Specifically, the audit policy can be the monitoring of the operation behavior of a graphical application, or the monitoring of sending a certain file, or the monitoring of sending a certain sentence keyword, etc. The audit policy is determined according to the actual test requirements, and this application does not make specific restrictions on this.

[0075] For example, creating an audit policy for graphical applications in the firewall device under test can be achieved by the following method:

[0076] First, define the input parameters. cmd_str0 is used to create an audit policy on the device, cmd_str1 is used to clear existing logs on the device, cmd_str2 is used to query audit logs, and cmd_str3 is used to delete audit policies. execute_script_list defines the python statements to be executed on the terminal device.

[0077] The specific code is as follows:

[0078]

[0079] Then the test execution device connects to the firewall device under test and configures the audit policy.

[0080] try:

[0081] device1=Device('192.168.230.120','admin','admin@123')

[0082] device1.connect_to_device()

[0083] device1.execute_cli(cmd_str0).

[0084] S102: Control the terminal device to operate the graphical application to run the graphical application.

[0085] In this embodiment, the test execution device can be connected to the terminal device through the Python third-party library pywinrm, and remotely control the terminal device to operate the graphical application. Because, whether it is power shell remote management or ssh connection, all that can be remotely controlled are dos command lines. Even if the graphical application is run by executing the script through the command line, it is run in the form of a background process without an interface. In this way, it is impossible to use image recognition to locate the controls of the graphical application, and it is difficult to operate and control the graphical application.

[0086] In order to realize remote control of the terminal device to run the graphical application in a manner of displaying a user operation interface, in a possible implementation, refer to Figure 3 , Figure 3 A flow chart of a method for controlling a terminal device to operate a graphical application provided in an embodiment of the present application, such as Figure 3 As shown, step S102, the method of controlling the terminal device to operate the graphical application to run the graphical application includes steps S201-S202:

[0087] S201: Creating an execution script from the test execution device to the terminal device, wherein the execution script is used to call an application operation library file, and the application operation library file is preset in the terminal device;

[0088] S202: Sending a trigger instruction from the test execution device to the terminal device, wherein the trigger instruction is used to trigger a preset scheduled task in the terminal device to run the execution script, and calling the application operation library file through the execution script to implement operations on the graphical application.

[0089] In this embodiment, an application operation library file (hereinafter mywinlib.py is used as an application operation library file for exemplary illustration) and a scheduled task (hereinafter testtask is used as a scheduled task for exemplary illustration) are preset in the terminal device. The test execution device creates an execution script in the terminal device (hereinafter test_script.py is used as an execution script for exemplary illustration), and the execution script can be used to call the application operation library file. The test execution device sends a trigger instruction to the terminal device (hereinafter schtasks command is used as a trigger instruction for exemplary illustration), and the terminal device triggers the testtask scheduled task according to the schtasks command to execute the test_script.py execution script, and the test_script.py execution script calls the mywinlib.py library file, so that the terminal device can be remotely controlled to run the graphical application in a manner of displaying a user operation interface.

[0090] For example, from the test execution device, create a test_script.py execution script in the terminal device, the command line of the terminal device can be remotely controlled through the python third-party library pywinrm, and the content of the execution script is written line by line into the file test_script.py through the dos command echo.

[0091] For example, a function run_script_on_windows() is provided in the test execution device, and the function provides a service of controlling the terminal device for each test case.

[0092] In addition, in order to facilitate frequent remote control of the terminal device command line, a function run_conn_cmd() is set in the test execution device. This function is used to execute the work of sending dos commands from the test execution device to the terminal device. By default, the operation process is not displayed. If it needs to be displayed, the default parameter display needs to be set to True.

[0093] The specific code is as follows:

[0094]

[0095] When the test starts, the test execution device can receive parameters from the test case script through the function run_script_on_windows(), including: win_ip, win_user, win_pw, timeout=60 and *args. Among them, win_ip, win_user, win_pw are the address, user and password of the terminal device connected to the firewall device under test. The timeout=60 parameter is the timeout time for waiting for the test report file to appear, and the default is 60 seconds. The variable parameter *args receives the specific execution steps in the execution script passed by the test case, that is, constructs the python statement of the execution script.

[0096] Concatenate the operations contained in the variable parameter *args into a list, which contains all the contents of the execution script that needs to be run on the terminal device. Since the statements "from mywinlib import*", 'try:', 'finally:' are fixed, they do not need to be included in the test case. Insert the Python statements passed in the test case between try and finally, and put the last statement after finally. Use a list test_script_list to save the Python statements contained in the execution script.

[0097] The specific code is as follows:

[0098]

[0099] Next, establish a remote power shell connection with the terminal device through the protocal method of the Python third-party library pywinrm.

[0100] The specific code is as follows:

[0101] conn=winrm.Protocol(endpoint=f'http: / / {win_ip}:5985 / wsman', transport='plaintext', username=win_user, password=win_pw)

[0102] shell_id=conn.open_shell().

[0103] Next, the test execution device remotely controls the terminal device, creates an execution script test_script.py on the terminal device, uses the Python third-party library pywinrm to control the command line of the terminal device, and writes the Python statements contained in the list test_script_list into the execution script test_script.py line by line through the DOS command echo. Call the function run_conn_cmd() in the previous step to complete the operation.

[0104] The specific code is as follows:

[0105] for n in test_script_list:

[0106] run_conn_cmd(conn,shell_id,f"echo{n}>>test_script.py")

[0107] sleep(0.1).

[0108] For examples, see Figure 4 , Figure 4 A schematic diagram of creating a planned task provided in an embodiment of the present application, such as Figure 4 As shown, create a testtask scheduled task in the terminal device, select the operation to execute the test_script.py script, but do not set a trigger. The testtask scheduled task is triggered only when the schtasks command sent by the test execution device is received. This can be achieved by using the remote scheduled task command described below:

[0109] schtasks / run / tn{terminal device scheduled task name} / s{terminal device IP} / u{terminal device user name} / p{terminal device password}.

[0110] To execute this command, you can use the system method in the Python built-in library os to execute the remote scheduled task command on the local machine.

[0111] The specific code is as follows:

[0112] os.system(f'schtasks / run / tn"testtask" / s"{win_ip}" / u"{win_user}" / p"{win_pw}"').

[0113] Correspondingly, ending the testtask scheduled task can be achieved using the following program code:

[0114] schtasks / end / tn{terminal device scheduled task name} / s{terminal device IP} / u{terminal device user name} / p{terminal device password}.

[0115] The specific code is as follows:

[0116] os.system(f'schtasks / end / tn"testtask" / s"{win_ip}" / u"{win_user}" / p"{win_pw}"').

[0117] The mywinlib.py library file preinstalled on the terminal device includes the operating methods of graphical applications. Although there are many kinds of graphical applications on the terminal device, according to the basic operating methods of graphical applications, graphical applications can be divided into instant messaging, community forums, stock software and other types. For example, instant messaging applications, including QQ, MSN, etc., can be classified into the same type. For firewall devices, the basic operating steps of instant messaging include: opening and logging in, sending messages, sending pictures, sending files, and closing applications. In this way, the mywinlib.py library file that creates automated test scripts for various graphical applications can be simplified to the process of creating application classes and creating typical operating methods.

[0118] In a possible implementation, in order to improve the efficiency of creating an application operation library file, the application operation library file includes: a plurality of application classes, and operation methods corresponding to the application classes.

[0119] In this embodiment, the mywinlib.py library file preinstalled on the terminal device contains operation methods for various types of graphical applications. For example, for instant messaging type graphical applications, the operation methods mainly include: opening, logging in, sending files, sending text, etc. For community type graphical applications, the operation methods mainly include: opening, logging in, posting, etc. For applications of the same type, such as QQ and MSN, the operation process is similar, except that the controls that need to be clicked to perform these operations are different. Therefore, QQ and MSN can both be used as different instances of the same instant messaging type graphical application.

[0120] When the execution script is running, a certain application class will be instantiated into an object. During the instantiation process, the class initialization function __init__() will be executed first. The initialization function contains certain attributes, such as the attribute self.app_name, which represents the name of a specific application. For QQ, this attribute self.app_name is assigned the string "QQ". For MSN, this attribute self.app_name is assigned the string "MSN". In addition, the final execution result is saved through the attribute self.report_text.

[0121] The specific code is as follows:

[0122]

[0123] After the object is initialized, when using various operation methods (such as opening an application, sending a message), the function corresponding to these methods will determine the value of the current object's self.app_name. For example, for the method of opening an application, if self.app_name is "QQ", QQ will be started using the file path where QQ is located; if self.app_name is "MSN", MSN will be started using the file path where MSN is located. For the method of opening a chat window, if self.app_name is "QQ", the image of the QQ dialog box saved in advance will be used for graphic recognition to find the coordinate position, and then the QQ dialog box will be double-clicked; if self.app_name is "MSN", the image of the MSN dialog box saved in advance will be used for graphic recognition to find the coordinate position, and then the MSN dialog box will be double-clicked. In this way, although there are many types of graphical applications, there is no need to create a class for each graphical application, but to create a class for a certain type of application. Different graphical applications use different ways to initialize examples, which will improve the efficiency of creating application operation library files.

[0124] For example, when the instantiated application class is QQ, the variable self.app_name will be assigned to QQ in the initialization function, and the initialization function will also create an attribute self.report_text to record the test results. Graphical applications for testing need to be installed on the terminal device. There are many ways to start these graphical applications. For example, it can be achieved through pywinauto.Application().Start() in the python third-party library pywinauto. Fill in the path of the application in Start(). For example, if QQ is installed in the path C:\Program Files(x86)\Tencent\QQ\Bin\QQ.exe, then the specific code is as follows:

[0125]

[0126] In some application scenarios, many graphical applications are not standard Windows form structures, and it is difficult to automate control through traditional Windows APIs. Therefore, in the embodiments of the present application, image recognition is used to locate controls in graphical applications, and then click, double-click, input text, etc. are performed at the location point. In a possible implementation, please refer to Figure 5 , Figure 5 A flowchart of a method for operating a graphical application provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, in step S202, the method for operating the graphical application includes steps S2021-S2024:

[0127] S2021: On the terminal device, obtain a target control image and a user operation interface image of the graphical application, wherein the target control image is pre-stored in the terminal device, and the target control image is the control image to be operated by the execution script.

[0128] S2022: On the terminal device, determine whether the target control image exists in the user operation interface image.

[0129] S2023: If the target control image exists in the user operation interface image, obtain the position information of the target control image in the user operation interface image; if the position information of the target control image is successfully obtained, perform the operation corresponding to the execution script according to the position information, and the result of this step of operation is successful operation; if the position information of the target control image cannot be found, the result of this step of operation is failed operation.

[0130] S2024: On the terminal device, after all operation steps are executed, a test report file is generated, and the test report file includes the result of each operation step.

[0131] In this implementation, the terminal device is preset with a target control image, and the terminal device locates the position information by image recognition according to the target control image, and executes the operation of executing the script according to the position information. However, if the position information is not obtained, the result of failure to obtain the position information is recorded in the test report file on the terminal device. If the position information is obtained, the result of successful acquisition of the position information is recorded in the test report file on the terminal device.

[0132] For example, the terminal device can use pyautogui.locateOnScreen(image path) in the python third-party library pyautogui to locate the positions of various target controls in the user interface and obtain the position information. After the positioning is completed, double-click, single-click, input text and other operations on the target control through pyautogui.doubleClick(position information), pyautogui.click(position information), pyautogui.typewrite(position information) and other methods. If you want to determine whether an operation is completed or effective, you can also use the pyautogui.locateOnScreen method to complete it. For example, to determine whether the login is successful, you can find out whether the account picture appears on the screen after the successful login.

[0133] Take the graphical application QQ as an example. After QQ has been started and logged in, when you need to send a message to a user, you can double-click the user icon to open the dialog box. As long as the target control for testing is saved locally on the terminal device, refer to Figure 6 , Figure 6 A schematic diagram of a target control image provided in an embodiment of the present application, such as Figure 6 As shown in the figure, the control picture is a screenshot of the functional control corresponding to a certain operation in a graphical application, such as opening a dialog box, sending text, opening a search box, etc. Then use the buttonlocation = pyautogui.locateOnScreen() method to locate the coordinates of the target control in the user operation interface, and then execute pyautogui.doubleClick (buttonlocation) to complete the double-click operation and open the user dialog box.

[0134] In some embodiments, opening a user dialog box can be implemented through the function open_chat_win(). In the function open_chat_win(), the target control image path of the QQ test account is assigned to the control locator locater. Next, the pyautogui.locateOnScreen method is used to find the position of the target control image in the user operation interface. If the corresponding position is not found, the positioning fails, and the variable buttonlocation in the function open_chat_win will be None. Only when the positioning is successful and the location information is obtained, the double-click operation will be performed, and the result of the current step 'open_chat_win:Success\n' will be recorded. On the contrary, only the result of the current step 'open_chat_win:False\n' is recorded, and the double-click operation will not be performed. Finally, the function will return the location information of the target control.

[0135] The specific code is as follows:

[0136]

[0137]

[0138] In some embodiments, for text input in graphical applications, the function text_input can be used. Since text input has nothing to do with specific application classes, any application uses the same method, so text input does not need to be placed in each application class, but directly placed in the mywinlib.py library file, and pyautogui.typewrite() is directly used to implement text input.

[0139] The specific code is as follows:

[0140] def text_input(input_char):

[0141] pyautogui.typewrite(input_char)

[0142] sleep(1).

[0143] When all operations corresponding to the execution script are completed, the current graphical application needs to be closed. In the embodiment of the present application, the graphical application process is closed by finding the process whose name contains the keyword "graphic application" among all processes, obtaining its pid, and then closing the graphical application. Specifically, the graphical application can be closed on the terminal device by executing the msdos command taskkill / F / pid{process id} locally through the system method in the python built-in library os. The input parameter of the function is the name of the application to be closed. According to its name, the corresponding pid can be found to close it.

[0144] The specific code is as follows:

[0145]

[0146] After all steps of operating the graphical application are completed on the terminal device, a text file for a test report will be generated and saved locally on the terminal device. It should be noted that the execution script running on the terminal device has multiple steps, and a test report file will be generated on the terminal device after the last step is completed.

[0147] The specific code is as follows:

[0148]

[0149] S103: Acquire a test report file generated by the terminal device from the test execution device, where the test report file is used to record the running data of the graphical application.

[0150] In the present embodiment, after the operations corresponding to the execution script are all executed, the relevant test results need to be saved in a test report file (hereinafter, the report_text.txt file is used as a test report file for exemplary description). Since the test execution device does not directly execute the test_script.py script, but executes the script in the form of triggering the testtask scheduled task by sending the schtasks command, the test execution device cannot directly obtain the running result of the test_script.py script, and can only obtain the running result by reading the test report file after the test_script.py script is run.

[0151] Since the test execution device cannot directly know whether the operation steps of the graphical application on the terminal device have been completed, after sending the command to trigger the scheduled task to the terminal device, it will cyclically query whether the test report file appears on the terminal device. If the file appears or the loop exceeds the limited number of times, the loop will be exited. From the test execution device, the command line of the terminal device is controlled using the python third-party library pywinrm, and the msdos command dir is used to query whether the file exists.

[0152] The specific code is as follows:

[0153]

[0154] After finding the test report file, the following steps will be performed:

[0155] S11: terminating the scheduled task on the terminal device by executing a remote scheduled task command schtasks / end from the test execution device;

[0156] S12: From the test execution device, use the python third-party library pywinrm to control the command line of the terminal device, and obtain the content of the test report through the msdos command type report_text.txt;

[0157] S13: From the test execution device, use the python third-party library pywinrm to control the command line of the terminal device, and delete the test report file and the execution script file on the terminal device through the msdos command del.

[0158] The specific code is as follows:

[0159] #End the scheduled task on the Windows terminal

[0160] os.system(f"schtasks / end / tn'testtask' / s'{win_ip}' / u'{win_user}' / p'{win_pw}'").

[0161] #Get the test report content

[0162] result=run_conn_cmd(conn,shell_id,"type report_text.txt",display=True).

[0163] Delete the temporary files generated by this run

[0164] run_conn_cmd(conn,shell_id,"del report_text.txt")

[0165] run_conn_cmd(conn,shell_id,"del test_script.py")

[0166] return result.

[0167] S104: Determine whether the graphical application runs successfully according to the test report.

[0168] In one possible implementation, see Figure 7 , Figure 7 A flowchart of a method for determining whether a graphical application is running successfully is provided in an embodiment of the present application, such as Figure 7 As shown, the method for judging whether the graphical application is successfully executed according to the test report includes steps S1041-S1043:

[0169] S1041: traverse the statement information in the test report;

[0170] S1042: Determine whether there is a running failed statement in the statement information;

[0171] S1043: If the execution failure statement does not exist in the statement information, the graphical application executes successfully.

[0172] In this embodiment, whether the graphical application runs successfully is determined by traversing the statement information in the test report to see whether there is a run failure statement. It should be noted that since the operation of the graphical application consists of multiple steps, each step will correspond to a statement of successful or failed operation, and will be recorded in the test report. Only when all the steps run successfully can it be said that the graphical application runs successfully. Once a step fails to run, the operation of the graphical application is stopped, indicating that the graphical application fails to run. Therefore, it is necessary to traverse the running results of each operation step in the test report. Only when the run failure statement does not exist in the statement information can it be said that the graphical application has successfully completed all operations corresponding to the execution script, that is, the graphical application runs successfully. It means that the audit log data can be obtained in the next step to further determine whether the audit function of the firewall device under test has passed the test.

[0173] S105: If the graphical application runs successfully, then the audit log data generated by the firewall device under test is obtained, where the audit log data is used to record monitoring data of the graphical application running according to the audit policy.

[0174] In this embodiment, the test execution device can connect to the firewall device under test through SSH to obtain the audit log data generated by the firewall device under test. The audit log data is generated by the firewall device under test, and records the monitoring data of the firewall device under test on the operation of the graphical application according to the audit policy. The audit log data is used to determine whether the audit function of the firewall device under test passes the test.

[0175] S106: Determine whether the audit log data complies with the audit policy.

[0176] In this embodiment, it is determined whether the audit log data complies with the audit policy. That is, it is determined whether all operations matching the audit policy during the operation of the graphical application are recorded in the audit log data. If all operations matching the audit policy during the operation of the graphical application are recorded in the audit log data, it means that the audit log data complies with the audit policy.

[0177] S107: If the audit log data complies with the audit policy, the firewall device under test passes the audit function test.

[0178] In this embodiment, if the audit log data complies with the audit policy, it means that the firewall device under test can accurately capture and record operations that match the audit policy during the operation of the graphical application, and the audit function of the firewall device under test is good and passes the audit function test.

[0179] In a possible implementation, in order to ensure the completeness and accuracy of the test results, the test report file is obtained only after the graphical application has finished running. In step S103, before obtaining the test report file generated by the terminal device, it also includes: determining whether the graphical application has finished running. It should be noted that in the embodiment of the present application, the completion of the graphical application is equivalent to the completion of all operations of executing the script. If the graphical application has finished running, the test report file generated by the terminal device is obtained.

[0180] In one possible implementation, see Figure 8 , Figure 8 A flowchart of a method for determining whether a graphical application has been completed is provided in an embodiment of the present application, such as Figure 8 As shown, the method for determining whether the graphical application has finished running includes steps S301-S303:

[0181] S301: Acquire a file list of the terminal device.

[0182] S302: Determine whether the file list includes a test report file.

[0183] S303: If the file list includes the test report file, the graphical application ends.

[0184] In this embodiment, whether the graphical application has finished running is determined by judging whether the file list includes a test report file. For example, the file list on the terminal device can be read in a loop through the DOS command dir until the report_text.txt file appears, and then the reading loop is exited. The appearance of the report_text.txt file means that the operation process on the terminal device has been completed and the running has ended.

[0185] In a possible implementation, in step S103, after the step of obtaining the test report file generated by the terminal device, the method further includes: deleting the test report file and the execution script in the terminal device.

[0186] In this embodiment, due to the diversity and complexity of the test case scripts in the test execution device, the execution script created on the terminal device is only used as a temporary file and is only used in the test process. When the execution script is fully executed, the execution script is deleted on the terminal device. At the same time, after obtaining the test report file generated by the terminal device, the test report file is deleted on the terminal device, so as to avoid interference with the next test.

[0187] In some embodiments, in order to prevent the situation that the test report file and the execution script on the terminal device are not successfully deleted due to an abnormality in the previous test, each time a test is performed, the test report file and the execution script that may remain from the previous test are first preventively deleted on the terminal device to avoid interference with the current test.

[0188] In a possible implementation, after the step of obtaining the audit log data generated by the firewall device under test in step S105, the method further includes: deleting the audit policy and the audit log data in the firewall device under test.

[0189] In this embodiment, after the audit log data generated by the firewall device under test is obtained, the relevant configuration of the audit policy and the audit log data are deleted on the firewall device under test, and the environment of the firewall device under test is restored to avoid interference with the next test.

[0190] In the second aspect, the present application also provides a firewall device audit function test system based on a graphical application, which is applied to a test execution device, the test execution device is connected to the firewall device under test, the firewall device under test is connected to a terminal device, and a graphical application is installed on the terminal device, and the graphical application is an application that displays a user operation interface in a graphical manner; please refer to Fig. 9 , Fig. 9 A schematic diagram of a firewall device audit function test system based on a graphical application is provided in an embodiment of the present application, such as Fig. 9 As shown, the system includes:

[0191] A creation module, used to create an audit policy for the graphical application in the firewall device under test, wherein the audit policy is a monitoring rule for the graphical application;

[0192] A control module, used for controlling the terminal device to operate the graphical application so as to run the graphical application;

[0193] A first acquisition module, used to acquire a test report file generated by the terminal device, wherein the test report file is used to record the operation data of the graphical application;

[0194] A first judgment module, used for judging whether the graphical application runs successfully according to the test report;

[0195] A second acquisition module, configured to acquire audit log data generated by the firewall device under test if the graphical application runs successfully, wherein the audit log data is used to record monitoring data of the graphical application running according to the audit policy;

[0196] The second judgment module is used to judge whether the audit log data complies with the audit policy; if the audit log data complies with the audit policy, the firewall device under test passes the audit function test. In conjunction with the second aspect, in a possible implementation, the system further includes: a first deletion module, used to delete the test report file and the execution script in the terminal device.

[0197] In conjunction with the second aspect, in a possible implementation, the system further includes: a second deletion module, configured to delete the audit policy and the audit log data in the firewall device under test.

[0198] As can be seen from the above technical solutions, the present application provides a method and system for testing the audit function of a firewall device based on a graphical application. The method is applied to a test execution device, the test execution device is connected to the firewall device under test, the firewall device under test is connected to a terminal device, and a graphical application is installed on the terminal device, and the graphical application is an application that displays a user operation interface in a graphical manner. The method includes: creating an audit policy for the graphical application in the firewall device under test, the audit policy is a monitoring rule for the graphical application; controlling the terminal device to operate the graphical application to run the graphical application; obtaining a test report file generated by the terminal device, the test report file is used to record the running data of the graphical application; judging whether the graphical application runs successfully according to the test report; if the graphical application runs successfully, obtaining the audit log data generated by the firewall device under test, the audit log data is used to record the monitoring data of the graphical application running according to the audit policy; judging whether the audit log data complies with the audit policy; if the audit log data complies with the audit policy, the firewall device under test passes the audit function test.

[0199] The firewall device audit function test method provided by the present application first creates an audit policy for the graphical application in the firewall device under test. Then, the terminal device is automatically controlled to run the graphical application in a manner that displays the user operation interface, and whether the graphical application runs successfully is determined based on the test report file generated by the terminal device. Finally, if the graphical application runs successfully, the audit log data of the firewall device under test is obtained to determine whether the audit log data complies with the audit policy, thereby realizing the automated test of the audit function of the firewall device. In this way, there is no need to manually operate the graphical application during the firewall device audit function test, which saves human resources and time and improves the efficiency of the firewall device audit function test.

[0200] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the general concept of this application and do not constitute a limitation on the protection scope of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without creative work belong to the protection scope of this application.

Claims

1. A firewall device audit function testing method based on graphical application, characterized in that: The method is applied to a test execution device, the test execution device is connected to a firewall device under test and a terminal device respectively, the firewall device under test is connected to the terminal device, and a graphical application is installed on the terminal device, wherein the graphical application is an application that displays a user operation interface in a graphical manner; the method comprises: Creating an audit policy for the graphical application in the firewall device under test, wherein the audit policy is a monitoring rule for the graphical application; Controlling the terminal device to operate the graphical application to run the graphical application, including: creating an execution script from the test execution device to the terminal device, the execution script is used to call an application operation library file, and the application operation library file is preset in the terminal device; sending a trigger instruction from the test execution device to the terminal device, the trigger instruction is used to trigger a preset scheduled task in the terminal device to run the execution script, and calling the application operation library file through the execution script to implement the operation of the graphical application, wherein the application operation library file includes: multiple application classes, and operation methods corresponding to the application classes; Obtaining a test report file generated by the terminal device, wherein the test report file is used to record the operation data of the graphical application; Determining whether the graphical application runs successfully according to the test report; If the graphical application runs successfully, then obtaining audit log data generated by the firewall device under test, wherein the audit log data is used to record monitoring data of the graphical application running according to the audit policy; Determining whether the audit log data complies with the audit policy; If the audit log data complies with the audit policy, the firewall device under test passes the audit function test.

2. The method according to claim 1, characterized in that The method for operating the graphical application includes: On the terminal device, obtaining a target control image and a user operation interface image of the graphical application, wherein the target control image is pre-stored in the terminal device and is the control image to be operated by the execution script; On the terminal device, determining whether the target control image exists in the user operation interface image; If the target control image exists in the user operation interface image, obtain the position information of the target control image in the user operation interface image; if the position information of the target control image is successfully obtained, perform the operation corresponding to the execution script according to the position information, and the result of this step of operation is successful operation; if the position information of the target control image cannot be found, the result of this step of operation is failed operation; On the terminal device, after all the operation steps are executed, a test report file is generated, and the test report file includes the result of each operation step.

3. The method according to claim 1 or 2, characterized in that: Before the step of obtaining the test report file generated by the terminal device, the step further includes: Determining, from the test execution device, whether the graphical application in the terminal device has finished running; If the graphical application is finished running, a test report file generated by the terminal device is obtained from the test execution device.

4. The method according to claim 3, characterized in that The step of determining whether the graphical application in the terminal device has finished running comprises: Obtaining a file list of the terminal device from the test execution device; Determine whether the file list includes a test report file; If the file list includes the test report file, the running of the graphical application ends.

5. The method according to claim 1, characterized in that The step of judging whether the graphical application is successfully executed according to the test report comprises: Traversing the statement information in the test report; Determine whether there is a failed statement in the statement information; If the execution failure statement does not exist in the statement information, the graphical application executes successfully.

6. The method according to claim 1, characterized in that After the step of obtaining the test report file generated by the terminal device, the method further includes: The test report file and the execution script in the terminal device are deleted from the test execution device.

7. The method according to claim 1, characterized in that After the step of obtaining the audit log data generated by the firewall device under test, the method further includes: The audit policy and the audit log data in the firewall device under test are deleted from the test execution device.

8. A firewall device audit function test system based on graphical application, characterized in that: The system is applied to a test execution device, the test execution device is connected to a firewall device under test, the firewall device under test is connected to a terminal device, and a graphical application is installed on the terminal device, wherein the graphical application is an application that displays a user operation interface in a graphical manner; the system comprises: A creation module, used to create an audit policy for the graphical application in the firewall device under test, wherein the audit policy is a monitoring rule for the graphical application; A control module, used for controlling the terminal device to operate the graphical application to run the graphical application, including: creating an execution script from the test execution device to the terminal device, the execution script is used to call an application operation library file, the application operation library file is preset in the terminal device; sending a trigger instruction from the test execution device to the terminal device, the trigger instruction is used to trigger a scheduled task preset in the terminal device to run the execution script, calling the application operation library file through the execution script to implement the operation of the graphical application, wherein the application operation library file includes: a plurality of application classes, and operation methods corresponding to the application classes; A first acquisition module, used to acquire a test report file generated by the terminal device, wherein the test report file is used to record the operation data of the graphical application; A first judgment module, used for judging whether the graphical application runs successfully according to the test report; A second acquisition module, configured to acquire audit log data generated by the firewall device under test if the graphical application runs successfully, wherein the audit log data is used to record monitoring data of the graphical application running according to the audit policy; The second judgment module is used to judge whether the audit log data complies with the audit policy; if the audit log data complies with the audit policy, the firewall device under test passes the audit function test.

9. The system according to claim 8, characterized in that Also includes: The first deletion module is used to delete the test report file and the execution script in the terminal device.

10. The system according to claim 8, characterized in that Also includes: The second deleting module is used to delete the audit policy and the audit log data in the firewall device under test.

Images