Artificial intelligence-based test case generation method, apparatus, device, and medium

Abstract

The application relates to the technical field of information security, and provides a test case generation processing method and device based on artificial intelligence, equipment and a medium. The application can improve the generation efficiency of test cases by combining artificial intelligence technology and is beneficial to improving the detection rate of business logic vulnerabilities. The method comprises the following steps: obtaining business resource access request information for a to-be-tested business resource providing end, determining at least one to-be-varied request parameter item, then obtaining to-be-varied request parameters corresponding to each to-be-varied request parameter item in the business resource access request information, converting the to-be-varied request parameters corresponding to each to-be-varied request parameter item into corresponding varied request parameters by using a request parameter variation model, and finally generating a test case for testing the business logic vulnerabilities of the to-be-tested business resource providing end according to the varied request parameters corresponding to each to-be-varied request parameter item obtained by conversion and the original business resource access request information.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a test case generation processing method and device based on artificial intelligence, a computer device and a storage medium. BACKGROUND

[0002] With the rapid development of Internet technology, network information security is becoming more and more important. The business resource providing end can provide user access services to business resources through the network, and the business resource providing end inevitably has business logic vulnerabilities. Among them, the business logic vulnerability mainly refers to a kind of vulnerability that makes the attacker bypass the protection mechanism to achieve malicious behavior without destructive operation due to improper business design, such as interface enumeration, privilege vulnerability and sensitive information return, etc. The attacker uses the business logic vulnerability to make its own behavior inconsistent with the business resource access strategy, so as to obtain unauthorized business resources and cause business information leakage.

[0003] In the current business logic vulnerability detection technology, it mainly depends on the experience of test personnel to excavate business logic vulnerabilities or uses existing test cases to detect business logic vulnerabilities, but there is a technical problem of low generation efficiency of test cases through this way. SUMMARY

[0004] Therefore, it is necessary to provide a test case generation processing method and device based on artificial intelligence, a computer device and a storage medium to solve the above technical problems.

[0005] A test case generation processing method based on artificial intelligence, the method comprising:

[0006] Obtaining business resource access request information for a to-be-tested business resource providing end;

[0007] Determining at least one to-be-variant request parameter item in the business resource access request information;

[0008] Obtaining the to-be-variant request parameter corresponding to each to-be-variant request parameter item in the business resource access request information;

[0009] Using a request parameter variation model to convert the to-be-variant request parameter corresponding to each to-be-variant request parameter item into a corresponding variant request parameter;

[0010] According to the variant request parameter corresponding to each to-be-variant request parameter item and the business resource access request information, a test case for testing the business logic vulnerability of the to-be-tested business resource providing end is generated.

[0011] A test case generation processing device based on artificial intelligence, the device comprising:

[0012] an information obtaining module, configured to obtain service resource access request information for a to-be-tested service resource providing end;

[0013] a parameter item determining module, configured to determine at least one to-be-varied request parameter item in the service resource access request information;

[0014] a parameter obtaining module, configured to obtain a to-be-varied request parameter corresponding to each to-be-varied request parameter item in the service resource access request information;

[0015] a parameter variation module, configured to convert the to-be-varied request parameter corresponding to each to-be-varied request parameter item into a corresponding varied request parameter by using a request parameter variation model;

[0016] a use case generating module, configured to generate a test use case for testing a business logic vulnerability of the to-be-tested service resource providing end according to the varied request parameter corresponding to each to-be-varied request parameter item and the service resource access request information.

[0017] A computer device, comprising a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0018] obtaining service resource access request information for a to-be-tested service resource providing end; determining at least one to-be-varied request parameter item in the service resource access request information; obtaining a to-be-varied request parameter corresponding to each to-be-varied request parameter item in the service resource access request information; converting the to-be-varied request parameter corresponding to each to-be-varied request parameter item into a corresponding varied request parameter by using a request parameter variation model; and generating a test use case for testing a business logic vulnerability of the to-be-tested service resource providing end according to the varied request parameter corresponding to each to-be-varied request parameter item and the service resource access request information.

[0019] A computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0020] obtaining service resource access request information for a to-be-tested service resource providing end; determining at least one to-be-varied request parameter item in the service resource access request information; obtaining a to-be-varied request parameter corresponding to each to-be-varied request parameter item in the service resource access request information; converting the to-be-varied request parameter corresponding to each to-be-varied request parameter item into a corresponding varied request parameter by using a request parameter variation model; and generating a test use case for testing a business logic vulnerability of the to-be-tested service resource providing end according to the varied request parameter corresponding to each to-be-varied request parameter item and the service resource access request information.

[0021] A computer program product or computer program comprises computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps of the above method.

[0022] The above-mentioned artificial intelligence-based test case generation processing method, device, computer device and storage medium obtain service resource access request information for a to-be-tested service resource providing end, determine at least one to-be-varied request parameter item in the service resource access request information, then obtain to-be-varied request parameters corresponding to each to-be-varied request parameter item in the service resource access request information, and convert the to-be-varied request parameters corresponding to each to-be-varied request parameter item into corresponding varied request parameters by using a request parameter variation model. Finally, according to the varied request parameters corresponding to each to-be-varied request parameter item obtained by conversion and the original service resource access request information, a test case for testing the service logic vulnerability of the to-be-tested service resource providing end is generated. The scheme automatically generates a corresponding test case based on the varied request parameters by using the request parameter variation model to perform variation processing on the to-be-varied request parameters, can automatically generate a test case based on the fuzzy testing technology by using artificial intelligence, does not rely on the experience of a tester to perform manual testing, so that the generation efficiency of the test case is improved, and the generated test case has wide detection coverage and directionality and pertinence, which is beneficial to improving the detection rate of the service logic vulnerability. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 An application environment diagram of the artificial intelligence-based test case generation processing method in one embodiment;

[0024] Figure 2 A flowchart of the artificial intelligence-based test case generation processing method in one embodiment;

[0025] Figure 3 A flowchart of the step of converting the to-be-varied request parameters into corresponding varied request parameters in one embodiment;

[0026] Figure 4 A flowchart of the method for detecting a service logic vulnerability based on a deep learning fuzzy testing technology in another embodiment;

[0027] Figure 5 A structural block diagram of the artificial intelligence-based test case generation processing device in one embodiment;

[0028] Figure 6 An internal structure diagram of the computer device in one embodiment. DETAILED DESCRIPTION

[0029] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0030] The test case generation processing method based on artificial intelligence provided by the present application can be applied in an application environment as shown in Figure 1 The server 120 can be connected to the to-be-tested service resource providing end through a network, where the to-be-tested service resource providing end refers to a service resource providing end to be tested for service logic vulnerability, for example, a cloud platform providing various service resource access services to users can serve as the to-be-tested service resource providing end. The server 120 can be implemented by an independent server or a server cluster composed of multiple servers. The server 120 can be a component of the to-be-tested service resource providing end such as a cloud platform for self-service logic vulnerability detection, or a server independent of the to-be-tested service resource providing end for providing service logic vulnerability detection services.

[0031] Specifically, service logic vulnerabilities usually occur in the Web service of the to-be-tested service resource providing end. When a user accesses a certain function provided by the to-be-tested service resource providing end, he or she is actually accessing a certain url (uniform resource locator) of a Web application. The url structure of the Web application is scheme: / / host:port / path?query#hash. Wherein, scheme represents a communication protocol, usually http or https; host represents a host domain name or IP address; port represents a service port number, which is optional; path represents a resource path; query represents a query parameter, multiple parameters are separated by an ampersand symbol, and a parameter name and a value are separated by an equal symbol; and hash represents an information fragment string, which is used to specify a fragment in a network resource. Taking the url http: / / 192.168.10.10 / user?ID=x as an example, the user user can only access the resource with ID=2, and the request url is http: / / 192.168.10.10 / user?ID=2. An attacker can tamper with the parameter ID=1 to access other user service resources. If the attack is successful, the to-be-tested service resource providing end has a service logic vulnerability.

[0032] The test case generation processing method based on artificial intelligence provided by the present application can be applied in an application environment as shown in Figure 1The server 120 shown performs, can be based on artificial intelligence to realize the automatic generation of test cases with fuzz testing technology, improve the generation efficiency of test cases, and make the generated test cases have wide detection coverage and directionality and pertinence, the server 120 can also use the generated test cases to test the business logic vulnerability of the to-be-tested business resource provider to obtain test results, and improve the detection rate of business logic vulnerabilities.

[0033] Among them, the fuzz testing technology (fuzz testing, fuzzing) is a software testing technology, its core idea is to input automatically or semi-automatically generated random data into a program, and monitor program exceptions such as crashes and assertion failures to find possible program errors such as memory leaks, which can be used to detect security vulnerabilities of software or computer systems.

[0034] Artificial intelligence (Artificial Intelligence, AI) is to use digital computers or digital computer controlled machines to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. Theory, method, technology and application system. Artificial intelligence is a comprehensive technology of computer science, which tries to understand the essence of intelligence and produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that machines have perception, reasoning and decision-making functions.

[0035] Artificial intelligence technology involves a wide range of fields, both hardware and software technologies. Among them, artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning, deep learning and other major directions. Among them, machine learning (Machine Learning, ML) is a multi-disciplinary subject, which involves probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It is to study how computers simulate or implement human learning behavior to acquire new knowledge or skills, and reorganize existing knowledge structure to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental approach to making computers intelligent, and its applications are widespread in various fields of artificial intelligence.

[0036] Specifically, machine learning and deep learning generally include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and teaching by example learning. The test case generation method based on artificial intelligence provided in the present application can be implemented based on machine learning and deep learning in artificial intelligence technology to automatically generate test cases with wide coverage and directionality and pertinence by using the fuzzy testing technology, and use the generated test cases to automatically test the business logic vulnerabilities of the to-be-tested service resource provider, thereby improving the test case generation efficiency, helping to improve the detection rate of business logic vulnerabilities, and specifically applying the method to the cloud business logic vulnerability detection scenario as a detection module of a Web vulnerability scanning product to detect business logic vulnerabilities pertinently.

[0037] The test case generation method based on artificial intelligence provided in the present application is further described below in combination with embodiments and corresponding drawings.

[0038] In one embodiment, as shown in Figure 2 , a test case generation method based on artificial intelligence is provided. The method is applied to the server 120 in Figure 1 for example, and includes the following steps:

[0039] Step S201, obtaining service resource access request information for a to-be-tested service resource provider.

[0040] In this step, the server 120 can obtain the access request URL information and cookie information in the request header of all service resources that can be provided by the to-be-tested service resource provider. These information can be used as service resource access request information, which is used by the server 120 to generate test cases to test the possible business logic vulnerabilities of the to-be-tested service resource provider.

[0041] Step S202, determining at least one to-be-varied request parameter item in the service resource access request information.

[0042] After obtaining the service resource access request information, the server 120 can structure and parse the service resource access request information to obtain each request parameter item, and then select one or more to-be-varied request parameter items from the request parameter items.

[0043] Exemplarily, in a web service, the url structure is scheme: / / host:port / path?query#hash, the server 120 can obtain the request parameter items including scheme, host, port, path, query and cookie by structurally parsing the service resource access request information including the access request url information and the cookie information in the request header, and the specific values of the request parameter items in the service resource access request information are referred to as the request parameters corresponding to the request parameter items, and the server 120 can select one or more of the request parameter items as the to-be-varied request parameter items, for example, the server 120 can select query and cookie as two to-be-varied request parameter items.

[0044] In step S203, the server 120 obtains the to-be-varied request parameters corresponding to the to-be-varied request parameter items in the service resource access request information.

[0045] In this step, after determining the to-be-varied request parameter items, the server 120 can obtain the request parameters corresponding to the to-be-varied request parameter items from the service resource access request information as the to-be-varied request parameters. As described above, if the server 120 can select query and cookie as two to-be-varied request parameter items, the server 120 obtains the request parameters corresponding to the two to-be-varied request parameter items query and cookie from the service resource access request information as the to-be-varied request parameters.

[0046] Exemplarily, assuming that the url link is http: / / www.example.com?user=admin&orderId=3, the to-be-varied request parameter corresponding to the to-be-varied request parameter item cookie is “user_role=admin;is_active=1”, and the to-be-varied request parameter corresponding to the to-be-varied request parameter item query is “user=admin,orderId=3”.

[0047] In step S204, the server 120 converts the to-be-varied request parameters corresponding to the to-be-varied request parameter items into corresponding varied request parameters by using the request parameter variation model.

[0048] The server 120 uses the pre-constructed request parameter variation model to convert the to-be-varied request parameter corresponding to each to-be-varied request parameter item into a corresponding variation request parameter. The specific variation process performed by the request parameter variation model can be to change all or part of the characters or numbers in the to-be-varied request parameter, so that the output request parameter after conversion is different from the original to-be-varied request parameter input into the model. This change can be regarded as a change in the to-be-varied request parameter caused by the request parameter variation model, so that the output request parameter after conversion is an abnormal request parameter relative to the normal request parameter input into the model. For example, the to-be-varied request parameter corresponding to the to-be-varied request parameter item query is changed from "orderId=3" to "orderId=2". The server 120 uses the request parameter variation model to vary the request parameter in this step, which can achieve the effect of generating test cases by using the fuzz testing technology (fuzzing).

[0049] In step S205, a test case for testing the business logic vulnerability of the to-be-tested business resource provider is generated according to the variation request parameter corresponding to each to-be-varied request parameter item and the business resource access request information.

[0050] In this step, after obtaining the variation request parameter corresponding to each to-be-varied request parameter item, the server 120 replaces the normal request parameter corresponding to each to-be-varied request parameter item in the original business resource access request information with the variation request parameter corresponding to each to-be-varied request parameter item, thereby obtaining a test case. The test case can be used by the server 120 to test the business logic vulnerability of the to-be-tested business resource provider. For example, the server 120 can use the test case to request a business resource from the to-be-tested business resource provider, and obtain the business logic vulnerability test result according to the response data fed back by the to-be-tested business resource provider.

[0051] The above-mentioned artificial intelligence-based test case generation processing method, the server 120 obtains service resource access request information for a to-be-tested service resource providing end, and determines at least one to-be-varied request parameter item, then the server 120 obtains the to-be-varied request parameters corresponding to each to-be-varied request parameter item in the service resource access request information, and converts the to-be-varied request parameters corresponding to each to-be-varied request parameter item into corresponding varied request parameters by using a request parameter variation model, and finally the server 120 generates a test case for testing the service logic vulnerability of the to-be-tested service resource providing end according to the varied request parameters corresponding to each to-be-varied request parameter item obtained by conversion and the original service resource access request information. The scheme automatically generates corresponding test cases based on varied request parameters by using the request parameter variation model to perform variation processing on the to-be-varied request parameters, can automatically generate test cases based on the fuzzy testing technology based on artificial intelligence, does not rely on the experience of test personnel for manual testing, so that the generation efficiency of the test case is improved, and the generated test case has wide detection coverage and directionality and pertinence, which is helpful to improve the detection rate of service logic vulnerabilities.

[0052] In one embodiment, the server 120 can determine at least one to-be-varied request parameter item in the following manner, specifically, the above-mentioned step S202 can include:

[0053] The server 120 determines a clustering characteristic request parameter item for clustering different service resource access request information, and the server 120 determines at least one to-be-varied request parameter item from the candidate request parameter items of the service resource access request information.

[0054] The number of service resource access request information obtained by the server 120 for the to-be-tested service resource providing end can be multiple, and the server 120 can cluster the obtained service resource access request information according to the business types to which they respectively belong, that is, different service resource access request information is classified into different business categories. Specifically, the server 120 can cluster according to the request parameter items in the service resource access request information, and the request parameter items on which the clustering is based are called clustering characteristic request parameter items. On this basis, when selecting the to-be-varied request parameter item, the server 120 needs to select from the candidate request parameter items of the service resource access request information, wherein the to-be-varied request parameter item includes the request parameter items in the service resource access request information except the aforementioned clustering characteristic request parameter items. In this way, it is beneficial to improve the detection overhead of service logic vulnerabilities in the case of a large amount of service resources.

[0055] Exemplarily, the host, the port and the path of the same service are invariable, so the server 120 can take the three request parameter items of the host, the port and the path in the service resource access request information as the clustering characteristic request parameter items, and cluster the service resource access request information according to the request parameters corresponding to the clustering characteristic request parameter items, each cluster can represent a category of service, thereby distinguishing different services, and based on this, the server 120 can select one or more of the remaining request parameter items such as query and cookie as the to-be-varied request parameter item. Since the business logic vulnerabilities of each service category are different, this method facilitates targeted processing of business logic vulnerabilities existing in different categories.

[0056] In some embodiments, after obtaining the service resource access request information for the to-be-tested service resource provider, the server 120 can perform structural analysis on the service resource access request information to obtain each request parameter item of the service resource access request information and the request parameter corresponding to each request parameter item.

[0057] Specifically, the server 120 can perform structural analysis on the url to obtain each request parameter item contained in the service resource access request information and the specific request parameter corresponding to each request parameter item, and can further form a corresponding vector w(scheme, host, port, path, query, cookie). The vector w has a dimension of 6, each dimension corresponds to a request parameter item, and the specific numerical value in the vector w is the request parameter corresponding to each request parameter item.

[0058] After determining the clustering characteristic request parameter item for clustering different service resource access request information, the server 120 can further determine the service category to which the service resource access request information belongs according to the clustering characteristic request parameter corresponding to the clustering characteristic request parameter item in the request parameter corresponding to each request parameter item.

[0059] As described above, the server 120 can use the crawler technology to crawl all service resource urls of the to-be-tested service resource provider, parse the url into the above-mentioned vector w, take the three request parameter items of the host, the port and the path as the clustering characteristic request parameter items, and divide the service resource access request information with similar structures (i.e., the request parameters corresponding to the clustering characteristic request parameter items are the same) into the same service category through pattern matching. Specifically, the service resource access request information belonging to different service categories can be divided into different url sets in the form of a set, so that the server 120 can obtain the service resource access request information belonging to various service categories, facilitate targeted detection of vulnerabilities existing in different service categories, and reduce detection overhead.

[0060] In one embodiment, the server 120 can convert the to-be-mutated request parameters into corresponding mutated request parameters by the following steps, for example: Figure 3 As shown, the steps specifically include:

[0061] In step S301, the server 120 determines the parameter composition features of each to-be-mutated request parameter.

[0062] In step S302, the server 120 splits each to-be-mutated request parameter into a plurality of to-be-mutated sub-request parameters corresponding to the parameter composition features thereof.

[0063] Different to-be-mutated request parameters can have respective parameter composition features, and the server 120 can split each to-be-mutated request parameter into a plurality of parts corresponding to the parameter composition features thereof according to the parameter composition features, each part being referred to as a to-be-mutated sub-request parameter. For example, assuming that the to-be-mutated request parameter corresponding to the to-be-mutated request parameter item cookie is "user_role=admin; is_active=1", which has the parameter composition feature of key-value pairs, the server 120 can split the to-be-mutated request parameter into two parts, one part being "user_role, is_active" and the other part being "admin, 1", which are to-be-mutated sub-request parameters. In this way, a request parameter having a complex structure can be split into sub-parts having relatively simple structures, which facilitates subsequent mutation processing and makes the mutation processing more targeted.

[0064] In step S303, the server 120 converts the plurality of to-be-mutated sub-request parameters corresponding to each to-be-mutated request parameter into corresponding mutated sub-request parameters by using the request parameter mutation model.

[0065] This step is mainly to convert each to-be-mutated sub-request parameter corresponding to each to-be-mutated request parameter into a corresponding mutated sub-request parameter by using the request parameter mutation model. As described above, the server 120 can mutate "user_role, is_active" and "admin, 1" by using the request parameter mutation model, so that each component in the to-be-mutated request parameter can be subjected to mutation processing by the parameter mutation model, and the to-be-mutated request parameter can be subjected to mutation processing more targetedly.

[0066] In step S304, the server 120 obtains the mutated request parameters according to the plurality of mutated sub-request parameters corresponding to each to-be-mutated request parameter.

[0067] In this step, after the server 120 obtains each sub-part request parameter output by the parameter mutation model, the server 120 can recombine each sub-part request parameter according to the parameter composition characteristics of each to-be-mutated request parameter to obtain a mutation request parameter.

[0068] According to the scheme of this embodiment, each to-be-mutated request parameter can be divided into parts according to the parameter composition characteristics of the to-be-mutated request parameter, so that each part of the to-be-mutated request parameter can be independently subjected to mutation processing by the parameter mutation model, and the mutation processing of the to-be-mutated request parameter is more targeted and operable.

[0069] In some embodiments, the parameter composition characteristics of each to-be-mutated request parameter generally include key-value pairs. For example, the to-be-mutated request parameter corresponding to the to-be-mutated request parameter item cookie is “user_role=admin; is_active=1”, and the to-be-mutated request parameter corresponding to the to-be-mutated request parameter item query is “user=admin, orderId=3”. The parameter composition characteristics of the to-be-mutated request parameters corresponding to the two to-be-mutated request parameter items are both key-value pairs.

[0070] In this regard, the step S302 specifically includes: the server 120 splits each to-be-mutated request parameter into a to-be-mutated key part request parameter and a to-be-mutated value part request parameter.

[0071] Specifically, for the to-be-mutated request parameter corresponding to the to-be-mutated request parameter item cookie, the server 120 splits the to-be-mutated request parameter into a to-be-mutated key part request parameter “user_role, is_active” and a to-be-mutated value part request parameter “admin, 1”. For the to-be-mutated request parameter corresponding to the to-be-mutated request parameter item query, the server 120 splits the to-be-mutated request parameter into a to-be-mutated key part request parameter “user, orderId” and a to-be-mutated value part request parameter “admin, 3”.

[0072] Further, the step S303 specifically includes: the server 120 inputs the to-be-mutated key part request parameter and the to-be-mutated value part request parameter corresponding to each to-be-mutated request parameter into the request parameter mutation model, so that the request parameter mutation model outputs the to-be-mutated key part request parameter and the to-be-mutated value part request parameter corresponding to each to-be-mutated request parameter.

[0073] According to the above, the server 120 can input the to-be-varied key part request parameter "user_role, is_active" and the to-be-varied value part request parameter "admin, 1" corresponding to the to-be-varied request parameter item cookie into the request parameter variation model, so that the request parameter variation model outputs the varied key part request parameter and the varied value part request parameter corresponding to the to-be-varied key part request parameter "user_role, is_active" and the to-be-varied value part request parameter "admin, 1"; and the server 120 can input the to-be-varied key part request parameter "user, orderId" and the to-be-varied value part request parameter "admin, 3" corresponding to the to-be-varied request parameter item query into the request parameter variation model, and the request parameter variation model outputs the varied key part request parameter and the varied value part request parameter corresponding to the to-be-varied key part request parameter "user, orderId" and the to-be-varied value part request parameter "admin, 3".

[0074] Further, the above step S304 can include: obtaining, by the server 120, the varied request parameter according to the varied key part request parameter and the varied value part request parameter corresponding to each to-be-varied request parameter.

[0075] Specifically, after the server 120 obtains the varied key part request parameter and the varied value part request parameter corresponding to the to-be-varied request parameter item cookie, the server 120 can reorganize the obtained varied key part request parameter and varied value part request parameter into the varied request parameter according to the parameter composition feature, i.e., the key-value pair, of the to-be-varied request parameter item cookie.

[0076] According to the above steps, the server 120 can decompose the relatively complex to-be-varied request parameter with the parameter composition feature being a key-value pair into the relatively simple key part and value part for variation processing, so that the variation processing of the to-be-varied request parameter with the parameter composition feature being a key-value pair is targeted and operable, the coverage of the test case is improved, and the detection rate of the business logic vulnerability is improved.

[0077] In one embodiment, the determined at least one to-be-varied request parameter item can include a first varied request parameter item and a second varied request parameter item, i.e., the server 120 can perform variation processing on two request parameter items in the business resource access request information to form corresponding test cases. In a network service application scenario, business logic vulnerability trigger points mainly exist in query and cookie queries. The present embodiment takes query and cookie as the first and second to-be-varied request parameter items, respectively, to illustrate the generation of test cases based on query variation and cookie variation. The above step S205 specifically includes:

[0078] The server 120 acquires the first mutation request parameter corresponding to the first mutation request parameter item, and acquires the second mutation request parameter corresponding to the second mutation request parameter item; the server 120 combines the first mutation request parameter, the second mutation request parameter and the business resource access request information to form multiple groups of test cases.

[0079] Specifically, the server 120 acquires the first mutation request parameter corresponding to the first mutation request parameter item query, and acquires the second mutation request parameter corresponding to the second mutation request parameter item cookie. Specifically, the server 120 can replace the normal request parameter corresponding to the first mutation request parameter item query in the original business resource access request information with the first mutation request parameter corresponding to the first mutation request parameter item query, thereby obtaining the test case based on the query mutation. Similarly, the server 120 can also obtain the test case based on the cookie mutation. Thus, the server 120 can obtain two kinds of test cases. The server 120 can also combine the test cases of the two mutations to obtain four kinds of test cases, i.e., directly using the test case based on the query mutation for testing; first using the test case based on the query mutation, and then using the test case based on the cookie mutation for testing; directly using the test case based on the cookie mutation for testing; first using the test case based on the cookie mutation, and then using the test case based on the query mutation for testing. Thus, all test cases are covered, and the obtained test cases have the characteristics of wide coverage, strong pertinence and directionality.

[0080] Further, after obtaining the multiple groups of test cases, the server 120 can use the multiple groups of test cases to perform business logic vulnerability testing on the aforementioned to-be-tested business resource provider, thereby obtaining the business logic vulnerability testing result for the to-be-tested business resource provider.

[0081] Specifically, the server 120 can use the above four test cases to test the service logic vulnerability of the to-be-tested service resource providing end, that is, the server 120 can directly use the test case based on query variation to test to obtain the service logic vulnerability test result of the group; the server 120 can first use the test case based on query variation, and then use the test case based on cookie variation to test to obtain the service logic vulnerability test result of the group; the server 120 can directly use the test case based on cookie variation to test to obtain the service logic vulnerability test result of the group; the server 120 can first use the test case based on cookie variation, and then use the test case based on query variation to test to obtain the service logic vulnerability test result of the group. In the embodiment, the server 120 uses the above four test cases with the characteristics of wide coverage, strong pertinence and directionality, which can improve the service logic vulnerability detection rate.

[0082] In some embodiments, the server 120 in the above embodiment uses each group of test cases to test the service logic vulnerability of the to-be-tested service resource providing end to obtain the service logic vulnerability test result of the to-be-tested service resource providing end, which can specifically include:

[0083] The server 120 respectively requests the to-be-tested service resource providing end for a service resource through each group of test cases, obtains a first resource request response of the to-be-tested service resource providing end, and the server 120 obtains a second resource request response, and compares the first resource request response with the second resource request response for consistency, and obtains the service logic vulnerability test result according to the consistency comparison result.

[0084] The second resource request response refers to a resource request response fed back by the to-be-tested business resource provider when the server 120 requests a business resource through the original business resource access request information. That is, the second resource request response is a response result obtained when the server 120 normally requests a resource from the to-be-tested business resource provider. To obtain a business logic vulnerability test result, the server 120 performs consistency comparison between the second resource request response and the first resource request responses obtained by the test cases. If the consistency comparison result obtained by the server 120 shows that the response results obtained from the to-be-tested business resource provider before and after the request parameter variation are consistent, it is indicated that there is no business logic vulnerability. If the consistency comparison result obtained by the server 120 shows that the response results obtained from the to-be-tested business resource provider before and after the request parameter variation are inconsistent, it is indicated that there is a business logic vulnerability. The server 120 can output a corresponding business logic vulnerability detection result. The business logic vulnerability detection result can be output in the form of a detection report. The specific content of the detection report can include a potential business logic vulnerability category, a test case triggering the vulnerability, an original URL request, and a response state, thereby facilitating reproduction of the vulnerability and patching of the potential business logic vulnerability.

[0085] To describe the scheme provided in the present application from the whole, the method is applied to the scene of detecting a business logic vulnerability on a cloud. The method can be used as a detection module of a Web vulnerability scanning product to detect a business logic vulnerability existing in a Web service. Specifically, as shown in FIG. 8, the method can be implemented based on a url parsing module, a test case generation module based on deep learning fuzzing technology, and a vulnerability detection module. From the whole, the input of the detection module is a Web application root url, and the output is a Web application logic vulnerability detection result. The specific process is as follows: Figure 4

[0086] For the url parsing module, the url parsing module can use a crawler technology to crawl all business resource urls (corresponding to business resource access request information) of a business site based on the input Web application root url. Due to a large amount of business resources, in order to reduce detection overhead, the url parsing module can perform structural analysis on the urls to generate a vector w (scheme, host, port, path, query, cookie). The url parsing module can further filter and divide structurally similar business resource urls into url sets s belonging to different business categories through pattern matching. Since the host, post, and path of the same category business are unchanged, they can be used as clustering feature request parameter items. That is, the url parsing module can specifically extract (host, port, path) in the vector w as clustering features, divide urls with the same features into the same category, and thereby obtain url sets s of different business categories.​

[0087] For the deep learning-based fuzzzing technology test case generation module, it can be divided into four sub-steps of sample preprocessing, neural network encoding, neural network decoding and sample generation, specifically:

[0088] For different categories of url set s, each of them is preprocessed as follows: the vector w(scheme, host, port, path, query, cookie) obtained by parsing the url is decomposed into the first vector m(query) and the second vector l(cookie). It can be understood that the two vectors can correspond to the two aforementioned request parameter items to be mutated and the corresponding request parameter to be mutated. The query and cookie parameter feature groups are both key-value pairs, that is, they are composed of strings in the format of "name=value", so the first vector m(query) and the second vector l(cookie) can be decomposed into vector N(name1, name2, …) and vector V(value1, value2, …). Then the decomposed vector mN(name1, name2, …) and mV(value1, value2, …) of the first vector m(query) can be obtained, and the decomposed vector lN(name1, name2, …) and lV(value1, value2, …) of the second vector l(cookie) can be obtained.

[0089] For example, suppose the url link is http: / / www.example.com?user=admin&orderId=3, and the cookie used is user_role=admin;is_active=1. According to the above sample preprocessing, the query can be represented as (user=admin, orderId=3)", and the query vector is decomposed into the decomposed vector mN(user, orderId) and the decomposed vector mV(admin, 3). The corresponding cookie vector can be represented as (user_role=admin, is_active=1), which is decomposed into the decomposed vector lN(user_role, is_active) and the decomposed vector lV(admin, 1).

[0090] Then, the module will disassemble the vectors formed by the to-be-varied vectors (mN, mV) and (IN, IV) using the encoding module and the decoding module of the recurrent neural network (RNN, Recurrent Neural Network) respectively to perform neural network encoding and neural network decoding in sequence, so as to obtain the fuzz samples based on query variation and the fuzz samples based on cookie variation. That is, in the module, the recurrent neural network is used as the aforementioned request parameter variation model to implement the variation processing of the to-be-varied request parameters of query and cookie by means of the characteristics of RNN processing data sequences or vector data, and then the test cases based on query variation and cookie variation are generated. In addition to using deep learning to generate fuzz samples, other machine learning algorithms can also be used to perform variation processing on the to-be-varied request parameters of query and cookie.

[0091] For the vulnerability detection module, the url link generates test cases based on query variation and cookie variation based on the deep learning fuzzing technology. The business logic vulnerability trigger point usually exists in the query and cookie queries. The vulnerability detection module can combine the two kinds of varied test cases to obtain four kinds of test cases, so as to cover all the test cases. Then, the vulnerability detection module respectively checks the response data of the four kinds of test cases, and compares them with the response data obtained by the unvaried test cases. If the obtained user resources are consistent, it means that there is no business logic vulnerability. If the obtained user resources are inconsistent, it means that there is a vulnerability. The vulnerability detection module can output the detection result of whether there is a logic vulnerability. The detection result can be output in the form of a detection report, and the specific content can include the potential logic vulnerability category, the test case triggering the vulnerability, the original URL request and its response data, and the like, so as to facilitate the technical personnel to reproduce the vulnerability and repair the potential logic vulnerability.

[0092] The scheme provided in the present application can realize automatic detection of business logic vulnerabilities, without relying on manual testing by test personnel experience. The test cases can be generated based on artificial intelligence using the fuzzing technology, so that the generated test cases have wide detection coverage, solving the problem of insufficient manual detection coverage. In addition, the deep learning is used to generate fuzzing test cases, which can make the generated test cases have stronger directionality and pertinence, avoiding the blindness of generating test cases, thereby effectively improving the logic vulnerability detection rate, that is, improving the business logic vulnerability detection rate under the condition of wide coverage.

[0093] It should be understood that although each step in the above flowchart is shown in sequence according to the direction of the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless explicitly stated herein, there is no strict order limitation for the execution of these steps, and these steps can be executed in other orders. Moreover, at least part of the steps in the above flowchart can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or steps or stages in other steps.

[0094] In one embodiment, as shown in Figure 5 An artificial intelligence-based test case generation processing apparatus is provided, which can be a part of a computer device in the form of a software module or a hardware module, or a combination of both. The apparatus 500 specifically includes:

[0095] An information acquisition module 501 is configured to acquire service resource access request information for a to-be-tested service resource providing end.

[0096] A parameter item determination module 502 is configured to determine at least one to-be-varied request parameter item in the service resource access request information.

[0097] A parameter acquisition module 503 is configured to acquire to-be-varied request parameters corresponding to each to-be-varied request parameter item in the service resource access request information.

[0098] A parameter variation module 504 is configured to convert the to-be-varied request parameters corresponding to each to-be-varied request parameter item into corresponding varied request parameters by using a request parameter variation model.

[0099] A test case generation module 505 is configured to generate a test case for testing a business logic vulnerability of the to-be-tested service resource providing end according to the varied request parameters corresponding to each to-be-varied request parameter item and the service resource access request information.

[0100] In one embodiment, the parameter item determination module 502 is configured to determine a clustering characteristic request parameter item used for clustering different service resource access request information, and determine the at least one to-be-varied request parameter item from candidate request parameter items of the service resource access request information. The candidate request parameter items include request parameter items other than the clustering characteristic request parameter item in each request parameter item included in the service resource access request information.

[0101] In an embodiment, the apparatus 500 can further include: a parsing processing unit, configured to structurally parse the service resource access request information, to obtain each request parameter item of the service resource access request information and a request parameter corresponding to each request parameter item; and a service classification unit, configured to determine a service category to which the service resource access request information belongs according to a clustering feature request parameter corresponding to the clustering feature request parameter in the request parameter corresponding to each request parameter item.

[0102] In an embodiment, the parameter variation module 504 is configured to determine a parameter composition feature possessed by each to-be-varied request parameter, split the each to-be-varied request parameter into a plurality of to-be-varied sub-part request parameters corresponding to the parameter composition feature possessed by the each to-be-varied request parameter, convert the plurality of to-be-varied sub-part request parameters corresponding to the each to-be-varied request parameter into a plurality of varied sub-part request parameters corresponding to the each to-be-varied request parameter by using the request parameter variation model, and obtain the varied request parameter according to the plurality of varied sub-part request parameters corresponding to the each to-be-varied request parameter.

[0103] In an embodiment, the parameter composition feature includes a key-value pair, and the parameter variation module 504 is specifically configured to split the each to-be-varied request parameter into a to-be-varied key part request parameter and a to-be-varied value part request parameter, input the to-be-varied key part request parameter and the to-be-varied value part request parameter corresponding to the each to-be-varied request parameter into the request parameter variation model, so that the request parameter variation model outputs a varied key part request parameter and a varied value part request parameter corresponding to the each to-be-varied request parameter, and obtains the varied request parameter according to the varied key part request parameter and the varied value part request parameter corresponding to the each to-be-varied request parameter.

[0104] In an embodiment, the at least one to-be-varied request parameter item includes a first varied request parameter item and a second varied request parameter item, the use case generation module 505 is further configured to obtain a first varied request parameter corresponding to the first varied request parameter item, obtain a second varied request parameter corresponding to the second varied request parameter item, and combine the first varied request parameter, the second varied request parameter, and the service resource access request information to form a plurality of groups of test cases, and the apparatus 500 can further include a vulnerability detection unit configured to perform a service logic vulnerability test on the to-be-tested service resource providing end by using the plurality of groups of test cases, to obtain a service logic vulnerability test result for the to-be-tested service resource providing end.

[0105] In an embodiment, the vulnerability detection unit is further configured to request a service resource from the to-be-tested service resource provider through each group of test cases respectively, to obtain a first resource request response of the to-be-tested service resource provider; to obtain a second resource request response; wherein the second resource request response is a resource request response of the to-be-tested service resource provider in the case of requesting a service resource from the to-be-tested service resource provider through the service resource access request information; to compare the first resource request response and the second resource request response for consistency; and to obtain the service logic vulnerability test result according to the consistency comparison result.

[0106] The specific limitations of the test case generation device based on artificial intelligence can refer to the limitations of the test case generation method based on artificial intelligence described above, and will not be repeated here. Each module in the test case generation device based on artificial intelligence can be realized by software, hardware, and combinations thereof, in whole or in part. Each module described above can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so that the processor invokes and executes the operations corresponding to each module.

[0107] In an embodiment, a computer device can be provided, which can be a server, and an internal structure diagram thereof can be as shown in Figure 6 The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device is configured to store data such as service resource access request information, request parameter variation model, test case, and service logic vulnerability test result. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement a test case generation method based on artificial intelligence.

[0108] Those skilled in the art can understand that Figure 6 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0109] In an embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above-mentioned method embodiments when executing the computer program.

[0110] In an embodiment, a computer readable storage medium is provided, storing a computer program, the computer program being executed by a processor to implement the steps in the above-mentioned method embodiments.

[0111] In an embodiment, a computer program product or computer program is provided, including computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the steps in the above-mentioned method embodiments.

[0112] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0113] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not contradict, they should be considered within the scope of the present application.

[0114] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific manner, but should not be construed as limiting the scope of the patent. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. An artificial intelligence-based test case generation processing method characterized by, The method comprises: obtaining service resource access request information for a to-be-tested service resource providing end; clustering service resource access request information with the same request parameters corresponding to a clustering characteristic request parameter item into the same set; determining at least one to-be-mutated request parameter item in the service resource access request information in the set; decomposing a vector formed by the request parameters of each service resource access request information in the set into a key-value pair form of the to-be-mutated request parameter item; decomposing the key part and the value part of the key-value pair form of each to-be-mutated request parameter item into a decomposition vector of the key part and a decomposition vector of the value part; forming a to-be-mutated vector of each to-be-mutated request parameter item from the decomposition vector of the key part and the decomposition vector of the value part of each to-be-mutated request parameter item; inputting the to-be-mutated vector of each to-be-mutated request parameter item into a request parameter mutation model to output a mutated key part request parameter and a mutated value part request parameter of each to-be-mutated request parameter item; obtaining a mutated request parameter corresponding to each to-be-mutated request parameter item according to the mutated key part request parameter and the mutated value part request parameter corresponding to each to-be-mutated request parameter; generating a test case for testing a business logic vulnerability of the to-be-tested service resource providing end according to the mutated request parameter corresponding to each to-be-mutated request parameter item and the service resource access request information.

2. The method of claim 1, wherein, The determination of the at least one to-be-mutated request parameter item in the service resource access request information in the set comprises: determining a clustering characteristic request parameter item for clustering different service resource access request information; determining the at least one to-be-mutated request parameter item from candidate request parameter items of the service resource access request information in the set; wherein the candidate request parameter items include request parameter items other than the clustering characteristic request parameter item in each request parameter item included in the service resource access request information.

3. The method of claim 2, wherein, After obtaining the service resource access request information for the to-be-tested service resource providing end, the method further comprises: structurally analyzing the service resource access request information to obtain each request parameter item of the service resource access request information and a request parameter corresponding to each request parameter item.

4. The method of claim 1, wherein, The at least one to-be-mutated request parameter item includes a query parameter and a cookie, and the clustering characteristic request parameter item includes a parameter item host, a server port number, and a resource path.

5. The method of claim 4, wherein, The parameter composition characteristics of the query parameter and the cookie are both key-value pairs.

6. The method according to any one of claims 1 to 5, characterized in that, The at least one to-be-mutated request parameter item includes a first to-be-mutated request parameter item and a second to-be-mutated request parameter item. The generation of a test case for testing a business logic vulnerability of the to-be-tested service resource providing end according to the mutated request parameter corresponding to each to-be-mutated request parameter item and the service resource access request information comprises: obtaining a first mutated request parameter corresponding to the first to-be-mutated request parameter item and a second mutated request parameter corresponding to the second to-be-mutated request parameter item; combining the first mutated request parameter, the second mutated request parameter, and the service resource access request information to form multiple groups of test cases; The method further comprises: The business logic vulnerability test result of the to-be-tested business resource providing end is obtained by using the multiple groups of test cases to perform business logic vulnerability testing on the to-be-tested business resource providing end.

7. The method of claim 6, wherein, The business logic vulnerability test result of the to-be-tested business resource providing end is obtained by using the multiple groups of test cases to perform business logic vulnerability testing on the to-be-tested business resource providing end. The first resource request response of the to-be-tested business resource providing end is obtained by respectively requesting business resources through each group of test cases; The second resource request response is obtained; wherein the second resource request response is a resource request response of the to-be-tested business resource providing end in the case of requesting business resources through the business resource access request information; The first resource request response and the second resource request response are compared for consistency; The business logic vulnerability test result is obtained according to the consistency comparison result.

8. An artificial intelligence-based test case generation processing apparatus characterized by comprising: The device comprises: An information acquisition module is configured to acquire business resource access request information for a to-be-tested business resource providing end; A clustering module is configured to cluster business resource access request information with the same request parameters corresponding to a clustering characteristic request parameter item into a same set; A parameter item determination module is configured to determine at least one to-be-variant request parameter item in the business resource access request information in the set; A vector decomposition module is configured to decompose a vector formed by request parameters of each business resource access request information in the set into a vector in the form of a key-value pair of a to-be-variant request parameter item; A vector disassembling module is configured to disassemble the vector in the form of a key-value pair of each to-be-variant request parameter item into a disassembled vector of a key part and a disassembled vector of a value part; A to-be-variant vector forming module is configured to form a to-be-variant vector of each to-be-variant request parameter item from the disassembled vector of the key part and the disassembled vector of the value part of each to-be-variant request parameter item; A parameter variation module is configured to input the to-be-variant vector of each to-be-variant request parameter item into a request parameter variation model, and output a variant key part request parameter and a variant value part request parameter of each to-be-variant request parameter item; A variant request parameter acquisition module is configured to obtain a variant request parameter corresponding to each to-be-variant request parameter item according to the variant key part request parameter and the variant value part request parameter corresponding to each to-be-variant request parameter item; A test case generation module is configured to generate test cases for performing business logic vulnerability testing on the to-be-tested business resource providing end according to the variant request parameter corresponding to each to-be-variant request parameter item and the business resource access request information. 9.The artificial intelligence-based test case generation processing apparatus of claim 8, characterized by, The parameter item determination module is further configured to determine a clustering characteristic request parameter item used for business clustering of different business resource access request information; The at least one to-be-variant request parameter item is determined from candidate request parameter items of the business resource access request information in the set; wherein the candidate request parameter items include request parameter items other than the clustering characteristic request parameter item in each request parameter item included in the business resource access request information. 10.The artificial intelligence-based test case generation processing apparatus of claim 9, characterized by, The device further comprises a structured analysis module configured to, after obtaining the service resource access request information for the to-be-tested service resource provider, perform structured analysis on the service resource access request information to obtain each request parameter item of the service resource access request information and a request parameter corresponding to each request parameter item. 11.The artificial intelligence-based test case generation processing apparatus of claim 8, characterized by, The at least one to-be-varied request parameter item comprises a query parameter and a cookie, and the clustering feature request parameter item comprises a parameter item host, a service port number and a resource path. 12.The artificial intelligence-based test case generation processing apparatus of claim 11, characterized by, The query parameter and the cookie are both key-value pairs.

13. The artificial intelligence-based test case generation processing apparatus according to any one of claims 8 to 12, characterized by, The at least one to-be-varied request parameter item comprises a first to-be-varied request parameter item and a second to-be-varied request parameter item. The use case generation module is further configured to obtain a first to-be-varied request parameter corresponding to the first to-be-varied request parameter item, obtain a second to-be-varied request parameter corresponding to the second to-be-varied request parameter item, and combine the first to-be-varied request parameter, the second to-be-varied request parameter and the service resource access request information to form a plurality of groups of test cases. The device further comprises a vulnerability detection unit configured to perform a business logic vulnerability test on the to-be-tested service resource provider by using the plurality of groups of test cases to obtain a business logic vulnerability test result for the to-be-tested service resource provider. 14.The artificial intelligence-based test case generation processing apparatus of claim 13, characterized by, The vulnerability detection unit is further configured to request a service resource from the to-be-tested service resource provider by using each group of test cases to obtain a first resource request response of the to-be-tested service resource provider. obtain a second resource request response, wherein the second resource request response is a resource request response of the to-be-tested service resource provider when the service resource is requested from the to-be-tested service resource provider by using the service resource access request information; perform consistency comparison on the first resource request response and the second resource request response; and obtain the business logic vulnerability test result according to the consistency comparison result.

15. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the method in any one of claims 1 to 7.

16. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method in any one of claims 1 to 7.

17. A computer program product comprising computer instructions, characterized in that, The computer program is executed by the processor to implement the method in any one of claims 1 to 7.

Images