A security testing method of a software system, a testing device and a medium

Abstract

The application provides a security testing method of a software system, a testing device and a medium. In the method, system baseline snapshot information and system snapshot information of the software system are acquired. The system baseline snapshot information includes multiple types of baseline snapshot information, and the system snapshot information includes multiple types of object snapshot information. The object snapshot information and the baseline snapshot information of the same type correspond to each other. For each type of object snapshot information, when the object snapshot information and the corresponding baseline snapshot information are different, the object snapshot information is determined as changed snapshot information. For each changed snapshot information, a testing rule is determined according to the type of the changed snapshot information. The changed snapshot information is tested according to the testing rule to determine a testing result. The security testing result of the software system is determined according to the testing result of each changed snapshot information. The method solves the problem of the prior art that the software system testing mode has a long testing time and a low testing result accuracy.

Description

Technical Field

[0001] This application relates to the field of software testing technology, and in particular to a security testing method, testing equipment and medium for a software system. Background Technology

[0002] Software system security testing is the testing to verify whether the existing security measures in a software system are effective, and it is an important means of ensuring the security of a software system.

[0003] Existing technologies for testing the security of software systems all rely on multiple predefined test rules that may identify test characteristics that reflect the vulnerability of the software system. These rules involve a full-coverage scan of the character data information of the software system to determine the test results that match the test rules.

[0004] However, existing methods for testing software systems suffer from problems such as long testing time and low accuracy of test results. Summary of the Invention

[0005] This application provides a security testing method, testing equipment, and media for software systems, which addresses the problems of long testing time and low accuracy of test results in existing software system testing methods.

[0006] In a first aspect, embodiments of this application provide a security testing method for a software system, including:

[0007] Obtain system baseline snapshot information of the software system, which includes various types of baseline snapshot information;

[0008] Obtain system snapshot information of the software system; wherein, the system snapshot information includes multiple types of object snapshot information, and the object snapshot information of the same type corresponds one-to-one with the baseline snapshot information;

[0009] For each type of object snapshot information, when there is a difference between the object snapshot information and the corresponding baseline snapshot information, the object snapshot information is determined to be changed snapshot information;

[0010] For each change snapshot, a test rule is determined based on the type of the change snapshot, and a matching test is performed on the change snapshot based on the test rule to determine the test result corresponding to the change snapshot.

[0011] The security test results of the software system are determined based on the test results corresponding to each of the change snapshots.

[0012] The beneficial effects of this embodiment are as follows: On the one hand, this embodiment only performs rule matching tests on object snapshot information that differs from the baseline snapshot information, which can narrow the testing scope, improve testing speed, and reduce the number of confirmed security test results, thereby reducing the cost of subsequent manual review of security test results. On the other hand, by applying test rules to classification and determining test features and test rules based on the type of changed snapshot information (object snapshot information), more targeted test rules can be used to test object snapshot information that differs from the baseline snapshot information to determine whether it possesses features corresponding to the test features, thereby avoiding the high false positive problem caused by indiscriminate scanning tests.

[0013] In a preferred embodiment of the above-described security testing method for a software system, obtaining the system snapshot information of the software system includes:

[0014] Determine whether the software system has undergone a software version update;

[0015] When it is determined that the software system has undergone a software version update, various types of program file snapshot information and various types of process snapshot information of the software system are obtained; or,

[0016] When it is determined that the software system has not undergone a software version update, various types of process snapshot information of the software system are obtained.

[0017] The beneficial effects of this embodiment are as follows: Based on whether the software system has undergone a software version update, it determines whether to obtain program file snapshot information, i.e., whether to subsequently acquire and match test rules based on the program file snapshot information. When it is determined that the software system has not undergone a software version update, the testing equipment can only obtain process snapshot information, and subsequently only acquire and match test rules based on the process snapshot information, further narrowing the testing scope and improving the speed of security testing of the software system.

[0018] In a preferred embodiment of the above-described security testing method for a software system, obtaining snapshot information of various types of program files of the software system includes:

[0019] Obtain the software package corresponding to the software system, and obtain the file information and file storage path corresponding to the software package. Based on the file storage path, determine the directory information corresponding to the software package. Based on the file information and directory information corresponding to the software package, determine the snapshot information of various types of program files of the software system; or,

[0020] Based on the file information and directory information corresponding to the software package input by the user, the snapshot information of various types of program files of the software system is determined.

[0021] The beneficial effects of this embodiment are: This embodiment ensures that when the software system undergoes a software version update, a comprehensive comparison and test rule matching test can be performed on the non-runtime information corresponding to the updated software system, thereby improving the accuracy and efficiency of testing the security of the software system.

[0022] In a preferred embodiment of the above-described security testing method for a software system, obtaining various types of process snapshot information of the software system includes:

[0023] Obtain the runtime information of the software system, and determine various types of process snapshot information of the software system based on the runtime information of the software system.

[0024] The beneficial effects of this embodiment are as follows: Based on the obtained runtime information of the software system, various types of process snapshot information of the software system can be determined, thereby ensuring that the testing equipment can determine process snapshot information that differs from the baseline snapshot information of the object when the software system has not run to an error state. That is, it can determine the process snapshot information that may cause errors in the software system, and determine the matching test results with test characteristics according to the corresponding test rules. This ensures that maintenance personnel can maintain the software system in a timely manner based on the matching test results corresponding to the process snapshot information, thereby improving the security testing effect of the software system.

[0025] In a preferred embodiment of the above-described security testing method for software systems, the method further includes:

[0026] When there is a difference between the object snapshot information and the corresponding baseline snapshot information, the object snapshot information is determined as the baseline snapshot information corresponding to the object snapshot information, so as to realize the update processing of the baseline snapshot information.

[0027] The beneficial effects of this embodiment are: when it is determined that there is a difference between the object snapshot information and the baseline snapshot information, the object snapshot information can be determined as the baseline snapshot information corresponding to the object snapshot information, so as to realize the update processing of the baseline snapshot information. This ensures that each security test for the software system is based on the previous security test, thereby narrowing the test scope and improving the test speed.

[0028] In a preferred embodiment of the above-described security testing method for the software system, the step of determining test rules based on the type of the change snapshot information, performing matching tests on the change snapshot information according to the test rules, and determining the test results corresponding to the change snapshot information includes:

[0029] Based on the type of the change snapshot information, the corresponding test features are determined, and based on the test features, the test rules are determined. The change snapshot information is then matched and tested according to the test rules to determine the test results corresponding to the change snapshot information.

[0030] The beneficial effects of this embodiment are: based on the type of the changed snapshot information (object snapshot information that differs from the baseline snapshot information), the test characteristics that the object snapshot information may have reflecting the vulnerability of the software system can be determined, and the corresponding test rules can be determined based on the test characteristics. Thus, the changed snapshot information can be matched and tested according to the test rules to determine whether the changed snapshot information has test characteristics, thereby improving the accuracy of software system testing.

[0031] In a preferred embodiment of the above-described security testing method for the software system, the step of determining the corresponding test features based on the type of the change snapshot information, determining the test rules based on the test features, performing matching tests on the change snapshot information according to the test rules, and determining the test results corresponding to the change snapshot information includes:

[0032] Based on the type of the change snapshot information, determine the corresponding test feature, and based on the test feature, determine the corresponding test rule;

[0033] Determine whether the test features and the test rules have been updated;

[0034] When it is determined that the test features and the test rules have been updated, the test features and test rules to be used are determined according to the updated test features and test rules, and the changed snapshot information is matched according to the test rules to be used to determine the matching test results;

[0035] Based on the matching test results, the test features to be used, and the test rules to be used, the test results corresponding to the changed snapshot information are determined.

[0036] The beneficial effects of this embodiment are as follows: Before performing matching tests on the changed snapshot information according to the test rules, it can be determined whether the test features and test rules have been updated. When it is determined that the test features and test rules have been updated, the test features and test rules to be used are determined according to the test features and test rules, so as to ensure that the changed snapshot information is matched only according to the difference rules, thereby reducing the number of test rules, ensuring that the security test of the software system is an incremental test, and thus shortening the security test time of the software system.

[0037] In a preferred embodiment of the above-described security testing method for the software system, determining that the object snapshot information is changed snapshot information when there is a difference between the object snapshot information and the corresponding baseline snapshot information includes:

[0038] Calculate the hash value of the object snapshot information, and calculate the hash value of the corresponding baseline snapshot information;

[0039] When it is determined that the hash value of the object snapshot information is different from the hash value of the corresponding baseline snapshot information, the object snapshot information is determined to be the changed snapshot information.

[0040] The beneficial effects of this embodiment are: by comparing the hash values ​​of object snapshot information and the corresponding baseline snapshot information, the object snapshot information whose content has changed can be quickly identified. Then, rule matching tests are only performed on the object snapshot information whose content has changed, which narrows the test scope, ensures that the test rule matching test is a lightweight test, and improves the efficiency of security testing of software systems.

[0041] Secondly, embodiments of this application provide a testing device, including:

[0042] The acquisition module is used to acquire system baseline snapshot information of the software system, which includes various types of baseline snapshot information.

[0043] The acquisition module is further configured to acquire system snapshot information of the software system; wherein, the system snapshot information includes multiple types of object snapshot information, and the object snapshot information of the same type corresponds one-to-one with the baseline snapshot information;

[0044] The processing module is used to determine that the object snapshot information is changed snapshot information when there is a difference between the object snapshot information and the corresponding baseline snapshot information for each type of object snapshot information;

[0045] The processing module is further configured to, for each change snapshot information, determine the corresponding test rule according to the type of the change snapshot information, and perform a matching test on the change snapshot information according to the test rule to determine the test result corresponding to the change snapshot information;

[0046] The processing module is also used to determine the security test result of the software system based on the test result corresponding to each of the change snapshot information.

[0047] The beneficial effects of this embodiment are as follows: On the one hand, the processing module only performs test rule matching tests on object snapshot information that differs from the baseline snapshot information. This narrows the testing scope, increases testing speed, and reduces the number of confirmed security test results, thereby reducing the cost of subsequent manual review of security test results. On the other hand, by applying test rules to classification, the processing module determines test features and test rules based on the type of object snapshot information. This allows for more targeted testing of object snapshot information that differs from the baseline snapshot information to determine whether it possesses features corresponding to the test features, avoiding the high false positive problem caused by indiscriminate scanning tests.

[0048] In a preferred embodiment of the above-described testing equipment, the acquisition module is specifically used for:

[0049] Determine whether the software system has undergone a software version update;

[0050] When it is determined that the software system has undergone a software version update, various types of program file snapshot information and various types of process snapshot information of the software system are obtained; or,

[0051] When it is determined that the software system has not undergone a software version update, various types of process snapshot information of the software system are obtained.

[0052] The beneficial effects of this embodiment are as follows: The acquisition module determines whether to acquire program file snapshot information based on whether the software system has undergone a software version update, that is, whether to subsequently acquire and match test rules for the program file snapshot information. When it is determined that the software system has not undergone a software version update, only process snapshot information is acquired, and subsequent test rules are only acquired and matched for the process snapshot information, thereby further narrowing the test scope and improving the security testing speed of the software system.

[0053] In a preferred embodiment of the above-described testing equipment, the acquisition module is specifically used for:

[0054] Obtain the software package corresponding to the software system, and obtain the file information and file storage path corresponding to the software package. Based on the file storage path, determine the directory information corresponding to the software package. Based on the file information and directory information corresponding to the software package, determine the snapshot information of various types of program files of the software system; or,

[0055] Based on the file information and directory information corresponding to the software package input by the user, the snapshot information of various types of program files of the software system is determined.

[0056] The beneficial effects of this embodiment are: This embodiment ensures that when the software system undergoes a software version update, the acquisition module can perform a comprehensive comparison and rule matching test on the non-runtime information corresponding to the updated software system, thereby improving the accuracy and efficiency of the security testing of the software system.

[0057] In a preferred embodiment of the above-described testing equipment, the acquisition module is specifically used for:

[0058] Obtain the runtime information of the software system, and determine various types of process snapshot information of the software system based on the runtime information of the software system.

[0059] The beneficial effects of this embodiment are as follows: The acquisition module can determine various types of process snapshot information of the software system based on the acquired runtime information of the software system. This ensures that the processing module can determine process snapshot information that differs from the baseline snapshot information of the object when the software system has not run to an error state. In other words, it can determine process snapshot information that may cause errors in the software system. Based on the corresponding test rules, it can determine the matching test results with test characteristics. This ensures that maintenance personnel can maintain the software system in a timely manner based on the matching test results corresponding to the process snapshot information, thereby improving the security testing effect of the software system.

[0060] In a preferred embodiment of the above-described testing equipment, the processing module is further configured to:

[0061] When there is a difference between the object snapshot information and the corresponding baseline snapshot information, the object snapshot information is determined as the baseline snapshot information corresponding to the object snapshot information, so as to realize the update processing of the baseline snapshot information.

[0062] The beneficial effects of this embodiment are as follows: When the processing module determines that there is a difference between the object snapshot information and the corresponding baseline snapshot information, it determines the object snapshot information as the baseline snapshot information corresponding to the object snapshot information, so as to realize the update processing of the baseline snapshot information. This ensures that each security test of the software system is based on the previous security test, thereby narrowing the test scope and improving the test speed.

[0063] In a preferred embodiment of the above-described testing equipment, the processing module is specifically used for:

[0064] Based on the type of the change snapshot information, the corresponding test features are determined, and based on the test features, the test rules are determined. The change snapshot information is then matched and tested according to the test rules to determine the test results corresponding to the change snapshot information.

[0065] The beneficial effects of this embodiment are: the processing module can determine the test characteristics that may reflect the vulnerability of the software system based on the type of the changed snapshot information (object snapshot information that differs from the baseline snapshot information), and determine the corresponding test rules based on the test characteristics. Thus, the changed snapshot information can be matched and tested according to the test rules to determine whether the changed snapshot information has test characteristics, thereby improving the accuracy of software system testing.

[0066] In a preferred embodiment of the above-described testing equipment, the processing module is specifically used for:

[0067] Based on the type of the change snapshot information, determine the corresponding test feature, and based on the test feature, determine the corresponding test rule;

[0068] Determine whether the test features and the test rules have been updated;

[0069] When it is determined that the test features and the test rules have been updated, the test features and test rules to be used are determined according to the updated test features and test rules, and the changed snapshot information is matched according to the test rules to be used to determine the matching test results;

[0070] Based on the matching test results, the test features to be used, and the test rules to be used, the test results corresponding to the changed snapshot information are determined.

[0071] The beneficial effects of this embodiment are as follows: Before performing matching tests on the changed snapshot information according to the test rules, the processing module can determine whether the test features and test rules have been updated. When it is determined that the test features and test rules have been updated, the module can determine the test features and test rules to be used based on the test features and test rules, so as to ensure that the changed snapshot information is matched only according to the difference rules. This reduces the number of test rules, ensures that the security testing of the software system is incremental testing, and thus shortens the security testing time of the software system.

[0072] In a preferred embodiment of the above-described testing equipment, the processing module is specifically used for:

[0073] Calculate the hash value of the object snapshot information, and calculate the hash value of the corresponding baseline snapshot information;

[0074] When it is determined that the hash value of the object snapshot information is different from the hash value of the corresponding baseline snapshot information, the object snapshot information is determined to be the changed snapshot information.

[0075] The beneficial effects of this embodiment are as follows: By comparing the hash values ​​of object snapshot information and the corresponding baseline snapshot information, the processing module can quickly identify object snapshot information whose content has changed. Subsequently, rule matching tests are only performed on object snapshot information whose content has changed, thereby narrowing the testing scope and ensuring that rule matching tests are lightweight tests, thus improving the efficiency of security testing of software systems.

[0076] Thirdly, embodiments of this application provide a testing device, including:

[0077] A processor, and a memory communicatively connected to the processor;

[0078] The memory is used to store computer-executed instructions;

[0079] The processor is used to execute computer execution instructions stored in the memory to implement the security testing method for the software system described in the first aspect.

[0080] The beneficial effects of this embodiment are as follows: On the one hand, the processor only performs rule matching tests on object snapshot information that differs from the baseline snapshot information, which can narrow the testing scope, improve testing speed, reduce the number of confirmed security test results, and lower the cost of subsequent manual review of security test results. On the other hand, by applying test rules to classification, the processor determines test features and test rules based on the type of changed snapshot information (object snapshot information). This allows for more targeted testing of object snapshot information that differs from the baseline snapshot information to determine whether it possesses features corresponding to the test features, avoiding the high false positive problem caused by indiscriminate scanning tests.

[0081] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the security testing method for the software system described in the first aspect.

[0082] The beneficial effects of this embodiment are as follows: On the one hand, the processor only performs rule matching tests on object snapshot information that differs from the baseline snapshot information, which can narrow the testing scope, improve testing speed, reduce the number of confirmed security test results, and lower the cost of subsequent manual review of security test results. On the other hand, by applying test rules to classification, the processor determines test features and test rules based on the type of changed snapshot information (object snapshot information). This allows for more targeted testing of object snapshot information that differs from the baseline snapshot information to determine whether it possesses features corresponding to the test features, avoiding the high false positive problem caused by indiscriminate scanning tests. Attached Figure Description

[0083] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0084] Figure 1 A system architecture diagram of a security testing method for a software system provided in this application;

[0085] Figure 2 A flowchart illustrating an embodiment of a security testing method for a software system provided in this application;

[0086] Figure 3 A flowchart illustrating a second embodiment of a security testing method for a software system provided in this application;

[0087] Figure 4 A flowchart illustrating Embodiment 4 of a security testing method for a software system provided in this application;

[0088] Figure 5 A flowchart illustrating Embodiment 5 of a security testing method for a software system provided in this application;

[0089] Figure 6 A flowchart illustrating a sixth embodiment of a security testing method for a software system provided in this application;

[0090] Figure 7 A system structure diagram of a testing device provided in this application;

[0091] Figure 8 A schematic diagram of the structure of a testing device provided in this application;

[0092] Figure 9 A structural diagram of a testing device provided in this application. Detailed Implementation

[0093] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments made by those skilled in the art under the guidance of these embodiments are within the scope of protection of this application.

[0094] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0095] Current technologies for testing the security of software systems typically involve a comprehensive scan of all character data within the system, based on predefined test rules designed to identify whether the system possesses testable characteristics. The test results are then determined based on whether the system matches the test rules. However, this method suffers from drawbacks such as long testing times and low accuracy.

[0096] Based on the above-mentioned technical problems, the technical conception process of this application is as follows: how to improve the security testing method of software system so as to shorten the testing time and improve the accuracy of the test results.

[0097] The security testing scheme for the software system in this application is described in detail below.

[0098] For example, Figure 1 A system architecture diagram of a security testing method for a software system provided in this application is shown below. Figure 1 As shown, the system may include: a test device 101 and a device under test 102.

[0099] The device under test (DUT) 102 runs a software system. Additionally, a monitoring and actuator (software) is installed on the DUT 102. The test device 101 can obtain system snapshot information of the software system monitored by the monitoring and actuator running on the DUT 102 through a communication connection with the DUT 102.

[0100] It should be noted that the test device 101 and the device under test 102 can be installed on different devices or integrated on the same device; this application does not impose any restrictions on this.

[0101] It should be noted that the embodiments in this application do not... Figure 1 The document does not limit the actual form of the various devices included, nor does it specify the form of the devices. Figure 1 The interaction methods between devices are limited, and can be set according to actual needs when applying the solution.

[0102] The technical solution of this application will now be described in detail through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0103] Figure 2 This is a flowchart illustrating an embodiment of a security testing method for a software system provided in this application. See also... Figure 2 The method specifically includes the following steps:

[0104] S201: Obtain system baseline snapshot information of the software system.

[0105] In this embodiment, the testing equipment can acquire system baseline snapshot information of the software system. This system baseline snapshot information includes various types of baseline snapshot information. For example, it may include baseline snapshot information of data files, baseline snapshot information of configuration files, and baseline snapshot information of binary files. It should be noted that the software system is the software system to be subjected to security testing. The software system can be system software or application software. System software refers to computer software that controls and coordinates the computer and its external devices, and supports the development and operation of application software. System software may include operating systems, language processing programs, database systems, and network management systems, etc. Application software refers to software developed for a specific field and serving a specific purpose. For example, application software may be engineering budgeting software or educational auxiliary software.

[0106] In some embodiments, the test device can acquire information about the environment under test (related information about the software system running on the device under test) through a monitoring and actuator, determine the initial system snapshot information of the software system based on the information about the environment under test, and use the initial system snapshot information of the software system as the system baseline snapshot information of the software system. Specifically, when the device under test and the test device are the same device, the test device can directly acquire the information about the environment under test through the monitoring and actuator deployed on the test device (i.e., the device under test). When the device under test and the test device are different devices, the test device can send a request to acquire information about the environment under test to the monitoring and actuator deployed on the device under test. The monitoring and actuator deployed on the device under test can acquire the information about the environment under test according to the request and send the information about the environment under test to the remote control module on the test device. It should be noted that the test device sends the request to acquire information about the environment under test to the monitoring and actuator deployed on the device under test through the remote control module.

[0107] In some embodiments, a user can input initial system snapshot information of the software system on the testing device. After obtaining this initial system snapshot information, the testing device can use it as the system baseline snapshot information of the software system. It should be noted that the testing device can provide an operable interface to the user through a user interface module to obtain the user-input initial system snapshot information. The testing device can manage various types of baseline snapshot information within the system baseline snapshot information of the software system through a snapshot information management module.

[0108] It should be noted that after acquiring the system baseline snapshot information of the software system, the testing equipment can store this information in the relevant information of the pre-created test target item (software system). This allows the test target item management module of the testing equipment to classify and save the baseline snapshot information of different software systems according to the dimensions of the test target item. Furthermore, the test target item management module can also be responsible for the creation and management of test target items. It should also be noted that the testing equipment can provide a user interface through the user interface module, allowing users to perform operations such as adding, deleting, modifying, and querying test target items.

[0109] S202: Obtain system snapshot information of the software system.

[0110] In this embodiment, the testing device can acquire a test request, which includes the identifier of the software system being tested. For example, the identifier of the software system being tested can be the name of the software system being tested. Specifically, when a user needs to perform security testing on the software system, the user can input a test request on the visual interface provided by the user interface module of the testing device, so that the testing device can acquire the test request through the user interface module.

[0111] When receiving a test request, the testing equipment can create a test task. The test task includes an identifier for the software system being tested. Test tasks can be one-time, scheduled, or continuous (i.e., real-time). It should be noted that the testing equipment can manage the creation, startup, and shutdown of test tasks through a test task management module. After creating a test task, the testing equipment can display it through a user interface module, allowing users to add, delete, modify, and query the task.

[0112] The testing equipment can acquire system snapshot information of the software system according to the testing task. This system snapshot information can include various types of object snapshot information. For example, it can include object snapshot information for data files, configuration files, and binary files. It should be noted that object snapshot information of the same type corresponds one-to-one with baseline snapshot information. For instance, object snapshot information for data files corresponds to baseline snapshot information for data files, object snapshot information for configuration files corresponds to baseline snapshot information for configuration files, and object snapshot information for binary files corresponds to baseline snapshot information for binary files.

[0113] After acquiring the system snapshot information of the software system, the testing equipment can store this information in the relevant information of the test target (software system) through the test target item management module. This ensures that the relevant information of different software systems can be classified, processed, and saved according to the dimensions of the test target item. It should be noted that the testing equipment manages the system snapshot information of the software system through the test target item management module, and it can also manage the system snapshot information of the software system through the snapshot information management module.

[0114] S203: For each type of object snapshot information, when there is a difference between the object snapshot information and the corresponding baseline snapshot information, the object snapshot information is determined to be changed snapshot information.

[0115] In this embodiment, when the testing device acquires multiple types of object snapshot information, for each type of object snapshot information, it can identify baseline snapshot information of the same type as the object snapshot information among the multiple types of baseline snapshot information. The testing device then determines whether there is a difference between the object snapshot information and the baseline snapshot information. When a difference is determined between the object snapshot information and the baseline snapshot information, it is determined that the content of the object snapshot information has changed compared to the baseline snapshot information. At this point, the object snapshot information can be identified as changed snapshot information, and subsequently, only the object snapshot information identified as changed snapshot information will be subject to the matching test rules.

[0116] It should be noted that when the testing equipment determines a difference between the object snapshot information and the corresponding baseline snapshot information, it identifies the object snapshot information that differs from the baseline snapshot information as the corresponding baseline snapshot information, thereby updating the baseline snapshot information. This method ensures that each security test of the software system is conducted based on the previous security test, thus narrowing the testing scope and improving testing speed.

[0117] It should be noted that the testing equipment can use the system analysis module to determine the snapshot information of each type of object and the corresponding baseline snapshot information, and use the difference calculation module to calculate whether there is a difference between the object snapshot information and the corresponding baseline snapshot information.

[0118] S204: For each change snapshot, determine the test rules based on the type of change snapshot, and perform matching tests on the change snapshot based on the test rules to determine the test results corresponding to the change snapshot.

[0119] In this embodiment, after determining the change snapshot information, the testing device can determine the type of each change snapshot information and the corresponding test rule. In one implementation, the testing device can pre-store the correspondence between change snapshot information types and test rules, allowing it to determine the corresponding test rule based on the change snapshot information type. In another implementation, the testing device pre-stores the correspondence between change snapshot information types and test features, as well as the correspondence between test features and test rules. The testing device can determine the corresponding test feature based on the change snapshot information type and the corresponding test rule based on the test feature.

[0120] The testing equipment can perform matching tests on all information in the change snapshot information according to the test rules to determine the matching test results (the part of the change snapshot information that matches the test rules).

[0121] After determining the matching test results, the testing equipment can determine the test results corresponding to the changed snapshot information based on the matching test results and the test rules. Specifically, after obtaining the matching test results for each changed snapshot information, the testing equipment can determine the matching test results and the test rules as the test results corresponding to the changed snapshot information; that is, the test results include the matching test results and the test rules corresponding to the matching test results.

[0122] It should be noted that when the testing equipment determines the corresponding test features based on the type of change snapshot information, determines the corresponding test rules based on the test features, performs matching tests on all information in the change snapshot information according to the test rules, and determines the matching test results, the testing equipment can determine the test results corresponding to the change snapshot information based on the matching test results, test features, and test rules.

[0123] For example, when the snapshot information is changed to a log file, the corresponding first test characteristic is access outside the authorized time, and the corresponding first test rule is to determine whether the access time matches a preset access time. The test device can determine, according to the first test rule, whether there is access data in the log file that does not match the preset access time. This access data includes access time, access scope, and accessing personnel. When the test device determines that there is access data in the log file that does not match the preset access time, it identifies this access data as the first matching test result that matches the first test rule. Similarly, when the snapshot information is changed to a log file, the corresponding second test characteristic is access outside the authorized scope, and the corresponding second test rule is to determine whether the access scope matches a preset access scope. The test device can determine, according to this second test rule, whether there is access data in the log file that does not match the preset access scope. When the test device determines that there is access data in the log file that does not match the preset access scope, it identifies this access data as the second matching test result that matches the second test rule. After determining a first matching test result reflecting that the log file possesses the first test characteristic according to the first test rule, and determining a second matching test result reflecting that the log file possesses the second test characteristic according to the second test rule, the testing equipment combines the above information into a test result corresponding to the log file (change snapshot information). Table 1 shows an example of the test results corresponding to the log file.

[0124] Table 1 shows examples of test results corresponding to the log files.

[0125]

[0126] It should also be noted that each type of change snapshot information can correspond to at least one test feature, and each test feature can correspond to at least one test rule. For example, when the type of change snapshot information is a data file, one test feature corresponding to the data file is the possibility of sensitive data leakage, one test rule corresponding to this test feature is to check the access permissions of sensitive data files in the data file, and another test rule corresponding to this test feature is to check whether sensitive data files exist in the log file.

[0127] It should be noted that the testing equipment can use the difference calculation module to calculate whether there is a difference between the object snapshot information and the corresponding baseline snapshot information. The testing equipment can use the result analysis module to determine the test rules corresponding to the changed snapshot information, and perform matching tests on the changed snapshot information according to the test rules to determine the test results. Additionally, it should be noted that when the testing equipment obtains user modifications to test rules and test features through the user interface module, it can modify the test rules and test features stored in the configuration database module and managed by the test feature and test rule management module according to the modifications.

[0128] S205: Determine the security test results of the software system based on the test results corresponding to each change snapshot information.

[0129] In this embodiment, after acquiring the test results corresponding to each change snapshot, the testing equipment can determine the security test result of the software system based on these results. That is, the test results corresponding to multiple change snapshots are determined as the overall security test result of the software system. It should be noted that the testing equipment can determine the security test result of the software system through a result analysis module. It should also be noted that during a single security test of a software system, the testing equipment can only determine one security test result for that software system, and this security test result includes at least one test result corresponding to a change snapshot.

[0130] For example, when testing engineering budgeting software (software system), the testing equipment can determine the following test results for log files (change snapshot information): The test characteristic is "accessed during the authorized time," the test rule is "determine whether the access time matches the preset access time," and the matching test result is "access data that does not match the preset access time." Similarly, the testing equipment can determine the following test results for data storage files (change snapshot information): The test characteristic is "data not encrypted using an encryption algorithm," the test rule is "determine whether the stored data is encrypted using an encryption algorithm," and the matching test result is "data not encrypted using an encryption algorithm." After obtaining the above information, the testing equipment can determine the security test results of the software system. Table 2 shows an example of the security test results for the engineering budgeting software.

[0131] Table 2 Security Test Results of Engineering Budgeting Software

[0132]

[0133] Optionally, after determining the security test results of the software system, the testing equipment can directly control the display of the security test results through the user interface module. Alternatively, after determining the security test results of the software system, the testing equipment can compare the security test results with security test results in a whitelist to filter the security test results, and then control the display of the filtered security test results through the user interface module.

[0134] In this embodiment, system baseline snapshot information and system snapshot information of the software system are acquired. The system baseline snapshot includes multiple types of baseline snapshots, and the system snapshot information includes multiple types of object snapshot information, with each type of object snapshot information corresponding one-to-one with the baseline snapshot information. For each type of object snapshot information, when there is a difference between the object snapshot information and the corresponding baseline snapshot information, the object snapshot information is determined to be a changed snapshot information. For each changed snapshot information, test rules are determined based on the type of changed snapshot information, and matching tests are performed on the changed snapshot information according to the test rules to determine the test results corresponding to the changed snapshot information. Based on the test results corresponding to each changed snapshot information, the security test results of the software system are determined. Compared to the existing technology's method of performing a full-coverage scan test on all character data information of the software system according to multiple test rules, which suffers from long testing time and low test result accuracy, this application can classify the snapshot information of the software system, determine multiple types of object snapshot information, and compare each type of object snapshot information with the corresponding baseline snapshot information to determine the object snapshot information that differs from the corresponding baseline snapshot information as changed snapshot information. Therefore, matching tests are performed only on the changed snapshot information to obtain test results. On the one hand, performing test rule matching tests only on object snapshots that differ from the baseline snapshot information can narrow the testing scope, increase testing speed, and reduce the number of confirmed security test results, thereby lowering the cost of subsequent manual review of security test results. On the other hand, applying test rules to classification, and determining test features and rules based on the type of object snapshot information, allows for more targeted testing of object snapshots that differ from the baseline snapshot information. This determines whether they possess features corresponding to the test features, thus avoiding the high false positive problem caused by indiscriminate scanning tests.

[0135] Based on the aforementioned method embodiment one, embodiment two is an implementation method for a test device to obtain system snapshot information of a software system.

[0136] Figure 3 A flowchart illustrating a second embodiment of a security testing method for a software system provided in this application is shown. The method specifically includes the following steps:

[0137] S301: Determine whether the software system has undergone a software version update.

[0138] In this embodiment, the testing device can determine the software version number corresponding to the software system when acquiring a test task. It should be noted that the testing device can determine the software version number corresponding to the software system based on the software package information stored in the file database module.

[0139] The testing equipment compares the software version number with the software version number determined in the previous test task to determine whether the software system has undergone a software version update. If it is determined that the software system has undergone a software version update, S302 is executed; if it is determined that the software system has not undergone a software version update, S303 is executed.

[0140] S302: Obtain snapshot information of various types of program files in the software system, and obtain snapshot information of various types of processes in the software system.

[0141] In this embodiment, when the testing device determines that a software version update has occurred in the software system, it needs to obtain information corresponding to the updated software package—various types of program file snapshot information. Additionally, the testing device also needs to obtain information corresponding to the running software—various types of process snapshot information.

[0142] It should be noted that the testing equipment categorizes system snapshot information into program file snapshot information and process snapshot information based on their presentation. Program file snapshot information includes all information about the non-running software system, while process snapshot information includes all information about the running software system.

[0143] In addition, since different logical functions correspond to different test rules, program file snapshot information and process snapshot information can be classified according to logical functions.

[0144] Table 3 shows examples of program file snapshot information classification, and Table 4 shows examples of process snapshot information classification.

[0145] It should also be noted that the software system can obtain user-inputted classification methods for program file snapshots and process snapshots through the user interface module. For example, the software system can obtain user-inputted classifications of data files; for instance, data files can be classified as sensitive data files and ordinary data files, or as temporary data files and non-temporary data files.

[0146] Table 3 Examples of Classification of Program File Snapshot Information

[0147]

[0148] Table 4 Examples of Process Snapshot Information Classification

[0149]

[0150] S303: Obtain various types of process snapshot information of the software system.

[0151] In this embodiment, when the testing device determines that the software system has not undergone a software version update, it can ascertain that there are no differences between the various types of program file snapshot information of the software system and the corresponding baseline snapshot information. At this time, the testing device does not need to obtain the program file snapshot information to compare it with the baseline snapshot information. The testing device only needs to obtain the various types of process snapshot information of the software system.

[0152] In this embodiment, the testing equipment determines whether a software version update has occurred in the software system. If a software version update is detected, it acquires various types of program file snapshot information and various types of process snapshot information. If a software version update is not detected, it acquires various types of process snapshot information. In this application, the testing equipment can determine whether to acquire program file snapshot information based on whether a software version update has occurred, i.e., whether to subsequently acquire and match test rules for the program file snapshot information. Therefore, when it is determined that no software version update has occurred, only process snapshot information is acquired, and subsequent test rule acquisition and matching tests are only performed on that process snapshot information. This method further narrows the testing scope and improves the speed of security testing of the software system.

[0153] Embodiment 3 of this application is an implementation method for a test device to obtain snapshot information of various types of program files of a software system.

[0154] In this embodiment, the testing system can obtain snapshot information of various types of program files of the software system when it determines that the software system has undergone a software version update.

[0155] Optionally, the testing system can use a monitor and actuator installed on the device under test to determine the software package corresponding to the software system and obtain the file information and file storage path of the package. After obtaining the file storage path of the package, the testing system can determine the directory information of the package based on the file storage path, and then determine the program file information of the software system based on the file information and directory information. After determining the program file information of the software system, the testing system can determine various types of program file snapshot information based on the program file information.

[0156] Optionally, the testing system can obtain the file information and directory information corresponding to the software package input by the user, and determine the program file information of the software system based on the file information and directory information. After determining the program file information of the software system, the testing system can determine various types of program file snapshot information based on the program file information.

[0157] This embodiment illustrates the specific process by which the testing system acquires snapshot information of various types of program files in a software system. This ensures that when the software system undergoes a software version update, the testing equipment can perform comprehensive comparison and rule matching tests on the non-runtime information corresponding to the updated software system, thereby improving the accuracy and efficiency of security testing of the software system.

[0158] Embodiment 4 of this application is an implementation method for a test device to obtain various types of process snapshot information of a software system.

[0159] Figure 4 A flowchart illustrating a fourth embodiment of a security testing method for a software system provided in this application is shown. The method specifically includes the following steps:

[0160] S401: Obtain runtime information of the software system.

[0161] In this embodiment, the test equipment can obtain the runtime information of the software system installed on the device under test through monitoring and actuators.

[0162] One possible implementation is that, when acquiring a test task, the test device can send a runtime information acquisition request to the monitoring and actuator installed on the device under test (DUT). This allows the monitoring and actuator to detect and acquire the runtime information of the software system installed on the DUT based on the request. After acquiring the runtime information, the DUT can then send that information back to the test device.

[0163] S402: Based on the runtime information of the software system, determine various types of process snapshot information of the software system.

[0164] In this embodiment, when the test device acquires the runtime information of the software system sent by the device under test, it can determine the process information of the software system based on the runtime information. After determining the process information, the test device can classify the process information to identify various types of process information of the software system, and determine various types of process snapshot information of the software system based on the various types of process information.

[0165] In this embodiment, the testing equipment can determine various types of process snapshot information of the software system based on the acquired runtime information of the software system. This ensures that the testing equipment can identify process snapshot information that differs from the baseline snapshot information of the target system even before the software system reaches an error state, i.e., identify process snapshot information that may lead to future errors in the software system. The testing equipment can then determine matching test results with test characteristics from the process snapshot information according to corresponding test rules. This ensures that maintenance personnel can promptly perform preventative maintenance on the software system based on the matching test results corresponding to the process snapshot information, thereby improving the effectiveness of software system security testing.

[0166] Based on the aforementioned Method Implementation Example 1, the following Method Implementation Example 5 will provide a detailed description of one implementation method for determining the test results corresponding to the changed snapshot information.

[0167] Figure 5 A flowchart illustrating a fifth embodiment of a security testing method for a software system provided in this application is shown. The method specifically includes the following steps:

[0168] S501: Based on the type of change snapshot information, determine the corresponding test features, and based on the test features, determine the corresponding test rules.

[0169] In this embodiment, the test device stores the correspondence between the types of change snapshot information and test features, and stores the correspondence between test features and test rules.

[0170] The testing equipment can determine the corresponding test characteristics based on the type of change snapshot information obtained, and then determine the corresponding test rules based on the test characteristics.

[0171] S502: Determine whether the test features and test rules have been updated.

[0172] In this embodiment, after obtaining the test features and test rules corresponding to the changed snapshot information, the test device can determine whether the test features and test rules have been updated compared to the historical test features and historical test rules. If it is determined that the test features and test rules have been updated, S503 is executed; if it is determined that the test features and test rules have not been updated, S505 is executed.

[0173] Among them, historical test features and historical test rules are the test features and test rules corresponding to the type of snapshot information when the test equipment performs security testing on the software system in the previous test task.

[0174] S503: Based on the updated test features and updated test rules, determine the test features and test rules to be used, and perform matching tests on the changed snapshot information according to the test rules to be used, and determine the matching test results.

[0175] In this embodiment, when the test features and test rules are set incrementally, when the test device determines that the test features and test rules have been updated, it can determine the test features and test rules to be used based on the updated test features and test rules, and perform matching tests on the changed snapshot information based on the test rules to be used, and determine the matching test results with the test features.

[0176] For example, when the test device executes the first test task, the test feature stored in the test device is the first test feature, and the test rule stored in the test device is the first test rule. The test device can perform a matching test on the first changed snapshot information according to the first test rule to determine the first matching test result that possesses the first test feature. When the test device executes the second test task, since the test device obtains the second test feature and the second test rule input by the user, the test feature stored in the test device at this time is the first test feature and the second test rule, and the test rule stored is the first test rule and the second test rule. When the test device determines that both the test feature and the test rule have been updated, it can determine the test feature to be used as the second test feature and the test rule to be used as the second test rule based on the updated test feature (first test feature and second test feature) and the updated test rule (first test rule and second test rule). The test device can perform a matching test on the second changed snapshot information according to the test rule to be used (second test rule) to determine the second matching test result that possesses the second test feature.

[0177] S504: Based on the matching test results, the test features to be used, and the test rules to be used, determine the test results corresponding to the changed snapshot information.

[0178] In this embodiment, after determining the matching test result corresponding to the changed snapshot information, the testing equipment can determine the test result corresponding to the changed snapshot information based on the matching test result, the test feature to be used, and the test rule to be used. That is, the testing equipment can determine that the test result corresponding to the changed snapshot information includes the matching test result, the test feature to be used, and the test rule to be used.

[0179] S505: Perform a matching test on the changed snapshot information according to the test rules, and determine the matching test results.

[0180] In this embodiment, when the testing device determines that the test features and test rules have not been updated, it can directly perform a matching test on the changed snapshot information according to the test rules to determine the matching test result that has the test features.

[0181] S506: Based on the matching test results, test characteristics, and test rules, determine the test results corresponding to the changed snapshot information.

[0182] In this embodiment, after determining the matching test result corresponding to the changed snapshot information, the testing equipment can determine the test result corresponding to the changed snapshot information based on the matching test result, test features, and test rules. That is, the testing equipment can determine that the test result corresponding to the changed snapshot information includes the matching test result, the test features to be used, and the test rules to be used.

[0183] In this embodiment, the corresponding test features are determined based on the type of the changed snapshot information, and the corresponding test rules are determined based on the test features. When it is determined that the test features and test rules have been updated, the test features and test rules to be used are determined based on the updated test features and test rules, and the changed snapshot information is matched with the test rules to be used to determine the matching test result. Based on the matching test result, the test features to be used, and the test rules to be used, the test result corresponding to the changed snapshot information is determined. In this application, before performing matching tests on the changed snapshot information according to the test rules, it can be determined whether the test features and test rules have been updated. When it is determined that the test features and test rules have been updated, the test features and test rules to be used are determined based on the test features and test rules, so as to ensure that the changed snapshot information is matched with only the difference rules, thereby reducing the number of test rules, ensuring that the security testing of the software system is incremental testing, and thus shortening the security testing time of the software system.

[0184] The following method embodiment six describes in detail the process of determining whether there is a difference between the object snapshot information and the corresponding baseline snapshot information.

[0185] Figure 6 A flowchart illustrating a security testing method for a software system provided in this application, specifically including the following steps:

[0186] S601: Calculate the hash value of the object snapshot information and calculate the hash value of the corresponding baseline snapshot information.

[0187] In this embodiment, after the test device determines the object snapshot information and the corresponding baseline snapshot information, it can calculate the hash value of the object snapshot information and the hash value of the corresponding baseline snapshot information according to the hash algorithm.

[0188] S602: Determine whether the hash value of the object snapshot information is different from the hash value of the corresponding baseline snapshot information.

[0189] In this embodiment, after calculating the hash value of the object snapshot information and the hash value of the corresponding baseline snapshot information, the test device can determine whether the hash value of the object snapshot information is different from the hash value of the corresponding baseline snapshot information.

[0190] When the test device determines that the hash value of the object snapshot information is different from the hash value of the corresponding baseline snapshot information, it executes S603; when it determines that the hash value of the object snapshot information is the same as the hash value of the corresponding baseline snapshot information, it determines that the content of the object snapshot information is completely the same as the content of the corresponding baseline snapshot information, that is, it determines that the object snapshot information is not a modified snapshot information, and ends at this point without performing further security testing on the object snapshot information.

[0191] S603: Determine that the object snapshot information is modified snapshot information.

[0192] In this embodiment, when the test device determines that the hash value of the object snapshot information is different from the hash value of the object baseline snapshot information, it determines that the content of the object snapshot information has changed compared to the object baseline snapshot information. At this time, the object snapshot information can be determined to be modified snapshot information, so as to conduct further security testing on the object snapshot information.

[0193] In this embodiment, the hash values ​​of the object snapshot information and the corresponding baseline snapshot information are calculated separately. When it is determined that the hash value of the object snapshot information differs from the hash value of the corresponding baseline snapshot information, the object snapshot information is identified as changed snapshot information. This application quickly identifies object snapshot information whose content has changed by comparing the hash values ​​of the object snapshot information and the corresponding baseline snapshot information. Subsequently, test rule matching tests are only performed on the object snapshot information whose content has changed, narrowing the test scope, ensuring that rule matching tests are lightweight, and improving the efficiency of security testing for the software system.

[0194] The testing equipment will be further described below through method embodiment seven.

[0195] Figure 7 A system structure diagram of a testing device provided in this application. Figure 7As shown, the testing equipment 70 includes 11 functional modules: a user interface module 701, a test target item management module 702, a test task management module 703, a snapshot information management module 704, a test feature and test rule management module 705, a system analysis module 706, a difference calculation module 707, a result analysis module 708, a remote control module 709, a configuration database module 710, and a file database module 711. It should be noted that these multiple functional modules are functional modules divided by the program used by the testing equipment to perform security testing on the software system. Each functional module completes a sub-function, and all functional modules work together to complete the security testing process of the software system.

[0196] In this embodiment, the user interface module 701 is used to provide an interface that can be operated by the user, so that the user can add, delete, modify and query test targets, test tasks, snapshot information and test features and test rules.

[0197] The test target item management module 702 is used to manage information about test target items, including various attribute information of test target items, such as configuration information, status information and baseline data information.

[0198] The test task management module 703 is used to manage test tasks. It can manage the creation, start and stop of test tasks. It should be noted that the test task management module 703 can support the management of single test tasks, dynamic test tasks and scheduled test tasks.

[0199] The snapshot information management module 704 manages snapshot information, including system baseline snapshot information (including various types of baseline snapshot information) and historical system snapshot information (including various types of object snapshot information). Additionally, the snapshot information management module 704 provides user-defined snapshot information types and the ability to add, delete, and modify snapshot information. After the user interface module receives user actions that modify snapshot information, the snapshot information management module can manage the snapshot information based on this information.

[0200] The Test Feature and Test Rule Management Module 705 provides CRUD (Create, Read, Update, Delete) functionality for test features and test rules. It's important to note that a test feature is an abstract representation of a class of problems, while a test rule is the technical implementation of a test feature. For example, when detecting whether sensitive information has been leaked, a test feature could be unauthorized access to sensitive information, and a test rule could be checking permissions on sensitive data files or checking for the presence of sensitive information in log files.

[0201] The system analysis module 706 is used to acquire snapshot information and baseline snapshot information of the software system, and to determine the snapshot information of each type of object and the corresponding baseline object snapshot information.

[0202] The difference calculation module 707 is used to calculate the hash value of each type of object snapshot information and the corresponding baseline object snapshot information, and to determine the object snapshot information whose hash value is different from the hash value of the baseline object snapshot information as the change snapshot information.

[0203] The results analysis module 708 is used to determine the corresponding test features based on the change snapshot information, determine the corresponding test rules based on the test features, perform matching detection on the change snapshot information according to the test rules, determine the test results corresponding to the change snapshot information, and determine the security test results of the software system based on the test results corresponding to each type of change snapshot information.

[0204] The remote control module 709 is used when the device under test and the test device 70 are installed on different devices. The test device can use the remote control module 709 to control the monitoring and actuator installed on the device under test to obtain system snapshot information of the software system.

[0205] The configuration database module 710 is mainly used to store information such as test targets, test tasks, snapshot information, test characteristics and test rules, and can provide CRUD capabilities.

[0206] The file database module 711 is used to store data such as snapshot information, software packages, and security test results of software systems, and can provide CRUD (Create, Read, Update, Delete) capabilities.

[0207] It should be noted that the testing equipment 70 may also include a third-party system interface module. Figure 7 (Not shown) It is mainly used to push the security test results of the software system to the third-party system on the terminal device, and can also be used to provide the security test capability of the software system to the third-party system on the terminal device.

[0208] In this embodiment, the testing equipment can achieve comprehensive management of the security testing process of the software system by setting up a user interface module, a test target item management module, a test task management module, a snapshot information management module, a test feature and test rule management module, a system analysis module, a difference calculation module, a result analysis module, a remote control module, a configuration database module, and a file database module.

[0209] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0210] Figure 8 A schematic diagram of the structure of a testing device provided in this application; such as Figure 8As shown, the test device 80 includes an acquisition module 81 and a processing module 82. The acquisition module 81 is used to acquire system baseline snapshot information of the software system, which includes various types of baseline snapshot information. The acquisition module 81 is also used to acquire system snapshot information of the software system, which includes various types of object snapshot information, with each type of object snapshot information corresponding one-to-one with the baseline snapshot information. The processing module 82 is used to determine that an object snapshot information is a changed snapshot information when there is a difference between the object snapshot information and the corresponding baseline snapshot information for each type. The processing module 82 is also used to determine the corresponding test rules for each changed snapshot information based on its type, and to perform matching tests on the changed snapshot information according to the test rules to determine the test results corresponding to the changed snapshot information. The processing module 82 is also used to determine the security test results of the software system based on the test results corresponding to each changed snapshot information.

[0211] The testing equipment provided in this application embodiment can execute the technical solutions shown in the above method embodiments. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0212] In one possible implementation, the acquisition module 81 is specifically used to: determine whether the software system has undergone a software version update; when it is determined that the software system has undergone a software version update, acquire multiple types of program file snapshot information of the software system and acquire multiple types of process snapshot information of the software system; or, when it is determined that the software system has not undergone a software version update, acquire multiple types of process snapshot information of the software system.

[0213] The testing equipment provided in this application embodiment can execute the technical solutions shown in the above method embodiments. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0214] In one possible implementation, the acquisition module 81 is specifically used to: acquire the software package corresponding to the software system, acquire the file information and file storage path corresponding to the software package, determine the directory information corresponding to the software package based on the file storage path, and determine the program file snapshot information of various types of the software system based on the file information and directory information corresponding to the software package; or, determine the program file snapshot information of various types of the software system based on the file information and directory information corresponding to the software package input by the user.

[0215] The testing equipment provided in this application embodiment can execute the technical solutions shown in the above method embodiments. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0216] In one possible implementation, the acquisition module 81 is specifically used to: acquire the runtime information of the software system, and determine various types of process snapshot information of the software system based on the runtime information of the software system.

[0217] The testing equipment provided in this application embodiment can execute the technical solutions shown in the above method embodiments. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0218] In one possible implementation, the processing module 82 is further configured to: when there is a difference between the object snapshot information and the corresponding baseline snapshot information, determine the object snapshot information as the baseline snapshot information corresponding to the object snapshot information, so as to realize the update processing of the baseline snapshot information.

[0219] The testing equipment provided in this application embodiment can execute the technical solutions shown in the above method embodiments. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0220] In one possible implementation, the processing module 82 is specifically used to: determine the corresponding test features based on the type of change snapshot information, determine the test rules based on the test features, perform matching tests on the change snapshot information according to the test rules, and determine the test results corresponding to the change snapshot information.

[0221] The testing equipment provided in this application embodiment can execute the technical solutions shown in the above method embodiments. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0222] In one possible implementation, the processing module 82 is specifically configured to: determine the corresponding test features based on the type of the changed snapshot information, and determine the corresponding test rules based on the test features; determine whether the test features and test rules have been updated; when it is determined that the test features and test rules have been updated, determine the test features and test rules to be used based on the updated test features and test rules, and perform matching tests on the changed snapshot information based on the test rules to be used, and determine the matching test results; and determine the test results corresponding to the changed snapshot information based on the matching test results, the test features to be used, and the test rules to be used.

[0223] The testing equipment provided in this application embodiment can execute the technical solutions shown in the above method embodiments. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0224] In one possible implementation, the processing module 82 is specifically used to: calculate the hash value of the object snapshot information and calculate the hash value of the corresponding baseline snapshot information; when it is determined that the hash value of the object snapshot information is different from the hash value of the corresponding baseline snapshot information, the object snapshot information is determined to be changed snapshot information.

[0225] The testing equipment provided in this application embodiment can execute the technical solutions shown in the above method embodiments. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0226] Figure 9 A structural diagram of a testing device provided in this application. Figure 9 As shown, the test device 90 includes a processor 91 and a memory 92. The processor 91 is communicatively connected to the memory 92, which stores computer execution instructions. The processor 91 is configured to execute the technical solutions in any of the aforementioned method embodiments by executing the computer execution instructions stored in the memory 92.

[0227] Optionally, the memory 92 can be either standalone or integrated with the processor 91. Optionally, when the memory 92 is a device independent of the processor 91, the test device 90 may further include a bus for connecting the aforementioned devices.

[0228] The testing equipment is used to execute the technical solutions in any of the aforementioned method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0229] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the technical solutions provided in any of the foregoing method embodiments.

[0230] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0231] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A security testing method for a software system, characterized in that, include: Obtain system baseline snapshot information of the software system, which includes various types of baseline snapshot information; Obtain system snapshot information of the software system; wherein, the system snapshot information includes multiple types of object snapshot information, and the object snapshot information of the same type corresponds one-to-one with the baseline snapshot information; For each type of object snapshot information, when there is a difference between the object snapshot information and the corresponding baseline snapshot information, the object snapshot information is determined to be changed snapshot information; For each change snapshot, a test rule is determined based on the type of the change snapshot, and a matching test is performed on the change snapshot based on the test rule to determine the test result corresponding to the change snapshot. The security test results of the software system are determined based on the test results corresponding to each of the change snapshots. The process of obtaining the system snapshot information of the software system includes: Determine whether the software system has undergone a software version update; When it is determined that the software system has undergone a software version update, various types of program file snapshot information and various types of process snapshot information of the software system are obtained; or, When it is determined that the software system has not undergone a software version update, various types of process snapshot information of the software system are obtained.

2. The security testing method for a software system according to claim 1, characterized in that, The acquisition of snapshot information of various types of program files in the software system includes: Obtain the software package corresponding to the software system, and obtain the file information and file storage path corresponding to the software package. Based on the file storage path, determine the directory information corresponding to the software package. Based on the file information and directory information corresponding to the software package, determine the snapshot information of various types of program files of the software system; or, Based on the file information and directory information corresponding to the software package input by the user, the snapshot information of various types of program files of the software system is determined.

3. The security testing method for a software system according to claim 1, characterized in that, The acquisition of various types of process snapshot information of the software system includes: Obtain the runtime information of the software system, and determine various types of process snapshot information of the software system based on the runtime information of the software system.

4. The security testing method for a software system according to claim 1, characterized in that, Also includes: When there is a difference between the object snapshot information and the corresponding baseline snapshot information, the object snapshot information is determined as the baseline snapshot information corresponding to the object snapshot information, so as to realize the update processing of the baseline snapshot information.

5. The security testing method for a software system according to claim 1, characterized in that, The step of determining test rules based on the type of the change snapshot information, and performing matching tests on the change snapshot information according to the test rules to determine the test results corresponding to the change snapshot information includes: Based on the type of the change snapshot information, the corresponding test features are determined, and based on the test features, the test rules are determined. The change snapshot information is then matched and tested according to the test rules to determine the test results corresponding to the change snapshot information.

6. The security testing method for a software system according to claim 5, characterized in that, The step of determining the corresponding test features based on the type of the change snapshot information, determining the test rules based on the test features, and performing matching tests on the change snapshot information according to the test rules to determine the test results corresponding to the change snapshot information includes: Based on the type of the change snapshot information, determine the corresponding test feature, and based on the test feature, determine the corresponding test rule; Determine whether the test features and the test rules have been updated; When it is determined that the test features and the test rules have been updated, the test features and test rules to be used are determined according to the updated test features and test rules, and the changed snapshot information is matched according to the test rules to be used to determine the matching test results; Based on the matching test results, the test features to be used, and the test rules to be used, the test results corresponding to the changed snapshot information are determined.

7. The security testing method for a software system according to claim 1, characterized in that, When the object snapshot information differs from the corresponding baseline snapshot information, determining that the object snapshot information is changed snapshot information includes: Calculate the hash value of the object snapshot information, and calculate the hash value of the corresponding baseline snapshot information; When it is determined that the hash value of the object snapshot information is different from the hash value of the corresponding baseline snapshot information, the object snapshot information is determined to be the changed snapshot information.

8. A testing device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory is used to store computer-executed instructions; The processor is used to execute computer execution instructions stored in the memory to implement the security testing method of the software system according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the security testing method of the software system according to any one of claims 1-7.

Images