Test method and device using a library of identification features, and electronic device

Abstract

The application provides a test method and device applying an application identification feature library and electronic equipment. Network flow data between a terminal device and a security gateway is acquired, the network flow data including access data initiated by a measured application and response data returned by the security gateway, and the security gateway is used for intercepting the access data based on the application identification feature library. Then, the network flow data is analyzed to determine an access interception rate of the security gateway to the measured application, and finally, the access interception rate is used to test the effectiveness of all application features of the measured application in the application identification feature library. Compared with the prior art, the electronic equipment can analyze the network flow data to automatically test the effectiveness of the application features of the measured application in the application identification feature library, thereby saving the labor cost and time cost of manual testing and improving the test efficiency.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a testing method, apparatus, and electronic device for applying a feature database. Background Technology

[0002] With the rapid development of the internet, its applications have undergone tremendous changes. From the initial web browsing, email, and FTP downloads, to today's music, games, videos, and mobile internet, a diverse array of applications have become the mainstream of the internet. Faced with this proliferation of applications, how to accurately manage application traffic is the biggest challenge for network administrators, and the prerequisite for such management is the accurate identification of various applications on the network. Traditional application identification technologies identify applications through protocols and port numbers. However, as applications become increasingly complex, traditional application identification technologies can no longer meet the needs of refined control, leading to the emergence of new APP application identification technologies.

[0003] APP application identification technology is an application feature extraction and matching technique, the key of which lies in the application identification feature library. This library includes features from several different applications, allowing the identification of an application by extracting specific fields or behavioral characteristics from messages related to that application and matching them with the library. Therefore, APP application identification technology can accurately identify applications, and further DPI (Deep Packet Inspection) technology can be used to precisely intercept application traffic.

[0004] Therefore, the accuracy of application recognition depends on the accuracy and validity of each feature in the application recognition feature library. However, due to the updates and iterations of application versions, in order to ensure the accuracy of application recognition, it is necessary to determine the validity of the features in the application recognition feature library in a timely manner.

[0005] In the current technology, the effectiveness testing of application identification feature libraries is still in the manual testing stage. However, for application identification feature libraries containing application features of a large number of applications, manual testing is extremely labor-intensive and time-consuming, with very low testing efficiency and a high error rate. Summary of the Invention

[0006] The purpose of this invention is to provide a testing method, apparatus, and electronic device for applying a feature library to improve the problems existing in the prior art.

[0007] The embodiments of the present invention can be implemented as follows:

[0008] In a first aspect, the present invention provides a testing method for an application identification feature library, applied to an electronic device, wherein the electronic device is communicatively connected to a security gateway and a terminal device connected to the security gateway; the security gateway is equipped with an application identification feature library, which includes application features of several applications; the method includes:

[0009] The network traffic data between the application under test on the terminal device and the security gateway is obtained; the network traffic data includes access data initiated by the application under test and response data returned by the security gateway; the security gateway is used to intercept the access data based on the application identification feature library.

[0010] The network traffic data is analyzed to determine the access interception rate of the security gateway for the tested application.

[0011] Using the access interception rate, the effectiveness of all application features corresponding to the tested application in the application identification feature library is tested.

[0012] Optionally, the step of analyzing the network traffic data to determine the access interception rate of the security gateway for the tested application includes:

[0013] The network traffic data is divided into multiple data streams based on the quintuple information;

[0014] Filter out irrelevant data streams from all the data streams to obtain multiple relevant data streams;

[0015] The number of response messages for each of the relevant data streams is counted to calculate the access interception rate of the security gateway for the tested application.

[0016] Optionally, the step of filtering irrelevant data streams from all the data streams to obtain multiple relevant data streams includes:

[0017] For any of the data streams, each data packet of the data stream is parsed to obtain specific fields;

[0018] If a specific field of the data packet in the data stream matches any one of the pre-stored preset fields, then the data stream is determined to be the irrelevant data stream.

[0019] If no specific field of any of the data packets in the data stream matches any of the preset fields, then the data stream is determined to be the relevant data stream.

[0020] Traverse each of the data streams to determine the relevant and irrelevant data streams in all the data streams;

[0021] After removing all irrelevant data streams, multiple relevant data streams are obtained.

[0022] Optionally, the step of counting the number of response messages for each of the relevant data streams to calculate the access interception rate of the security gateway for the tested application includes:

[0023] Get the total number of data streams;

[0024] For any of the aforementioned related data streams, count the number of response messages for that related data stream;

[0025] Perform protocol analysis on the data packets in the relevant data stream to determine the data stream type of the relevant data stream;

[0026] Based on the number of response messages and the data stream type, determine the interception result of the relevant data stream;

[0027] Traverse each of the relevant data streams to obtain the interception result for each of the relevant data streams;

[0028] The interception result is the total number of relevant data streams successfully intercepted;

[0029] The ratio of the total number to the total number of data streams is calculated to obtain the access interception rate of the security gateway for the tested application.

[0030] Optionally, the interception result is either successful interception or unsuccessful interception; the step of determining the interception result of the security gateway for the relevant data stream based on the number of response messages and the data stream type includes:

[0031] When the data stream type is TCP data stream and the number of response packets does not exceed the preset TCP response packet value, it is determined that the security gateway has successfully intercepted the relevant data stream;

[0032] When the data stream type is TCP data stream and the number of response packets exceeds the preset TCP response packet value, it is determined that the security gateway has failed to intercept the relevant data stream.

[0033] When the data stream type is UDP data stream and the number of response messages does not exceed the preset UDP response message value, it is determined that the security gateway has successfully intercepted the relevant data stream;

[0034] When the data stream type is UDP data stream and the number of response messages exceeds the preset UDP response message value, it is determined that the security gateway has failed to intercept the relevant data stream.

[0035] Optionally, before the step of acquiring network traffic data between the application under test on the terminal device and the security gateway, the method further includes:

[0036] Control the security gateway to download and install the application identification feature library;

[0037] Send the network access interception policy of the application under test to the security gateway, so that the security gateway can intercept data based on the network access interception policy;

[0038] Control the terminal device to access the network in order to obtain network traffic data between the application under test on the terminal device and the security gateway.

[0039] Optionally, the step of controlling the terminal device to access the network to obtain network traffic data between the application under test on the terminal device and the security gateway includes:

[0040] Control the terminal device to launch the application under test;

[0041] Send a simulated operation command to the terminal device and simultaneously start monitoring the network traffic of the terminal device; the simulated operation command is used to instruct the terminal device to perform data interaction with different interactive objects through the application under test within a set time period.

[0042] After the set time period, an uninstallation command is sent to the terminal device to cause the terminal device to uninstall the application under test.

[0043] Stop monitoring the network traffic of the terminal device and obtain the network traffic data between the application under test on the terminal device and the security gateway.

[0044] Optionally, when the terminal device is a PC, the method further includes:

[0045] Control the terminal device to open a browser, and control the terminal device to search for the application under test in the browser;

[0046] Receive search result data returned by the terminal device;

[0047] The official website URL of the tested application is obtained based on the search results data;

[0048] Send an access instruction to the terminal device, the access instruction being used to instruct the terminal device to access the official website of the application under test based on the official website URL;

[0049] Receive the access result returned by the terminal device;

[0050] Based on the access results, the effectiveness of all application features corresponding to the tested application in the application identification feature library is tested.

[0051] Secondly, the present invention also provides a testing device for an application identification feature library, applied to an electronic device, wherein the electronic device is communicatively connected to a security gateway and a terminal device connected to the security gateway; the security gateway is equipped with an application identification feature library, which includes application features of several applications; the device includes:

[0052] The traffic acquisition module is used to acquire network traffic data between the application under test on the terminal device and the security gateway; the network traffic data includes access data initiated by the application under test and response data returned by the security gateway; the security gateway is used to intercept the access data based on the application identification feature library.

[0053] The data analysis module is used to: analyze the network traffic data to determine the access interception rate of the security gateway for the application under test; and use the access interception rate to test the effectiveness of all application features corresponding to the application under test in the application identification feature library.

[0054] Thirdly, the present invention also provides an electronic device, comprising: a memory and a processor, wherein the memory stores a software program, and when the electronic device is running, the processor executes the software program to implement the testing method for the application recognition feature library described in the first aspect.

[0055] Compared with existing technologies, this invention provides a testing method, apparatus, and electronic device for an application identification feature library. In this invention, the electronic device is communicatively connected to a security gateway and terminal devices connected to the security gateway. The security gateway is equipped with an application identification feature library, which includes application features of several applications. By acquiring network traffic data between the application under test on the terminal device and the security gateway, including access data initiated by the application under test and response data returned by the security gateway, the security gateway is used to intercept access data based on the application identification feature library. The network traffic data is then analyzed to determine the access interception rate of the security gateway for the application under test. Finally, the access interception rate can be used to test the effectiveness of all application features corresponding to the application under test in the application identification feature library. Compared with existing technologies, the electronic device can analyze network traffic data to automatically test the effectiveness of application features of the application under test in the application identification feature library, saving the manpower and time costs of manual testing and improving testing efficiency. Attached Figure Description

[0056] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present invention.

[0058] Figure 2 This is one of the flowcharts illustrating a testing method for applying a feature library to an embodiment of the present invention.

[0059] Figure 3 This is a second flowchart illustrating a testing method for applying a feature library, provided as an embodiment of the present invention.

[0060] Figure 4 This is one of the flowcharts illustrating the process of a control terminal device starting the application under test, as provided in an embodiment of the present invention.

[0061] Figure 5 This is a second schematic diagram of a process for a control terminal device to start the application under test, provided as an embodiment of the present invention.

[0062] Figure 6 This is the third flowchart illustrating a testing method for applying a feature library in an embodiment of the present invention.

[0063] Figure 7 This is a schematic diagram of the structure of a test device for applying a feature library to an embodiment of the present invention.

[0064] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0066] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0067] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0068] It should be noted that, where there is no conflict, the features in the embodiments of the present invention can be combined with each other.

[0069] Here, we will first introduce the keywords or key terms involved in this invention:

[0070] 1. TCP: Transmission Control Protocol, is a connection-oriented, reliable, byte-stream-based transport layer communication protocol. TCP provides connection-oriented service, meaning that the two communicating parties (usually a client and a server) must establish a TCP connection before transmitting data, and establishing a TCP connection requires a three-way handshake.

[0071] (1) First handshake: The client sends a data packet 1 with the SYN (synchronize) flag to the server to request the establishment of a TCP connection;

[0072] (2) Second handshake: The server receives data packet 1 and sends back data packet 2 with the SYN / ACK flag to the client to indicate that the server has received data packet 1;

[0073] (3) Third handshake: The client sends back a data packet 3 with the ACK flag to the server, indicating that the client has received data packet 2.

[0074] After a three-way handshake, a TCP connection can be successfully established between the client and the server.

[0075] 2. UDP: User Datagram Protocol, is a connectionless transport layer protocol in the OSI (Open System Interconnection) reference model that provides a simple, unreliable, transaction-oriented message delivery service.

[0076] 3. Selenium: A testing tool for web applications.

[0077] 4. Appium: A compound word formed from Application and Selenium, it is one of the mainstream automated testing tools on current mobile platforms.

[0078] 5. DPI Technology: An application-layer-based traffic inspection and control technology called "Deep Packet Inspection." DPI technology can determine the true application source of data packets by probing the content of data packets in the application stream. 6. ADB: Android Debug Bridge, a command-line tool used to operate emulators or real devices from a computer. It can reside in the platform-tools directory on the computer (adb.exe). ADB is a client / server application with a client / server architecture.

[0079] Please see Figure 1 , Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present invention. In the application scenario of the present invention, there are terminal devices 100, security gateways 200 and electronic devices 300.

[0080] The terminal device 100 is communicatively connected to the security gateway 200, enabling network access through the security gateway 200; the electronic device 300 is communicatively connected to both the terminal device 100 and the security gateway 200, enabling control of both the terminal device 100 and the security gateway 200.

[0081] Optionally, terminal device 100 can be a mobile device, such as a smartphone or tablet, or a PC device, such as a laptop or computer. Electronic device 300 includes personal laptops of testers, professional test computers, etc.

[0082] The aforementioned electronic device 300 executes the testing method for the application identification feature library provided in this embodiment of the invention, thereby analyzing the network traffic data between the application under test on the terminal device 100 and the security gateway 200, in order to achieve validity testing of all application features corresponding to the application under test in the application identification feature library. The testing method for the application identification feature library will be described in detail below through embodiments and with reference to the accompanying drawings.

[0083] Please refer to Figure 2 , Figure 2 This is a flowchart illustrating a testing method for an application identification feature library provided in an embodiment of the present invention. The execution subject of this method is an electronic device, which is communicatively connected to a security gateway and terminal devices connected to the security gateway. The security gateway has an application identification feature library installed, which includes application features of several applications. The method includes the following steps S201 to S203:

[0084] S201. Obtain network traffic data between the application under test and the security gateway on the terminal device.

[0085] In this embodiment, the application under test can be any application associated with the application identification feature library, and the network traffic data can be generated when the application under test on the electronic device control terminal initiates network access through the security gateway. Therefore, the network traffic data can include access data initiated by the application under test and response data returned by the security gateway.

[0086] It is understandable that when the application under test on the terminal device initiates network access through the security gateway, the security gateway can be used to intercept the access data based on the application identification feature library.

[0087] S202. Analyze network traffic data to determine the access interception rate of the security gateway for the application under test.

[0088] S203. Using the access interception rate, test the effectiveness of all application features corresponding to the tested application in the application identification feature library.

[0089] In this embodiment, since the security gateway can intercept access data initiated by the terminal device, if the interception is successful, it means that the security gateway will not forward some access request packets of the terminal device. Therefore, the corresponding security gateway will not receive the response packets that should exist for these intercepted request packets and send them back to the terminal device.

[0090] In other words, the effectiveness of data interception at the security gateway will affect the response data sent back by the security gateway to the terminal device. Whether the security gateway can intercept the access data of the application under test depends to some extent on the validity of all application features corresponding to the application under test in the application identification feature library.

[0091] The testing method for the application identification feature library provided in this invention can analyze the network traffic data between the application under test and the security gateway to determine the access interception rate of the security gateway to the application under test. Then, the access interception rate is used to infer the effectiveness of all application features corresponding to the application under test in the application identification feature library. This saves the manpower and time costs of manual testing and improves testing efficiency.

[0092] The following section describes the process of capturing network traffic data between the application under test and the security gateway.

[0093] Among the optional implementation methods, in Figure 2 Based on this, please refer to Figure 3 Before step S201 above, the testing method for the application's feature database may further include S101 to S103:

[0094] S101. Control the security gateway to download and install the application identification feature library.

[0095] In this embodiment, the electronic device can send a feature library installation instruction for the application identification feature library to the security gateway, so that the security gateway downloads and installs the application identification feature library in response to the feature library installation instruction.

[0096] S101. Send the network access interception policy of the application under test to the security gateway so that the security gateway can intercept data based on the network access interception policy.

[0097] In this embodiment, the electronic device can send the pre-configured network access interception policy of the application under test to the security gateway, so that the security gateway can intercept data based on the network access interception policy.

[0098] S103. Control the terminal device to access the network in order to obtain network traffic data between the application under test on the terminal device and the security gateway.

[0099] In this embodiment, when the application features of the application under test are valid in the application feature recognition library, the security gateway can accurately identify the application under test by using the application features of the application under test when the terminal device accesses the network through the security gateway, and then call the network access interception policy of the application under test to intercept the request packets from the application under test.

[0100] If the application features of the application under test are invalid in the application feature recognition library, when the terminal device accesses the network through the security gateway, the security gateway cannot identify the application under test using the application features of the application under test, so it will not call the network access interception policy to intercept the request packets from the application under test.

[0101] Optionally, the sub-steps of step S103 above may include sub-steps S1031 to S10314:

[0102] S1031, Control terminal device starts the application under test.

[0103] In this embodiment, the terminal device is either a mobile device or a PC. However, the specific method of controlling the terminal device to launch the application under test is different in these two cases, which will be described below:

[0104] 1. When the terminal device is a mobile device (e.g., a smartphone), an Appium server can be deployed within the electronic device. Please refer to [link to relevant documentation]. Figure 4 The electronic device can control the terminal device to start the application under test through the following steps (1) to (8):

[0105] (1) Control the terminal device to launch the application store through the Appium server;

[0106] In this embodiment, a simulated click command can be sent to the terminal device through the Appium server, so that the terminal device responds to the simulated click command and launches the app store.

[0107] (2) Control the terminal device to search for the tested application in the application store through the Appium server;

[0108] (3) Receive search page data returned by the terminal device;

[0109] The search page data can include page elements from multiple search results;

[0110] (4) Based on the page elements of the first search result in the search page data, determine whether the terminal device has the application under test installed;

[0111] If the terminal device has the application under test installed, then proceed directly to step (5); if the terminal device does not have the application under test installed, then proceed to step (6) to (8) and then proceed to step (5).

[0112] In the optional example, if the page element of the first search result contains the word "open", it can be determined that the terminal device has the application under test installed; if the page element of the first search result contains the word "install", it can be determined that the terminal device has not installed the application under test.

[0113] (5) Control the terminal device to start the application under test through the Appium server;

[0114] (6) Perform XPath positioning on the page element of the first search result to obtain the button position information of the install button on the search page;

[0115] (7) Send an installation instruction, including button location information, to the terminal device;

[0116] In this embodiment, the installation command can be used to instruct the terminal device to install the application under test within a preset installation time. For example, the preset installation time can be 40 seconds, and the length of the preset installation time depends on the actual network conditions and is not limited here.

[0117] (8) Wait for the preset installation time.

[0118] II. When the terminal device is a PC (e.g., a personal computer), a Selenium server can be deployed on the terminal device. Please refer to [link to relevant documentation]. Figure 5 The electronic device can control the terminal device to start the application under test through the following steps 1 to 3:

[0119] 1. Send a location query command to the terminal device via the Selenium server;

[0120] In this embodiment, the location query command can be used to instruct the terminal device to obtain the installation path of the application under test. Optionally, the location query command can be a cmd command used to query the installation path of the application under test.

[0121] 2. Receive the installation path of the application under test returned by the terminal device;

[0122] 3. Send a startup command, including the installation path, to the terminal device via the Selenium server, so that the terminal device executes the startup command to start the application under test installed at the installation path.

[0123] It should be noted that the terminal device can be either a mobile device or a PC, and there is no limitation here.

[0124] S1032. Send a simulated operation command to the terminal device and simultaneously start monitoring the network traffic of the terminal device.

[0125] In this embodiment, the simulated operation command can be an adb monkey command, which can be used to instruct the terminal device to perform data interaction with different interactive objects through the application under test within a set time period. The set time period can be set to 15s or 20s, and the length of the set time period is subject to the actual situation and is not limited here.

[0126] Optionally, the electronic device can be equipped with a packet capture and analysis tool. This allows the electronic device to send simulated operation commands to the terminal device while simultaneously monitoring the terminal device's network traffic using the packet capture and analysis tool. This enables continuous monitoring of the terminal device's Wi-Fi port at set intervals to obtain both sent and received data packets. In an optional example, the packet capture and analysis tool could be Wireshark.

[0127] It is understandable that when a terminal device executes a simulated operation command, it is similar to a user performing random operations (such as swiping and / or clicking the screen) on different interfaces of the application being tested on the terminal device, thus enabling requests to be sent to different interactive objects.

[0128] S1033. After a set time period, send an uninstallation command to the terminal device so that the terminal device uninstalls the application under test.

[0129] In this embodiment, to avoid network traffic interference from the application under test during the traffic capture process for testing the effectiveness of the application characteristics of the next application, the application under test needs to be uninstalled.

[0130] S1034. Stop monitoring the network traffic of the terminal device and obtain the network traffic data between the application under test and the security gateway on the terminal device.

[0131] In this embodiment, while the electronic device sends the unload command to the terminal device, the network traffic monitoring of the terminal device can be stopped by the packet capture analysis tool. In this way, all data packets sent and received by the user terminal within the set time period are obtained, that is, the network traffic data between the application under test on the terminal device and the security gateway is obtained.

[0132] The following section details the process of analyzing network traffic data.

[0133] In an optional implementation, as mentioned above, network traffic data may include several data packets, one part of which may be multiple request packets in the access data initiated by the application under test, and another part may be multiple response packets in the response data returned by the security gateway. Optionally, since network traffic data may include all data packets generated by the application under test attempting to interact with different interaction objects, the network traffic data can be classified into multiple data streams based on the different interaction objects before analysis. Therefore, the sub-steps of step S202 above may include S2021 to S2023.

[0134] S2021. Based on the quintuple information, network traffic data is divided into multiple data streams.

[0135] It is understandable that the five-tuple information of a data packet can include the source IP address, destination IP address, source port number, destination port number, and transport protocol.

[0136] Therefore, based on the 5-tuple information of data packets in network traffic data, the interaction object of the application under test (i.e., the recipient of the request message initiated by the application under test) can be determined. Thus, all data packets between the application under test and the same interaction object in the network traffic data can be divided into a single data stream. That is, a single data stream can include all data packets between the application under test and the same interaction object.

[0137] S2022. Filter out irrelevant data streams from all data streams to obtain multiple relevant data streams.

[0138] Optionally, when the application under test accesses the network, the terminal device may also generate some data packets with basic service providers (such as domain name servers, terminal device manufacturers, etc.). Therefore, some data streams inevitably consist of all data packets generated by the interaction between the terminal device and various basic service providers. Such data streams are irrelevant to the application under test, and the security gateway does not need to intercept these invalid data streams. Therefore, the calculation of the access interception rate is unrelated to irrelevant data streams.

[0139] In an optional example, assuming data flow A consists entirely of DNS (Domain Name System) related messages, and data flow B consists entirely of messages related to terminal device manufacturers, then the data packets in both data flows A and B can be considered invalid miscellaneous packets. Data flows A and B are the irrelevant data flows that need to be filtered out. This example is merely illustrative and does not limit the types of irrelevant data flows.

[0140] In an optional implementation, it can be determined whether a data stream is irrelevant based on specific fields of the data packets in the data stream. Therefore, the sub-steps of step S2022 above can include S20221 to S20225.

[0141] S20221. For any data stream, parse each data packet in the data stream to obtain specific fields.

[0142] In this embodiment, the specific field can be used to identify the identity information of the communication object, such as a domain name or IP address. In an optional example, if the data packets in the data stream are HTTPS packets, then the specific field can be the server_name field in the HTTPS packet; if the data packets in the data stream are HTTP packets, then the specific field can be the host field in the HTTP packet.

[0143] S20222. If a specific field of a data message in the data stream matches any of the pre-stored preset fields, then the data stream is determined to be an irrelevant data stream.

[0144] S20223. If a specific field of all data packets in the data stream does not match any of the preset fields, then the data stream is determined to be a related data stream.

[0145] In this embodiment, the preset field can be the domain name or IP address of the basic service provider (such as a domain name server, terminal equipment manufacturer, etc.).

[0146] S20224. Traverse each data stream to determine the relevant and irrelevant data streams in the entire data stream.

[0147] For each data stream, execute steps S20221 and S20222 above, or execute steps S20221 and S20222 above, to determine whether each data stream is an irrelevant data stream or a relevant data stream.

[0148] S20225. Remove all irrelevant data streams to obtain multiple relevant data streams.

[0149] As mentioned above, irrelevant data streams are the interaction data between the terminal device and the basic service provider, and are unrelated to the application under test. In order to ensure the accuracy of the access interception rate, all irrelevant data streams need to be removed.

[0150] S2023. Count the number of response messages for each relevant data stream to calculate the access interception rate of the security gateway to the application under test.

[0151] In this embodiment, the number of response messages for the relevant data stream can reflect whether the security gateway intercepts the relevant data stream.

[0152] In an optional implementation, it can be determined whether a relevant data stream is intercepted by the security gateway based on the data stream type and the number of response messages. That is, the sub-steps of step S2023 above can include S20231 to S20237:

[0153] S20231, Get the total number of data streams.

[0154] S20232. For any relevant data stream, count the number of response messages for that data stream.

[0155] S20233. Perform protocol analysis on the data packets in the relevant data stream to determine the data stream type of the relevant data stream.

[0156] In this embodiment, the total number of data streams can be the total number of data streams obtained by performing step S2021 above. The response messages in the relevant data streams are data packets received by the terminal device. The data stream type of the relevant data streams can be either TCP or UDP. Both the number of response messages and the data stream type of the relevant data streams can be determined based on the five-tuple information of the data packets.

[0157] S20234. Based on the number of response messages and the data stream type, determine the interception result of the relevant data stream.

[0158] For TCP data streams, the security gateway only intercepts data packets from the application under test after the TCP connection is established via the three-way handshake. Since the terminal device receives the response packet during the second handshake in the three-way handshake, if the number of response packets in the TCP data stream does not exceed one, it indicates that the security gateway has successfully intercepted the TCP data stream; otherwise, it indicates that the security gateway has not successfully intercepted the TCP data stream.

[0159] For UDP data streams, security gateways typically intercept the first or second datagram sent by the terminal device. Since the security gateway sends the first datagram, the terminal device can receive a response message for that first datagram. Therefore, if the number of response messages in the UDP data stream does not exceed one, it indicates that the security gateway has successfully intercepted the UDP data stream; otherwise, it indicates that the security gateway has not successfully intercepted the UDP data stream.

[0160] In other words, the interception results of the relevant data stream in step S20234 above fall into the following four categories:

[0161] (1) When the data stream type is TCP data stream and the number of response packets does not exceed the preset TCP response packet value, it is determined that the security gateway has successfully intercepted the relevant data stream;

[0162] (2) When the data stream type is TCP data stream and the number of response packets exceeds the preset TCP response packet value, it is determined that the security gateway has failed to intercept the relevant data stream;

[0163] (3) When the data stream type is UDP data stream and the number of response messages does not exceed the preset UDP response message value, it is determined that the security gateway has successfully intercepted the relevant data stream;

[0164] (4) When the data stream type is UDP data stream and the number of response messages exceeds the preset UDP response message value, it is determined that the security gateway has failed to intercept the relevant data stream.

[0165] It is understandable that the default TCP response message value and the default UDP response message value can both be 1.

[0166] S20235. Traverse each relevant data stream to obtain the interception result for each relevant data stream.

[0167] By performing the above steps S20232-S20234 on each relevant data stream, the interception result for each relevant data stream can be obtained.

[0168] S20236. The statistical interception result is the total number of relevant data streams successfully intercepted. The ratio of this total number to the total number of data streams is used to obtain the access interception rate of the security gateway to the application under test.

[0169] In this embodiment, since the access interception rate of the security gateway for the tested application is the ratio of the total number of successfully intercepted relevant data streams to the total number of data streams, and the total number of data streams includes irrelevant data streams that the security gateway will not intercept, even if the application features of the tested application in the application identification feature library are invalid, the calculated access interception rate is not close to 0 but close to a threshold.

[0170] In an optional implementation, the sub-steps of step S203 above may include:

[0171] S2031. Determine whether the access interception rate exceeds a set threshold.

[0172] S2032. If the access interception rate exceeds the set threshold, then all application features corresponding to the tested application in the application identification feature library are determined to be valid.

[0173] S2033. If the access interception rate does not exceed the set threshold, then all application features corresponding to the tested application in the application identification feature library are determined to be invalid.

[0174] In this embodiment, if all application features corresponding to the application under test in the application identification feature library are invalid, it indicates that the application features of the application under test urgently need to be updated.

[0175] In the optional example, the threshold can be set to 30% or 40%. This example is only for illustration, and the size of the threshold can be set according to the actual situation. There is no limitation here.

[0176] Thus, based on the above steps S101 to S103 and S201 to S203, the effectiveness of the application features of the application under test can be tested.

[0177] When the terminal device is a PC, the following is another way to test the effectiveness of the application features of the application under test.

[0178] Please see Figure 6 The testing of the application recognition feature library may also include the following steps S301 to S306:

[0179] S301. Control the terminal device to open a browser and control the terminal device to search for the application under test in the browser.

[0180] S302, Receive search result data returned by the terminal device.

[0181] S303. Obtain the official website URL of the application under test based on search results data.

[0182] In this embodiment, XPath positioning can be performed based on search result data. If XPath positioning yields results, the page URL at that location can be obtained, thus obtaining the official website address of the application under test.

[0183] S304. Send an access command to the terminal device. The access command is used to instruct the terminal device to access the official website of the application under test based on the official website URL.

[0184] S305. Receive the access result returned by the terminal device.

[0185] S306. Based on the access results, test the effectiveness of all application features corresponding to the tested application in the application identification feature library.

[0186] In this embodiment, if the access result is successful, it indicates that the security gateway did not intercept the terminal device's access request, further indicating that all application features corresponding to the tested application in the application identification feature library are invalid. If the access result is unsuccessful, it indicates that the security gateway successfully intercepted the terminal device's access request, further indicating that all application features corresponding to the tested application in the application identification feature library are still valid.

[0187] Similarly, when the terminal device is a PC, a Selenium server can be deployed on the terminal device, and the electronic device can use the Selenium server to execute S301 to S306.

[0188] It should be noted that the execution order of each step in the above method embodiments is not limited to that shown in the attached figures, and the execution order of each step shall be subject to the actual application situation.

[0189] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0190] This invention utilizes an electronic device as a control center to first capture network traffic data between the application under test and the security gateway, then analyzes the network traffic data to determine the access interception rate of the security gateway to the application under test, and then uses the access interception rate to infer the effectiveness of all application features corresponding to the application under test in the application identification feature library. This saves the manpower and time costs of manual testing and improves testing efficiency.

[0191] For both mobile and PC terminals, this invention can use the Appium framework and the Selenium framework respectively to capture network traffic data, and then test the effectiveness of all application features corresponding to the tested application in the application identification feature library.

[0192] When the terminal device is a PC and the application under test has an official website, the present invention can also control the terminal device to access the official website of the application under test, and judge the validity of the application features of the application under test based on the access results.

[0193] In order to perform the corresponding steps in the above method embodiments and various possible implementations, an implementation of a test device for applying a recognition feature library is given below.

[0194] Please see Figure 7 , Figure 7A schematic diagram of the structure of a testing device for an application identification feature library provided in an embodiment of the present invention is shown. This testing device 400 is applied to an electronic device, which is communicatively connected to a security gateway and terminal devices connected to the security gateway. The security gateway has an application identification feature library installed, which includes application features of several applications. The testing device 400 includes: a traffic acquisition module 420 and a data analysis module 430.

[0195] The traffic acquisition module 420 is used to acquire network traffic data between the application under test on the terminal device and the security gateway; the network traffic data includes access data initiated by the application under test and response data returned by the security gateway; the security gateway is used to intercept the access data based on the application identification feature library.

[0196] The data analysis module 430 is used to: analyze the network traffic data to determine the access interception rate of the security gateway to the application under test; and use the access interception rate to test the effectiveness of all application features corresponding to the application under test in the application identification feature library.

[0197] Those skilled in the art will clearly understand that the test device 400 for applying the identification feature library may further include a traffic capture module 410 and an access control module 440. The traffic capture module 410 can be used to implement steps S101 to S103 and their sub-steps, and the access control module 440 can be used to implement steps S301 to S306 and their sub-steps. The traffic acquisition module 420 can be used to implement step S201, and the data analysis module 430 can specifically be used to implement steps S202 to S203 and their sub-steps. For ease of description and brevity, the specific working process of the test device 400 for applying the identification feature library described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0198] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. The electronic device 300 includes a processor 310, a memory 320, and a bus 330, with the processor 310 connected to the memory 320 via the bus 330.

[0199] The memory 320 can be used to store software programs, such as the software program corresponding to the application recognition feature library testing device 400 described above. The processor 310 executes various functional applications and data processing by running the software program stored in the memory 320 to implement the application recognition feature library testing method provided in the embodiments of the present invention.

[0200] The memory 320 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0201] The processor 310 can be an integrated circuit chip with signal processing capabilities. The processor 310 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0202] Understandable. Figure 8 The structure shown is for illustrative purposes only; the electronic device 300 may also include components that are more advanced than those shown. Figure 8 The more or fewer components shown, or having the same Figure 8 The different configurations shown. Figure 8 The components shown can be implemented using hardware, software, or a combination thereof.

[0203] In summary, this invention provides a testing method, apparatus, and electronic device for an application identification feature library. It acquires network traffic data between the application under test (AUT) and a security gateway on a terminal device. This network traffic data includes access data initiated by the AUT and response data returned by the security gateway, which then intercepts the access data based on the application identification feature library. The network traffic data is then analyzed to determine the security gateway's access interception rate for the AUT. Finally, the access interception rate can be used to test the effectiveness of all application features corresponding to the AUT in the application identification feature library. Compared to existing technologies, this electronic device can analyze network traffic data to automatically test the effectiveness of application features of the AUT in the application identification feature library, saving manpower and time costs associated with manual testing and improving testing efficiency.

[0204] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A testing method for applying a feature database, characterized in that, The device is applied to an electronic device, which is communicatively connected to a security gateway and terminal devices connected to the security gateway; the security gateway is equipped with an application identification feature library, which includes application features of several applications. When the terminal device is a mobile device, the method includes: The network traffic data between the application under test on the terminal device and the security gateway is obtained; the network traffic data includes access data initiated by the application under test and response data returned by the security gateway; the security gateway is used to intercept the access data based on the application identification feature library. The network traffic data is analyzed to determine the access interception rate of the security gateway for the tested application. Determine whether the access interception rate exceeds a set threshold; If the access interception rate exceeds the set threshold, then all application features corresponding to the tested application in the application identification feature library are deemed valid. If the access interception rate does not exceed the set threshold, then all application features corresponding to the tested application in the application identification feature library are determined to be invalid. When the terminal device is a PC, the method includes: Control the terminal device to open a browser, and control the terminal device to search for the application under test in the browser; Receive search result data returned by the terminal device; The official website URL of the tested application is obtained based on the search results data; Send an access instruction to the terminal device, the access instruction being used to instruct the terminal device to access the official website of the application under test based on the official website URL; The system receives the access result returned by the terminal device; if the access result is successful, it determines that all application features corresponding to the tested application in the application identification feature library are invalid; if the access result is unsuccessful, it determines that all application features corresponding to the tested application in the application identification feature library are valid. or, The network traffic data between the application under test on the terminal device and the security gateway is obtained; the network traffic data includes access data initiated by the application under test and response data returned by the security gateway; the security gateway is used to intercept the access data based on the application identification feature library. The network traffic data is analyzed to determine the access interception rate of the security gateway for the tested application. Determine whether the access interception rate exceeds a set threshold; If the access interception rate exceeds the set threshold, then all application features corresponding to the tested application in the application identification feature library are deemed valid. If the access interception rate does not exceed the set threshold, then all application features corresponding to the tested application in the application identification feature library are deemed invalid.

2. The method according to claim 1, characterized in that, The step of analyzing the network traffic data to determine the access interception rate of the security gateway for the tested application includes: The network traffic data is divided into multiple data streams based on the quintuple information; Filter out irrelevant data streams from all the data streams to obtain multiple relevant data streams; The number of response messages for each of the relevant data streams is counted to calculate the access interception rate of the security gateway for the tested application.

3. The method according to claim 2, characterized in that, The step of filtering irrelevant data streams from all the data streams to obtain multiple relevant data streams includes: For any of the data streams, each data packet of the data stream is parsed to obtain specific fields; If a specific field of the data packet in the data stream matches any one of the pre-stored preset fields, then the data stream is determined to be the irrelevant data stream. If no specific field of any of the data packets in the data stream matches any of the preset fields, then the data stream is determined to be the relevant data stream. Traverse each of the data streams to determine the relevant and irrelevant data streams in all the data streams; After removing all irrelevant data streams, multiple relevant data streams are obtained.

4. The method according to claim 2, characterized in that, The step of counting the number of response messages for each of the relevant data streams to calculate the access interception rate of the security gateway for the tested application includes: Get the total number of data streams; For any of the aforementioned related data streams, count the number of response messages for that related data stream; Protocol analysis is performed on the data packets in the relevant data stream to determine the data stream type of the relevant data stream; Based on the number of response messages and the data stream type, determine the interception result of the relevant data stream; Traverse each of the relevant data streams to obtain the interception result for each of the relevant data streams; The interception result is the total number of relevant data streams successfully intercepted; The ratio of the total number to the total number of data streams is calculated to obtain the access interception rate of the security gateway for the tested application.

5. The method according to claim 4, characterized in that, The interception result is either successful interception or unsuccessful interception. The step of determining the interception result of the relevant data stream by the security gateway based on the number of response messages and the data stream type includes: When the data stream type is TCP data stream and the number of response packets does not exceed the preset TCP response packet value, it is determined that the security gateway has successfully intercepted the relevant data stream; When the data stream type is TCP data stream and the number of response packets exceeds the preset TCP response packet value, it is determined that the security gateway has failed to intercept the relevant data stream. When the data stream type is UDP data stream and the number of response messages does not exceed the preset UDP response message value, it is determined that the security gateway has successfully intercepted the relevant data stream; When the data stream type is UDP data stream and the number of response messages exceeds the preset UDP response message value, it is determined that the security gateway has failed to intercept the relevant data stream.

6. The method according to any one of claims 1-5, characterized in that, Prior to the step of acquiring network traffic data between the application under test on the terminal device and the security gateway, the method further includes: Control the security gateway to download and install the application identification feature library; Send the network access interception policy of the application under test to the security gateway, so that the security gateway can intercept data based on the network access interception policy; Control the terminal device to access the network in order to obtain network traffic data between the application under test on the terminal device and the security gateway.

7. The method according to claim 6, characterized in that, The step of controlling the terminal device to access the network to obtain network traffic data between the application under test on the terminal device and the security gateway includes: Control the terminal device to launch the application under test; Send a simulated operation command to the terminal device and simultaneously start monitoring the network traffic of the terminal device; the simulated operation command is used to instruct the terminal device to perform data interaction with different interactive objects through the application under test within a set time period. After the set time period, an uninstallation command is sent to the terminal device to cause the terminal device to uninstall the application under test. Stop monitoring the network traffic of the terminal device and obtain the network traffic data between the application under test on the terminal device and the security gateway.

8. A testing device that applies a feature database for identification, characterized in that, It is applied to electronic devices, which are communicatively connected to a security gateway and terminal devices connected to the security gateway; the security gateway is equipped with an application identification feature library, which includes application features of several applications; When the terminal device is a mobile device, the apparatus includes: The traffic acquisition module is used to acquire network traffic data between the application under test on the terminal device and the security gateway; the network traffic data includes access data initiated by the application under test and response data returned by the security gateway; the security gateway is used to intercept the access data based on the application identification feature library; The data analysis module is used to: analyze the network traffic data to determine the access interception rate of the security gateway to the tested application; determine whether the access interception rate exceeds a set threshold; if the access interception rate exceeds the set threshold, determine that all application features corresponding to the tested application in the application identification feature library are valid; if the access interception rate does not exceed the set threshold, determine that all application features corresponding to the tested application in the application identification feature library are invalid. When the terminal device is a PC-based device, the apparatus includes: An access control module is configured to: control the terminal device to open a browser and search for the application under test in the browser; receive search result data returned by the terminal device; obtain the official website URL of the application under test based on the search result data; send an access instruction to the terminal device, the access instruction instructing the terminal device to access the official website of the application under test based on the official website URL; receive the access result returned by the terminal device; if the access result is successful, determine that all application features corresponding to the application under test in the application identification feature library are invalid; if the access result is unsuccessful, determine that all application features corresponding to the application under test in the application identification feature library are valid. Alternatively, the device may include: The traffic acquisition module is used to acquire network traffic data between the application under test on the terminal device and the security gateway; the network traffic data includes access data initiated by the application under test and response data returned by the security gateway; the security gateway is used to intercept the access data based on the application identification feature library. The data analysis module is used to: analyze the network traffic data to determine the access interception rate of the security gateway to the tested application; determine whether the access interception rate exceeds a set threshold; if the access interception rate exceeds the set threshold, determine that all application features corresponding to the tested application in the application identification feature library are valid; if the access interception rate does not exceed the set threshold, determine that all application features corresponding to the tested application in the application identification feature library are invalid.

9. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a software program, and the processor executes the software program when the electronic device is running to implement the test method for the application identification feature library as described in any one of claims 1-7.

Images