Method and device for detecting application feature aging, electronic device, and storage medium

Abstract

This invention discloses a method, apparatus, electronic device, and storage medium for detecting application feature aging, relating to application testing technology. The detection method includes: remotely controlling the application under test on a target terminal to generate application traffic for accessing a target service; acquiring a first data volume of application traffic generated by the application under test during a detection period; acquiring a second data volume obtained by a network security device identifying the application traffic generated by the application under test during the detection period based on a preset application feature library; determining the traffic detection rate of the application under test based on the first and second data volumes; and determining whether the features of the application under test in the application feature library are aging based on a comparison between the traffic detection rate and a preset threshold. This invention solves the technical problem in related technologies where application features are easily missed during detection, leading to low detection accuracy.

Description

Technical Field

[0001] This invention relates to the field of application testing technology, and more specifically, to a method and apparatus for detecting application characteristic aging, an electronic device, and a storage medium. Background Technology

[0002] With the continuous advancement of internet technology and the constant improvement of internet infrastructure, internet applications are showing trends of diversification, enrichment of content, and intelligent development. Therefore, deep packet inspection and deep stream inspection technologies are playing an increasingly important role in network security, content control, and network optimization. This has led to an increasing number of applications supported by application libraries, consequently increasing the workload of application feature maintenance and application version update testing. Given limited manpower and a huge number of applications, the cycle for each feature maintenance or update testing becomes extremely long, causing some application feature issues to go undetected and unfixed in a timely manner. Aging detection of application features is a way to reduce manpower investment and shorten the cycle of feature maintenance and update testing.

[0003] In related technologies, application feature aging detection typically involves setting up an Appium server framework (Appium is an automated open-source tool) on a GUIPC (i.e., a virtual machine or physical machine running Windows). Developers then control application behavior by writing complex scripts. Furthermore, the final determination of Windows application feature aging generally involves acquiring network traffic data between the application under test on the terminal device and the security gateway device. The security gateway then intercepts access data based on the application library. The network traffic data is then analyzed to determine the network traffic interception rate of the security gateway device for the application under test. Finally, the network traffic interception rate is used to determine whether the features of the application under test have aged.

[0004] However, each application under test initiates numerous sessions (accessing data), and there is also interference from the Windows system environment and unrelated application communication processes. Among these sessions, some are critical, some are unimportant, and many are useless. The amount of communication data between sessions also varies, and there are also correlations between sessions. Therefore, blocking one session may prevent multiple other sessions from being established and communicating. This is especially true for applications with very small amounts of communication data or few sessions, where the error is very large. As a result, when determining whether the features of the application under test are aging, a large number of features are easily missed, leading to low accuracy in application feature aging detection.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This invention provides a method, apparatus, electronic device, and storage medium for detecting application feature aging, in order to at least solve the technical problem in related technologies where application features are easily missed, resulting in low detection accuracy.

[0007] According to one aspect of the present invention, a method for detecting application feature aging is provided, comprising: remotely controlling an application under test on a target terminal to generate application traffic for accessing a target service; acquiring a first data volume of application traffic generated by the application under test during a detection period; acquiring a second data volume obtained by a network security device identifying the application traffic generated by the application under test during the detection period based on a preset application feature library; determining a traffic detection rate of the application under test based on the first data volume and the second data volume; and determining whether the features of the application under test in the application feature library are aged based on a comparison result of the traffic detection rate and a preset threshold.

[0008] Further, the process of remotely controlling the application under test on the target terminal to generate application traffic for accessing the target service includes: remotely controlling the target terminal to start a process packet capture program for the application under test, and controlling the target terminal to perform simulated behavior that generates the application traffic during the detection period; wherein, the process packet capture program is used to generate a process packet capture file for the application under test; obtaining the first data volume of application traffic generated by the application under test during the detection period includes: obtaining the process packet capture file for the application under test from the target terminal; and calculating the first data volume of application traffic generated by the application under test during the detection period based on the process packet capture file.

[0009] Furthermore, the application under test on the remotely controlled target terminal generates application traffic for accessing the target service, including: establishing a remote desktop connection between the executor and the remote desktop of the target terminal, wherein the executor is deployed with the Airtest open-source testing framework; based on the Airtest open-source testing framework, mapping the remote desktop of the target terminal to the executor, starting the application under test, and remotely controlling the application under test to generate application traffic for accessing the target service.

[0010] Furthermore, controlling the target terminal to perform simulated behaviors that generate the application traffic during the detection period includes: identifying multiple application images in a preset set of application images on the actuator to determine at least one target control object on the application under test, wherein the application image is a screenshot of the operation interface of the application under test; and remotely controlling the target terminal to sequentially perform simulated behaviors for each target control object on the application under test during the detection period to generate the application traffic.

[0011] Further, the first data volume is: the number of application traffic bytes obtained after deleting redundant data from the process packet capture file of the application under test; the second data volume is: the number of traffic bytes obtained by the network security device by matching multiple sessions contained in the application traffic with application features in the application feature library, and statistically analyzing the matching results; each session corresponds to one application feature of the application under test.

[0012] Furthermore, the remote control of the application under test on the target terminal to generate application traffic for accessing the target service includes: when the target terminal is a first terminal configured with a first operating system, the actuator remotely controls the application under test on the first terminal to generate application traffic for accessing the target service; or, when the target terminal is a second terminal configured with a second operating system connected to the first terminal, the actuator remotely controls the application under test on the second terminal through the first terminal to generate application traffic for accessing the target service.

[0013] Furthermore, where the target terminal is the first terminal and there are multiple first terminals, the actuator directly remotely controls the application under test on the target terminal to generate application traffic for accessing the target service, including: the actuator remotely controls the application under test on each of the first terminals to generate application traffic for accessing the target service in a parallel manner; wherein, the application under test on different first terminals is different, and the target service accessed by different application under test is different.

[0014] According to another aspect of the present invention, an application feature aging detection device is also provided, comprising: a control unit for remotely controlling a test application on a target terminal to generate application traffic for accessing a target service; a first acquisition unit for acquiring a first data volume of application traffic generated by the test application during a detection period; a second acquisition unit for acquiring a second data volume obtained by a network security device identifying the application traffic generated by the test application during the detection period based on a preset application feature library; a first determination unit for determining a traffic detection rate of the test application based on the first data volume and the second data volume; and a second determination unit for determining whether the features of the test application in the application feature library are aged based on a comparison result of the traffic detection rate and a preset threshold.

[0015] Further, the control unit includes: a first execution module, configured to remotely control the target terminal to start a process packet capture program for the application under test, and control the target terminal to perform simulated behavior that generates the application traffic during the detection period; wherein, the process packet capture program is used to generate a process packet capture file for the application under test; the first acquisition unit includes: a first acquisition module, configured to acquire the process packet capture file for the application under test from the target terminal; and a first statistics module, configured to calculate a first data volume of application traffic generated by the application under test during the detection period based on the process packet capture file.

[0016] Furthermore, the control unit includes: a first establishment module, used to establish a remote desktop connection between the executor and the remote desktop of the target terminal, wherein the executor is deployed with the Airtest open-source testing framework; and a first mapping module, used to map the remote desktop of the target terminal to the executor based on the Airtest open-source testing framework, start the application under test, and remotely control the application under test to generate application traffic for accessing the target service.

[0017] Further, the first execution module includes: a first identification submodule, used to identify multiple application images in a preset application image set on the executor to determine at least one target control object on the application under test, wherein the application image is a screenshot of the operation interface of the application under test; and a first execution submodule, used to remotely control the target terminal to sequentially execute simulated behaviors for each target control object on the application under test during the detection time period to generate the application traffic.

[0018] Further, the first data volume is: the number of application traffic bytes obtained after deleting redundant data from the process packet capture file of the application under test; the second data volume is: the number of traffic bytes obtained by the network security device by matching multiple sessions contained in the application traffic with application features in the application feature library, and statistically analyzing the matching results; each session corresponds to one application feature of the application under test.

[0019] Furthermore, the control unit includes: a first control module, configured to, when the target terminal is a first terminal configured with a first operating system, remotely control the application under test on the first terminal to generate application traffic for accessing the target service by an actuator; and a second control module, configured to, when the target terminal is a second terminal configured with a second operating system connected to the first terminal, remotely control the application under test on the second terminal via the first terminal to generate application traffic for accessing the target service by an actuator.

[0020] Furthermore, where the target terminal is the first terminal and there are multiple first terminals, the first control module is used to remotely control the application under test on each of the first terminals to generate application traffic for accessing the target service in a parallel manner by the actuator; wherein the applications under test on different first terminals are different, and the target services accessed by different applications under test are different.

[0021] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform any of the above-described application feature aging detection methods.

[0022] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described methods for detecting application feature aging.

[0023] In this invention, the application under test on the remote control target terminal generates application traffic for accessing the target service, obtains the first data volume of the application traffic generated by the application under test during the detection period, obtains the second data volume obtained by the network security device based on the preset application feature library to identify the application traffic generated by the application under test during the detection period, determines the traffic detection rate of the application under test based on the first data volume and the second data volume, and determines whether the features of the application under test in the application feature library are aging based on the comparison result of the traffic detection rate and the preset threshold.

[0024] In this invention, a single actuator can remotely control the application under test on a target terminal to detect application feature aging. By remotely controlling the application under test to generate application traffic, a first data volume of application traffic generated by the application under test during the detection period can be obtained. After the application traffic reaches the network security device, the network security device can identify the application traffic generated by the application under test during the detection period according to a preset application feature library, thereby obtaining a second data volume that the network security device can identify. Then, based on the first and second data volumes, the traffic detection rate of the application under test is calculated. By comparing the traffic detection rate with a preset threshold, it can be determined whether the features of the application under test are aging. Compared with the scheme of determining whether the features of the application under test are aging using network traffic interception rate, the method of using the network security device to identify the application traffic generated by the application under test according to the application feature library, and then using the obtained traffic detection rate to determine whether the features of the application under test are aging, can reduce the occurrence of missed feature detections and effectively improve the detection accuracy.

[0025] Therefore, the solution provided by this invention achieves the purpose of detecting application features, thereby reducing the missed detection rate of application features and improving the accuracy of application feature aging detection. It also solves the technical problem in related technologies where application features are easily missed, resulting in low detection accuracy. Attached Figure Description

[0026] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0027] Figure 1 This is a flowchart of an optional application feature aging detection method according to an embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram of an optional topology for detecting aging features in an application according to an embodiment of the present invention;

[0029] Figure 3 This is a schematic diagram of an optional application feature detection method based on a multi-system application scenario according to an embodiment of the present invention;

[0030] Figure 4 This is a schematic diagram of an optional application feature detection based on a multi-task application scenario according to an embodiment of the present invention;

[0031] Figure 5 This is a schematic diagram of an optional application feature aging detection process according to an embodiment of the present invention;

[0032] Figure 6 This is a schematic diagram of an optional simulated application automated file download process according to an embodiment of the present invention;

[0033] Figure 7 This is a schematic diagram of an optional application feature aging detection device according to an embodiment of the present invention;

[0034] Figure 8 This is a hardware structure block diagram of an electronic device for applying a feature aging detection method according to an embodiment of the present invention. Detailed Implementation

[0035] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0037] It should be noted that all related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and it does not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0038] For application feature aging detection solutions in related technologies, the number of applications to be tested is very large. Each application needs to be uninstalled after testing, otherwise the GUIPC cannot handle such a large number of applications. The speed of application installation and uninstallation also depends on hardware resources, resulting in a long testing time for all applications each time. At the same time, since Windows applications are developed based on different frameworks of different programming languages, problems such as dynamic changes of UI (User Interface) elements and non-standard controls will be encountered during the testing process. Furthermore, the use of Appium needs to be considered, so the technical requirements for development and maintenance personnel are relatively high.

[0039] This invention, by installing a modified automated Airtest open-source testing framework (an open-source GUI (Graphical User Interface) automated testing framework based on image and control recognition, supporting systems such as Windows, Android, and iOS) on an executor, enables the remote desktop of a target terminal (e.g., a GUIPC) to be mapped to the local executor. Then, application feature aging detection is performed through image recognition. Therefore, only one set of the Airtest open-source testing framework needs to be installed on the executor, and the testing time for all applications can be shortened by deploying multiple target terminals. This not only simplifies the environment deployment process and reduces human error and environmental problems, but also facilitates maintenance and management. Furthermore, for developers and maintainers, the image recognition technology of the Airtest open-source testing framework allows for application screenshots instead of code writing, enabling interaction with the application, simulation of application behavior, and automated operation of the application's graphical interface. This not only reduces the workload of code development but also lowers the technical threshold for code development, thereby saving development time and costs.

[0040] Furthermore, in this invention, by remotely controlling the target terminal on the local executor to enable process packet capture of the application under test (capturing only the communication data of the application under test), and counting the number of communication bytes of the application under test, and then counting the number of bytes of the application under test detected by the application detection engine on the network security device (e.g., firewall), the detection rate of the communication data of the application under test can be calculated. This allows for an accurate determination of whether the features of the application under test are aging, eliminating interference from irrelevant communication data, thereby reducing the missed detection rate of a large number of related application features.

[0041] The present invention will now be described in detail with reference to various embodiments.

[0042] Example 1

[0043] According to an embodiment of the present invention, an embodiment of a detection method for application feature aging is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0044] Figure 1 This is a flowchart of an optional application feature aging detection method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0045] Step S101: The application under test on the remote control target terminal generates application traffic for accessing the target service.

[0046] Step S102: Obtain the first data volume of application traffic generated by the application under test during the detection period.

[0047] Step S103: Obtain the second data volume obtained by the network security device identifying the application traffic generated by the tested application within the detection time period based on a preset application feature library.

[0048] Step S104: Determine the traffic detection rate of the application under test based on the first data volume and the second data volume.

[0049] Step S105: Based on the comparison result between the traffic detection rate and the preset threshold, determine whether the features of the tested application in the application feature library are aged.

[0050] Here, the target terminal can be a Windows terminal, Android or iOS terminal with the application under test installed. For example, it can be a test terminal with a GUI interface, which can be used for application feature aging test.

[0051] In this embodiment, the detection method for applied feature aging can be executed by an actuator, which can communicate with the target terminal and a network security device between the target terminal and the server. This actuator can be a terminal using a Linux system.

[0052] In this embodiment, the network security device can be a firewall or other device capable of detecting application traffic. The firewall can be a FW (Firewall) or WAF (Web Application Firewall), etc.

[0053] In this embodiment of the invention, a test application on a target terminal can be remotely controlled by an actuator to detect application feature aging. By remotely controlling the test application to generate application traffic, a first data volume of application traffic generated by the test application during the detection period can be obtained. After the application traffic reaches the network security device, the network security device can identify the application traffic generated by the test application during the detection period according to a preset application feature library, thereby obtaining a second data volume that the network security device can identify. Then, based on the first and second data volumes, the traffic detection rate of the test application is calculated. By comparing the traffic detection rate with a preset threshold, it can be determined whether the features of the test application are aging. Compared with the scheme of determining whether the features of the test application are aging using network flow interception rate, the method of using the network security device to identify the application traffic generated by the test application according to the application feature library, and then using the obtained traffic detection rate to determine whether the features of the test application are aging, can reduce the occurrence of missed feature detections and effectively improve the detection accuracy. This solves the technical problem in related technologies where application features are easily missed, resulting in low detection accuracy.

[0054] The embodiments of the present invention will now be described in detail with reference to the steps described above.

[0055] In this embodiment of the invention, a method is proposed to use the Airtest open-source testing framework under the executor to detect application feature aging. By modifying the Airtest open-source testing framework, the remote desktop of the target terminal can be mapped to the local executor. Then, the image recognition technology of the Airtest open-source testing framework is used to perform automated detection of application feature aging in group control applications.

[0056] Figure 2 This is a schematic diagram of an optional topology for detecting aging features in an application according to an embodiment of the present invention, such as... Figure 2As shown, the setup includes: a GUIPC (target terminal), an executor, a Windows PC, and a firewall (network security device). The GUIPC can be a Windows terminal with the tested application and process capture program installed, and remote desktop service enabled. Application traffic generated by the tested application's behavior is detected by the firewall's application identification engine before accessing the internet (target service). The executor can be a Linux terminal supporting multi-tasking, with the main task program and the Airtest open-source testing framework installed. Testers log in to the executor on the Windows PC using the MobaXterm tool (a client supporting the X11 protocol, i.e., the X Window System Protocol) to execute the main task program. The main task program first performs initial configuration of the GUIPC and firewall via SSH (Secure Shell, a network protocol for secure remote login), then accesses the GUIPC's remote desktop via Rdesktop (a network tool for accessing Windows remote desktops under Linux), and operates the GUIPC's remote desktop connected to Rdesktop through the Airtest open-source testing framework interface.

[0057] In some optional embodiments, the network on the target terminal and the network on the network security device can be configured first, wherein the application under test and the process packet capture program are installed on the target terminal; the latest application library (i.e., the preset application feature library) is loaded on the network security device, and the application under test statistics function on the network security device is enabled, wherein the latest application library includes: the latest features of each application, and the application under test statistics function is used to count the number of valid data bytes.

[0058] In this embodiment of the invention, before performing application feature aging detection, it is necessary to initialize the target terminal and network security device. For example, it is necessary to configure the network of the target terminal and the network security device to establish a network connection between the target terminal and the network security device. The network security device stores the application feature library most recently obtained from the protection center. The application feature library includes the features of each application. The application feature library can be actively sent to the network device by the protection center when there is an update of the application features, or it can be obtained by the network device from the protection center periodically. The network security device has a test application statistics function. This statistics function is used by the network security device to count the number of effective data bytes of application traffic (i.e., the second data volume, which can reflect the number of traffic sessions that the network security device can identify).

[0059] In some alternative embodiments, the target terminal may be a terminal with a Windows system installed, or a physical machine or virtual machine with other operating systems installed. The target terminal has the application under test and a process packet capture program installed, so as to capture the traffic sessions generated by the behavior of the application under test through the process packet capture program.

[0060] In some alternative embodiments, the executor may be a Linux system machine capable of supporting multitasking, and equipped with a task master program and a modified Airtest open-source testing framework.

[0061] In this embodiment, by modifying the Airtest open-source testing framework, the remote desktop of the target terminal can be mapped to the local executor. This allows feature detection of a large number of applications to be achieved by installing only one Airtest open-source testing framework on the executor, thereby improving retrieval efficiency.

[0062] Step S101: The application under test on the remote control target terminal generates application traffic for accessing the target service.

[0063] In step S101, the actuator can remotely control the application under test on the target terminal to generate application traffic for accessing the target service. That is, the image recognition technology of the Airtest open-source testing framework on the actuator is used to locate and control the control objects of the application under test to automate the operation of various behaviors of the application (e.g., clicking, creating, etc.) and simulate real application traffic.

[0064] Step S102: Obtain the first data volume of application traffic generated by the application under test during the detection period.

[0065] In step S102, the detection time period can be determined based on the analysis of the historical usage of each application under test. When the simulation duration reaches the detection duration, it indicates that the simulated application behavior has generated enough real application traffic. The simulation operation can be terminated, the packet capture process can be terminated, and the application and its related background processes can be closed. This will result in the process packet capture file of the application under test, and the first data volume of application traffic generated by the application under test can be calculated based on the process packet capture file.

[0066] Optionally, remotely controlling the application under test on the target terminal to generate application traffic for accessing the target service includes: remotely controlling the target terminal to start a process packet capture program for the application under test, and controlling the target terminal to perform simulated behavior of generating application traffic during the detection period; wherein, the process packet capture program is used to generate a process packet capture file for the application under test; obtaining the first data volume of application traffic generated by the application under test during the detection period includes: obtaining the process packet capture file for the application under test from the target terminal; and calculating the first data volume of application traffic generated by the application under test during the detection period based on the process packet capture file.

[0067] In this embodiment of the invention, the target terminal can be remotely controlled by the actuator to start a process packet capture program for the application under test. The process packet capture program is used to generate a process packet capture file for the application under test at the end of the detection period, so that the first data volume can be counted according to the process packet capture file, and the target terminal can be controlled to perform simulated behavior that generates application traffic during the detection period.

[0068] In some optional embodiments, when the target terminal is a terminal with a Windows system installed (e.g., a GUIPC), the actuator can directly and remotely control the terminal; when the target terminal is a terminal with an Android system installed or an iOS system installed, the actuator can indirectly control the terminal with an Android system installed or an iOS system installed by controlling the terminal with a Windows system installed. The terminal with an Android system installed or an iOS system installed is connected to the terminal with a Windows system installed.

[0069] For example, an actuator can be used to remotely control a target terminal to perform simulated behaviors against the application under test, thereby causing the application under test to generate application traffic.

[0070] In this embodiment of the invention, a process packet capture file for the application under test can be obtained from the target terminal, and then the first data volume of application traffic generated by the application under test during the detection period can be counted based on the process packet capture file.

[0071] Optionally, remotely controlling the application under test on the target terminal to generate application traffic for accessing the target service includes: establishing a remote desktop connection between the executor and the remote desktop of the target terminal, wherein the executor is equipped with the Airtest open-source testing framework; based on the Airtest open-source testing framework, mapping the remote desktop of the target terminal to the executor, starting the application under test, and remotely controlling the application under test to generate application traffic for accessing the target service.

[0072] In this embodiment of the invention, a remote desktop connection can be established between the executor and the remote desktop of the target terminal. The executor is equipped with the Airtest open-source testing framework. Based on the Airtest open-source testing framework, the remote desktop of the target terminal is mapped to the executor, the application under test is started, and the application under test is remotely controlled based on the remote desktop connection. The behavior of the application under test is simulated using the Airtest open-source testing framework, thereby generating application traffic for accessing the target service.

[0073] In some alternative embodiments, a remote desktop on the target terminal can be opened first. Then, the main task program on the executor is executed on the test terminal (e.g., a Windows PC). This allows the main task program to access the remote desktop on the target terminal via a remote access tool (e.g., Rdesktop) and operate the remote desktop connected to the remote access tool through the interface of the Airtest open-source testing framework (e.g., the Airtest framework) deployed on the executor (i.e., establishing a remote desktop connection between the executor and the remote desktop). Subsequently, based on the remote desktop connection, the application under test can be launched, and the image recognition technology of the Airtest open-source testing framework can be used to locate and control the application's control objects to automate various application behaviors and simulate real application traffic (i.e., simulating the behavior of the application under test based on the Airtest open-source testing framework).

[0074] Optionally, controlling the target terminal to perform simulated behaviors that generate application traffic during the detection period includes: identifying multiple application images in a preset set of application images on the actuator to determine at least one target control object on the application under test, wherein the application image is a screenshot of the operation interface of the application under test; and remotely controlling the target terminal to sequentially perform simulated behaviors for each target control object on the application under test during the detection period to generate application traffic.

[0075] In this embodiment of the invention, a set of application images of the application under test can first be transmitted to the executor. This set of application images includes multiple application images, each of which is a screenshot taken when the application under test is operated (i.e., the application image is a screenshot of the operation interface of the application under test), such as screenshots of pop-up windows, new download links, or item pickup. Then, the image recognition technology of the Airtest open-source testing framework is used to recognize the multiple application images, such as identifying the position of each control object. Based on the recognition results, the control objects on the application under test are located and controlled to automate the operation of various application behaviors and simulate real application traffic (i.e., the executor recognizes multiple application images in the preset set of application images, determines at least one target control object on the application under test, and remotely controls the target terminal to sequentially execute simulated behaviors for each target control object on the application under test during the detection period to generate application traffic). In this way, by using the image recognition technology of the Airtest open-source testing framework, multiple application screenshots can replace writing code, realizing application interaction, application behavior simulation, and automated operation of the application's graphical interface, which can reduce the workload of code development and lower the technical threshold for code development, thereby saving development time and costs.

[0076] In this embodiment of the invention, after the application traffic generated by the application under test reaches the network security device, the application traffic can be identified by the application identification engine of the network security device based on a preset application feature library. According to the identification result, the number of effective data bytes of the application under test (i.e., the second data volume, which is the number of traffic session bytes that can be identified) is counted by the application statistics function of the application under test on the network security device. The application traffic identified by the application identification engine of the network security device can be accessed to the Internet.

[0077] Step S103: Obtain the second data volume obtained by the network security device identifying the application traffic generated by the tested application within the detection time period based on a preset application feature library.

[0078] In step S103, the preset application feature library records the latest features of each application. The network security device can identify the application traffic generated by the application under test during the detection period based on the latest features of the application under test, so as to obtain the identified second data volume.

[0079] Optionally, the first data volume is the number of application traffic bytes obtained after deleting redundant data from the process packet capture file of the application under test; the second data volume is the number of traffic bytes obtained by the network security device matching multiple sessions contained in the application traffic with application features in the application feature library, and statistically analyzing the matching results; each session corresponds to one application feature of the application under test.

[0080] In this embodiment of the invention, the first data volume is the number of application traffic bytes obtained after deleting redundant data from the process packet capture file of the application under test. This redundant data is unimportant and irrelevant data determined based on the historical traffic data of the application under test. For example, unimportant and irrelevant redundant data, such as DNS (Domain Name System) and promotional data, are filtered out based on the historical traffic data of the application under test during its historical usage.

[0081] In this embodiment of the invention, the second data volume is the number of bytes of traffic obtained by the network security device by matching multiple sessions (each session corresponds to an application feature of the tested application) contained in the application traffic with application features in the application feature library and by counting the matching results.

[0082] In some optional embodiments, application traffic can be identified using the application recognition engine on the network security device based on the latest application library (i.e., the preset application feature library) loaded on the network security device. The application traffic includes multiple sessions, and each session corresponds to a current feature of the application under test (e.g., download feature, creation feature, etc., which will change as the application functions are continuously updated). If the current session cannot be detected (i.e., matched) by any of the latest features in the latest application feature library, it indicates that the function of the application under test has been updated, and the application feature of the application under test in the application feature library has become outdated, thus making it impossible for the network security device to identify the session corresponding to the current feature. If the current session can be detected (i.e. matched) by any of the latest features in the latest application feature library, the application feature of the application under test in the application feature library has not become outdated, indicating that the current feature is still in use in the application under test. The network security device can identify the session corresponding to the current feature and record the identified session in the identification result so that the application under test statistics function can count the number of effective data bytes of the application under test (i.e., the number of identified session bytes) based on the identification result.

[0083] Step S104: Determine the traffic detection rate of the application under test based on the first data volume and the second data volume.

[0084] In this embodiment of the invention, a method for determining the aging of application features based on the detection rate of application communication data is proposed. The method obtains the accurate amount of communication data of the application under test by capturing process packets, and then calculates the detection rate that can be identified as the application under test by the application detection engine on the network security device, so as to determine whether the features of the application under test have an aging problem.

[0085] In step S104, the detection rate DR of the tested application can be calculated as (N / M)*100% based on the first data volume M of the tested application on the target terminal and the second data volume N (i.e. the number of application data bytes detected by the application identification engine based on the application library) counted by the statistical function of the tested application on the network security device.

[0086] Step S105: Based on the comparison result between the traffic detection rate and the preset threshold, determine whether the features of the tested application in the application feature library are aged.

[0087] For example, if the comparison result indicates that the traffic detection rate is less than a preset threshold, it is determined that the features of the tested application in the application feature library are aged; or, if the comparison result indicates that the traffic detection rate is greater than or equal to the preset threshold, it is determined that the features of the tested application in the application feature library are not aged.

[0088] In this embodiment of the invention, a preset threshold can be determined based on the specific analysis results of each tested application. For example, if the calculated DR is less than 90%, it can be considered that the current tested application features are aging. That is, when the traffic detection rate is less than the preset threshold, it is determined that the features of the tested application in the application feature library are in an aging state.

[0089] Optionally, remotely controlling the application under test on the target terminal to generate application traffic for accessing the target service includes: when the target terminal is a first terminal configured with a first operating system, the actuator remotely controls the application under test on the first terminal to generate application traffic for accessing the target service; or, when the target terminal is a second terminal configured with a second operating system connected to the first terminal, the actuator remotely controls the application under test on the second terminal through the first terminal to generate application traffic for accessing the target service.

[0090] In this embodiment of the invention, the first operating system is a Windows system, and the second operating system is an Android or iOS system. If the target terminal is a first terminal configured with the first operating system (e.g., a GUIPC), the executor can remotely control the application under test on the first terminal to generate application traffic for accessing the target service. If the target terminal is a second terminal connected to the first terminal and configured with the second operating system (e.g., an Android platform device or an iOS platform device), the executor can remotely control the application under test on the second terminal through the first terminal to generate application traffic for accessing the target service.

[0091] Figure 3 This is a schematic diagram of an optional application feature detection method based on a multi-system application scenario according to an embodiment of the present invention, such as... Figure 3As shown, the setup includes: a GUIPC, an executor, a Windows PC, and a firewall. The GUIPC has the application under test and a process capture program installed, and its remote desktop service is enabled. It can connect to Android and iOS devices via a data cable. The Android and iOS devices also have the application under test installed. Application traffic generated by the application behavior of the application under test on the Android and iOS devices can be transmitted to the firewall via Wi-Fi / Ethernet. Application traffic generated by the application behavior of the application under test on the GUIPC can be directly transmitted to the firewall, and then accessed by the firewall's application identification engine. The executor has the main task program and the Airtest open-source testing framework installed. Testers log in to the executor on the Windows PC using the MobaXterm tool to execute the main task program. The main task program first performs initial configuration of the GUIPC and firewall via SSH, then accesses the remote desktop of the GUIPC through Rdesktop, and operates the remote desktop of the GUIPC connected to Rdesktop through the Airtest open-source testing framework interface.

[0092] like Figure 3 As shown, by connecting at least one of Android and iOS platform devices via a data cable, it is possible not only to verify feature aging issues of Windows applications on the GUIPC, but also to extend the verification to Android and iOS platform applications. In some optional embodiments, the AirtestIDE tool (i.e., an automated test editor with a built-in Airtest and Python environment) needs to be installed on the GUIPC. Scripts are executed through AirtestIDE to drive and control Android and iOS applications. Therefore, the script development work for simulating application behavior can be migrated to AirtestIDE for development and execution.

[0093] Optionally, when the target terminal is a first terminal and there are multiple first terminals, the actuator directly remotely controls the application under test on the target terminal to generate application traffic for accessing the target service, including: the actuator remotely controls the application under test on each first terminal to generate application traffic for accessing the target service in a parallel manner; wherein the application under test on different first terminals is different, and the target service accessed by different application under test is different.

[0094] In this embodiment of the invention, when the target terminal is a first terminal using a Windows system, and there are multiple first terminals, the executor can adopt a parallel approach to remotely control the application under test on each first terminal to generate application traffic for accessing the target service. In this embodiment, the applications under test on different first terminals are different, and the target services accessed by different applications under test are different.

[0095] Figure 4 This is a schematic diagram of an optional application feature detection method based on a multi-task application scenario according to an embodiment of the present invention, such as... Figure 4 As shown, the setup includes: multiple GUIPCs (e.g., GUIPC-1, GUIPC-2, GUIPC-3, ..., GUIPC-N, etc.), an executor, a Windows PC, and a firewall. Each GUIPC has the application under test and a packet capture program installed, and remote desktop services are enabled. Application traffic generated by the application behavior of the application under test is detected by the firewall's application identification engine before accessing the internet. The executor supports multi-tasking (i.e., multiple GUIPCs running in parallel) and has a main task program and the Airtest open-source testing framework installed. Testers log in to the executor on the Windows PC using the MobaXterm tool to execute the main task program. The main task program first performs initial configuration for multiple GUIPCs and the firewall via SSH, then accesses the remote desktops of multiple GUIPCs through Rdesktop, and operates the remote desktops of the GUIPCs connected to Rdesktop through the Airtest open-source testing framework interface.

[0096] In this embodiment, for application scenarios where the time from installation and update to testing is long and the number of applications under test is large, deploying N GUIPCs to distribute and control the verification of all applications can avoid building an Appium server framework on each GUIPC and eliminate the need to uninstall each application after testing. This simplifies the environment deployment process, reduces the error rate, makes the verification process easier to maintain and manage, and shortens the verification time for all applications.

[0097] The following uses application A as an example to illustrate the application feature aging detection scenario.

[0098] Figure 5 This is a schematic diagram of an optional application feature aging detection process according to an embodiment of the present invention, such as... Figure 5As shown, initially, the GUIPC network is configured. If the configuration fails, a test report is generated directly. If the configuration succeeds, the FW (firewall) network is configured. If the configuration fails, a test report is generated directly. If the configuration succeeds, an application status check is performed. If the check fails, a test report is generated directly. If the check succeeds, the application upgrade process is processed. If the upgrade process fails, a test report is generated directly. Otherwise, application statistics monitoring is enabled. If enabled, a test report is generated directly. If enabled, packet capture of the GUIPC process is enabled. If enabled, a test report is generated directly. If enabled, application A's behavior is simulated to access the internet. If the simulation fails, a test report is generated directly. If the simulation succeeds, the detection rate of application A is calculated. If the calculation fails, a test report is generated directly. If the calculation succeeds, it is determined whether application A's features are aging. If not, a test report is generated based on the result that application A's features are not aging. If yes, a test report is generated based on the result that application A's features are aging. Then, the report is sent, and the process ends.

[0099] Figure 5 The application status check in the test is used to check the software status of the application under test, including: startup (indicating that the latest version of the application under test has been installed), installation (indicating that the application under test needs to be installed), and update (indicating that the application under test has been installed and needs to be upgraded).

[0100] Figure 5 The application upgrade process handles the software status (installation, update) of the two types of applications being tested, and the process depends on the installation and update process of each specific application.

[0101] Figure 5 The simulated application behavior in the test involves developing specific scripts based on each behavior or sub-behavior of the tested application to simulate real application behavior traffic, such as file download, account login, and file upload.

[0102] Figure 6 This is a schematic diagram of an optional simulated application automated file download behavior flow according to an embodiment of the present invention, such as... Figure 6 As shown, first launch application A, perform pop-up window processing (including: create a new download link, enter the download link, click download), create N new download links, delete the downloaded files, and exit application A.

[0103] The application feature aging detection method proposed in this embodiment can be applied in complex, multi-tasking, scalable network testing environments, and can also dynamically adjust the scale of the system technical solution and the verifiable application types, such as web applications, Android applications, and iOS applications.

[0104] In this embodiment of the invention, the Airtest open-source testing framework under the executor is used for application feature aging verification, which simplifies the deployment process of the verification environment, reduces the error rate, makes the verification process easier to maintain and manage, and shortens the application verification time. Furthermore, the image recognition technology using the Airtest open-source testing framework lowers the technical threshold requirements for application script developers and maintainers. In addition, determining whether application features are aging by calculating the detection rate of application communication data volume improves the accuracy of judging application feature aging and reduces the false negative rate of application feature aging.

[0105] The technical solutions in the embodiments of the present invention can not only be used for the verification of application feature aging, but also for the verification of other network traffic feature aging in the field of network traffic detection technology, such as transport layer feature libraries, HTTP (HyperText Transfer Protocol) / DNS / TLS (Transport Layer Security) feature libraries, time series feature libraries, behavioral feature libraries, model feature libraries, etc.

[0106] Example 2

[0107] The application feature aging detection device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0108] Figure 7 This is a schematic diagram of an optional application feature aging detection device according to an embodiment of the present invention, such as... Figure 7 As shown, the detection device may include: a control unit 70, a first acquisition unit 71, a second acquisition unit 72, a first determination unit 73, and a second determination unit 74.

[0109] Among them, the control unit 70 is used to remotely control the application under test on the target terminal to generate application traffic for accessing the target service;

[0110] The first acquisition unit 71 is used to acquire the first data volume of application traffic generated by the application under test during the detection period.

[0111] The second acquisition unit 72 is used to acquire the second data volume obtained by the network security device based on the application traffic generated by the application under test during the detection period according to the preset application feature library.

[0112] The first determining unit 73 is used to determine the traffic detection rate of the application under test based on the first data volume and the second data volume.

[0113] The second determining unit 74 is used to determine whether the features of the tested application in the application feature library are aged based on the comparison result between the traffic detection rate and the preset threshold.

[0114] The aforementioned detection device can remotely control the application under test on the target terminal to generate application traffic for accessing the target service through the control unit 70. The first acquisition unit 71 acquires the first data volume of the application traffic generated by the application under test during the detection period. The second acquisition unit 72 acquires the second data volume obtained by the network security device based on the application traffic generated by the application under test during the detection period according to the preset application feature library. The first determination unit 73 determines the traffic detection rate of the application under test based on the first and second data volumes. The second determination unit 74 determines whether the features of the application under test in the application feature library are aging based on the comparison result of the traffic detection rate and the preset threshold. This solves the technical problem in related technologies where application features are easily missed during detection, resulting in low detection accuracy.

[0115] Optionally, the control unit includes: a first execution module, configured to remotely control the target terminal to start a process packet capture program for the application under test, and control the target terminal to perform simulated behavior that generates application traffic during the detection period; wherein, the process packet capture program is used to generate a process packet capture file for the application under test; the first acquisition unit includes: a first acquisition module, configured to acquire the process packet capture file for the application under test from the target terminal; and a first statistics module, configured to calculate the first data volume of application traffic generated by the application under test during the detection period based on the process packet capture file.

[0116] Optionally, the control unit includes: a first establishment module for establishing a remote desktop connection between the executor and the remote desktop of the target terminal, wherein the executor is equipped with the Airtest open-source testing framework; and a first mapping module for mapping the remote desktop of the target terminal to the executor based on the Airtest open-source testing framework, starting the application under test, and remotely controlling the application under test to generate application traffic for accessing the target service.

[0117] Optionally, the first execution module includes: a first identification submodule, used to identify multiple application images in a preset set of application images on the executor to determine at least one target control object on the application under test, wherein the application image is a screenshot of the operation interface of the application under test; and a first execution submodule, used to remotely control the target terminal to sequentially execute simulated behaviors for each target control object on the application under test during the detection time period to generate application traffic.

[0118] Optionally, the first data volume is the number of application traffic bytes obtained after deleting redundant data from the process packet capture file of the application under test; the second data volume is the number of traffic bytes obtained by the network security device matching multiple sessions contained in the application traffic with application features in the application feature library, and statistically analyzing the matching results; each session corresponds to one application feature of the application under test.

[0119] Optionally, the control unit includes: a first control module, configured to, when the target terminal is a first terminal configured with a first operating system, remotely control the application under test on the first terminal to generate application traffic for accessing the target service by an actuator; and a second control module, configured to, when the target terminal is a second terminal configured with a second operating system connected to the first terminal, remotely control the application under test on the second terminal via the first terminal to generate application traffic for accessing the target service by an actuator.

[0120] Optionally, where the target terminal is a first terminal and there are multiple first terminals, the first control module is used to remotely control the application under test on each first terminal to generate application traffic for accessing the target service in a parallel manner by the actuator; wherein the application under test on different first terminals is different, and the target service accessed by different application under test is different.

[0121] The aforementioned detection device may also include a processor and a memory. The aforementioned control unit 70, first acquisition unit 71, second acquisition unit 72, first determination unit 73, second determination unit 74, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0122] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, the aging of the features of the tested application in the application feature library can be determined based on a comparison between the traffic detection rate and a preset threshold.

[0123] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0124] The present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: remotely controlling the application under test on the target terminal to generate application traffic for accessing the target service; acquiring a first data volume of application traffic generated by the application under test during the detection period; acquiring a second data volume obtained by a network security device identifying the application traffic generated by the application under test during the detection period based on a preset application feature library; determining the traffic detection rate of the application under test based on the first data volume and the second data volume; and determining whether the features of the application under test in the application feature library are aged based on the comparison result of the traffic detection rate and a preset threshold.

[0125] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to perform the above-described application feature aging detection method.

[0126] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the above-described method for detecting application feature aging.

[0127] Figure 8 This is a hardware structure block diagram of an electronic device for applying a feature aging detection method according to an embodiment of the present invention. Figure 8 As shown, an electronic device may include one or more processors (e.g., Figure 8 The processors 802a, 802b, ..., 802n, etc., may include, but are not limited to, processing devices such as microprocessors (MCUs) or programmable logic devices (FPGAs), and a memory 804 for storing data. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 8 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 8 The more or fewer components shown, or having the same Figure 8 The different configurations shown.

[0128] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0129] The embodiments or examples disclosed herein are not exhaustive, but merely illustrative of some embodiments or examples, and are not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment or example can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment or example can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment or example can be arbitrarily interchanged. Furthermore, optional methods or examples in a particular embodiment or example can be arbitrarily combined; moreover, embodiments or examples can be arbitrarily combined. For example, some or all steps of different embodiments or examples can be arbitrarily combined, and a particular embodiment or example can be arbitrarily combined with optional methods or examples of other embodiments or examples.

[0130] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0131] In the several embodiments provided by this invention, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection can be through some interfaces; the indirect coupling or communication connection of units or modules can be electrical or other forms.

[0132] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0133] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0134] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0135] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting aging characteristics, characterized in that, include: The application under test on the target terminal is remotely controlled to generate application traffic for accessing the target service; Obtain the first data volume of application traffic generated by the tested application during the detection period; The second data volume is obtained by the network security device identifying the application traffic generated by the tested application within the detection time period based on a preset application feature library; The traffic detection rate of the tested application is determined based on the first data volume and the second data volume. Based on the comparison result between the traffic detection rate and the preset threshold, it is determined whether the features of the tested application in the application feature library are outdated; The application under test on the remotely controlled target terminal generates application traffic for accessing the target service, including: The target terminal is remotely controlled to start a process packet capture program for the application under test, and the target terminal is controlled to perform simulated behavior that generates application traffic during the detection period; wherein, the process packet capture program is used to generate process packet capture files for the application under test; The first data volume of application traffic generated by the tested application during the detection period includes: Obtain process packet capture files for the application under test from the target terminal; Based on the process packet capture file, calculate the first data volume of application traffic generated by the tested application during the detection time period; Controlling the target terminal to perform simulated behavior that generates the application traffic during the detection time period includes: The actuator identifies multiple application images from a preset set of application images to determine at least one target control object on the application under test, wherein the application image is a screenshot of the operation interface of the application under test. During the detection period, the target terminal is remotely controlled to sequentially execute simulated behaviors for each target control object on the application under test in order to generate the application traffic.

2. The detection method according to claim 1, characterized in that, The application under test on the remotely controlled target terminal generates application traffic for accessing the target service, including: A remote desktop connection is established between the executor and the remote desktop of the target terminal, wherein the executor is deployed with the Airtest open-source testing framework; Based on the Airtest open-source testing framework, the remote desktop of the target terminal is mapped to the executor, the application under test is started, and the application under test is remotely controlled to generate application traffic for accessing the target service.

3. The detection method according to claim 1, characterized in that, The first data volume is the number of application traffic bytes obtained after deleting redundant data from the process packet capture file of the application under test; the second data volume is the number of traffic bytes obtained by the network security device by matching multiple sessions contained in the application traffic with application features in the application feature library, and statistically analyzing the matching results; each session corresponds to one application feature of the application under test.

4. The detection method according to any one of claims 1 to 3, characterized in that, The application under test on the remotely controlled target terminal generates application traffic for accessing the target service, including: When the target terminal is a first terminal configured with a first operating system, the actuator remotely controls the application under test on the first terminal to generate application traffic for accessing the target service; or... When the target terminal is a second terminal connected to the first terminal and equipped with a second operating system, the actuator remotely controls the application under test on the second terminal through the first terminal to generate application traffic for accessing the target service.

5. The detection method according to claim 4, characterized in that, The target terminal is the first terminal, and there are multiple first terminals. The actuator directly and remotely controls the application under test on the target terminal to generate application traffic for accessing the target service, including: The actuator remotely controls the application under test on each of the first terminals to generate application traffic for accessing the target service in a parallel manner; wherein, the applications under test on different first terminals are different, and the target services accessed by different applications under test are different.

6. A detection device for application characteristic aging, characterized in that, include: The control unit is used to remotely control the application under test on the target terminal to generate application traffic for accessing the target service. The first acquisition unit is used to acquire the first data volume of application traffic generated by the application under test during the detection time period; The second acquisition unit is used to acquire the second data volume obtained by the network security device based on the application traffic generated by the tested application within the detection time period by the preset application feature library. The first determining unit is configured to determine the traffic detection rate of the application under test based on the first data volume and the second data volume. The second determining unit is used to determine whether the features of the tested application in the application feature library are aged based on the comparison result of the traffic detection rate and the preset threshold. The control unit includes: a first execution module, used to remotely control the target terminal to start a process packet capture program for the application under test, and to control the target terminal to perform simulated behavior that generates application traffic during the detection period; wherein, the process packet capture program is used to generate a process packet capture file for the application under test; the first acquisition unit includes: a first acquisition module, used to acquire the process packet capture file for the application under test from the target terminal; and a first statistics module, used to calculate the first data volume of application traffic generated by the application under test during the detection period based on the process packet capture file; The first execution module includes: a first identification submodule, used to identify multiple application images in a preset set of application images on the executor to determine at least one target control object on the application under test, wherein the application image is a screenshot of the operation interface of the application under test; and a first execution submodule, used to remotely control the target terminal to sequentially execute simulated behaviors for each target control object on the application under test during the detection period to generate application traffic.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the application feature aging detection method according to any one of claims 1 to 5.

8. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the application feature aging detection method according to any one of claims 1 to 5.

Images