Intelligent fuzzy detection method and equipment based on format constraint and fireworks algorithm

Abstract

The invention is suitable for the technical field of fuzzy testing, and particularly relates to an intelligent fuzzy detection method and device based on format constraint and fireworks algorithm, and the method comprises the steps: obtaining first input data; executing corresponding operation on the first input data based on a fireworks algorithm and format constraint in sequence to obtain first termination input data; wherein the format constraint is used for constraining the format of the input data, and the fireworks algorithm is used for generating new input data; executing corresponding operation on the first input data based on format constraint and a fireworks algorithm in sequence to obtain second termination input data; and inputting the first termination input data and the second termination input data into a target system, and performing a fuzzy test on the target system to obtain a test result. The method not only improves the test efficiency and accuracy, but also improves the coverage rate and vulnerability triggering probability in the test process.

Description

Technical Field

[0001] The present application belongs to the field of fuzzy testing technology, and in particular to an intelligent fuzzy detection method and device based on format constraints and fireworks algorithm. Background Art

[0002] Fuzz testing is an automated vulnerability discovery technology. The core idea of ​​fuzz testing is to automatically or semi-automatically generate random data according to certain rules, then input the generated data into the program and monitor whether the program has any exceptions to detect possible program errors, such as memory leaks, system crashes, unhandled exceptions, etc.

[0003] In the prior art, most of the random data generated by fuzz testing may be invalid data that does not conform to the input format of the system under test. These invalid input data cannot trigger the effective code path of the system, resulting in low test efficiency. Fuzz testing lacks effective guidance on input generation and cannot generate targeted input data according to the characteristics of the system under test, making the test process relatively blind and difficult to ensure that all test scenarios and boundary conditions can be covered.

[0004] In summary, when using fuzz testing to detect system vulnerabilities, there are problems of low testing efficiency and low coverage. Summary of the invention

[0005] The embodiments of the present application provide an intelligent fuzzy detection method and device based on format constraints and fireworks algorithm, which can solve the problems of low testing efficiency and low coverage when using fuzzy testing to detect system vulnerabilities in related technologies.

[0006] In a first aspect, an embodiment of the present application provides an intelligent fuzzy detection method based on format constraints and a fireworks algorithm, including:

[0007] Obtaining first input data;

[0008] Based on the fireworks algorithm and the format constraint, corresponding operations are performed on the first input data to obtain first termination input data; wherein the format constraint is used to constrain the format of the input data, and the fireworks algorithm is used to generate new input data;

[0009] Based on the format constraint and the fireworks algorithm, corresponding operations are performed on the first input data to obtain second termination input data;

[0010] The first termination input data and the second termination input data are input into a target system, and a fuzzy test is performed on the target system to obtain a test result.

[0011] The above technical solutions in the embodiments of the present application have at least the following technical effects:

[0012] The intelligent fuzzy detection method based on format constraints and fireworks algorithm provided by the present application first obtains the first input data, then performs corresponding operations on the first input data based on the fireworks algorithm and format constraints in turn, obtains the first termination input data, then performs corresponding operations on the first input data based on the format constraints and fireworks algorithm in turn, obtains the second termination input data, finally inputs the first termination input data and the second termination input data into the target system, and performs fuzzy testing on the target system to obtain the test results. The method reduces the generation of invalid data through format constraints, thereby improving the test efficiency and accuracy; by generating new input data through the fireworks algorithm, a wider data space can be explored, thereby improving the effectiveness of fuzzy testing. The method includes two data processing paths, which process data based on "fireworks algorithm first and then format constraints" and "format constraints first and then fireworks algorithm", respectively, which helps to compare and analyze input data generated in different orders, thereby covering more test scenarios and further improving the comprehensiveness of the test. The method inputs the termination input data generated in two different processing orders into the target system for fuzzy testing, which can more comprehensively detect the performance of the system under different input conditions, discover potential security issues or performance bottlenecks, and enhance the robustness of the system.

[0013] In a possible implementation manner of the first aspect, the performing corresponding operations on the first input data based on the fireworks algorithm and the format constraint in sequence to obtain the first termination input data includes:

[0014] First explosion operation: using the fireworks algorithm to perform an explosion operation on the first input data to generate second input data;

[0015] First mutation operation: performing a mutation operation on the second input data based on the format constraint to obtain third input data;

[0016] First selection operation: judging whether the third input data meets the termination condition, and obtaining a first judgment result; when the first judgment result indicates that the third input data does not meet the termination condition, evaluating and selecting the third input data according to the evaluation function, and obtaining fourth input data;

[0017] The fourth input data is input into the fireworks algorithm, the first explosion operation, the first mutation operation and the first selection operation are iterated until the termination condition is met, and the input data that meets the termination condition is determined as the first termination input data.

[0018] In a possible implementation manner of the first aspect, the using the fireworks algorithm to perform an explosion operation on the first input data to generate second input data includes:

[0019] Calculate the explosion radius and the number of explosion sparks of the fireworks algorithm;

[0020] Based on the explosion radius and the number of explosion sparks, performing an explosion operation on the first input data to generate explosion data;

[0021] Data evaluation and data selection are performed on the explosion data to obtain the second input data.

[0022] In a possible implementation manner of the first aspect, performing a mutation operation on the second input data based on the format constraint to obtain third input data includes:

[0023] Obtaining format rules of the target system;

[0024] According to the format rule of the target system and the format constraint, performing a mutation operation on the second input data to obtain mutated data;

[0025] Determine whether the mutated data conforms to the format rule of the target system, and obtain a mutation determination result;

[0026] When the variation judgment result indicates that the variation data conforms to the format rule of the target system, the variation data is determined to be the third input data.

[0027] In a possible implementation manner of the first aspect, performing a mutation operation on the second input data according to the format rule of the target system and the format constraint to obtain mutated data includes:

[0028] According to the format rule of the target system, formatting the second input data is constrained to generate constrained data;

[0029] According to a variation strength calculation formula, the variation strength of the constraint data is calculated to obtain variation strength information; wherein the variation strength calculation formula is used to calculate the variation strength of the constraint data;

[0030] According to the calculation formula for the number of generated samples, the number of generated samples of the constraint data is calculated to obtain the information on the number of generated samples; wherein the calculation formula for the number of generated samples is used to calculate the number of generated samples of the constraint data;

[0031] Based on the mutation intensity information and the generated sample quantity information, a mutation algorithm is used to perform a mutation operation on the constraint data to obtain the mutated data.

[0032] In a possible implementation manner of the first aspect, evaluating and selecting the third input data according to an evaluation function to obtain the fourth input data includes:

[0033] According to the evaluation function, calculating the evaluation value of each sample data in the third input data to obtain an evaluation value set;

[0034] Based on the sorting rule, the sample data corresponding to each evaluation value in the evaluation value set are sorted, and n sample data with evaluation values ​​greater than the termination threshold are selected to obtain the fourth input data; wherein the sorting rule is to sort from high evaluation value to low evaluation value.

[0035] In a possible implementation manner of the first aspect, the performing corresponding operations on the first input data based on the format constraint and the fireworks algorithm in sequence to obtain second termination input data includes:

[0036] Second mutation operation: performing a mutation operation on the first input data based on the format constraint to obtain first sample data;

[0037] Second explosion operation: using the fireworks algorithm to perform an explosion operation on the first sample data to obtain second sample data;

[0038] Second selection operation: judging whether the second sample data meets the termination condition to obtain a second judgment result; when the second judgment result indicates that the second sample data does not meet the termination condition, evaluating and selecting the second sample data according to the evaluation function to obtain third sample data;

[0039] Performing format constraints on the third sample data, iterating the second mutation operation, the second explosion operation and the second selection operation until the termination condition is met, and determining the input data that meets the termination condition as the second termination input data.

[0040] In a possible implementation manner of the first aspect, inputting the first termination input data and the second termination input data into a target system, and performing a fuzzy test on the target system to obtain a test result includes:

[0041] Inputting the first termination input data into the target system, and performing a fuzzy test on the target system to obtain a first test result;

[0042] Inputting the second termination input data into the target system, and performing a fuzzy test on the target system to obtain a second test result;

[0043] The first test result and the second test result are integrated to obtain a test result.

[0044] In a possible implementation manner of the first aspect, the method further includes:

[0045] Comparatively analyzing the first test result and the second test result to obtain a comparative analysis result;

[0046] According to the comparative analysis result, the target system is evaluated to obtain an evaluation result.

[0047] In a possible implementation manner of the first aspect, the comparing and analyzing the first test result and the second test result to obtain a comparative analysis result includes:

[0048] Comparing and analyzing the input processing capability in the first test result and the input processing capability in the second test result to obtain an input processing capability analysis result;

[0049] Comparing and analyzing the vulnerability discovery rate in the first test result and the vulnerability discovery rate in the second test result to obtain a vulnerability discovery rate analysis result;

[0050] Compare and analyze the coverage in the first test result and the coverage in the second test result to obtain a coverage analysis result;

[0051] Comparing and analyzing the system performance in the first test result and the system performance in the second test result to obtain a performance analysis result;

[0052] The input processing capability analysis result, the vulnerability discovery rate analysis result, the coverage analysis result and the performance analysis result are integrated to obtain the comparative analysis result.

[0053] In a possible implementation manner of the first aspect, evaluating the target system according to the comparative analysis result to obtain an evaluation result includes:

[0054] According to the input processing capability analysis result, the input processing capability of the target system is evaluated to obtain a first evaluation result;

[0055] According to the vulnerability discovery rate analysis result, the security of the target system is evaluated to obtain a second evaluation result;

[0056] According to the coverage analysis result, the coverage of the target system is evaluated to obtain a third evaluation result;

[0057] According to the performance analysis result, the performance of the target system is evaluated to obtain a fourth evaluation result;

[0058] The first evaluation result, the second evaluation result, the third evaluation result and the fourth evaluation result are integrated to obtain the evaluation result.

[0059] In a second aspect, the embodiment of the present application provides an intelligent fuzzy detection device based on format constraints and fireworks algorithm, including:

[0060] An acquisition unit, used for acquiring first input data;

[0061] a first termination input data obtaining unit, configured to perform corresponding operations on the first input data based on the fireworks algorithm and the format constraint in sequence to obtain first termination input data; wherein the format constraint is used to constrain the format of the input data, and the fireworks algorithm is used to generate new input data;

[0062] A second termination input data obtaining unit is used to perform corresponding operations on the first input data based on format constraints and fireworks algorithm in sequence to obtain second termination input data;

[0063] The fuzzy testing unit is used to input the first termination input data and the second termination input data into a target system, and perform a fuzzy test on the target system to obtain a test result.

[0064] In a third aspect, an embodiment of the present application provides an intelligent fuzzy detection device based on format constraints and a fireworks algorithm, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any one of the embodiments of the first aspect when executing the computer program.

[0065] It can be understood that the beneficial effects of the second to third aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0067] Figure 1 It is a flowchart of an intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0068] Figure 2 It is a schematic diagram of the implementation process of step S200 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0069] Figure 3 It is a schematic diagram of the implementation process of step S210 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0070] Figure 4 It is a schematic diagram of the implementation process of step S220 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0071] Figure 5 It is a schematic diagram of the implementation process of step S222 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0072] Figure 6 This is a schematic diagram of a partial implementation flow of step S230 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0073] Figure 7 It is a schematic diagram of the implementation process of step S300 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0074] Figure 8 It is a schematic diagram of the implementation process of step S400 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0075] Fig. 9 This is a partial flow chart of an intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0076] Fig.10 This is a schematic diagram of the implementation process of step S10 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0077] Fig.11 It is a schematic diagram of the implementation process of step S20 in the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in one embodiment of the present application;

[0078] Fig.12 It is a structural diagram of an intelligent fuzzy detection device based on format constraints and fireworks algorithm provided in an embodiment of the present application;

[0079] Fig.13 It is a structural diagram of an intelligent fuzzy detection device based on format constraints and fireworks algorithm provided in an embodiment of the present application. DETAILED DESCRIPTION

[0080] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0081] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0082] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0083] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0084] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0085] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0086] In related technologies, most of the random data generated by fuzz testing may be invalid data that does not conform to the input format of the system under test. These invalid input data cannot trigger the effective code path of the system, resulting in low test efficiency. Fuzz testing lacks effective guidance on input generation and cannot generate targeted input data based on the characteristics of the system under test, making the test process relatively blind and difficult to ensure that all test scenarios and boundary conditions can be covered.

[0087] To solve the above problems, the embodiment of the present application provides an intelligent fuzzy detection method and device based on format constraints and fireworks algorithm. In the method, firstly, the first input data is obtained, and then the corresponding operation is performed on the first input data based on the fireworks algorithm and format constraints in turn to obtain the first termination input data, and then the corresponding operation is performed on the first input data based on the format constraints and the fireworks algorithm in turn to obtain the second termination input data, and finally the first termination input data and the second termination input data are input into the target system, and the target system is fuzzy tested to obtain the test results. The method reduces the generation of invalid data through format constraints, thereby improving the test efficiency and accuracy; by generating new input data through the fireworks algorithm, a wider data space can be explored, thereby improving the effectiveness of fuzzy testing. The method includes two data processing paths, which process data based on "fireworks algorithm first and then format constraints" and "format constraints first and then fireworks algorithm", respectively, which helps to compare and analyze the input data generated in different orders, thereby covering more test scenarios and further improving the comprehensiveness of the test. This method inputs the termination input data generated under two different processing orders into the target system for fuzz testing, which can more comprehensively detect the performance of the system under different input conditions, discover potential security issues or performance bottlenecks, and enhance the robustness of the system.

[0088] The intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in the embodiment of the present application can be applied to an intelligent fuzzy detection device based on format constraints and fireworks algorithm. At this time, the intelligent fuzzy detection device based on format constraints and fireworks algorithm is the execution subject of the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in the embodiment of the present application. The embodiment of the present application does not impose any restrictions on the specific type of the intelligent fuzzy detection device based on format constraints and fireworks algorithm.

[0089] For example, an intelligent fuzzy detection device based on format constraints and fireworks algorithm can be a station (STAION, ST) in a WLAN, and can be a mobile phone, a tablet computer, a laptop computer, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook, a personal digital assistant (personal digital assistant, PDA), a desktop computer, a smart screen, a smart TV, a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a computer, a laptop computer, a handheld communication device, a handheld computing device, a satellite wireless device, a wireless modem card, a user premise equipment (customer premise equipment, CPE) and / or other devices used to communicate on a wireless system and a next-generation communication system, for example, a mobile terminal in a 5G network or a mobile terminal in a future evolved public land mobile network (Public Land Mobile Network, PLMN), etc.

[0090] In order to better understand the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in the embodiment of the present application, the specific implementation process of the intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in the embodiment of the present application is exemplarily introduced below.

[0091] Figure 1 A schematic flow chart of an intelligent fuzzy detection method based on format constraints and fireworks algorithm provided in an embodiment of the present application is shown. The intelligent fuzzy detection method based on format constraints and fireworks algorithm includes:

[0092] S100, obtaining first input data.

[0093] Exemplarily, obtaining the first input data may be obtaining raw data from a database, an API, a file, a user input, or a sensor, etc. For example, querying records in a specific data table from a database; obtaining real-time data through an API request; reading file content from a local or remote file system.

[0094] After acquiring the data, some preprocessing steps may be required, such as data cleaning, format conversion, or preliminary validation, to ensure that the data meets the requirements of subsequent steps. If the input data involves parameterization, it may be necessary to dynamically generate input data based on specific conditions or contexts. The acquired input data is recorded in the log for debugging or validation in subsequent steps.

[0095] S200, performing corresponding operations on the first input data based on the fireworks algorithm and the format constraint in sequence to obtain first termination input data, wherein the format constraint is used to constrain the format of the input data, and the fireworks algorithm is used to generate new input data.

[0096] It can be understood that the fireworks algorithm is an optimization algorithm based on random search, which simulates the process of fireworks explosion. By selecting an initial point (i.e., the first input data) and then simulating the fireworks explosion, multiple new candidate solutions (input data) are generated.

[0097] Format constraints are sets of rules used to ensure that data conforms to predefined format or structure requirements. For example, data type, length, range, format pattern, etc. Format constraint technologies include template-based generation, which uses predefined templates to generate data that conforms to the format. The template can be a simple string or a complex structure; grammar generator, which uses context-free grammar (CFG) to define the format of input data, and parses and generates input data that conforms to grammatical rules; regular expression generation, which uses regular expressions to define the format of input data, and generates input data that conforms to regular expressions through regular expression generators; constraint solvers, which use constraint solving technology to generate input data that conforms to specific constraints, and are often used to generate input data that meets complex logical and mathematical constraints.

[0098] The first termination input data refers to the final input data generated by the fireworks algorithm and after passing the format constraint check.

[0099] Exemplarily, the operation process of the fireworks algorithm is: select the first input data as the explosion center, and generate multiple new input data (i.e. "fireworks") according to the algorithm rules. These new data may be slightly adjusted or significantly changed based on the original input data. The operation process of the format constraint is: perform format checks on the new input data generated by the fireworks algorithm one by one, apply format constraints to correct, filter or adjust data that does not meet the requirements, and only retain data that meets the format requirements. The others are discarded or regenerated. The data that passes the format constraint is used as the final output, which is called the first termination input data. The first termination input data will be used for subsequent fuzz testing or other processing steps.

[0100] This step generates a set of input data that is both diverse and in a specific format, ensuring the effectiveness and comprehensiveness of subsequent testing or processing steps.

[0101] In one possible implementation, see Figure 2 , S200, sequentially performing corresponding operations on the first input data based on the fireworks algorithm and the format constraint to obtain the first termination input data, including:

[0102] S210, first explosion operation: using a fireworks algorithm to perform an explosion operation on the first input data to generate second input data.

[0103] Exemplarily, the first input data is directly input into the fireworks algorithm as the initial "fireworks" data, which explodes to generate "sparks" (second input data). The second input data generated by this step may have extremely high diversity, but since format constraints have not yet been performed, some of the data may not conform to the predefined format.

[0104] Optionally, see Figure 3 In step S210, the fireworks algorithm is used to perform an explosion operation on the first input data to generate second input data, including:

[0105] S211, calculating the explosion radius and the number of explosion sparks of the fireworks algorithm.

[0106] It can be understood that the explosion radius is used to determine the distance between the newly generated spark (data) and the first input data, and the explosion radius is related to the value of the objective function or the quality of the input data.

[0107] For example, better input data (i.e., data with higher quality) corresponds to a smaller explosion radius, while worse input data corresponds to a larger explosion radius. The explosion radius can be calculated according to the explosion radius calculation formula. The specific calculation formula can be set according to the requirements of the problem and the objective function. For example, Among them, R i is the explosion radius of the i-th input data, R max is the maximum explosion radius, f best and f worst are the best and worst values ​​of the objective function, respectively, i is the objective function value of the current input data, and ε is a very small number to avoid division by zero errors.

[0108] It can be understood that the number of explosion sparks represents the number of new data generated by each explosion operation. Better input data corresponds to more sparks, while worse input data generates fewer sparks.

[0109] Exemplarily, the number of explosion sparks is related to the quality of the input data, and the number of explosion sparks can be calculated according to a calculation formula for the number of explosion sparks, for example, Among them, S i is the number of explosion sparks of the i-th input data, S max is the maximum number of sparks.

[0110] S212, performing an explosion operation on the first input data based on the explosion radius and the number of explosion sparks to generate explosion data.

[0111] Exemplarily, for each input data, the generated sparks (explosion data) may be randomly distributed within the explosion radius, and the number of generated sparks may be based on the number of sparks calculated previously.

[0112] S213, performing data evaluation and data selection on the explosion data to obtain second input data.

[0113] Exemplarily, the data generated by each explosion is evaluated, the objective function value or other evaluation index of the explosion data is calculated, all the explosion data are sorted according to the evaluation value, and the best or better data is selected as the second input data according to the selection strategy for subsequent processing or further optimization. The selection strategy may include: best selection, selecting the data with the best objective function value; probability selection, assigning probability according to the objective function value and randomly selecting from it; threshold selection, selecting the data with the objective function value above a certain threshold.

[0114] Through the above steps, the evaluation and selection of explosion data can effectively filter and select the data with the best quality as the basis for subsequent operations. The explosion operation plays a vital role in the optimization algorithm, making each iteration move towards a better solution.

[0115] S220, first mutation operation: performing a mutation operation on the second input data based on the format constraint to obtain third input data.

[0116] For example, the "spark" data (second input data) generated by the first explosion operation is screened and mutated by applying format constraint technology to remove data that does not conform to the format. The mutation operation may include fine-tuning, correction or other forms of modification of the data. At the same time, the data may be moderately mutated again to ensure that the final data is both diverse and meets the format requirements.

[0117] Optionally, see Figure 4 In step S220, based on the format constraint, a mutation operation is performed on the second input data to obtain third input data, including:

[0118] S221, obtaining the format rules of the target system.

[0119] For example, it can be obtained through documents. Most complex systems will have corresponding documents, which contain the format rules of system input, which may include API documents, data format specifications, system user manuals, etc. Consult the documents of the target system, find the chapter on input data format, and record all necessary format rules, such as data type (string, number, Boolean value, etc.), maximum length, format patterns that must be followed (such as regular expressions), etc.

[0120] It can be obtained through API or interface. Some systems provide API or service interface, which can be directly called to obtain format rule information. Use HTTP request, SOAP request or other protocols to access the system API. The API will return detailed information about the input format, including the type, constraints and other related information of each field.

[0121] You can obtain it by direct query or configuration file. Some system format rules may be stored in the database or configuration file. You can obtain these rules by querying the database or reading the configuration file. Connect to the system's database and execute SQL query to obtain format rule information. Alternatively, open the system configuration file (such as XML, JSON, YAML, etc.) and parse the format rules.

[0122] It can be obtained through system testing or observation. If the format rules cannot be directly obtained through documents, APIs, or configuration files, the format rules can be inferred by tentatively testing the system. By trying to input data in different formats into the system, observing the system's response, and recording which formats are accepted by the system and which formats cause errors or rejections, the format rules of the system can be inferred.

[0123] S222: Perform a mutation operation on the second input data according to the format rules and format constraints of the target system to obtain mutated data.

[0124] It can be understood that the mutation operation refers to modifying the second input data in some form to generate a new candidate solution. In this step, the mutation operation must follow the format rules of the target system.

[0125] For example, a numerical mutation method can be used, which is used to make minor adjustments or changes to numerical data. The numerical mutation method is suitable for scenarios involving numerical input in the target system, such as fields such as age, price, and quantity. The range of the numerical field (such as the minimum value and maximum value) is determined according to the format rules of the target system, and a random value is added or subtracted based on the current value to keep it within the specified range.

[0126] You can use the string pattern mutation method, which is used to mutate string data, which may include inserting, deleting, replacing characters, or reorganizing strings. It is suitable for scenarios involving string input in the target system, such as user name, email, address, and other fields. Determine the constraints of the string field according to the format rules of the target system (such as regular expressions or length requirements), replace, insert, or delete characters based on the string, and generate a mutated string.

[0127] For example, see Figure 5, S222, performing a mutation operation on the second input data according to the format rules and format constraints of the target system to obtain mutated data, including:

[0128] S2221, performing format constraints on the second input data according to the format rules of the target system to generate constraint data.

[0129] Exemplarily, each input data can be checked one by one to ensure that it complies with the corresponding format rules. For example, verify whether a field is an integer, whether the length of the string is within the specified range, whether the value is within the allowed range, etc. If it is found that a certain input data does not comply with the format rules, it may be necessary to adjust, correct or supplement, which may involve operations such as conversion of data types, trimming string length, adjusting the value range, or adding default values. According to the format rules of the target system, the second input data is adjusted to a form that meets the requirements of the target system, and the generated data is the constraint data. In the adjustment process, the integrity and consistency of the data can be ensured, and there will be no errors in data logic or meaning caused by format adjustment. After generating the constraint data, verify again whether the constraint data fully complies with all the format rules of the target system, ensure that after applying the format constraints, all data items meet the requirements of the target system, and after confirming that the constraint data fully complies with the format rules of the target system, finally use the constraint data as input data for subsequent processing or operation.

[0130] S2222: Calculate the variation strength of the constraint data according to the variation strength calculation formula to obtain variation strength information. The variation strength calculation formula is used to calculate the variation strength of the constraint data.

[0131] It can be understood that the variation intensity indicates the magnitude or strength of the variation in the data. A higher variation intensity means that the data has changed more, while a lower variation intensity means that the data has only changed slightly.

[0132] Exemplarily, the mutation strength calculation formula can be determined based on a variety of factors, which may include: the complexity of the data. The higher the complexity, the greater the mutation strength that may be required; the current state of the data, for example, the distance of the data from the target value, or the stability of the data in the existing environment; the robustness requirements of the system, and the tolerance of the system to abnormal inputs may also affect the mutation strength.

[0133] For example, the formula for calculating mutation strength is Among them, R i =R(x i ) represents the i-th sample x i The corresponding resource allocation R i ; Indicates the total amount of resources, or the standard value of resources; q maxIndicates the maximum fitness value or quality value in the sample set; est(x i ) represents the i-th sample x i fitness estimation or quality assessment; ε is a small positive number to prevent the denominator from being zero; the denominator part represents the resource normalization factor of all samples, that is, the sum of the differences between the estimates of all samples and the maximum value.

[0134] Find the maximum value q of the estimate among all the constrained data max , for each constraint data x i Calculate q max -est(x i )+ε, sum the difference values ​​of all constraint data and calculate the denominator Will Multiply the ratio of the numerator to the denominator of each data, that is Get the variation intensity R of each constraint data i After the calculation is completed, the variation intensity R of each data i Record it as an important reference for subsequent mutation operations.

[0135] Through this step, the variation intensity R of each constraint data can be calculated i ,The mutation strength information is used to guide the subsequent mutation ,operations and determine the amplitude and strength of the mutation.,The mutation strength calculation formula comprehensively considers the relative differences among the ,data to ensure that the distribution of the mutation strength is reasonable and ,effective.

[0136] S2223, calculating the number of generated samples of the constraint data according to the calculation formula for the number of generated samples, and obtaining information on the number of generated samples. The calculation formula for the number of generated samples is used to calculate the number of generated samples of the constraint data.

[0137] It can be understood that the number of generated samples refers to the number of new data samples generated according to the constraint data in the mutation operation, and the number of new data samples is related to the mutation intensity, data complexity and test requirements.

[0138] Exemplarily, the formula for calculating the number of samples generated can be determined based on a variety of factors, which may include: variation intensity. The higher the variation intensity, the more samples may be required to fully cover the range of data changes; data complexity. Complex data structures may require more samples to cover various possible combinations and scenarios; system testing requirements. If the system requires high coverage testing, the number of samples generated also needs to be increased accordingly.

[0139] For example, the formula for generating the sample size is Among them, N i =N(x i ) represents the i-th sample x iThe corresponding split number N i , Represents the total number of splits or target value, q min It represents the minimum fitness value or quality value in the sample set. The denominator represents the split normalization factor of all samples, that is, the sum of the differences between the estimates of all samples and the minimum value.

[0140] Find the minimum value q of the estimate among all the constrained data min , for each constraint data x i , calculate est(x i )-q min +ε, sum the difference values ​​of all data and calculate the denominator Will Multiply the ratio of the numerator to the denominator of each data, that is Get the number of samples N generated by each constraint data i After the calculation is completed, the number of samples N generated by each data i Record it as an important reference for subsequent sample generation.

[0141] Through this step, the number of samples N generated by each constraint data can be calculated i ,The calculation method for generating sample quantity takes into account the relative ,differences between each data and the minimum estimated value, ensuring that ,the number of samples generated is reasonably distributed among the data, and ,the information of the number of samples generated is used to guide ,subsequent data generation operations to ensure that different

[0142] S2224, based on the mutation strength information and the generated sample quantity information, using a mutation algorithm to perform a mutation operation on the constrained data to obtain mutant data.

[0143] Exemplarily, an appropriate mutation algorithm can be selected according to the nature of the data and the mutation requirements. For example, numerical mutation is applicable to numerical data and mutation is performed by adding or subtracting a random quantity; string mutation is applicable to string data and mutation is performed by character replacement, insertion or deletion; combination mutation is applicable to more complex data structures, such as arrays or objects, and mutation is achieved by randomly adjusting the values ​​of each part.

[0144] Determine the magnitude of the mutation based on the mutation strength of each data point. A higher mutation strength may result in a larger data change, while a lower mutation strength may result in a smaller adjustment. For each data point, generate a corresponding number of mutation samples based on the generated sample quantity information. For data points that require multiple samples to be generated, repeat the mutation operation to generate a sufficient number of samples. Collect the mutation samples generated for each data point to form a complete mutation data set. The mutation data set includes all sample data generated according to the mutation strength and sample quantity requirements. After the mutation data is generated, it can be checked to ensure that the data conforms to the format rules of the target system and the expected mutation effect. If some mutation samples do not meet the requirements, they may need to be adjusted or regenerated.

[0145] The variant data obtained through the above steps can be used for further testing, optimization or system verification to ensure the robustness and reliability of the target system when processing various inputs.

[0146] S223, judging whether the mutated data conforms to the format rule of the target system, and obtaining a mutation judgment result.

[0147] Exemplarily, for each field, check whether the type of the mutated data matches the type requirements in the format rules (such as numbers, strings, Boolean values, etc.). If the data type does not match, immediately return a "non-compliant" judgment result. For string type data, check whether its length is within the range specified by the rules; for numeric type data, check whether its value is between the specified minimum and maximum values. You can use regular expressions or other format patterns to verify whether the data meets specific format requirements (such as email format, phone number format, etc.). If the data does not match the format pattern, return a "non-compliant" judgment result. Apply the format rules one by one to check the mutated data. If all rules pass, return a "compliant" judgment result; if any rule fails, return a "non-compliant" judgment result.

[0148] S224: When the variation determination result indicates that the variation data conforms to the format rule of the target system, the variation data is determined to be the third input data.

[0149] Exemplarily, if the mutated data conforms to the format rule of the target system, the data will be determined as the third input data for use in subsequent operations.

[0150] Through the above steps, the format rules of the target system are obtained, mutation operations are performed, and format verification is performed to ensure that the final generated data meets the system requirements.

[0151] S230, first selection operation: determine whether the third input data meets the termination condition to obtain a first determination result; when the first determination result indicates that the third input data does not meet the termination condition, evaluate and select the third input data according to the evaluation function to obtain fourth input data.

[0152] It can be understood that the termination condition is a preset criterion used to decide whether to end the iteration process, which may be when the optimization target reaches a certain threshold or after a specific number of iterations.

[0153] Exemplarily, it is determined whether the third input data satisfies a preset termination condition. If so, the third input data is the first termination input data. If not, the third input data is evaluated based on an evaluation function, and high-quality data in the third input data is selected as the fourth input data.

[0154] In one possible implementation, see Figure 6 In step S230, the third input data is evaluated and selected according to the evaluation function to obtain the fourth input data, including:

[0155] S231, calculating the evaluation value of each sample data in the third input data according to the evaluation function to obtain an evaluation value set.

[0156] It can be understood that the purpose of the evaluation function is to assign a score or weight to each mutated input data, which represents the "quality" of the input data. The design of the evaluation function can be based on a variety of factors, such as the diversity of the input data, the degree of difference between the mutated data and the original data; coverage, the number of code paths or logic branches triggered by the input data; execution results, the results of the input data after execution on the target system, such as whether it triggers an exception or causes a crash; resource consumption, the resource consumption (CPU, memory, etc.) when the system processes the input data.

[0157] Exemplarily, for each mutated input data (third input data), a defined evaluation function is used to perform calculations to obtain an evaluation value of each mutated input data, that is, a set of evaluation values, where the evaluation value is a numerical value, and the higher the numerical value, the better the quality of the input data.

[0158] S232, based on the sorting rule, sort the sample data corresponding to each evaluation value in the evaluation value set, and select n sample data with evaluation values ​​greater than the termination threshold to obtain fourth input data. The sorting rule is to sort from high evaluation value to low evaluation value.

[0159] Exemplarily, the evaluation values ​​of all mutated input data are sorted in order from high to low, and the mutated data with high evaluation values ​​will be ranked in front, and the mutated data with low evaluation values ​​will be ranked behind. Among the sorted samples, select the data with evaluation values ​​greater than the termination threshold, which is pre-set to determine which samples are worthy of further consideration. Among the data that meet the evaluation value greater than the termination threshold, select the first n data with the highest evaluation values ​​as high-quality samples (the fourth input data), which will be used as input data in the next round of testing for continued testing. The first n selected high-quality samples will be used as input data for the next round of testing, and these data will undergo a new mutation and evaluation process. In order to avoid the simplification of samples, some randomness can be added to the selection strategy, or some diverse samples can be ensured to be retained, even if the evaluation value of some samples is not the highest, and the size of n can be dynamically adjusted according to the progress of the test, or the weight of the evaluation function can be adjusted to better meet the test requirements.

[0160] Through the above steps, the sample data that best meets the evaluation criteria can be screened out, and the sample data can be used for subsequent analysis or processing.

[0161] S240, inputting the fourth input data into the fireworks algorithm, iterating the first explosion operation, the first mutation operation and the first selection operation until a termination condition is satisfied, and determining the input data satisfying the termination condition as the first termination input data.

[0162] Exemplarily, the fourth input data is input into the fireworks algorithm again, the first explosion operation is performed, the first mutation operation and the first selection operation are continued to be performed on the newly generated data, and the above process is repeated until the input data generated by the first mutation operation meets the termination condition, the input data that meets the termination condition is determined as the first termination input data, and the iterative process ends.

[0163] Through the above steps, some atypical but still valid inputs may be generated, which can reveal potential vulnerabilities or errors in the target system under abnormal circumstances.

[0164] S300, performing corresponding operations on the first input data based on the format constraint and the fireworks algorithm in sequence to obtain second termination input data.

[0165] It can be understood that the second terminal input data refers to the final input data that is first subjected to format constraints and then processed by the fireworks algorithm.

[0166] Exemplarily, the first input data may be format checked, and the data that does not meet the format requirements may be corrected, filtered or adjusted through format constraints, and only the data that meets the requirements may be retained as the input for subsequent steps. The input data that meets the format constraints is used as the initial data of the fireworks algorithm, and multiple new candidate solutions (new input data) are generated by simulating fireworks explosions. These candidate solutions inherit the data characteristics under the format constraints and have a certain degree of diversity and randomness. The new data generated by the fireworks algorithm is used as the output, which is called the second termination input data. The second termination input data can be used for further fuzz testing or other processing steps.

[0167] This step helps ensure that all generated data conforms to the predetermined format requirements, thereby improving the effectiveness of subsequent testing while still maintaining data diversity.

[0168] In one possible implementation, see Figure 7 , S300, sequentially performing corresponding operations on the first input data based on the format constraint and the fireworks algorithm to obtain second termination input data, including:

[0169] S310, second mutation operation: based on the format constraint, perform a mutation operation on the first input data to obtain first sample data.

[0170] Exemplarily, the format constraint technology is applied to the first input data to mutate, so as to generate a batch of mutated data that meet the format requirements. The mutated data conform to the predefined rules in terms of format and undergo moderate mutation.

[0171] S320, second explosion operation: using a fireworks algorithm to perform an explosion operation on the first sample data to obtain second sample data.

[0172] Exemplarily, the mutated data (first sample data) is used as the initial data of "fireworks", and the fireworks algorithm is applied to explode and generate "sparks", thereby further expanding the diversity of test data. The fireworks algorithm generates a new set of test data (second sample data) by adjusting parameters (such as the number of sparks and the explosion range). The second sample data maintains format constraints but has a higher diversity in content.

[0173] S330, second selection operation: determine whether the second sample data meets the termination condition to obtain a second determination result; when the second determination result indicates that the second sample data does not meet the termination condition, evaluate and select the second sample data according to the evaluation function to obtain third sample data.

[0174] Exemplarily, it is determined whether the second sample data satisfies a preset termination condition. If so, the second sample data is the second termination input data. If not, the second sample data is evaluated based on an evaluation function, and high-quality data in the second sample data is selected as the third sample data.

[0175] S340, performing format constraints on the third sample data, iterating the second mutation operation, the second explosion operation and the second selection operation until a termination condition is satisfied, and determining the input data satisfying the termination condition as second termination input data.

[0176] Exemplarily, the format constraint is performed again on the third sample data, the second mutation operation is performed, the second explosion operation and the second selection operation are continued to be performed on the newly generated data, and the above process is repeated until the input data generated by the second explosion operation meets the termination condition, the input data that meets the termination condition is determined as the second termination input data, and the iterative process ends.

[0177] Since the data generated in each of the above steps conforms to the format constraints, the test results are often closer to the actual production environment and can detect potential vulnerabilities or errors in the system under normal use.

[0178] S400, inputting the first termination input data and the second termination input data into a target system, and performing a fuzzy test on the target system to obtain a test result.

[0179] It is understood that the target system can be a software system, a hardware device or a specific application, and the target system can accept input data and generate a response or output.

[0180] Fuzz Testing is a testing method that detects potential defects or vulnerabilities in a system by inputting random or generated abnormal data. Fuzz testing can help discover possible crashes, abnormal behaviors, or security vulnerabilities in the system under abnormal or unexpected inputs.

[0181] Test results refer to the system behaviors observed and recorded during the fuzz testing process. The results may include normal responses, abnormal responses, crash reports, etc.

[0182] Exemplarily, the first termination input data is input into the target system one by one, and the response of the system is recorded. The second termination input data is input into the target system one by one, and the response of the system is recorded. After each input of data, the response behavior of the target system is observed to check whether the system can process all the input data, whether there is a crash, abnormal output or other unexpected behavior, and all abnormal situations are recorded, including the time of system response, error log, crash report, etc. The test results of all input data are summarized, and the performance of the target system under different input conditions is analyzed. Based on the analysis results, potential problems, vulnerabilities or room for improvement of the system are identified.

[0183] Through two sets of diverse data, the input space of the target system is covered to the maximum extent, which can help discover more potential problems.

[0184] In one possible implementation, see Figure 8 , S400, inputting the first termination input data and the second termination input data into the target system, and performing a fuzzy test on the target system to obtain a test result, including:

[0185] S410, inputting first termination input data into a target system, and performing a fuzzy test on the target system to obtain a first test result.

[0186] Exemplarily, the first termination input data obtained by sequentially processing the fireworks algorithm and format constraints can be input into the target system. The first termination input data is the result of processing with a specific algorithm and constraints, and may contain optimized data or formatted data. After the first termination input data is input into the target system, fuzz testing of the target system begins. During the test, the target system will process the first termination input data and respond accordingly. The focus of fuzz testing is to observe the performance of the system when facing unexpected inputs. After the test is completed, the output, log, error report, performance data, etc. of the target system are collected to form a first test result. The first test result may include system correctness verification, frequency and type of errors, number of system crashes, performance indicators, etc.

[0187] Through this step, the first test result provides information about the behavior of the target system when processing the first termination input data. The first test result can be used to further analyze the robustness and stability of the system and its performance under abnormal input conditions.

[0188] S420, inputting the second termination input data into the target system, and performing a fuzzy test on the target system to obtain a second test result.

[0189] Exemplarily, the second termination input data obtained by sequentially processing the format constraint and the fireworks algorithm is input into the target system. After the second termination data is input, the target system is fuzz tested. During the test, the target system processes a new set of input data (the second termination input data) to test the response of the target system when facing different types of inputs. After the fuzz test is completed, all outputs of the target system are collected, including logs, error reports, crash records, performance data, etc., to form a second test result. The second test results will provide information about the system's performance when processing the second termination input data. These results can be compared with the first test results to analyze the impact of different data processing orders on system behavior.

[0190] Through this step, the response of the target system when processing the second termination input data can be evaluated, which helps to fully understand the robustness of the system, especially its performance when processing different types of input data.

[0191] S430, integrating the first test result and the second test result to obtain a test result.

[0192] For example, the first set of test results obtained from the fuzz test records the performance of the target system when processing the first termination input data. Including error logs, crash records, performance indicators, etc. Similarly, the second set of test results obtained from the fuzz test records the performance of the target system when processing the second termination input data. The two sets of test results are integrated to form a test result report.

[0193] Through the above steps, a complete test result can be obtained, covering the performance of the target system under different data processing methods, which helps to more comprehensively evaluate the reliability, robustness and performance of the system.

[0194] In one possible implementation, see Fig. 9 ,The intelligent fuzzy detection method based on format constraints and fireworks algorithm also includes:

[0195] S10, performing comparative analysis on the first test result and the second test result to obtain a comparative analysis result.

[0196] Exemplarily, the errors in the first and second test results can be classified by type (such as crashes, performance issues, logical errors, etc.), and the frequency of each error in the two tests can be compared to analyze whether a specific type of error occurs more frequently under certain input data. The crash points of the system in the two tests can be compared to determine whether the crash occurred under the same conditions or whether it was caused by similar input data, and to analyze whether the system exhibits different abnormal behaviors under the same input in the two tests. The performance indicators in the two tests (such as response time, CPU and memory usage) can be compared to evaluate whether there are significant differences, and to identify and compare possible performance bottlenecks or system load differences in the two tests.

[0197] Optionally, see Fig.10 S10, comparing and analyzing the first test result and the second test result to obtain a comparative analysis result, including:

[0198] S11, comparing and analyzing the input processing capability in the first test result and the input processing capability in the second test result to obtain an input processing capability analysis result.

[0199] Exemplarily, the input processing capability indicators of the target system when processing the first termination input data can be extracted from the first test result, which may include the speed, accuracy, and ability to process complex data of the system in processing the input data. The input processing capability indicators of the target system when processing the second termination input data are extracted from the second test result. Compare the processing capabilities of the target system under the two input data to evaluate whether there are significant differences. Analyze whether the target system performs consistently when processing different inputs, whether certain types of data are easier or more challenging to process, and evaluate the system's overall input processing efficiency, data accuracy, and whether it can effectively handle abnormal or complex inputs. Summarize the findings of the comparative analysis to form the results of the input processing capability analysis, pointing out the advantages and disadvantages of the system when processing different input data.

[0200] S12, comparing and analyzing the vulnerability discovery rate in the first test result and the vulnerability discovery rate in the second test result to obtain a vulnerability discovery rate analysis result.

[0201] Exemplarily, the vulnerability discovery rate (the number or proportion of vulnerabilities detected in the target system during fuzz testing) can be extracted from the first test result, and the vulnerability discovery rate data can be extracted from the second test result. Compare the vulnerability discovery rates in the two tests, evaluate the frequency of system vulnerability exposure under different input data, analyze whether there is a certain type of input that is more likely to cause vulnerabilities or errors, evaluate the system's vulnerability detection capabilities, and determine its vulnerability exposure in different scenarios. Summarize the findings of the comparative analysis to form the vulnerability discovery rate analysis results, indicating the degree of vulnerability exposure of the system under different inputs and their possible causes.

[0202] S13, comparing and analyzing the coverage in the first test result and the coverage in the second test result to obtain a coverage analysis result.

[0203] Exemplarily, the code coverage (the proportion of code executed during the test) can be extracted from the first test result and the code coverage data can be extracted from the second test result. Compare the code coverage in the two tests, evaluate the coverage of the system under different input data, analyze whether certain input data leads to higher or lower code coverage, evaluate the code path coverage of the system when processing different inputs, and judge the effectiveness of the test. Summarize the findings of the comparative analysis, form the coverage analysis results, and point out the code coverage of the system under different inputs and its impact on the test effect.

[0204] S14, comparing and analyzing the system performance in the first test result and the system performance in the second test result to obtain a performance analysis result.

[0205] Exemplarily, system performance data (such as response time, CPU and memory usage) can be extracted from the first test result and system performance data can be extracted from the second test result. Compare the system performance in the two tests, evaluate the performance of the system under different input data, analyze whether there are certain input data that cause performance degradation or improvement, evaluate the stability and efficiency of the system, and determine whether it can maintain a consistent performance level under different input conditions. Summarize the findings of the comparative analysis and form performance analysis results, pointing out the performance of the system under different inputs and their possible influencing factors.

[0206] S15, integrating the input processing capability analysis results, the vulnerability discovery rate analysis results, the coverage analysis results and the performance analysis results to obtain a comparative analysis result.

[0207] For example, the advantages and disadvantages of input processing capabilities, the differences in vulnerability discovery rates, the differences in coverage, and the differences in performance can be combined to form a comprehensive comparative analysis result. The comparative analysis result can cover the performance of the system under different input conditions, including processing capabilities, vulnerability detection, code coverage, and performance. The final analysis result can help identify the strengths and weaknesses of the system and provide directions for system improvement and optimization suggestions.

[0208] S20, evaluating the target system according to the comparative analysis results to obtain an evaluation result.

[0209] For example, based on the comparative analysis results, the stability and reliability of the target system when processing different input data can be evaluated to determine whether there are specific types of input that are more likely to cause system errors or crashes. The performance consistency of the analysis system when facing different input data (especially input data generated by different processing methods) is analyzed. Robust systems perform stably under different input conditions. Evaluate whether the system's performance is consistent under different input conditions. If there are significant differences, evaluate the impact of different input conditions on the overall performance of the system.

[0210] Integrate all the results of the comparative analysis to conduct a comprehensive evaluation of the target system, which can include the overall risk, potential vulnerabilities, and fault tolerance of the system under different input conditions. Propose improvement suggestions based on the evaluation results to help improve the stability, reliability, and performance of the system. Summarize all the analysis and evaluation content to form a final evaluation report, which can cover the advantages and disadvantages, potential risks, and improvement suggestions of the target system.

[0211] Through the above steps, the results of the two tests can be systematically analyzed, the target system can be comprehensively evaluated, and the current status of the system and the direction of improvement can be clarified.

[0212] Optionally, see Fig.11 , S20, evaluate the target system according to the comparative analysis results, and obtain evaluation results, including:

[0213] S21, evaluating the input processing capability of the target system according to the input processing capability analysis result to obtain a first evaluation result.

[0214] For example, based on the input processing capability analysis results, including the system's performance, processing efficiency, data accuracy, and ability to deal with abnormal or complex inputs when processing different types of inputs, evaluate the system's speed in processing input data and resource usage, and determine whether the target system can efficiently process large quantities or complex inputs; evaluate the accuracy and stability of the target system when processing input data, and determine whether the target system can maintain consistent processing results under different conditions; evaluate the target system's ability to deal with abnormal inputs or boundary condition inputs, and determine whether the target system can effectively identify and handle abnormal situations. Based on the above evaluations, the input processing capability evaluation results (first evaluation results) of the target system are formed, pointing out the strengths, weaknesses, and improvement suggestions of the system.

[0215] S22, evaluating the security of the target system according to the vulnerability discovery rate analysis result to obtain a second evaluation result.

[0216] For example, based on the vulnerability discovery rate analysis results, including the vulnerability exposure of the system under different input data, the frequency and severity of the vulnerabilities, etc., the number and type of vulnerabilities exposed by the target system in the fuzz test are evaluated to determine the security risk of the system; the potential threat of the discovered vulnerabilities to the overall security of the target system is evaluated, especially high-severity vulnerabilities; the target system's ability to prevent known vulnerabilities and its ability to respond to new vulnerabilities is evaluated. Based on the above evaluations, the security assessment results of the target system (the second assessment results) are formed, indicating the system's security level, potential risks, and suggestions for strengthening security.

[0217] S23, evaluating the coverage of the target system according to the coverage analysis result to obtain a third evaluation result.

[0218] For example, based on the coverage analysis results, including the performance of code coverage during the test and the degree of test coverage of each part of the system, the proportion of executed code during the test is evaluated to judge the comprehensiveness of the test; whether the test covers all key functions and modules of the target system; whether the test effectively covers edge cases or abnormal paths to ensure that the target system is fully tested in all possible situations. Based on the above evaluations, the coverage evaluation results of the target system (the third evaluation results) are formed, pointing out the comprehensiveness of the test, the missing parts, and suggestions for improving the coverage.

[0219] S24, evaluating the performance of the target system according to the performance analysis result to obtain a fourth evaluation result.

[0220] For example, based on the performance analysis results, including the response time of the system under different input data, resource usage (CPU, memory, etc.), stability, etc., the response time of the target system under different loads is evaluated to determine whether the system meets the performance requirements; the resource consumption of the target system when processing different inputs is evaluated to determine whether the system uses resources efficiently; the stability of the target system under long-term operation or high load conditions is evaluated, and whether it can adapt to expansion needs. Based on the above evaluations, the performance evaluation results of the target system (the fourth evaluation result) are formed, pointing out the performance advantages and disadvantages of the system, potential bottlenecks, and optimization suggestions.

[0221] S25, integrating the first evaluation result, the second evaluation result, the third evaluation result and the fourth evaluation result to obtain an evaluation result.

[0222] For example, the input processing capability assessment results, security assessment results, coverage assessment results, and performance assessment results can be integrated. Summarize the performance of the target system in terms of input processing, security, coverage, and performance, and clarify the main advantages and disadvantages of the target system. Based on the results of each assessment, put forward specific suggestions for optimizing the target system to help improve the overall performance and reliability of the system. Summarize all assessment results, summaries, and suggestions to form a complete assessment report to provide a basis for subsequent development, optimization, or decision-making of the target system.

[0223] Through the above steps, a detailed evaluation result can be obtained, covering the performance of the target system in multiple key aspects, helping to identify improvement points and improve the overall quality of the system.

[0224] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0225] Corresponding to the intelligent fuzzy detection method based on format constraints and fireworks algorithm described in the above embodiment, the embodiment of the present application also provides an intelligent fuzzy detection device based on format constraints and fireworks algorithm, and each unit of the device can implement each step of the intelligent fuzzy detection method based on format constraints and fireworks algorithm. Fig.12 A structural block diagram of an intelligent fuzzy detection device based on format constraints and fireworks algorithm provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0226] Reference Fig.12 , the device comprises:

[0227] The acquiring unit is used to acquire first input data.

[0228] The first termination input data obtaining unit is used to perform corresponding operations on the first input data based on the fireworks algorithm and the format constraint in sequence to obtain the first termination input data, wherein the format constraint is used to constrain the format of the input data, and the fireworks algorithm is used to generate new input data.

[0229] The second termination input data obtaining unit is used to perform corresponding operations on the first input data based on the format constraint and the fireworks algorithm in sequence to obtain the second termination input data.

[0230] The fuzzy testing unit is used to input the first termination input data and the second termination input data into the target system, and perform fuzzy testing on the target system to obtain a test result.

[0231] It should be noted that the information interaction, execution process and other contents between the above-mentioned units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0232] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned device can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0233] The embodiment of the present application also provides an intelligent fuzzy detection device based on format constraints and fireworks algorithm, Fig.13 This is a schematic diagram of the structure of an intelligent fuzzy detection device based on format constraints and fireworks algorithm provided in one embodiment of the present application. Fig.13 As shown, the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm of this embodiment includes: at least one processor 60 ( Fig.13 Only one is shown), at least one memory 61 ( Fig.13 Only one is shown in the figure) and a computer program 62 stored in the at least one memory 61 and executable on the at least one processor 60. When the processor 60 executes the computer program 62, the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm implements the steps in any of the above-mentioned intelligent fuzzy detection method embodiments based on format constraints and fireworks algorithm, or implements the functions of each unit in the above-mentioned device embodiments.

[0234] Exemplarily, the computer program 62 may be divided into one or more modules / units, which are stored in the memory 61 and executed by the processor 60 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 62 in the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm.

[0235] The intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The intelligent fuzzy detection device based on format constraints and fireworks algorithm can include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art can understand that Fig.13 It is only an example of the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm, and does not constitute a limitation of the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm. It may include more or less components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, buses, etc.

[0236] The processor 60 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0237] In some embodiments, the memory 61 may be an internal storage unit of the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm, such as a hard disk or memory of the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm. In other embodiments, the memory 61 may also be an external storage device of the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm. Further, the memory 61 may also include both the internal storage unit of the intelligent fuzzy detection device 6 based on format constraints and fireworks algorithm and an external storage device.

[0238] The memory 61 is used to store an operating system, an application program, a boot loader, data, and other programs, such as program codes of the computer program, etc. The memory 61 can also be used to temporarily store data that has been output or is to be output.

[0239] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0240] An embodiment of the present application provides a computer program product. When the computer program product runs on an intelligent fuzzy detection device based on format constraints and a fireworks algorithm, the intelligent fuzzy detection device based on format constraints and a fireworks algorithm implements the steps in any of the above method embodiments.

[0241] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the intelligent fuzzy detection device based on format constraints and fireworks algorithm, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, USB flash drive, mobile hard disk, disk or optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0242] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0243] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0244] In the embodiments provided in the present application, it should be understood that the disclosed intelligent fuzzy detection device, equipment and method based on format constraints and fireworks algorithm can be implemented in other ways. For example, the above-described intelligent fuzzy detection device and equipment embodiments based on format constraints and fireworks algorithm are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0245] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0246] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. An intelligent fuzzy detection method based on format constraints and fireworks algorithm, characterized in that: include: Obtaining first input data; Based on the fireworks algorithm and the format constraint, corresponding operations are performed on the first input data to obtain first termination input data; wherein the format constraint is used to constrain the format of the input data, and the fireworks algorithm is used to generate new input data; Based on the format constraint and the fireworks algorithm, corresponding operations are performed on the first input data to obtain second termination input data; The first termination input data and the second termination input data are input into a target system, and a fuzzy test is performed on the target system to obtain a test result.

2. The intelligent fuzzy detection method based on format constraints and fireworks algorithm as claimed in claim 1, characterized in that: The step of sequentially performing corresponding operations on the first input data based on the fireworks algorithm and the format constraint to obtain first termination input data includes: First explosion operation: using the fireworks algorithm to perform an explosion operation on the first input data to generate second input data; First mutation operation: performing a mutation operation on the second input data based on the format constraint to obtain third input data; First selection operation: judging whether the third input data meets the termination condition, and obtaining a first judgment result; when the first judgment result indicates that the third input data does not meet the termination condition, evaluating and selecting the third input data according to the evaluation function, and obtaining fourth input data; The fourth input data is input into the fireworks algorithm, the first explosion operation, the first mutation operation and the first selection operation are iterated until the termination condition is met, and the input data that meets the termination condition is determined as the first termination input data.

3. The intelligent fuzzy detection method based on format constraints and fireworks algorithm as claimed in claim 2, characterized in that: The step of using the fireworks algorithm to perform an explosion operation on the first input data to generate second input data includes: Calculate the explosion radius and the number of explosion sparks of the fireworks algorithm; Based on the explosion radius and the number of explosion sparks, performing an explosion operation on the first input data to generate explosion data; Data evaluation and data selection are performed on the explosion data to obtain the second input data.

4. The intelligent fuzzy detection method based on format constraints and fireworks algorithm as claimed in claim 2, characterized in that: The performing a mutation operation on the second input data based on the format constraint to obtain third input data includes: Obtaining format rules of the target system; According to the format rule of the target system and the format constraint, performing a mutation operation on the second input data to obtain mutated data; Determine whether the mutated data conforms to the format rule of the target system, and obtain a mutation determination result; When the variation judgment result indicates that the variation data conforms to the format rule of the target system, the variation data is determined to be the third input data.

5. The intelligent fuzzy detection method based on format constraints and fireworks algorithm as claimed in claim 4, characterized in that: The step of performing a mutation operation on the second input data according to the format rule of the target system and the format constraint to obtain mutated data includes: According to the format rule of the target system, formatting the second input data is constrained to generate constrained data; According to a variation strength calculation formula, the variation strength of the constraint data is calculated to obtain variation strength information; wherein the variation strength calculation formula is used to calculate the variation strength of the constraint data; According to the calculation formula for the number of generated samples, the number of generated samples of the constraint data is calculated to obtain the information on the number of generated samples; wherein the calculation formula for the number of generated samples is used to calculate the number of generated samples of the constraint data; Based on the mutation intensity information and the generated sample quantity information, a mutation algorithm is used to perform a mutation operation on the constraint data to obtain the mutated data.

6. The intelligent fuzzy detection method based on format constraints and fireworks algorithm as claimed in claim 2, characterized in that: The step of evaluating and selecting the third input data according to the evaluation function to obtain the fourth input data comprises: According to the evaluation function, calculating the evaluation value of each sample data in the third input data to obtain an evaluation value set; Based on the sorting rule, the sample data corresponding to each evaluation value in the evaluation value set are sorted, and n sample data with evaluation values ​​greater than the termination threshold are selected to obtain the fourth input data; wherein the sorting rule is to sort from high evaluation value to low evaluation value.

7. The intelligent fuzzy detection method based on format constraints and fireworks algorithm as claimed in claim 2, characterized in that: The performing corresponding operations on the first input data based on the format constraint and the fireworks algorithm in sequence to obtain second termination input data includes: Second mutation operation: performing a mutation operation on the first input data based on the format constraint to obtain first sample data; Second explosion operation: using the fireworks algorithm to perform an explosion operation on the first sample data to obtain second sample data; Second selection operation: judging whether the second sample data meets the termination condition to obtain a second judgment result; when the second judgment result indicates that the second sample data does not meet the termination condition, evaluating and selecting the second sample data according to the evaluation function to obtain third sample data; Performing format constraints on the third sample data, iterating the second mutation operation, the second explosion operation and the second selection operation until the termination condition is met, and determining the input data that meets the termination condition as the second termination input data.

8. The intelligent fuzzy detection method based on format constraints and fireworks algorithm as claimed in claim 1, characterized in that: The step of inputting the first termination input data and the second termination input data into a target system and performing a fuzzy test on the target system to obtain a test result includes: Inputting the first termination input data into the target system, and performing a fuzzy test on the target system to obtain a first test result; Inputting the second termination input data into the target system, and performing a fuzzy test on the target system to obtain a second test result; The first test result and the second test result are integrated to obtain a test result.

9. The intelligent fuzzy detection method based on format constraints and fireworks algorithm as claimed in claim 8, characterized in that: The method further comprises: Comparatively analyzing the first test result and the second test result to obtain a comparative analysis result; According to the comparative analysis result, the target system is evaluated to obtain an evaluation result.

10. An intelligent fuzzy detection device based on format constraints and fireworks algorithm, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

Images