A test case filtering method based on reachability prediction model and related equipment

Abstract

The application relates to the technical field of system testing, and provides a test case filtering method based on a reachability prediction model and related equipment, which comprises the following steps: generating a function call graph and a plurality of control flow graphs of a target system, integrating the function call graph and the plurality of control flow graphs to obtain an inter-process control flow graph; calculating reachability representation of test cases based on the inter-process control flow graph; performing feature extraction on the test cases to obtain case features, and constructing an association graph of the test cases; performing reachability prediction on the case features and the association graph by using the reachability prediction model to obtain predicted reachability representation; optimizing the reachability prediction model by using all predicted reachability representation and all reachability representation, and performing reachability prediction on target test cases by using the optimized reachability prediction model to obtain final reachability representation; and filtering the target test cases according to the final reachability representation to obtain a filtering result. The method can improve the universality of test case filtering.

Description

Technical Field

[0001] The present application relates to the field of system testing technology, and in particular to a test case filtering method based on a reachability prediction model and related equipment. Background Art

[0002] Amid the rapid growth of cloud computing, the operating system kernel, as the core technology foundation, has a quality that directly impacts the stability and security of cloud services. Cloud service providers such as Alibaba Cloud, Huawei Cloud, and Tencent Cloud all base their server operating systems on the Linux kernel, serving a variety of sectors, including public and hybrid clouds. However, with the increasing adoption of cloud computing, security issues arising from kernel vulnerabilities are becoming increasingly prominent. These not only threaten business continuity and data security, but can also have a serious impact on the national economy.

[0003] Statistics show that the Linux kernel is one of the most vulnerable software programs, and as new features are constantly added, new defects are also increasing. Current open source operating system projects still face many challenges in kernel quality assurance, especially insufficient technical capabilities for kernel defect detection.

[0004] Test case execution is one of the most resource-intensive steps in the fuzz testing process and a key process in kernel fuzz testing. During test case mutation execution, kernel fuzz testing generates a large number of test cases for the operating system to execute by mutating the seed. However, due to a lack of effective test case quality assessment, many test cases fail to cover the target locations during execution. This results in a significant waste of testing resources on target-irrelevant test cases, reduces the probability of executing test cases that cover the target locations, and limits the efficiency of kernel fuzz testing in defect detection.

[0005] Current test case filtering techniques primarily include code coverage-based methods, mutation testing, symbolic execution, and other statistical or machine learning-based approaches. While these methods have improved the effectiveness and relevance of test cases to some extent, they each have limitations. For example, while code coverage-based methods can help testers understand which parts of the code have been fully tested, they often fail to distinguish meaningful coverage. Especially when dealing with complex systems, high coverage does not necessarily equate to high test quality. Mutation testing methods assess the effectiveness of test case suites by introducing "faults." While this provides deeper testing, it is computationally expensive and difficult to select variants. Symbolic execution attempts to automatically discover potential defects by executing program paths using symbolic variables. However, handling non-deterministic inputs and complex path constraints can lead to an explosive growth in the state space, compromising efficiency. While statistical or machine learning-based methods can improve test case generation efficiency to some extent, they are still limited by data dependency and model generalization capabilities in practical applications. Therefore, current test case filtering methods suffer from limited versatility. Summary of the Invention

[0006] The present application provides a test case filtering method and related equipment based on a reachability prediction model, which can solve the problem of poor versatility of test filtering methods.

[0007] In a first aspect, an embodiment of the present application provides a test case filtering method based on a reachability prediction model, the test case filtering method comprising:

[0008] Generate a function call graph and multiple control flow graphs of the target system, and integrate the function call graph and all control flow graphs to obtain an inter-procedural control flow graph; multiple nodes in the function call graph correspond one-to-one to multiple kernel functions of the target system, and edges between nodes represent call relationships between two corresponding kernel functions; multiple control flow graphs correspond one-to-one to multiple kernel functions; multiple nodes in the control flow graph correspond one-to-one to multiple basic blocks in the corresponding kernel functions, and edges between nodes represent control relationships between two corresponding basic blocks;

[0009] Obtain multiple test cases for testing the target system and calculate the reachability representation of each test case based on the inter-procedural control flow graph; the reachability representation is used to describe the coverage of the target function by the test case, where the target function is the kernel function to be tested;

[0010] For each test case, feature extraction is performed on the test case to obtain the test case features, and a correlation graph is constructed based on the test case. The multiple nodes in the correlation graph correspond one-to-one to the multiple call resources of the test case, and the edges between the nodes are the association relationships between the corresponding two call resources.

[0011] Based on all use case features and all association graphs, reachability prediction is performed using the reachability prediction model to obtain the predicted reachability representation of each test case.

[0012] Optimizing the reachability prediction model using all predicted reachability representations and all reachability representations to obtain an optimized reachability prediction model, and using the optimized reachability prediction model to perform reachability prediction on the target test case to obtain the final reachability representation of the target test case;

[0013] The target test cases are filtered according to the final reachability representation to obtain filtering results; the filtering results are used to describe whether the target test cases can be used as test cases for the target system.

[0014] Optionally, compute a reachability representation for each test case based on the interprocedural control flow graph, including:

[0015] For each test case, perform the following steps:

[0016] Determine the use case node corresponding to each use case coverage position of the test case from all nodes of the inter-procedural control flow graph;

[0017] For each use case node, obtain the distance between the use case node and the node corresponding to the target function, and use the distance as the initial reachability representation of the use case node;

[0018] All initial reachability representations are integrated to obtain the reachability representation of the test case.

[0019] Optionally, perform feature extraction on the test case to obtain the test case features, including:

[0020] Test cases include file description sequence, system call description sequence, and function description sequence;

[0021] Perform feature extraction on the file description sequence to obtain file semantic features, perform feature extraction on the system call description sequence to obtain call semantic features, and perform feature extraction on the function description sequence to obtain function semantic features;

[0022] The file semantic features, call semantic features and function semantic features are spliced ​​together to obtain the use case features of the test case.

[0023] Optionally, based on all use case features and all association graphs, a reachability prediction model is used to perform reachability prediction, obtaining a predicted reachability representation for each test case, including:

[0024] For each test case, perform the following steps in sequence:

[0025] The input layer of the reachability prediction model is used to process the test case association graph to obtain the test case association matrix;

[0026] Based on the use case association matrix and the use case features of the test cases, the graph convolution layer of the reachability prediction model is used to obtain the high-order association features of the test cases.

[0027] The output layer of the reachability prediction model is used to process the high-order correlation features of the use case to obtain the predicted reachability representation.

[0028] Optionally, the input layer of the reachability prediction model is used to process the test case association graph to obtain a test case association matrix, including:

[0029] By formula:

[0030]

[0031] A'=A+I

[0032] Calculating the Use Case Correlation Matrix

[0033] in, It represents the matrix used to perform symmetric normalization on the adjacency matrix, which is obtained from the degree matrix. A' represents the self-connection association matrix. D'(i,i) represents the degree of the i-th node in the association graph. A'(i,j) represents the adjacency relationship between the i-th node and the j-th node in the association graph. A represents the adjacency matrix of the association graph. i,j∈N, where N represents the total number of nodes in the association graph.

[0034] Optionally, the reachability prediction model is optimized using all predicted reachability representations and all reachability representations to obtain an optimized reachability prediction model, including:

[0035] Construct a loss function using all predicted reachability representations and all reachability representations;

[0036] The reachability prediction model is optimized using the loss function to obtain the optimized reachability prediction model.

[0037] Optionally, the loss function is:

[0038]

[0039] Among them, Err represents the value of the loss function, V represents the set of all test cases, M represents the number of categories of reachability labels, and Y p,q represents the probability that the accessibility of the p-th test case is represented by the q-th accessibility label, Z p,q represents the probability that the predicted reachability of the p-th test case is characterized by the q-th reachability label.

[0040] Optionally, the reachability prediction model is optimized using a loss function to obtain an optimized reachability prediction model, including:

[0041] Determine whether the value of the loss function is less than the preset value of the loss function;

[0042] If so, the accessibility prediction model is used as the optimized accessibility prediction model;

[0043] Otherwise, adjust the parameters of the reachability prediction model, and return to the step of performing reachability prediction based on all use case features and all association graphs using the reachability prediction model to obtain the predicted reachability representation of each test case.

[0044] Optionally, target test cases are filtered based on the final reachability representation to obtain filtering results, including:

[0045] If the final reachability representation indicates that the target test case covers the target function, then the filtering result of applying the target test case to the target system is obtained.

[0046] In a second aspect, an embodiment of the present application provides a test case filtering device based on a reachability prediction model, comprising:

[0047] A generation module generates a function call graph and multiple control flow graphs of the target system, and integrates the function call graph and all control flow graphs to obtain an inter-procedural control flow graph; multiple nodes in the function call graph correspond one-to-one to multiple kernel functions of the target system, and the edges between the nodes are the call relationships between the corresponding two kernel functions; multiple control flow graphs correspond one-to-one to multiple kernel functions; multiple nodes in the control flow graph correspond one-to-one to multiple basic blocks in the corresponding kernel functions, and the edges between the nodes are the control relationships between the corresponding two basic blocks;

[0048] The calculation module obtains multiple test cases for testing the target system and calculates the reachability representation of each test case based on the inter-procedural control flow graph. The reachability representation is used to describe the coverage of the target function by the test case. The target function is the kernel function to be tested.

[0049] The construction module extracts features from each test case to obtain the test case features and constructs an association graph based on the test case. The multiple nodes in the association graph correspond one-to-one to the multiple call resources of the test case, and the edges between the nodes represent the association relationship between the corresponding two call resources.

[0050] The reachability prediction module uses the reachability prediction model to perform reachability prediction based on all use case features and all association graphs, and obtains the predicted reachability representation of each test case;

[0051] An optimization module optimizes the reachability prediction model using all predicted reachability representations and all reachability representations to obtain an optimized reachability prediction model, and uses the optimized reachability prediction model to perform reachability prediction on the target test case to obtain the final reachability representation of the target test case;

[0052] The filtering module filters the target test cases according to the final reachability representation to obtain filtering results; the filtering results are used to describe whether the target test cases can be used as test cases for the target system.

[0053] In a third aspect, an embodiment of the present application provides a terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned test case filtering method based on the reachability prediction model when executing the above-mentioned computer program.

[0054] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned test case filtering method based on the reachability prediction model.

[0055] The above solution of the present application has the following beneficial effects:

[0056] In an embodiment of the present application, a function call graph and multiple control flow graphs of a target system are generated, and the function call graph and all control flow graphs are integrated to obtain an inter-procedural control flow graph, and then multiple test cases for testing the target system are obtained, and the reachability representation of each test case is calculated based on the inter-procedural control flow graph, and then for each test case, feature extraction is performed on the test case to obtain the use case features of the test case, and an association graph is constructed based on the test case, and then reachability prediction is performed based on all use case features and all association graphs to obtain a predicted reachability representation of each test case, and then all predicted reachability representations and all reachability representations are used to optimize the reachability prediction model to obtain an optimized reachability prediction model, and the optimized reachability prediction model is used to perform reachability prediction on the target test case to obtain a final reachability representation of the target test case, and finally, the target test case is filtered according to the final reachability representation to obtain a filtering result. Among them, the reachability representation is obtained according to the inter-procedural control flow graph, focusing on the reachability of the system at two granularities: function and basic block, to improve the accuracy of the reachability representation and optimize the reachability prediction model, which can improve the performance of the reachability prediction model and effectively improve the accuracy of the predicted reachability representation. Predictions are made based on use case features and association graphs, and test cases are filtered without generating variants, which effectively improves the efficiency of test case filtering. At the same time, there is no need for specific processing of test cases, which reduces the data dependence on test cases and improves the versatility of test case filtering.

[0057] Other beneficial effects of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0059] Figure 1 A flowchart of a test case filtering method based on a reachability prediction model provided in one embodiment of the present application;

[0060] Figure 2 A schematic diagram of a function call graph provided in one embodiment of the present application;

[0061] Figure 3 A schematic diagram of a control flow graph provided in one embodiment of the present application;

[0062] Figure 4 A schematic diagram of an inter-procedural control flow graph provided in one embodiment of the present application;

[0063] Figure 5 A schematic diagram of an association diagram provided in one embodiment of the present application;

[0064] Figure 6 A specific flow chart of a test case filtering method based on a reachability prediction model provided in one embodiment of the present application;

[0065] Figure 7 A schematic diagram of the structure of a test case filtering device based on a reachability prediction model provided in one embodiment of the present application;

[0066] Figure 8 A schematic diagram of the structure of a terminal device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0067] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0068] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0069] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0070] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0071] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0072] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0073] In response to the problem of poor versatility of existing test case filtering methods, an embodiment of the present application provides a test case filtering method based on a reachability prediction model. The test case filtering method generates a function call graph and multiple control flow graphs of a target system, and integrates the function call graph and all control flow graphs to obtain an inter-procedural control flow graph, then obtains multiple test cases for testing the target system, calculates the reachability representation of each test case based on the inter-procedural control flow graph, and then performs feature extraction on each test case to obtain the use case features of the test case, and constructs an association graph based on the test case. Then, based on all use case features and all association graphs, a reachability prediction is performed using a reachability prediction model to obtain a predicted reachability representation of each test case, and then all predicted reachability representations and all reachability representations are used to optimize the reachability prediction model to obtain an optimized reachability prediction model, and the optimized reachability prediction model is used to perform reachability prediction on the target test case to obtain the final reachability representation of the target test case. Finally, the target test case is filtered according to the final reachability representation to obtain a filtering result. Among them, the reachability representation is obtained according to the inter-procedural control flow graph, focusing on the reachability of the system at two granularities: function and basic block, to improve the accuracy of the reachability representation and optimize the reachability prediction model, which can improve the performance of the reachability prediction model and effectively improve the accuracy of the predicted reachability representation. Predictions are made based on use case features and association graphs, and test cases are filtered without generating variants, which effectively improves the efficiency of test case filtering. At the same time, there is no need for specific processing of test cases, which reduces the data dependence on test cases and improves the versatility of test case filtering.

[0074] The following is an explanation of the relevant professional terms of this application.

[0075] A target function refers to a function that implements a specific function and requires special attention and verification during software or system testing. It is usually a critical part or a place where defects are prone to occur.

[0076] A basic block is a sequence of statements in a function's program that is executed in the most sequential order possible, with only one entry and exit, the entry being its first statement and the exit being its last statement.

[0077] A test case is a description of a software or system test task, reflecting the test plan, methods, techniques, and strategies. It includes test objectives, test environment, input data, test steps, expected results, test scripts, and other content, ultimately forming a document.

[0078] Kernel functions are functions belonging to the kernel of the system.

[0079] Next, an exemplary description is given of the test case filtering method based on the reachability prediction model provided in this application.

[0080] like Figure 1 As shown, the test case filtering method based on the reachability prediction model provided by this application includes the following steps:

[0081] Step 11: Generate a function call graph and multiple control flow graphs of the target system, and integrate the function call graph and all control flow graphs to obtain an inter-procedural control flow graph.

[0082] The nodes in the function call graph correspond one-to-one to the kernel functions of the target system. The edges between nodes represent the call relationships between two corresponding kernel functions. The control flow graphs correspond one-to-one to the kernel functions. For each kernel function with multiple basic blocks, a control flow graph is constructed. The nodes in the control flow graph correspond one-to-one to the basic blocks in the kernel function, and the edges between nodes represent the control relationships between two corresponding basic blocks. The target system is the system to be tested, such as Alibaba Cloud's server operating system. The kernel functions can include list management functions, kernel library functions, and so on.

[0083] In some embodiments of the present application, static code analysis can be performed on the kernel code of the target system to obtain a function call graph and multiple control flow graphs. The number of control flow graphs is the same as the number of kernel functions with basic blocks. When the function call graph and all control flow graphs are integrated, edges are generated between the control flow graph and the nodes of the kernel function corresponding to the control flow graph.

[0084] This step will be described below with reference to a specific example.

[0085] Function call diagram Figure 2 As shown in the figure, the circles represent the nodes corresponding to the kernel functions, the arrows represent the calling relationships between the nodes, and main, a, b, c, d, and e all represent kernel functions.

[0086] Taking kernel function b as an example, the control flow graph corresponding to the kernel function is as follows Figure 3 As shown, Figure 3 The squares represent the statements in the basic blocks of the kernel function, the arrows represent the control relationships between the statements, and the numbers are the numbers of the basic blocks.

[0087] Step 12: Obtain multiple test cases for testing the target system, and calculate the reachability representation of each test case based on the inter-procedural control flow graph.

[0088] The above reachability representation is used to describe the coverage of the target function by the test case, and the target function is the kernel function that needs to be tested.

[0089] Specifically, for each test case, perform the following steps:

[0090] The first step is to determine the use case node corresponding to each use case coverage position of the test case from all nodes of the inter-procedural control flow graph.

[0091] It should be noted that the above-mentioned use case coverage locations are the kernel functions, basic blocks, etc. run by the target system when the test case is used to test the target system. The nodes corresponding to the use case coverage locations in the inter-procedural control flow graph are used as use case nodes.

[0092] In the second step, for each use case node, the distance between the use case node and the node corresponding to the target function is obtained, and the distance is used as the initial reachability representation of the use case node.

[0093] It should be noted that for the distance between the node corresponding to the kernel function and the node corresponding to the target function, the shortest path between the nodes is obtained from the process control flow graph, and the number of edges of the shortest path is used as the distance between the nodes. For the distance between the node corresponding to the basic block and the node corresponding to the target function, first calculate the distance between the kernel function corresponding to the basic block and the target function, the exit distance of the basic block from the kernel function corresponding to the basic block, and the entry distance of the basic block from the kernel function corresponding to the basic block. Then, the weighted sum of the three distances is taken to obtain the distance between the node corresponding to the basic block and the node corresponding to the target function. Figure 3 Taking the control flow graph shown as an example, basic block 1 is the entry and basic block 7 is the exit. For basic block 2, the distance between basic block 2 and basic block 1 is 1, that is, the entry distance is 1, and the distance between basic block 2 and basic block 7 is 1, that is, the exit distance is 1.

[0094] In the third step, all initial reachability representations are integrated to obtain the reachability representation of the test case.

[0095] For example, all initial reachability representations are integrated into a set to obtain a reachability representation. The reachability representation is expressed as the distance between the test case coverage position and the target function.

[0096] It's worth noting that by obtaining reachability representations based on interprocedural control flow graphs, we focus on reachability at both the function and basic block levels. This improves the accuracy of reachability representations and accurately assesses test case effectiveness, avoiding the issue of high coverage not necessarily equating to high test quality. By focusing not only on kernel function code line coverage but also on the actual reachability of test cases to specific code paths within kernel functions, we improve test effectiveness and relevance.

[0097] The above distance is exemplified below with reference to a specific example.

[0098] Will Figure 2 The function call graph shown is similar to Figure 3 The inter-procedural control flow graph obtained by integrating the control flow graph shown in Figure 4 As shown, Figure 4 The numbers of the nodes in the control flow graph represent the distances between the nodes and the target function. The distances between all nodes and the target function in the inter-procedural control flow graph are integrated to obtain Figure 4 As shown in the table, ICFG nodes (i.e., nodes in the inter-procedural control flow graph) include n1, n2, etc. The type of n1 is function, and the corresponding distance is 8.7. The type of n2 is basic block, and the corresponding distance is 30. Figure 4 N / A means the distance was not calculated.

[0099] Step 13: For each test case, extract the test case features to obtain the test case features, and build a correlation graph based on the test case.

[0100] The multiple nodes in the association graph correspond one-to-one to the multiple call resources of the test case. The edges between the nodes represent the association between the two corresponding call resources. A call resource is the function or basic block that the target system needs to call when executing the test case. A test case includes a file description sequence, a system call description sequence, and a function description sequence. The file description sequence describes the file name of the test case, the system call description sequence describes the system call name of the test case, and the function description sequence describes the function of the test case.

[0101] In some embodiments of the present application, the steps of extracting features from test cases, obtaining use case features of the test cases, and constructing an association graph of the test cases are specifically as follows:

[0102] In the first step, feature extraction is performed on the file description sequence to obtain file semantic features, feature extraction is performed on the system call description sequence to obtain call semantic features, and feature extraction is performed on the function description sequence to obtain function semantic features.

[0103] For example, a deep language model (such as a large language model, a deep bag-of-words model, etc.) can be used to perform feature extraction to obtain file semantic features, call semantic features, and function semantic features.

[0104] For example, let's take the fuzz testing template file dev_snd_midi.txt as an example. This file stores system call templates related to the Linux MIDI interface (i.e., test cases, such as ioctl$SNDRV_RAWMIDI_IOCTL_INFO). For the system call template ioctl$SNDRV_RAWMIDI_IOCTL_INFO, ioctl is the system call name, and SNDRV_RAWMIDI_IOCTL_INFON is the function description sequence. For example, the file name (file description sequence) of the system call template ioctl$SNDRV_RAWMIDI_IOCTL_INFO is dev_snd_midi, the system call name (system call description sequence) is ioctl, and the function description (function description sequence) is SNDRV_RAWMIDI_IOCTL_INFO.

[0105] In the second step, the file semantic features, call semantic features and function semantic features are spliced ​​together to obtain the use case features of the test case.

[0106] The third step is to build an association diagram based on the test cases.

[0107] The association diagram describes the association relationship between all call resources corresponding to the test case.

[0108] For example, the test case association diagram is as follows Figure 5 As shown in the figure, this test case consists of the system calls open(), read(), and close(). The system calls complete the file opening, reading, and closing operations in sequence. Among them, r0 is the file pointer, which is generated by open and used by read and close. To explore the association relationship between use cases, we first describe the sequence relationship by connecting unidirectional edges in the graph structure (pointing open to read and read to close). Then, we describe the resource dependency relationship between system calls based on the resource generation and use process between system calls (pointing open to read and close respectively). The code of the test case in this example is:

[0109] r0=open(&(0x7f0000000000)=”. / file0”,0x3,0x9);

[0110] read(r0,&(0x7f0000000000),42);

[0111] close(r0).

[0112] It is worth mentioning that by constructing the association graph of test cases, the resource calling sequence and dependency relationship of the test cases can be described, and the key information of the test cases can be obtained without generating a large number of variants, thereby reducing computing costs and complexity and improving efficiency.

[0113] Step 14: Based on all use case features and all association graphs, reachability prediction is performed using the reachability prediction model to obtain a predicted reachability representation for each test case.

[0114] The above-mentioned reachability prediction model includes an input layer, a graph convolution layer, and an output layer connected in sequence. The input ends of the input layer and the graph convolution layer are both the input ends of the reachability prediction model, and the output end of the output layer is the output end of the reachability prediction model. The input end of the input layer receives the association graph, and the input end of the graph convolution layer receives the use case features and the output data of the input layer.

[0115] In some embodiments of the present application, the above-mentioned steps of performing reachability prediction using the reachability prediction model based on all use case features and all association graphs to obtain the predicted reachability representation of each test case are specifically as follows:

[0116] For each test case, perform the following steps in sequence:

[0117] In the first step, the input layer of the reachability prediction model is used to process the association graph of the test cases to obtain the use case association matrix.

[0118] Specifically, the input layer is expressed as follows:

[0119]

[0120] A'=A+I

[0121] Calculating the Use Case Correlation Matrix

[0122] in, It represents the matrix used to perform symmetric normalization on the adjacency matrix, which is obtained from the degree matrix. A' represents the self-connection association matrix. D'(i,i) represents the degree of the i-th node in the association graph (the number of edges connected to the node). A'(i,j) represents the adjacency relationship between the i-th node and the j-th node in the association graph. A represents the adjacency matrix of the association graph, i,j∈N, and N represents the total number of nodes in the association graph.

[0123] It can be understood that the above formula for calculating the use case association matrix is ​​an expression of the input layer.

[0124] In the second step, based on the use case association matrix and the use case features of the test cases, the graph convolution layer of the reachability prediction model is used to obtain the use case high-order association features of the test cases.

[0125] Specifically, the use case association matrix and use case features are input into the graph convolution layer for processing to obtain the high-order association features of the use case.

[0126] It should be noted that the graph convolution layer includes multiple layers of graph convolutional networks, and the propagation rules of two adjacent graph convolutional layer networks are expressed as:

[0127]

[0128] Among them, L (i+1) Represents the input feature matrix of the i-th layer graph convolutional network. When i=0, L (0) Represents the use case characteristics, W (i) Represents the weight matrix, i=0,1,2,...,I, I represents the last layer of graph convolutional network.

[0129] In the third step, the output layer of the reachability prediction model is used to process the high-order correlation features of the use case to obtain the predicted reachability representation.

[0130] It should be noted that the output layer is an activation function, and the calculation expression of the graph convolution layer and the output layer is:

[0131]

[0132] Among them, F(X,A) represents the predicted reachability representation, represents the use case association matrix, X represents the use case characteristics, W (1) and W (2) Both represent weight matrices.

[0133] It is worth mentioning that the reachability prediction model built based on graph convolutional networks can handle complex paths and non-deterministic input problems, avoid the problem of state space explosion, and capture the complex relationships of test cases.

[0134] Step 15: Optimize the reachability prediction model using all predicted reachability representations and all reachability representations to obtain an optimized reachability prediction model, and use the optimized reachability prediction model to perform reachability prediction on the target test case to obtain the final reachability representation of the target test case.

[0135] The above target test cases are test cases that need to be filtered.

[0136] In some embodiments of the present application, the steps of optimizing the reachability prediction model using all predicted reachability representations and all reachability representations to obtain an optimized reachability prediction model, and performing reachability prediction on a target test case using the optimized reachability prediction model to obtain a final reachability representation of the target test case are specifically as follows:

[0137] In the first step, a loss function is constructed using all predicted reachability representations and all reachability representations.

[0138] Specifically, the loss function is:

[0139]

[0140] Among them, Err represents the value of the loss function, V represents the set of all test cases, M represents the number of categories of reachability labels, and Y p,q represents the probability that the accessibility of the p-th test case is represented by the q-th accessibility label, Z p,q represents the probability that the predicted reachability of the p-th test case is characterized by the q-th reachability label.

[0141] It should be noted that the reachability representation and predicted reachability representation reflect the distance between the test case and the target function. When there are multiple target functions, the target function closest to the test case can be described. In this step, in order to construct the loss function, the process from step 12 to step 13 is carried out, and by changing the target function, the reachability representation and predicted reachability representation of different target functions and each test case are obtained. The above reachability label describes the closest distance between the test case and the target function. For example, the qth reachability label describes the information that "the test case is closest to the qth target function."

[0142] In the second step, the reachability prediction model is optimized using the loss function to obtain the optimized reachability prediction model.

[0143] Specifically, it is determined whether the value of the loss function is less than a preset value of the loss function.

[0144] If so, the reachability prediction model is used as the optimized reachability prediction model.

[0145] Otherwise, adjust the parameters of the reachability prediction model, and return to the step of performing reachability prediction based on all use case features and all association graphs using the reachability prediction model to obtain the predicted reachability representation of each test case.

[0146] For example, in order to prevent overfitting of the model training, a regularization (Dropout) network layer can be added between the graph convolutional layers.

[0147] In the third step, the optimized reachability prediction model is used to predict the reachability of the target test case and obtain the final reachability representation of the target test case.

[0148] Specifically, we first extract features of the target test cases to obtain the use case features of the target test cases, and construct an association graph of the target test cases. Based on the use case features and the association graph, we use the optimized reachability prediction model to predict the reachability of the target test cases and obtain the final reachability representation.

[0149] It is worth mentioning that by training the reachability prediction model, the performance of the reachability prediction model can be improved, thereby improving the accuracy of the final reachability representation.

[0150] Step 16: Filter the target test cases according to the final reachability representation to obtain filtering results.

[0151] The above filtering results are used to describe whether the target test case can be used as a test case for the target system.

[0152] Specifically, if the final reachability representation indicates that the target test case covers the target function, then the target test case is filtered as a test case for the target system. If the final reachability representation indicates that the target test case does not cover the target function, then the target test case is filtered as a test case for the target system. When testing the target function of the target system, the target test case is removed.

[0153] It is worth mentioning that the reachability representation is obtained based on the inter-procedural control flow graph, focusing on the reachability of the system at two granularities: function and basic block, to improve the accuracy of the reachability representation and optimize the reachability prediction model. This can improve the performance of the reachability prediction model and effectively improve the accuracy of the predicted reachability representation. Predictions are made based on use case features and association graphs, and test cases are filtered without generating variants, which effectively improves the efficiency of test case filtering. At the same time, there is no need for specific processing of test cases, which reduces the data dependence on test cases and improves the versatility of test case filtering.

[0154] The test case filtering method based on the reachability prediction model provided in this application is illustrated below with reference to a specific example.

[0155] like Figure 6As shown, the input data includes an inter-procedural control flow graph (ICFG), a target function, and a test case. The ICFG and the target function are subjected to target reachability relationship characterization analysis to obtain a reachability characterization. The test case is subjected to use case feature extraction to obtain a use case feature. The test case is subjected to association mining to obtain an association description (i.e., an association graph). The use case feature and the association graph are then input into a reachability prediction model for processing. The model is trained using the reachability characterization. The reachability prediction model outputs a target reachability prediction result (i.e., a predicted reachability characterization) of the test case. A seed filtering decision is made based on the target reachability prediction result (i.e., the step of obtaining the filtering result in step 16 above). When the method of the present application is implemented as follows Figure 6 As shown in the targeted fuzz testing sub-process - use case evaluation and filtering, the test cases undergo seed filtering (i.e., reachability prediction model and seed filtering decision), and then seed execution (i.e., executing the filtered test cases) and coverage information collection are performed.

[0156] It should be noted that the method provided in this application aims to overcome the limitations of existing technologies, particularly the difficulties of current use case filtering methods in distinguishing meaningful coverage in complex systems, high computational costs, difficulty in selecting variants, and state space explosion. The method provided in this application effectively addresses these issues by introducing a reachability prediction model, combining system call type feature extraction with graph convolutional network technology.

[0157] First, the method provided by this application analyzes the reachability relationship between test cases and targets through reachability characterization, providing a compact feature representation for each test case. Compared with traditional code coverage-based methods, the method of this application not only focuses on the coverage of code lines, but also on the actual reachability of test cases to specific code paths. It can more accurately evaluate the effectiveness of test cases and avoid the problem that high coverage does not necessarily equate to high test quality.

[0158] Secondly, the method of this application extracts use case features based on system call types and mines use case associations based on system call dependencies. This method extracts key use case features by analyzing system call types and further mines associations between use cases through system call dependencies. Compared to mutation testing methods, this method does not require generating a large number of variants, thereby reducing computational cost and complexity. Furthermore, this method can more accurately identify which use cases cover specific program paths, improving the effectiveness and pertinence of test cases.

[0159] Finally, the method of the present application constructs a use case reachability prediction model based on a graph convolutional network. By training the model with use cases in the corpus, the trained model can predict the reachability representation of the use case to be executed. This method utilizes the powerful capabilities of graph convolutional networks to handle complex paths and non-deterministic input problems, avoiding the problem of state space explosion in symbolic execution methods. Graph convolutional networks can capture the complex relationships between use cases and predict the reachability of use cases through the trained model, thereby filtering out use cases that are not related to the target function before the test case is executed, improving test efficiency and quality.

[0160] Compared with the existing methods, the method of the present application overcomes the shortcomings of the existing technology in the following aspects:

[0161] (1) Accuracy:

[0162] By using reachability characterization, this method can more accurately assess the effectiveness of use cases, avoiding the problem that high coverage does not necessarily equate to high test quality. This approach focuses not only on code line coverage but also on the actual reachability of use cases to specific code paths, thereby improving the effectiveness and targetedness of tests.

[0163] (2) Computational efficiency:

[0164] By extracting use case features through system call types and mining use case associations based on system call dependencies, this method can extract key use case features without generating a large number of variants. This method reduces computational cost and complexity, and improves testing efficiency.

[0165] (3) Handling complex paths:

[0166] By leveraging a graph convolutional network (GCN) reachability prediction model, this application's method can handle complex paths and non-deterministic inputs, avoiding the problem of state space explosion. GCNs can capture the complex relationships between use cases and predict their target reachability through a trained model. This allows the method to filter out unrelated use cases before execution, improving testing efficiency and quality.

[0167] (4) Comprehensive advantages:

[0168] This method combines the advantages of multiple technologies. By leveraging reachability characterization, system call type feature extraction, and graph convolutional network technology, it provides a more comprehensive and efficient method for use case filtering. This method not only improves the effectiveness and relevance of test cases, but also reduces computational cost and complexity, thus possessing greater practical value and potential for widespread adoption in real-world applications.

[0169] The following is an exemplary description of the test case filtering device based on the reachability prediction model provided in this application.

[0170] like Figure 7 As shown, an embodiment of the present application provides a test case filtering device based on a reachability prediction model. The test case filtering device 700 based on a reachability prediction model includes:

[0171] A generation module 701 generates a function call graph and multiple control flow graphs of the target system, and integrates the function call graph and all control flow graphs to obtain an inter-procedural control flow graph; multiple nodes in the function call graph correspond one-to-one to multiple kernel functions of the target system, and edges between nodes represent call relationships between two corresponding kernel functions; multiple control flow graphs correspond one-to-one to multiple kernel functions; multiple nodes in the control flow graph correspond one-to-one to multiple basic blocks in the corresponding kernel functions, and edges between nodes represent control relationships between two corresponding basic blocks;

[0172] A calculation module 702 obtains multiple test cases for testing the target system and calculates a reachability representation for each test case based on the inter-procedural control flow graph; the reachability representation is used to describe the coverage of the target function by the test case, where the target function is the kernel function to be tested;

[0173] The construction module 703 extracts features of each test case to obtain the test case features, and constructs an association graph based on the test case; the multiple nodes in the association graph correspond one-to-one to the multiple call resources of the test case, and the edges between the nodes represent the association relationship between the corresponding two call resources;

[0174] The reachability prediction module 704 performs reachability prediction based on all use case features and all association graphs using a reachability prediction model to obtain a predicted reachability representation for each test case.

[0175] An optimization module 705 optimizes the reachability prediction model using all predicted reachability representations and all reachability representations to obtain an optimized reachability prediction model, and uses the optimized reachability prediction model to perform reachability prediction on a target test case to obtain a final reachability representation of the target test case.

[0176] The filtering module 706 filters the target test case according to the final reachability representation to obtain a filtering result; the filtering result is used to describe whether the target test case can be used as a test case for the target system.

[0177] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0178] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0179] like Figure 8 As shown, an embodiment of the present application provides a terminal device, and the terminal device D10 of this embodiment includes: at least one processor D100 ( Figure 8 Only one processor is shown in the figure), a memory D101, and a computer program D102 stored in the memory D101 and executable on the at least one processor D100, wherein the processor D100 implements the steps of any of the above method embodiments when executing the computer program D102.

[0180] Specifically, when the processor D100 executes the computer program D102, it generates a function call graph and multiple control flow graphs of the target system, and integrates the function call graph and all control flow graphs to obtain an inter-procedural control flow graph, then obtains multiple test cases for testing the target system, calculates the reachability representation of each test case based on the inter-procedural control flow graph, and then performs feature extraction on each test case to obtain the use case features of the test case, and constructs an association graph based on the test case, and then uses the reachability prediction model to perform reachability prediction based on all use case features and all association graphs to obtain a predicted reachability representation of each test case, and then uses all predicted reachability representations and all reachability representations to optimize the reachability prediction model to obtain an optimized reachability prediction model, and uses the optimized reachability prediction model to perform reachability prediction on the target test case to obtain the final reachability representation of the target test case, and finally filters the target test case according to the final reachability representation to obtain a filtering result. Among them, the reachability representation is obtained according to the inter-procedural control flow graph, focusing on the reachability of the system at two granularities: function and basic block, to improve the accuracy of the reachability representation and optimize the reachability prediction model, which can improve the performance of the reachability prediction model and effectively improve the accuracy of the predicted reachability representation. Predictions are made based on use case features and association graphs, and test cases are filtered without generating variants, which effectively improves the efficiency of test case filtering. At the same time, there is no need for specific processing of test cases, which reduces the data dependence on test cases and improves the versatility of test case filtering.

[0181] The processor D100 may be a central processing unit (CPU), or may be another general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor may be a microprocessor or any conventional processor.

[0182] In some embodiments, the memory D101 may be an internal storage unit of the terminal device D10, such as a hard disk or memory of the terminal device D10. In other embodiments, the memory D101 may also be an external storage device of the terminal device D10, such as a plug-in hard disk, a smart memory card (SMC, SmartMedia Card), a secure digital (SD, Secure Digital) card, a flash card, etc. equipped on the terminal device D10. Furthermore, the memory D101 may also include both an internal storage unit of the terminal device D10 and an external storage device. The memory D101 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory D101 may also be used to temporarily store data that has been output or is to be output.

[0183] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0184] An embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0185] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program, when executed by the processor, can implement the steps of the above-mentioned various method embodiments. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium that can carry the computer program code to the test case filtering method device / terminal device based on the reachability prediction model. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk.

[0186] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0187] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0188] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles described in the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A test case filtering method based on a reachability prediction model, characterized in that: include: generating a function call graph and multiple control flow graphs of a target system, and integrating the function call graph and all the control flow graphs to obtain an inter-procedural control flow graph; The multiple nodes in the function call graph correspond one-to-one to the multiple kernel functions of the target system, the edges between the nodes are the call relationships between the corresponding two kernel functions, the multiple control flow graphs correspond one-to-one to the multiple kernel functions, the multiple nodes in the control flow graph correspond one-to-one to the multiple basic blocks in the corresponding kernel functions, and the edges between the nodes are the control relationships between the corresponding two basic blocks; Acquire multiple test cases for testing the target system, and calculate a reachability representation of each of the test cases based on the inter-procedural control flow graph; The reachability representation is used to describe the coverage of the target function by the test case, and the target function is the kernel function that needs to be tested; For each of the test cases, feature extraction is performed on the test case to obtain the test case feature of the test case, and an association graph is constructed based on the test case; the multiple nodes in the association graph correspond one-to-one to the multiple call resources of the test case, and the edges between the nodes are the association relationships between the corresponding two call resources; Based on all use case features and all association graphs, a reachability prediction model is used to perform reachability prediction to obtain a predicted reachability representation of each test case; Optimizing the reachability prediction model using all predicted reachability representations and all reachability representations to obtain an optimized reachability prediction model, and performing reachability prediction on a target test case using the optimized reachability prediction model to obtain a final reachability representation of the target test case; Filtering the target test case according to the final reachability representation to obtain a filtering result; The filtering result is used to describe whether the target test case can be used as a test case for the target system; The method of performing reachability prediction based on all use case features and all association graphs using a reachability prediction model to obtain a predicted reachability representation for each test case includes: For each test case, perform the following steps in sequence: Processing the association graph of the test case using the input layer of the reachability prediction model to obtain a use case association matrix; Based on the use case association matrix and the use case features of the test case, using the graph convolution layer of the reachability prediction model to obtain the use case high-order association features of the test case; Processing the high-order correlation features of the use case using the output layer of the reachability prediction model to obtain a predicted reachability representation; The step of processing the association graph of the test case using the input layer of the reachability prediction model to obtain a use case association matrix includes: By formula: A′=A+I Calculating the Use Case Correlation Matrix in, represents the matrix used to perform symmetric normalization on the adjacency matrix, which is obtained from the degree matrix. A′ represents the self-connection association matrix, D′(i,i) represents the degree of the i-th node in the association graph, A′(i,j) represents the adjacency relationship between the i-th node and the j-th node in the association graph, A represents the adjacency matrix of the association graph, i,j∈N, and N represents the total number of nodes in the association graph.

2. The test case filtering method according to claim 1, characterized in that: Calculating the reachability representation of each test case based on the inter-procedural control flow graph includes: For each test case, perform the following steps: Determine, from all nodes of the inter-procedural control flow graph, a use case node corresponding to each use case coverage position of the test case; For each of the use case nodes, respectively, obtain the distance between the use case node and the node corresponding to the target function, and use the distance as an initial reachability representation of the use case node; All initial reachability representations are integrated to obtain the reachability representation of the test case.

3. The test case filtering method according to claim 1, wherein: The extracting features of the test case to obtain the test case features includes: The test case includes a file description sequence, a system call description sequence, and a function description sequence; Performing feature extraction on the file description sequence to obtain file semantic features, performing feature extraction on the system call description sequence to obtain call semantic features, and performing feature extraction on the function description sequence to obtain function semantic features; The file semantic feature, the call semantic feature and the function semantic feature are spliced ​​together to obtain the use case feature of the test case.

4. The test case filtering method according to claim 1, wherein: The optimizing the reachability prediction model by using all predicted reachability representations and all reachability representations to obtain an optimized reachability prediction model includes: Construct a loss function using all predicted reachability representations and all reachability representations; The reachability prediction model is optimized using the loss function to obtain an optimized reachability prediction model.

5. The test case filtering method according to claim 4, characterized in that: The loss function is: Among them, Err represents the value of the loss function, V represents the set of all test cases, M represents the number of categories of reachability labels, and Y p,q represents the probability that the accessibility of the p-th test case is represented by the q-th accessibility label, Z p,q represents the probability that the predicted reachability of the p-th test case is characterized by the q-th reachability label.

6. The test case filtering method according to claim 5, characterized in that: The optimizing the reachability prediction model by using the loss function to obtain the optimized reachability prediction model includes: Determine whether the value of the loss function is less than a preset value of the loss function; If yes, the reachability prediction model is used as the optimized reachability prediction model; Otherwise, adjust the parameters of the reachability prediction model, and return to the step of performing reachability prediction based on all use case features and all association graphs using the reachability prediction model to obtain a predicted reachability representation for each test case.

7. The test case filtering method according to claim 1, characterized in that: The filtering of the target test case according to the final reachability representation to obtain a filtering result includes: If the final reachability representation indicates that the target test case covers the target function, a filtering result is obtained that the target test case can be used as a test case for the target system.

8. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the test case filtering method based on the reachability prediction model as described in any one of claims 1 to 7 is implemented.

Images