Automatic safety test method and device, computer equipment and readable storage medium

Abstract

The invention relates to an automatic security test method and device, computer equipment and a readable storage medium. The method comprises the steps of obtaining function test information corresponding to a function test task in a function test environment, and generating a security test task corresponding to the function test task based on the function test information; the security test task is sent to a security test environment to receive response data returned by the security test environment for automatic security test based on the security test task, and the security test environment is an environment for mirror deployment based on a functional test environment; and generating a security test result corresponding to the security test task based on the response data. By adopting the method, on one hand, the comprehensive safety test aiming at the function item corresponding to the function test is ensured, and on the other hand, the accuracy of the safety test and the integrity of the function test environment are ensured.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to an automated security testing method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In the field of computer security technology, it involves implementing corresponding security tests according to the functional tests performed in a functional testing environment.

[0003] However, in the current security testing methods, on the one hand, the implemented security tests are not complete. For example, it is difficult to cover the problem of permission overstepping and the problem of DDOS attack simulation, making it difficult to comprehensively and adaptively cover different functional testing scenarios with security tests. On the other hand, security testing is usually performed in a functional testing environment by inserting test tools, which affects the functional testing environment during the security testing process and reduces the stability of the testing environment. Summary of the invention

[0004] Based on this, it is necessary to provide an automated security testing method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve the coverage of security testing and improve environmental stability in response to the above technical problems.

[0005] In a first aspect, the present application provides an automated security testing method, comprising:

[0006] Acquire functional test information corresponding to a functional test task in a functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information;

[0007] Sending the security test task to a security test environment to receive response data returned by the security test environment based on the security test task for automated security testing; the security test environment is an environment that is mirror-deployed based on the functional test environment;

[0008] Based on the response data, a security test result corresponding to the security test task is generated.

[0009] In one of the embodiments, generating a security test task corresponding to the functional test task based on the functional test information includes: obtaining a test type corresponding to the functional test information; determining a target security test case that matches the test type in preset security test cases; and integrating the functional test information into the target security test case to generate a security test task corresponding to the functional test task.

[0010] In one of the embodiments, obtaining functional test information corresponding to a functional test task in a functional test environment includes: obtaining at least two functional test information of the same type in the functional test environment; if the at least two functional test information of the same type match, treating the at least two functional test information of the same type as the same functional test information.

[0011] In one of the embodiments, generating a security test task corresponding to the functional test task based on the functional test information includes: determining task attribute information corresponding to the security test task based on a task processing environment corresponding to the security test task; and sorting the task attribute information according to preset rules based on the task attribute information corresponding to the security test task to obtain a scheduled security test task.

[0012] In one of the embodiments, the obtaining of functional test information corresponding to a functional test task in a functional test environment and the generating of a security test task corresponding to the functional test task based on the functional test information include: determining whether the functional test task matches a historical functional test task executed in a historical period; if the functional test task matches a historical functional test task executed in a historical period, then using the historical security test task corresponding to the historical functional test task as the security test task corresponding to the functional test task.

[0013] In one of the embodiments, after generating the security test result corresponding to the security test task, it also includes: obtaining a verification result corresponding to the security test result, if the verification result does not meet a preset verification condition, then using the security test task corresponding to the security test result as a security test task to be optimized; based on the verification result, optimizing the security test task to be optimized to obtain an optimized security test task.

[0014] In a second aspect, the present application also provides an automated safety testing device, comprising:

[0015] An acquisition module, used to acquire functional test information corresponding to a functional test task in a functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information;

[0016] A sending module, used to send the security test task to a security test environment to receive response data returned by the security test environment based on the security test task for automated security testing; the security test environment is an environment for mirror deployment based on the functional test environment;

[0017] A generation module is used to generate a security test result corresponding to the security test task based on the response data.

[0018] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the above steps when executing the computer program.

[0019] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the above steps when executed by a processor.

[0020] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements the above steps when executed by a processor.

[0021] The above-mentioned automated security testing method, apparatus, computer equipment, computer-readable storage medium and computer program product first obtain functional test information corresponding to the functional test task in the functional test environment to generate a security test task corresponding to the functional test task, and then send the security test task to a security test environment that is mirror-deployed based on the functional test environment to receive response data returned by the security test environment for automated security testing based on the security test task, and then generate a security test result corresponding to the security test task based on the response data; based on this, on the one hand, the corresponding security test task is generated based on the functional test task, which improves the coverage of the functional test by the security test, so as to ensure that comprehensive and adaptive security tests can be performed on the functional items corresponding to the functional test, and on the other hand, the security test environment is obtained by mirror-deployment based on the functional test environment to realize security testing, so as to reduce the impact on the functional test environment during the security testing process, so as to ensure the accuracy of the security test and the integrity of the functional test environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A schematic diagram of a process flow of an automated security testing method in one embodiment;

[0024] Figure 2 A schematic diagram of a flow chart of an automated security testing method in another embodiment;

[0025] Figure 3 A schematic diagram of the structure of a security test automation platform, a functional test environment, and a security test environment in one embodiment;

[0026] Figure 4 is a structural block diagram of an automated safety testing device in one embodiment;

[0027] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0029] In an exemplary embodiment, Figure 1 As shown, an automated security testing method is provided. This embodiment uses the method applied to a server as an example. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps S102 to S106, wherein:

[0030] Step S102: Acquire functional test information corresponding to the functional test task in the functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information.

[0031] Among them, the functional testing environment refers to the specific software and hardware environment used to perform functional testing, which can simulate the actual usage environment so that testers can verify the various functions of the software or system under conditions close to the actual usage scenarios.

[0032] Among them, the functional testing task refers to the specific functional testing activities planned and executed for the specified functional items in the software or system, which are used to verify the specific functions or characteristics of the software or system; the functional testing information refers to the detailed information related to the functional testing task, which is used to describe the content or characteristics of the functional testing task.

[0033] Among them, the security testing task refers to the specific security testing activities planned and executed for the designated security items in the software or system to ensure that the software or system meets the predetermined security standards and requirements.

[0034] Exemplarily, functional test information corresponding to any functional test task in the functional test environment can be obtained, and functional test information corresponding to a specified functional test task in the functional test environment can also be obtained; functional test information corresponding to a functional test task in the functional test environment can be obtained in real time, and functional test information corresponding to a functional test task in the functional test environment can also be obtained at preset time intervals.

[0035] Exemplarily, the functional testing information may represent information describing the functional testing task at any stage, that is: the functional testing information may represent information of the functional testing task at the generation stage, for example, information such as the test scope, test content, and test method for requesting the functional test; the functional testing information may represent information of the functional testing task at the execution stage, for example, information such as the execution status, intermediate results, and resource usage; the functional testing information may represent information of the functional testing task at the response stage, for example, information such as the test results and result analysis.

[0036] Optionally, the functional testing information may include request messages and response messages corresponding to the functional testing tasks, that is, capturing the request messages and response messages corresponding to the functional testing tasks in the functional testing environment, and generating security testing tasks corresponding to the functional testing tasks based on the request messages and response messages, so as to realize security testing of the functional items corresponding to the functional testing tasks.

[0037] Optionally, the number of functional testing tasks in a functional testing environment may be one or more, that is, the number of functional testing tasks in a functional testing environment that are in a pending state, in an executing state, or in an executed state may be one or more; a security testing task may correspond to one functional testing task or to multiple functional testing tasks, that is, one security testing task may perform security testing on the functional items corresponding to one functional testing task, or may perform security testing on the functional items corresponding to multiple functional testing tasks.

[0038] Optionally, the functional testing environment may represent a Web-based functional testing environment, by acquiring functional testing information corresponding to the functional testing task in the Web-based functional testing environment, generating security testing tasks corresponding to the functional testing tasks, thereby implementing security testing of functional items corresponding to the functional testing tasks performed based on the Web; further, the Web-based functional testing environment may represent a functional testing environment that includes a Web, that is, the functional testing environment may include a Web and a server, and a database is configured in the server.

[0039] Step S104, sending the security test task to the security test environment to receive response data returned by the security test environment based on the security test task for automated security testing; the security test environment is an environment for mirror deployment based on the functional test environment.

[0040] Among them, the security testing environment refers to the specific software and hardware environment used to perform security testing, which can simulate the actual usage environment so that testers can perform security verification of various functions of the software or system under conditions close to the actual usage scenarios.

[0041] The response data returned by the security test task may represent the response result generated after executing the security test task, or any intermediate result generated when executing the security test task. The response data returned by the security test task may also be the operating status of the security test environment after executing the security test task in the security test environment, such as whether it is still running normally.

[0042] Among them, automated security testing refers to the process of automatically executing various security testing tasks through software tools and / or automated scripts configured in a security testing environment, aiming to improve the efficiency, consistency and coverage of security testing while reducing human errors.

[0043] Exemplarily, the security testing task can be sent to the security testing environment in real time, or according to a preset time period; the response data returned by the security testing environment after the security testing task is run in the security testing environment can be received in real time, or according to a preset time period.

[0044] Optionally, image deployment can be performed in advance based on the functional test environment to obtain one or more security test environments corresponding to the functional test environment; or, according to the generated security test tasks, image deployment can be performed in real time based on the functional test environment to obtain a security test environment corresponding to the security test tasks.

[0045] Optionally, the number of security testing tasks in a security testing environment may be one or more, which is equivalent to that one security testing environment can be used to execute one security testing task or multiple security testing tasks; one security testing task may correspond to one security testing environment or multiple security testing environments, which is equivalent to that one security testing task can be executed in one or more security testing environments.

[0046] Step S106: Generate a security test result corresponding to the security test task based on the response data.

[0047] The safety test result refers to the test result generated by performing safety test on the functional items corresponding to the functional test task in the safety test task.

[0048] Optionally, the security test results may represent information used to describe whether the functional items in the security test task have passed the security test, such as descriptions in the form of binary results, scores, levels and other information; the security test results may represent a test log or test report that records detailed information such as the test process, discovered security vulnerabilities, and recommended repair measures.

[0049] Optionally, if the response data represents a response result generated after executing a security testing task, then a security testing result corresponding to the security testing task can be generated based on the response result; if the response data represents a sub-response result generated at a certain stage when executing the security testing task, then a sub-security testing result corresponding to the sub-response result is generated, and based on the sub-security test results corresponding to each sub-response result, the security testing result corresponding to the security testing task is comprehensively obtained.

[0050] In the above security testing method, first, functional testing information corresponding to the functional testing task in the functional testing environment is obtained to generate a security testing task corresponding to the functional testing task. Secondly, the security testing task is sent to a security testing environment that is mirror-deployed based on the functional testing environment to receive response data returned by the security testing environment for automated security testing based on the security testing task. Furthermore, based on the response data, a security testing result corresponding to the security testing task is generated. Based on this, on the one hand, corresponding security testing tasks are generated based on functional testing tasks, which improves the coverage of security testing on functional testing to ensure that comprehensive and adaptive security testing can be performed on functional items corresponding to functional testing. On the other hand, a security testing environment is obtained by mirror-deployment based on the functional testing environment to implement security testing, which reduces the impact on the functional testing environment during security testing to ensure the accuracy of security testing and the integrity of the functional testing environment.

[0051] In an exemplary embodiment, generating a safety test task corresponding to the functional test task based on the functional test information includes steps S202 to S206, wherein:

[0052] Step S202: Obtain the test type corresponding to the functional test information.

[0053] Step S204: Determine a target security test case that matches the test type in the preset security test cases.

[0054] Among them, the security test case represents a template used to generate a security test task; the target security test case represents a security test case to which the functional test information is applicable.

[0055] Exemplarily, by parsing the functional test information, the test type corresponding to the functional test information can be obtained. Optionally, the request method, request header, request body, and request URL of the functional test information can be parsed to obtain the corresponding test type. For example, for the functional test information of the test login request, the corresponding test type may be an unauthorized access security test. There may be multiple corresponding test types. By obtaining the test type corresponding to the functional test information, the target security test case that matches the functional test information can be determined from the preset security test cases based on the test type. The correspondence between the functional test information and the test type can be stored in a data table. When the functional test information is captured, the test type corresponding to the functional test information is obtained by parsing the functional test information and matching the parsed result with the aforementioned data table, and then the target security test case is determined from the preset security test cases based on the test type corresponding to the functional test information.

[0056] Exemplarily, a security test case may include a test type, test conditions, and test steps corresponding to the security test, wherein: the test type may indicate a specific category of the security test, the test condition may indicate a specific setting or prerequisite that needs to be met before executing the test, and the test step may indicate a specific operation that needs to be performed when executing the test. When the test type corresponding to the functional test information is consistent with the test type corresponding to the security test case, the security test case is determined to be a target security test case matched by the functional test information.

[0057] Optionally, when the test type is a security scanning test, the test condition can be the request content in the functional test information, and the test steps can be calling SQLmap (SQL injection vulnerability detection tool), XSScan (cross-site scripting vulnerability scanning tool), AWVS (web application security scanner), APPScan (application security testing tool), Xray (security assessment tool), etc., which are commonly used security testing scanning tools in the industry, in the command line through a preset script to scan the request content and parse the scanning results to determine whether the request content passes the security scanning test corresponding to the security testing scanning tool.

[0058] Optionally, when the test type is an automated security test for sensitive information, the test condition is the request return information in the functional test information, and the test steps may be to detect the sensitive information in the request return information through a regular expression to determine whether the request return information contains sensitive information.

[0059] Optionally, when the test type is a CC session attack security test, the test condition is a message in the functional test information, and the test step may be to send messages in batches to the server to determine whether the server's response is normal.

[0060] Optionally, when the test type is an unauthorized access security test, the test condition is the authorized user information in the functional test information, and the test steps may be to log in to the system through the authorized user information, record the returned information, and then log in to the system by removing the authentication of the authorized user information, record the returned information, and analyze the difference between the two returned information to determine whether unauthorized access can be identified and blocked.

[0061] Optionally, when the test type is a vertical unauthorized access security test, the test condition is the user authority information in the functional test information, and the test steps may be to determine two users with different authorities in the user authority information. For example, a user with full-function authority obtains all functional authorities of the system, and a user without authority obtains the minimum functional authority of the system by default. By comparing the functional test execution results between the user with full-function authority and the user without authority, it is determined whether the user has vertical unauthorized access.

[0062] Optionally, when the test type is a lateral unauthorized access security test, the test condition is the user permission information in the functional test information, and the test steps may be to determine two users with the same permission in the user permission information, and have the two users with the same permission request a functional test respectively, and compare the functional test execution results between the two users, and then exchange cookie information for the two users' requests and re-request the functional test, and then compare the functional test execution results between the two users to determine whether the user has lateral unauthorized access.

[0063] Step S206: Integrate the functional test information into the target security test case to generate a security test task corresponding to the functional test task.

[0064] Exemplarily, based on the functional test information, a security test case applicable to the functional test information is selected from the preset security test cases as the target security test case, which is equivalent to using the functional test information as the test condition of the target security test case, and generating a security test task corresponding to the functional test task based on the test type, test conditions and test steps of the target security test case.

[0065] Optionally, based on the functional test information in the same functional test task, multiple target security test cases can be matched to merge the functional test information into the matched target security test cases respectively, thereby generating different security test tasks corresponding to the same functional test task.

[0066] In some embodiments, the functional test information is parsed to substitute the content parsed from the functional test information (eg, the aforementioned test conditions) into the target location in the target security test case, thereby obtaining a security test task corresponding to the functional test task.

[0067] In this embodiment, the corresponding target security test case is obtained based on the functional test information matching, and then the corresponding security test task is obtained based on the functional test information and the target security test case. Based on this, the security test case is adaptively matched and reused according to the functional test information in the functional test task to improve the generation efficiency and availability of the security test task.

[0068] In an exemplary embodiment, obtaining functional test information corresponding to a functional test task in a functional test environment includes steps S302 to S304, wherein:

[0069] Step S302: Acquire at least two pieces of functional test information of the same type in the functional test environment.

[0070] Step S304: if at least two pieces of function test information of the same type match, the at least two pieces of function test information of the same type are regarded as the same function test information.

[0071] Among them, the same type of functional test information may represent functional test information under the same functional classification, which has common characteristics or objectives; matching of the same type of functional test information may represent that the functional test information under the same functional classification has the same or similar meaning.

[0072] Exemplarily, if different function test information of the same type have the same meaning, then the different function test information are judged to match and can be used as the same function test information; if the similarity between the meanings corresponding to different function test information of the same type reaches a preset threshold, then the different function test information are judged to match and can be used as the same function test information, wherein the similarity between the meanings corresponding to different function test information can be analyzed by text similarity algorithm, semantic similarity analysis, etc.

[0073] Optionally, a functional test information may include multiple sub-functional test information. In different functional test information of the same type, it is determined whether the different functional test information have the same or similar meanings in the sub-functional test information of the same type to determine whether the sub-functional test information of the same type matches, and then it is determined whether the functional test information of the same type matches.

[0074] Optionally, if in different function test information of the same type, all types of sub-function test information match, then the different function test information of the same type is judged to match; if in different function test information of the same type, all types of sub-function test information match, then the different function test information of the same type is judged to match, wherein the specified type may indicate the type to which sub-function test information of higher importance belongs, or may indicate a specified number of sub-function test information types.

[0075] Optionally, when the functional test information is message information such as request messages and response messages, it can be determined whether different message information matches by judging whether the message information has the same or similar meanings in sub-functional test information such as business fields, subdivided functional units in the business fields, specific operations performed, and data entities involved in the operations.

[0076] Optionally, when the functional test information is a request message, it is possible to determine whether different request messages correspond to the same request condition by determining whether they have the same or similar meanings in sub-functional test information such as URL (Uniform Resource Locator), request URL parameters, and request body parameters.

[0077] In this embodiment, based on the matching conditions between at least two pieces of function test information of the same type, the matching function test information is adaptively deduplicated to be used as the same function test information, thereby greatly saving computer resources.

[0078] In an exemplary embodiment, generating a safety test task corresponding to the functional test task based on the functional test information includes steps S402 to S404, wherein:

[0079] Step S402: determining task attribute information corresponding to the security test task based on the task processing environment corresponding to the security test task.

[0080] The task processing environment refers to the environment corresponding to the processing process based on the security test task.

[0081] Optionally, the task processing environment may represent an environment for generating a security testing task, that is, a computer device environment for executing the above-mentioned embodiment method; the task processing environment may represent an environment for executing a security testing task, that is, a security testing environment corresponding to the security testing task; the task processing environment may represent an environment for generating response data based on the security testing task, that is, a security testing environment corresponding to the security testing task; the task processing environment may represent an environment for receiving response data corresponding to the security testing task, that is, a computer device environment for executing the above-mentioned embodiment method.

[0082] The task attribute information corresponding to the security test task represents information describing the attributes or characteristics of the security test task.

[0083] Optionally, the task attribute information corresponding to the security testing task may represent information that describes the attributes or characteristics of the security testing task based on the processing procedure of the security testing task, wherein: the task attribute information can be used to describe the attributes or characteristics of the security testing task in the generation process, such as task generation time, data source and other information; the task attribute information can be used to describe the attributes or characteristics of the security testing task in the execution process, such as execution order, execution time, resource occupancy and other information; the task attribute information can be used to describe the attributes or characteristics of the security testing task in the response process, such as the representation form of the response data, the sending time of the response data and other information.

[0084] Step S404, according to the task attribute information corresponding to the security test task, the task attribute information is sorted according to a preset rule to obtain the arranged security test task.

[0085] Exemplarily, based on the task attribute information corresponding to each security test task, each security test task is arranged and organized in an orderly manner to obtain a scheduled security test task, and then the scheduled security test task is sent in sequence to the corresponding security test environment for security testing.

[0086] Optionally, orchestrating the security testing tasks may mean setting the order in which different security testing tasks are sent to different security testing environments for security testing, or may mean setting the order in which different security testing tasks are sent to the same security testing environment for security testing.

[0087] For example, the task attribute information may include execution time and resource occupancy rate. According to the execution time corresponding to the security test task, the execution time is sorted from early to late to obtain the scheduled security test task. Or, according to the resource occupancy rate corresponding to the security test task, the resource occupancy rate is sorted from low to high to obtain the scheduled security test task. Among them, the execution time may be the time when the security test task is generated. The resource occupancy rate may be determined based on the amount of code of the security test task.

[0088] In this embodiment, first, based on the task processing environment corresponding to the security testing task, the task attribute information corresponding to the security testing task is adaptively determined. Secondly, based on the task attribute information corresponding to the security testing task, the security testing task is efficiently orchestrated and processed. Based on this, the execution efficiency of the security testing tasks is improved by sequentially executing the orchestrated security testing tasks.

[0089] In an exemplary embodiment, obtaining functional test information corresponding to a functional test task in a functional test environment, and generating a security test task corresponding to the functional test task based on the functional test information, includes steps S502 to S504, wherein:

[0090] Step S502: determine whether the functional test task matches a historical functional test task executed in a historical period.

[0091] Step S504: if the functional test task matches a historical functional test task executed in a historical period, the historical security test task corresponding to the historical functional test task is used as the security test task corresponding to the functional test task.

[0092] Exemplarily, if the functional test task matches the historical functional test task, it may indicate that the functional test task and the historical functional test task are tasks for testing the same functional item, that is, after requesting to execute the historical functional test task in the historical period, a second request is made to execute the functional test task for testing the same functional item.

[0093] Exemplarily, whether the functional test task and the historical functional test task match can be determined by determining the difference between the functional test information respectively corresponding to the functional test task and the historical functional test task.

[0094] Exemplarily, if a functional testing task matches a historical functional testing task executed in a historical period, after taking the historical security testing task corresponding to the historical functional testing task as the security testing task corresponding to the functional testing task, the security testing environment corresponding to the historical security testing task can be used as the security testing environment corresponding to the obtained security testing task, or a new security testing environment can be redeployed based on the obtained security testing task.

[0095] Optionally, the functional test task and the historical functional test task may be tasks executed in the same functional test environment, or may be tasks executed in different functional test environments.

[0096] In this embodiment, based on the historical functional testing tasks that match the functional testing tasks, the security testing tasks corresponding to the historical functional testing tasks in the same functional testing scenario are adaptively reused, thereby improving the generation efficiency and execution efficiency of the security testing tasks corresponding to the functional testing tasks.

[0097] In an exemplary embodiment, after generating the security test result corresponding to the security test task, the method further includes steps S602 to S604, wherein:

[0098] Step S602, obtaining a verification result corresponding to the security test result. If the verification result does not meet a preset verification condition, the security test task corresponding to the security test result is used as a security test task to be optimized.

[0099] Step S604, optimizing the security test task to be optimized based on the verification result to obtain an optimized security test task.

[0100] Among them, the verification result refers to the result obtained by verifying the safety test result; the preset verification condition refers to the condition used to verify that the safety test result meets the requirements.

[0101] Optionally, if the security test result represents information used to describe whether the functional items in the security test task have passed the security test, such as information described in the form of binary results, scores, levels, etc., then check and verify whether the information in the security test result is properly described to obtain the corresponding verification result; if the security test result represents a test log or test report that records detailed information such as the test process, discovered security vulnerabilities, and recommended repair measures, then each detailed information in the security test result is checked and verified one by one to obtain the corresponding verification result.

[0102] Optionally, the verification results corresponding to the obtained security test results may represent the results obtained by security testers performing manual verification of the security test results, which is equivalent to verifying the security test results based on the business experience of the security testers; it may also represent the results obtained by verification by automated tools such as neural networks and machine learning algorithms, which is equivalent to verifying the security test results based on the result trends and tendencies of similar security test tasks performed in historical time periods.

[0103] Optionally, the preset verification conditions may be determined based on compliance requirements and standards, for example, through industry-wide security testing standards; the preset verification conditions may also be determined based on security testing tasks, for example, through information such as the test type, test conditions, and test steps corresponding to the security testing task, to adaptively determine the verification conditions that the security testing results of the security testing task are adapted to; the preset verification conditions may also be determined based on available resources in the security testing environment, for example, through resources such as the network environment, automated tools and scripts, and security vulnerability databases configured in the security testing environment, to adaptively determine the verification conditions that the security testing results corresponding to the security testing tasks performed in the security testing environment are adapted to.

[0104] Optionally, based on the optimization of the security test task, the security test case corresponding to the security test task can be adaptively optimized to match the security test case, so as to obtain the optimized security test case accordingly. In some embodiments, the target security test case determined from the preset security test case that matches the test type of the functional test information may not completely match the functional test information. For example, when performing security tests related to the user's login function, the target security test case that may be determined is built based on cookies. In fact, the login request issued by the user is based on tokens. At this time, if the determined target security test case is used to execute, the response result is likely to be that the test case fails. However, in fact, the security test related to the login request issued by the user should be passed, so the security test task needs to be optimized at this time. The security test task is optimized based on the response result. Specifically, the security test task can be optimized by adjusting the target security test case. For example, the above-mentioned cookie-based test case is replaced with a token-based test case. In this way, the optimized security test case can be obtained, so that the optimized security test case can be used to re-test in the security test environment to reduce the misjudgment rate of the security test environment.

[0105] In this embodiment, the corresponding verification results are obtained by verifying the security test results, so as to optimize the security test tasks to which the verification results that do not meet the verification conditions belong, thereby improving the optimization efficiency of the security test and improving the reliability of the security test results.

[0106] In an exemplary embodiment, Figure 2 As shown, an automated security testing method is provided, which is applied to a security testing automation platform, which is a platform for generating and distributing security testing tasks; the method includes the following steps S702 to S712, wherein:

[0107] Step S702, obtain the request message and response message corresponding to the functional test task in the functional test environment, and deduplicate the request message and response message based on the similarity between different request messages and the similarity between different response messages to obtain deduplicated request message and response message.

[0108] Step S704, determine the security test environment mirrored by the Web-based functional test environment, ensure that the version information upgrade status between the functional test environment and the security test environment is consistent, and ensure that the database information in the functional test environment is backed up in real time or regularly to the database in the security test environment.

[0109] Step S706, determine the security task test case preset in the security test automation platform, and generate a security test task corresponding to the functional test task based on the security task test case and the deduplicated request message and response message.

[0110] Step S708, based on the task processing environment corresponding to the security test task, determine the task attribute information corresponding to the security test task, and obtain the scheduled security test task according to the task attribute information corresponding to the security test task.

[0111] Step S710, sending the arranged security test task to the security test environment to receive the response data returned by the security test environment based on the automated security test of the security test task, generating and displaying the security test result corresponding to the security test task based on the response data.

[0112] Step S712, obtain the verification result corresponding to the security test result. If the verification result does not meet the preset verification condition, the security test task corresponding to the security test result is used as the security test task to be optimized. The security test task to be optimized is optimized based on the verification result to obtain the optimized security test task and re-perform the security test.

[0113] Optionally, the data transmission relationship between the security test automation platform, the functional test environment, and the security test environment can refer to Figure 3 As shown, in the security test automation platform, first, the message information corresponding to the functional test based on the functional test environment is captured, and the message information is deduplicated, and a security test task is generated based on the deduplicated message information and the security test case. Then, the security test task is sent to the security test environment, and the response data returned by the security test environment for the automated security test based on the security test task is received. Then, the security test result is generated and displayed based on the response data. In addition, after the security test automation platform monitors the message information in the functional test environment, the database information in the functional test environment is backed up in real time or periodically to the database in the security test environment to ensure the consistency of the functional test environment and the security test environment.

[0114] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0115] Based on the same inventive concept, the embodiment of the present application also provides a safety test device for implementing the safety test method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more safety test device embodiments provided below can refer to the limitations on the safety test method above, and will not be repeated here.

[0116] In an exemplary embodiment, Figure 4 As shown, an automated safety testing device is provided, including: an acquisition module 402, a sending module 404 and a generation module 406, wherein:

[0117] An acquisition module 402 is used to acquire functional test information corresponding to a functional test task in a functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information;

[0118] The sending module 404 is used to send the security test task to the security test environment to receive the response data returned by the security test environment based on the security test task for the automated security test; the security test environment is an environment for mirror deployment based on the functional test environment;

[0119] The generating module 406 is used to generate a security test result corresponding to the security test task based on the response data.

[0120] In an exemplary embodiment, the acquisition module 402 is also used to: obtain the test type corresponding to the functional test information; determine the target security test case that matches the test type in the preset security test case; integrate the functional test information into the target security test case to generate a security test task corresponding to the functional test task.

[0121] In an exemplary embodiment, the acquisition module 402 is further used to: acquire at least two functional test information of the same type in the functional test environment; if the at least two functional test information of the same type match, then treat the at least two functional test information of the same type as the same functional test information.

[0122] In an exemplary embodiment, the acquisition module 402 is also used to: determine the task attribute information corresponding to the security testing task based on the task processing environment corresponding to the security testing task; and sort the task attribute information according to preset rules based on the task attribute information corresponding to the security testing task to obtain a scheduled security testing task.

[0123] In an exemplary embodiment, the acquisition module 402 is also used to: determine whether the functional testing task matches the historical functional testing task executed in the historical period; if the functional testing task matches the historical functional testing task executed in the historical period, then the historical security testing task corresponding to the historical functional testing task is used as the security testing task corresponding to the functional testing task.

[0124] In an exemplary embodiment, the device also includes a verification module, which is used to: obtain a verification result corresponding to the security test result, and if the verification result does not meet a preset verification condition, use the security test task corresponding to the security test result as a security test task to be optimized; optimize the security test task to be optimized based on the verification result to obtain an optimized security test task.

[0125] Each module in the above-mentioned safety test device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module above.

[0126] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data suitable for security testing. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a security testing method is implemented.

[0127] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0128] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0129] Acquire functional test information corresponding to the functional test task in the functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information;

[0130] Send the security test task to the security test environment to receive the response data returned by the security test environment based on the security test task for the automated security test; the security test environment is an environment for image deployment based on the functional test environment;

[0131] Based on the response data, generate security test results corresponding to the security test task.

[0132] In one embodiment, when the processor executes the computer program, it also implements the following steps: obtaining the test type corresponding to the functional test information; determining a target security test case that matches the test type in the preset security test cases; integrating the functional test information into the target security test case to generate a security test task corresponding to the functional test task.

[0133] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining at least two functional test information of the same type in the functional test environment; if the at least two functional test information of the same type match, treating the at least two functional test information of the same type as the same functional test information.

[0134] In one embodiment, when the processor executes the computer program, the following steps are also implemented: based on the task processing environment corresponding to the security testing task, determining the task attribute information corresponding to the security testing task; based on the task attribute information corresponding to the security testing task, sorting the task attribute information according to preset rules to obtain a scheduled security testing task.

[0135] In one embodiment, when the processor executes the computer program, it also implements the following steps: determining whether the functional test task matches the historical functional test task executed in the historical period; if the functional test task matches the historical functional test task executed in the historical period, then using the historical security test task corresponding to the historical functional test task as the security test task corresponding to the functional test task.

[0136] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining a verification result corresponding to the security test result, and if the verification result does not meet the preset verification condition, using the security test task corresponding to the security test result as the security test task to be optimized; optimizing the security test task to be optimized based on the verification result to obtain an optimized security test task.

[0137] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0138] Acquire functional test information corresponding to the functional test task in the functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information;

[0139] Send the security test task to the security test environment to receive the response data returned by the security test environment based on the security test task for the automated security test; the security test environment is an environment for image deployment based on the functional test environment;

[0140] Based on the response data, generate security test results corresponding to the security test task.

[0141] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining the test type corresponding to the functional test information; determining a target security test case that matches the test type in the preset security test cases; integrating the functional test information into the target security test case to generate a security test task corresponding to the functional test task.

[0142] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining at least two functional test information of the same type in the functional test environment; if the at least two functional test information of the same type match, treating the at least two functional test information of the same type as the same functional test information.

[0143] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the task processing environment corresponding to the security testing task, determining the task attribute information corresponding to the security testing task; based on the task attribute information corresponding to the security testing task, sorting the task attribute information according to preset rules to obtain a scheduled security testing task.

[0144] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining whether the functional test task matches the historical functional test task executed in the historical period; if the functional test task matches the historical functional test task executed in the historical period, then using the historical security test task corresponding to the historical functional test task as the security test task corresponding to the functional test task.

[0145] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining a verification result corresponding to the security test result, and if the verification result does not meet the preset verification condition, using the security test task corresponding to the security test result as the security test task to be optimized; optimizing the security test task to be optimized based on the verification result to obtain an optimized security test task.

[0146] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0147] Acquire functional test information corresponding to the functional test task in the functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information;

[0148] Send the security test task to the security test environment to receive the response data returned by the security test environment based on the security test task for the automated security test; the security test environment is an environment for image deployment based on the functional test environment;

[0149] Based on the response data, generate security test results corresponding to the security test task.

[0150] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining the test type corresponding to the functional test information; determining a target security test case that matches the test type in the preset security test cases; integrating the functional test information into the target security test case to generate a security test task corresponding to the functional test task.

[0151] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining at least two functional test information of the same type in the functional test environment; if the at least two functional test information of the same type match, treating the at least two functional test information of the same type as the same functional test information.

[0152] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the task processing environment corresponding to the security testing task, determining the task attribute information corresponding to the security testing task; based on the task attribute information corresponding to the security testing task, sorting the task attribute information according to preset rules to obtain a scheduled security testing task.

[0153] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining whether the functional test task matches the historical functional test task executed in the historical period; if the functional test task matches the historical functional test task executed in the historical period, then using the historical security test task corresponding to the historical functional test task as the security test task corresponding to the functional test task.

[0154] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining a verification result corresponding to the security test result, and if the verification result does not meet the preset verification condition, using the security test task corresponding to the security test result as the security test task to be optimized; optimizing the security test task to be optimized based on the verification result to obtain an optimized security test task.

[0155] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0156] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0157] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An automated security testing method, characterized in that: The method comprises: Acquire functional test information corresponding to a functional test task in a functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information; Sending the security test task to a security test environment to receive response data returned by the security test environment based on the security test task for automated security testing; the security test environment is an environment that is deployed in a mirror image based on the functional test environment; Based on the response data, a security test result corresponding to the security test task is generated.

2. The method according to claim 1, characterized in that The generating a safety test task corresponding to the functional test task based on the functional test information includes: Obtain the test type corresponding to the functional test information; Determine a target security test case that matches the test type among preset security test cases; The functional test information is integrated into the target security test case to generate a security test task corresponding to the functional test task.

3. The method according to claim 1, characterized in that The obtaining of functional test information corresponding to the functional test task in the functional test environment includes: Acquire at least two functional test information of the same type in a functional test environment; If the at least two pieces of functional test information of the same type match, the at least two pieces of functional test information of the same type are regarded as the same functional test information.

4. The method according to claim 1, characterized in that The generating a safety test task corresponding to the functional test task based on the functional test information includes: Determining task attribute information corresponding to the security test task based on the task processing environment corresponding to the security test task; According to the task attribute information corresponding to the security test task, the task attribute information is sorted according to preset rules to obtain the arranged security test task.

5. The method according to claim 1, characterized in that The generating a safety test task corresponding to the functional test task based on the functional test information includes: Determining whether the functional test task matches a historical functional test task executed during a historical period; If the functional test task matches a historical functional test task executed in a historical period, the historical safety test task corresponding to the historical functional test task is used as the safety test task corresponding to the functional test task.

6. The method according to claim 1, characterized in that After generating the security test result corresponding to the security test task, the method further includes: Obtaining a verification result corresponding to the security test result, and if the verification result does not meet a preset verification condition, taking the security test task corresponding to the security test result as the security test task to be optimized; The security test task to be optimized is optimized based on the verification result to obtain an optimized security test task.

7. An automated safety testing device, characterized in that: The device comprises: An acquisition module, used to acquire functional test information corresponding to a functional test task in a functional test environment, and generate a security test task corresponding to the functional test task based on the functional test information; A sending module, used to send the security test task to a security test environment to receive response data returned by the security test environment based on the security test task for automated security testing; the security test environment is an environment for mirror deployment based on the functional test environment; A generation module is used to generate a security test result corresponding to the security test task based on the response data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images