A Deep Learning-Based Protocol Fuzzing Optimization Method

Abstract

This invention relates to a deep learning-based protocol fuzzing optimization method, belonging to the field of network technology. The method includes: collecting data gathered by Boofuzz ​​during fuzzing before optimization, and classifying message data with different responses according to server response type; initially identifying the dynamic, static, and length fields of the protocol using a protocol inversion module, and constructing requests and setting session messages within the Boofuzz ​​framework based on the identified information; generating test cases using mutation rules within the Boofuzz ​​framework based on the fields inferred by the protocol inversion module; constructing an optimizer model and initializing model parameters; adjusting and optimizing the model hyperparameters using the SSA algorithm, and then training the model based on the optimal hyperparameters; extracting features from the generated test cases to obtain input features; and using the optimizer model to predict the effectiveness of the test cases.

Description

Technical Field

[0001] This invention belongs to the field of network technology and relates to a protocol fuzz testing optimization method based on deep learning. Background Technology

[0002] In network protocol vulnerability discovery methods, fuzzing is currently the most commonly used and effective technique. Tools such as SPIKE, Peach, and Boofuzz ​​are all developed based on this technique. The core of fuzzing is to input different test cases into the target and monitor its response to discover potential vulnerabilities. Therefore, the quality of the test cases directly affects the testing effect and efficiency. Many protocol fuzzing tools, such as Boofuzz ​​and Peach, require users to define the protocol format. Without a defined protocol format, these tools can only perform byte-based mutations, but this method generates many invalid mutations, especially when context information is lacking, which may fail to trigger valid vulnerabilities. Byte-by-byte mutation is particularly computationally intensive and easily generates a large number of redundant test cases, which is especially prominent when dealing with complex protocols and can lead to test path explosion. Fuzzing also faces many constraints, which come from complex logic such as protocol field dependencies and state transitions, increasing the difficulty and time consumption in solving them.

[0003] In summary, protocol reverse engineering plays a crucial role in fuzz testing tools. By extracting protocol structure and field information through packet analysis, it helps improve the accuracy and effectiveness of testing, especially when dealing with complex or closed-source protocols. Current sequence alignment algorithms are mostly used for comparing DNA sequences or text strings, typically neglecting character positional deviations, which is a limitation.

[0004] Furthermore, the main role of artificial intelligence technology in fuzzing is to generate and filter test cases. Through genetic algorithms and neural networks, invalid or low-priority test cases can be automatically filtered out, improving testing efficiency and coverage. However, current deep learning models in fuzzing are generally relatively simple, and their accuracy needs improvement. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a protocol fuzzing optimization method based on deep learning, which solves problems such as the difficulty of fuzzing tools in identifying protocol formats, path explosion in test case generation, and complexity in constraint solving.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A deep learning-based protocol fuzzing optimization method, comprising:

[0008] S1. Before optimization, Boofuzz ​​collected data during fuzz testing and classified message data with different responses according to the server response type.

[0009] The message data is categorized into normal test cases, invalid test cases, and abnormal test cases. Normal test cases are those that respond correctly; invalid test cases are those that do not respond, do not reply, or have an incorrect response message format; abnormal test cases are those that respond incorrectly.

[0010] S2. Initially identify the dynamic, static, and length fields of the protocol using the protocol reverse engineering module, and construct requests and set session messages in the Boofuzz ​​framework based on the identified information; use the mutation rules in the Boofuzz ​​framework to generate test cases based on the fields inferred by the protocol reverse engineering module.

[0011] S3. Construct the optimization model and initialize the model parameters; adjust and optimize the model hyperparameters using the SSA algorithm, and then train the model based on the optimal hyperparameters;

[0012] S4. Extract features from the generated test cases to obtain input features; use the optimizer model to predict the effectiveness of the test cases.

[0013] Furthermore, in step S2, the preliminary identification of the dynamic fields, static fields, and length fields of the protocol through the protocol reverse engineering module includes: sorting the messages in ascending order of length, and calling the improved SmithWaterman algorithm to extract the format string for each pair of adjacent messages until only one string remains, thus obtaining the protocol static fields.

[0014] Randomly select several messages, match them with the extracted format strings, and split the format strings, keeping the shorter parts of the subfields;

[0015] The length field is deduced using an exhaustive search method;

[0016] Based on the above steps, obtain the format fields of other types of messages. Using the normal response type of message as the standard, perform sequence comparison with the message data of other types to compare the fields of different categories, making the field segmentation more refined.

[0017] The improved Smith-Waterman algorithm is expressed as follows:

[0018]

[0019]

[0020] In the formula, Q ij S represents the total score.ij represents the byte matching score, o represents the space penalty; P represents the relative position penalty function, distance represents the distance between two different characters, and length represents the total length of the message.

[0021] Furthermore, in step S3, the optimizer model is a model that combines multiple deep learning networks, including convolutional neural networks, bidirectional long short-term memory networks, attention mechanisms, and Kolmogorov-Arnold networks. By combining different network structures and adopting a dual-channel structure, while combining the advantages of CNN and LSTM, the model's accuracy and convergence speed are increased. This model can handle complex temporal and spatial feature data and uses fewer parameters than MLP.

[0022] Furthermore, in step S3, the hyperparameters of the optimizer model are adjusted using the SSA algorithm, including:

[0023] 1) Collect message data of different response types during the communication process, and clean, format and normalize the data;

[0024] 2) The model weights are adjusted by minimizing the loss function, and the model parameters are adjusted based on the loss value using the Adam optimizer to improve the classification accuracy of the model;

[0025] 3) Use the SSA algorithm for hyperparameter optimization.

[0026] The loss function is expressed as follows:

[0027]

[0028] In the formula, N represents the number of training samples, and C represents the number of classes; y ic Let represent the true label, and let represent the true category of sample i. If sample i belongs to category c, then y ic =1, otherwise y ic =0; o ic This represents the probability output of the class c predicted by the model, i.e., the output of the Softmax layer.

[0029] In step 3), the hyperparameter optimization using the SSA algorithm includes:

[0030] ① Initialize the population and generate a set of random solutions, where each solution is a hyperparameter vector X. i This represents the initial position of each individual;

[0031] ② The performance of each solution is evaluated through model training and testing, and the fitness of each individual is evaluated through the model's error rate:

[0032]

[0033] In the formula, M represents the number of samples in the test set, and y m Let o represent the true label of the m-th sample. m II(y) represents the model-predicted label for the m-th sample; m ≠o m ) represents an indicator function, when y m ≠o m A value of 1 indicates a prediction error;

[0034] ③ By iteratively updating the optimal solution, the final output is the hyperparameter combination with the lowest error rate; during the iteration process, explorer updates, follower updates, and reconnaissance and early warning operations are performed, allowing the follower to move closer to the current optimal solution for local development and optimization; the iteration ends when the preset maximum number of iterations t is reached. max Or the change in fitness is no longer significant.

[0035] The beneficial effects of this invention are as follows: By adding a protocol inversion module and a selector module to the Boofuzz ​​framework, the protocol inversion module automatically identifies the protocol format and then generates test cases based on the identified format template. The selector module uses an SSA-KAN-CNN-BiLSTM-Attention deep learning model to predict the validity of the test cases, discarding those predicted as invalid and prioritizing valid test cases that may uncover vulnerabilities, thereby improving the pass rate of test cases and the efficiency of vulnerability discovery. This invention can solve problems such as difficulty in protocol identification, path explosion, and complex constraint solving, and it is applicable to other fuzz testing tools that require predefined protocol formats.

[0036] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0037] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0038] Figure 1 This is a structural block diagram of the method described in this invention;

[0039] Figure 2 This is a schematic diagram of the KAN-CNN-BI-LSTM-Attention model structure;

[0040] Figure 3 This is a schematic diagram of an LSTM network structure;

[0041] Figure 4 This is a schematic diagram of the Bi-LSTM network structure;

[0042] Figure 5 This is a schematic diagram of the SSA algorithm flow.

[0043] Figure 6 This is a schematic diagram of the fuzz testing process. Detailed Implementation

[0044] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0045] like Figure 1 As shown, an embodiment of the present invention provides a protocol fuzz testing optimization method based on deep learning, which is specifically described as follows:

[0046] Step 1: Collect the data captured during the Boofuzz ​​fuzzing process before optimization, classify it according to its server response type, and use it for protocol reverse engineering and deep learning modules.

[0047] The captured data is categorized according to its server response type, typically into normal test cases, invalid test cases, and abnormal test cases, defined as follows:

[0048] Invalid test cases: no response, no reply, or incorrect response message format.

[0049] Normal test cases: Test cases that can respond normally.

[0050] Abnormal test cases: Error response, but the response message does not contain any malformed flag information.

[0051] Step 2: Design a protocol reverse engineering module that can initially identify the dynamic fields, static fields, and length fields of the protocol. Construct requests using the identified information in the Boofuzz ​​framework, set session message templates, and use the mutation rules in the Boofuzz ​​framework to generate test cases based on the fields inferred by the protocol reverse engineering module.

[0052] A protocol reverse engineering module is constructed, using an improved multi-sequence comparison method to extract the protocol format of each message type obtained in step one. This includes the following steps:

[0053] (1) Sort the messages in ascending order of length. Each time, call the improved Smith Waterman algorithm to extract the format string for two adjacent messages until only one string remains, which is the string of the same format string merged, which is the protocol static field.

[0054] Among them, the Smith-Waterman algorithm is a dynamic programming algorithm based on matrix operations. It first provides a function to calculate the similarity score of two strings. After a successful match, it uses backtracking to find the optimal matching result. Its state transition function is defined as follows:

[0055]

[0056] Among them, S ij 'o' represents the score for matching bytes, and 'o' represents the penalty for empty spaces.

[0057] The drawback of the Smith-Waterman algorithm is that it can cause false matches when dealing with messages of variable length due to large differences in relative position. Therefore, this invention adjusts the distance scoring function by adding a relative position penalty function P; the higher the positional offset, the stronger the penalty. The improved Smith-Waterman algorithm is shown in the following equation:

[0058]

[0059]

[0060] In the formula, `distance` represents the distance between two different characters, and `length` refers to the total length of the message. When `distance` is less than 10% of the sequence length, the penalty value is 0.1 times the distance, i.e., a slight penalty. When the distance is between 10% and 30%, the penalty value is the distance itself. When the distance is greater than 30% of the sequence length, the penalty value is the square of the distance, i.e., a heavy penalty.

[0061] (2) Split format string: Randomly select several messages, match them with the extracted format string, and split the format string, keeping the shorter part of the sub-field, because the shorter field is more representative.

[0062] (3) Use exhaustive search to infer the length field.

[0063] The specific process for determining the protocol length field is as follows: First, all cases with fixed sequence lengths need to be excluded, as these are considered static fields by default. Therefore, this invention discusses the method for obtaining variable-length messages. Furthermore, the length field generally refers to the length from the end field to the beginning of the sequence. Therefore, we first exhaustively enumerate all aligned one- to three-byte field values, then calculate the length len(v) of all sequences, ignoring empty spaces during the length field inference process. Finally, we determine whether the following equation is satisfied:

[0064] len(v) = v + C

[0065] Here, v represents a candidate value for the length field, and C is a constant typically used to adjust the offset of the message header or other fixed fields. If the total length of the message matches the length field plus the constant, then the field can be identified as the length field.

[0066] (4) The format fields of the other two types of messages obtained by the first three steps are compared with the normal response category as the standard, and then the data of other categories are compared to make the field segmentation more refined.

[0067] Step 3: Design the optimization module, build the KAN-CNN-BI-LSTM-Attention model, and initialize the model parameters.

[0068] like Figure 2 As shown, the KAN-CNN-BI-LSTM-Attention model is a hybrid model architecture that combines multiple deep learning techniques, including Convolutional Neural Network (CNN), Bidirectional Long Short-Term Memory (Bi-LSTM), Attention mechanism, and Kolmogorov-Arnold Network (KAN). By combining different network structures and adopting a dual-channel structure, while combining the advantages of CNN and LSTM, the model's accuracy and convergence speed are increased. This model can handle complex temporal and spatial feature data and uses fewer parameters than MLP.

[0069] like Figure 3 As shown, in an LSTM network, the forget gate determines how much information from the cell state is retained:

[0070] f t =sigm(x t W f +U f h t-1 +b f )

[0071] Among them, f t Indicates the output of the forget gate, x tW represents the current state input. f h represents the current weight matrix. t-1 U represents the previous state. f The weight matrix of the previous state, b f This represents the bias term.

[0072] The input gate controls how much of the input information is written to the cell state:

[0073] i t =sigm(x t W i +U i h t-1 +b i )

[0074] g t =tanh(x) t W g +U g h t-1 +b g )

[0075] Among them, i t g t All are input gate inputs.

[0076] Candidate cell state: Calculate the candidate cell state at the current time step. This information, along with the input gate, will determine the new cell state.

[0077] c t =(f t *c t-1 +i t *g t )

[0078] Where c t This is the output of the current cell state.

[0079] The output gate controls the output at the current moment, i.e., the hidden state of the LSTM unit:

[0080] o t =sigm(x t W o +U o h t-1 +b o )

[0081] Among them o t This is the output of the output gate.

[0082] Hidden State Update: Calculate the new hidden state.

[0083] h t=sigm(o t *tanh(c t ))

[0084] Where h t It is in a hidden state.

[0085] Similarly, Bi-LSTM is an improved recurrent neural network (RNN) that is particularly well-suited for processing sequential data. Unlike traditional LSTM, Bi-LSTM processes input data in two directions, thereby capturing richer contextual information.

[0086] Bidirectional processing: Bi-LSTM processes the input sequence in both forward and backward directions using two independent LSTM layers. The forward LSTM layer processes the data from the beginning to the end of the sequence, while the backward LSTM layer processes the data from the end to the beginning. This allows Bi-LSTM to utilize past and future information from the input data, capturing more comprehensive features, such as... Figure 4 As shown.

[0087] The Bi-LSTM network is represented as follows:

[0088]

[0089]

[0090]

[0091] in, For the output of the forward LSTM, For the output of the inverse LSTM, y t This is the final output.

[0092] CNNs, through convolutional operations, can automatically extract local patterns or feature combinations between fields in a message, and these patterns may recur in multiple messages. Attention mechanisms are a technique that has emerged in the field of deep learning in recent years to improve the model's ability to process sequential data. KAN proposes a novel AI architecture different from MLP, offering more flexible activation function settings, higher accuracy, and better interpretability, making it particularly suitable for small-scale scientific tasks. KAN's advantage lies in achieving higher accuracy with fewer parameters and possessing excellent interpretability.

[0093] Step 4: Introduce the Sparrow Optimization Algorithm (SSA). By simulating sparrow foraging behavior, adjust hyperparameters to optimize model performance, find the optimal parameter set and the optimal model, and then train the model. Specifically, this includes:

[0094] 1. Collect message data of different response types during communication, and perform data cleaning, formatting, and normalization processing. This mainly includes the following key operations:

[0095] (1) Data cleaning is a key step in data preprocessing, which aims to remove invalid or inaccurate data that affects model training. First, by checking and deleting duplicate data in the dataset, the same information can be avoided from appearing multiple times, which helps to prevent the model from becoming biased.

[0096] (2) Formatting: Normalize all collected data to a fixed length, fill zeros for rows that are less than the length, filter rows that exceed the length, and then add a label to each data.

[0097] (3) Normalization: Save the processed data into a unified CSV file containing all processed feature data and label information to ensure consistent data format, facilitating subsequent model training and testing. The normalization formula is as follows:

[0098]

[0099] Where X is the original data value, X min X is the minimum value of the data. max X represents the maximum value of the data. nomal The normalized data value is usually located in the range [-1, 1].

[0100] This step ensures the consistency, integrity, and traceability of the input data format, providing high-quality standardized data for subsequent model training and testing.

[0101] 2. Conduct model training.

[0102] For the KAN-CNN-BI-LSTM-Attention model, the objective function of the classification model is the loss function, and its formula is as follows:

[0103]

[0104] Where N represents the number of training samples, and C represents the number of classes; y ic y is the true label, representing the true category of sample i. If sample i belongs to category c, then y ic =1, otherwise y ic =0; o ic This is the output probability of the predicted class c by the model, i.e., the output of the Softmax layer. The Softmax function is used for multi-class classification problems, transforming the model's output into a probability distribution, as shown in the following formula:

[0105]

[0106] Here, z is the score of the i-th class. Softmax converts these scores into probability values, ensuring that the sum of the probabilities of all classes is 1. During training, the model gradually adjusts the weights by minimizing the loss value, making the predicted values ​​as close as possible to the true labels. The Adam optimizer then adjusts the model's parameters based on this loss value to improve the model's classification accuracy.

[0107] 3. Use SSA for hyperparameter optimization. The core steps of SSA include population initialization, fitness evaluation, and iterative optimization, such as... Figure 5 As shown, the SSA algorithm includes the following steps:

[0108] (1) Population Initialization: In the population initialization step, a set of random solutions is generated. Each solution is a hyperparameter vector X. i , representing the initial position of each individual:

[0109] X i =θ1,θ2,…,θ d

[0110] Where d represents the number of hyperparameters to be optimized, and θ j This represents the value of the j-th hyperparameter. The initial value of each hyperparameter is randomly generated, satisfying its upper and lower bounds:

[0111]

[0112] (2) Fitness Evaluation: The performance of each solution is evaluated through model training and testing. The fitness of each individual is evaluated by the model's error rate, using the following formula:

[0113]

[0114] Where M is the number of samples in the test set, y m It is the true label of the m-th sample, o m It is the model-predicted label of the m-th sample, II(y m ≠o m ) is an indicator function, when y m ≠o m A value of 1 indicates a prediction error.

[0115] 3. Iterative Optimization: The optimal solution is continuously updated through several iterations, ultimately outputting the hyperparameter combination with the lowest error rate, including:

[0116] Explorer updates are performed by conducting a global search based on the explorer's current state, as shown in the following formula:

[0117]

[0118] Among them, t represents the current iteration number; j represents the dimension of the input variable; t max is set as a constant, representing the maximum iteration number of the algorithm; represents the position of the i-th sparrow in the j-th dimension during the t-th iteration process; α is a random number in [0, 1); Q follows a normal distribution. R2 and ST respectively represent the warning value and the safety value. When R2 < ST, it means that the foraging environment is in a safe area, and the discoverer can search globally; if R2 ≥ ST, it means that the foraging environment is no longer safe, and all individuals must take actions to change positions to avoid being preyed upon.

[0119] Update of followers: The joiners in the foraging state will continuously observe the movements of the discoverers. Once they obtain a better foraging position, they will immediately go to compete for food. If they win, their energy value will increase; otherwise, they will repeat this process. The position update method of the joiners is as follows:

[0120]

[0121] Among them, is the current globally worst position; is the current optimal position of the discoverer; A + is a one-dimensional matrix, and the elements in it are randomly assigned 1 or -1. In the above formula, when it indicates that the current joiner does not obtain food due to a lower fitness value, and thus needs to go to other areas to forage for more energy; in other cases, it indicates that the sparrow randomly finds a position near the current optimal position.

[0122] Reconnaissance and warning: When the foraging environment where the sparrows are located is no longer safe, the sparrow individuals in different positions will generate different movement strategies, and its mathematical expression is:

[0123] <00><000370>

[0124] Among them, β is a random number conforming to a normal distribution, K is a random number between [-1, 1], ε is a relatively small number to prevent the denominator from being 0. f worst is the worst fitness value of the current population. f g is the global optimal fitness value. When f i ≠ f g , the sparrow is at the edge of the population and is vulnerable to attack by foragers. At this time, it flies towards the optimal sparrow; when f i = f g , at this time the sparrow is in a dangerous position and moves away from the worst sparrow position.

[0125] Through these update formulas, the followers approach the current optimal solution to conduct local development and optimization.

[0126] The iteration ends when one of the following conditions is met:

[0127] 1) Reach the preset maximum number of iterations t max .

[0128] 2. The change in fitness is no longer significant.

[0129] The optimal hyperparameters of the model are obtained through the SSA optimization algorithm, and the selector model is trained using these hyperparameters.

[0130] Step 5, as follows Figure 6 As shown, the server is tested, and features are extracted from the generated test cases to obtain input features. The KAN-CNN-BI-LSTM-Attention model, trained with the optimal parameters obtained in step four, is used to predict the validity of the test cases. Test cases predicted as valid are filtered out, while those predicted as invalid are filtered out. Simultaneously, valid test cases are sent to the server, a monitor is added, and the framework's performance is evaluated by detecting the response of the tested object, the pass rate of the calculated test cases, the total number of discovered states, and the number of vulnerabilities discovered.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A protocol fuzz testing optimization method based on deep learning, characterized in that, The method includes: Before optimization, Boofuzz ​​collected data during fuzzing and categorized message data with different responses according to the server response type. The protocol's dynamic, static, and length fields are initially identified using the protocol reverse engineering module. Requests are then constructed and session messages are set using the identified information within the Boofuzz ​​framework. Test cases are generated based on the fields inferred from the protocol reverse engineering module using the mutation rules within the Boofuzz ​​framework. Construct an optimization model and initialize the model parameters; adjust and optimize the model hyperparameters using the SSA algorithm, and then train the model based on the optimal hyperparameters; the optimization model is a model that combines multiple deep learning networks, including convolutional neural networks, bidirectional long short-term memory networks, attention mechanisms, and Kolmogorov-Arnold networks; The hyperparameters of the selector model are adjusted and optimized using the SSA algorithm, including: 1) Collect message data of different response types during the communication process, and clean, format and normalize the data; 2) The model weights are adjusted by minimizing the loss function, and the model parameters are adjusted based on the loss value using the Adam optimizer to improve the classification accuracy of the model; 3) Hyperparameter optimization is performed using the SSA algorithm, including: ① Initialize the population and generate a set of random solutions, where each solution is a hyperparameter vector. This represents the initial position of each individual; ② The performance of each solution is evaluated through model training and testing, and the fitness of each individual is evaluated through the model's error rate: In the formula, M Indicates the number of samples in the test set. Indicates the first m The true label of each sample Indicates the first m The model predicts the label for each sample; Indicates an indicator function, when A value of 1 indicates a prediction error; ③ By iteratively updating the optimal solution, the final output is the hyperparameter combination with the lowest error rate; during the iteration process, explorer updates, follower updates, and reconnaissance and early warning operations are performed, allowing the follower to move closer to the current optimal solution for local development and optimization; the iteration ends when the preset maximum number of iterations is reached. Or the change in fitness is no longer significant; Feature extraction is performed on the generated test cases to obtain input features; the optimization model is then used to predict the effectiveness of the test cases.

2. The method according to claim 1, characterized in that, The preliminary identification of the protocol's dynamic fields, static fields, and length fields through the protocol reverse engineering module includes: sorting the messages in ascending order of length, and each time applying the improved Smith Waterman algorithm to extract the format string from two adjacent messages until only one string remains, thus obtaining the protocol's static fields. Randomly select several messages, match them with the extracted format strings, and split the format strings, keeping the shorter parts of the subfields; The length field is deduced using an exhaustive search method; The format fields of other types of messages are obtained in the same way. Taking the normal response type of message as the standard, sequence comparison is performed using message data from other types of messages. The fields of different categories are compared to make the field segmentation more refined.

3. The method according to claim 2, characterized in that, The improved Smith-Waterman algorithm is expressed as follows: In the formula, This represents the total score. Indicates the byte matching score. o Indicates a penalty for an open shot; P This represents the relative position penalty function. distance Indicates the distance between two different characters. lenth Indicates the total length of the message.

4. The method according to claim 1, characterized in that, The loss function is expressed as: In the formula, N Indicates the number of training samples. C Indicates the number of categories; Represents the true label, represents the sample i The true category, if the sample i Category c ,but ,otherwise ; Indicates the category predicted by the model. c The probability output, i.e. the output of the Softmax layer.

5. The method according to claim 1, characterized in that, The message data is categorized into normal test cases, invalid test cases, and abnormal test cases. The normal test case is a test case that can respond normally; the invalid test case is a test case that does not respond, does not reply, or has an incorrect response message format; the abnormal test case is a test case that responds with an error.

Images