WEB application firewall automatic test method and device based on distributed scheduling mechanism

Abstract

The invention provides a WEB application firewall automatic test method and device based on a distributed scheduling mechanism, and the method comprises the steps: enabling a host process to access a preset number of protection websites based on a one-host multi-slave structure of the distributed scheduling mechanism; collecting test cases, and grouping the test cases by the host process; the sub-process is initialized, and the main process distributes the test cases of different groups to work nodes with the same number as the protection websites; the working nodes execute the test cases in parallel, execute the test cases after receiving the test cases sent by the host process, and report test results to the host process; the host process collects a test result; according to the method, the test cases are executed in parallel through a distributed scheduling mechanism, the whole process work is automatically set, the human input of the test is saved to the maximum extent, and the problems that the case construction efficiency is low, and the test efficiency is high are solved. And whether an existing protection module can protect vulnerabilities or not cannot be checked in time.

Description

Technical Field

[0001] The present application relates to the field of computer and cyberspace security technology, and in particular to a method and device for automatically testing a WEB application firewall based on a distributed scheduling mechanism. Background Art

[0002] A Web Application Firewall (WAF) is a security device or service designed specifically to protect Web applications. It performs intelligent and comprehensive detection of Web business traffic, effectively identifies malicious traffic and defends against it, thereby preventing malicious intrusions on the source server and protecting the core business and data security of the website.

[0003] Currently, the testing of WEB application firewalls mainly includes the testing of their engine or rule base modules. At present, most of the testing of WEB application firewalls is based on manually constructed test cases or test cases constructed using test tools. The test cases constructed in these two ways have lags and are different from the real website attack traffic. They cannot introduce 0day vulnerabilities to test the protection capabilities of WEB application firewalls against 0day vulnerabilities, and the construction efficiency is low.

[0004] In addition, testers often use manual or semi-automated methods to test WEB application firewalls. When there are many test functions, they need to manually access a large number of protection configurations and execute a large number of test cases. An iterative upgrade of the engine or rule library will take a long time to test, which seriously affects the speed of going online.

[0005] In the testing of WEB application firewall, first you need to connect the website to be protected to the WEB application firewall and configure different protection strategies for the website (CC protection, BOT protection, WEB basic protection, IP blacklist and whitelist, regional access control, etc.). Next, you need to construct corresponding attack traffic for different protection modules and trigger attacks to verify whether the protection strategies of each module of the WEB application firewall are effective. Currently, there are many protection types and rules of WEB application firewall, and there is a priority relationship between the rules. For example, the priority of IP blacklist strategy is higher than CC rule, and the priority of CC rule is higher than WEB basic protection. Therefore, the testing of WEB application firewall cannot be directly executed concurrently because of the dependency of test case scenarios (for example, under a protected website at the same time, triggering attack traffic of different modules in a concurrent way may only hit the protection strategy of one module due to the priority relationship, resulting in the failure of the strategy verification of another module). Therefore, the current automated testing solution is serial execution, and a round of testing takes a long time. Summary of the invention

[0006] The present application shows a method and device for automatically testing a WEB application firewall based on a distributed scheduling mechanism.

[0007] In a first aspect, the present application shows a method for automatically testing a WEB application firewall based on a distributed scheduling mechanism, the method comprising:

[0008] Based on a one-master-multiple-slave structure of a distributed scheduling mechanism, the master process accesses a preset number of protection websites, where the preset number is the same as the number of protection modules;

[0009] Collect test cases, and the main process groups test cases;

[0010] Initialize the child process, and the main process assigns different groups of test cases to the same number of worker nodes as the number of protected websites;

[0011] Each working node executes in parallel. Each working node receives the test case sent by the main process, executes the test case, and reports the test result to the main process;

[0012] The main process collects test results;

[0013] The main process generates test results and sends test reports.

[0014] According to the method of the first aspect of the present application, the main process accesses different protection websites, including:

[0015] The main process will dynamically connect to the corresponding number of protection websites based on the number of working nodes specified at runtime;

[0016] The main process records the domain name of each protected website and creates a new test case folder named after the domain name.

[0017] According to the method of the first aspect of the present application, the collecting of test cases comprises the following steps:

[0018] S101. Design test cases and design different test case templates for different protection modules;

[0019] S102, obtaining real attack traffic, and automatically updating the attack traffic under the corresponding test case;

[0020] S103. Set up a crawler module to regularly collect and classify 0day vulnerabilities published on the Internet, and automatically create new test cases.

[0021] According to the method of the first aspect of the present application, the use case template includes a corresponding protection module configuration access submodule, an attack traffic triggering submodule, a WEB application firewall corresponding protection log acquisition submodule and a protection module verification submodule, wherein the corresponding protection module configuration access submodule dynamically confirms under which protection website the protection configuration is accessed by reading the folder name of the folder where it is located; the attack traffic triggering submodule confirms which protection website to attack by reading the folder name of the folder where it is located, and the configuration of its attack request parameters is derived from the configuration file corresponding to the attack traffic, in which the URI, port, headers and other information of the attack traffic are set; the WEB application firewall corresponding protection log acquisition submodule obtains the protection log information of the WEB application firewall in real time by using the folder name of the folder where it is located and the time when the attack traffic is sent as parameters; the protection module verification submodule confirms whether the protection module is effective by comparing the expected protection information set in the configuration file with the protection information obtained in the log.

[0022] According to the method of the first aspect of the present application, the step of obtaining the real attack traffic and automatically updating the attack traffic under the corresponding test case includes:

[0023] Obtain the real attack traffic of the corresponding protection module in the attack cluster log;

[0024] For the attack traffic of the corresponding module, retain the attack features such as payload, path, user_agent, and replace the attack domain name and other information with the test domain name information;

[0025] Replace the corresponding module test case in the test file with the generated new test case.

[0026] According to the method of the first aspect of the present application, the main process performs test case grouping, including:

[0027] The main process scans all test cases under the specified test case folder, classifies the test cases according to the protection modules, and evenly distributes the protection modules into corresponding folders named after the domain name.

[0028] According to the method of the first aspect of the present application, the main process allocates different groups of test cases to working nodes that are the same number as the protected websites, including:

[0029] The main process creates a gateway through execnet and connects to each working node;

[0030] When sending a task, the main process uses the send method of execnet to send the test case path to the working node;

[0031] The working node returns the test results to the main process through the receive method of execnet.

[0032] According to the method of the first aspect of the present application, the process communication between the main process and the working node comprises the following steps:

[0033] S201, based on the polling scheduling method, the main process sends about 30% of the test cases in each folder to the corresponding working node;

[0034] S202, based on the detection method, the main process sends about 70% of the test cases in each folder to the corresponding working node;

[0035] S203, when there are 5% of the test cases to be executed by the working node, the working node will send a "hungry" signal to the main process, and the main process will continue to send new test cases to the corresponding working node after receiving the signal;

[0036] S204, when the main process has no more test tasks, a "shutdown" signal is sent to all working nodes, and the working nodes exit the process after receiving the signal;

[0037] S205: After the main process waits for all working nodes to exit, it executes the protection website access and report sending operations.

[0038] According to the method of the first aspect of the present application, each working node executes in parallel, including:

[0039] After receiving the task, each working node executes the assigned test cases sequentially in an independent environment;

[0040] After collecting a complete set of test sets, the worker node will send the collected test IDs to the main process that does not undertake the execution task.

[0041] A WEB application firewall automated testing device based on a distributed scheduling mechanism comprises a processor and a memory for storing processor executable instructions; wherein the processor is configured to execute the WEB application firewall automated testing method based on a distributed scheduling mechanism as described in any one of the above aspects.

[0042] The technical solution provided by this application may have the following beneficial effects:

[0043] (1) This application introduces a distributed scheduling mechanism, which allocates the testing work of corresponding modules to different sub-processes through the main process, uses the protected website domain name as a folder, and stores the test cases of each protection module in a classified manner. The distributed scheduling mechanism is used to execute the test cases assigned to the corresponding domain name in parallel to eliminate the test case dependency when executing a single protection domain name, thereby shortening the testing time of the WEB application firewall;

[0044] (2) In the design of the use case, the present invention uses the real attack traffic collected by the online attack cluster to expand the request traffic in the test case, solving the problem of the difference between the attack traffic in the use case construction and the real website attack traffic. In addition, the present invention regularly collects 0day vulnerabilities published on the Internet through the crawler module, and automatically corresponds to the test case of the module according to its category, so as to solve the problem that the WEB application firewall cannot timely verify whether the existing protection module can protect against 0day vulnerabilities;

[0045] (3) This application can automatically complete the entire process of accessing the protection website and protection configuration, triggering the attack traffic of each module, and verifying the protection capabilities of each module of the WEB application firewall, thereby saving manpower investment in testing to the greatest extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is a flowchart of the steps of a WEB application firewall automatic testing method and device based on a distributed scheduling mechanism of the present application.

[0047] Figure 2 It is a flow chart of replacing the test attack traffic with the real attack traffic in this application.

[0048] Figure 3 This is a flow chart of the 0day traffic verification protection function solution in this application.

[0049] Figure 4 This is the process communication flow chart between the master process and the working node in this application.

[0050] Figure 5 It is a block diagram of an electronic device of the present application.

[0051] Figure 6 It is a block diagram of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0053] Before introducing the WEB application firewall automatic testing method and device based on the distributed scheduling mechanism provided by the present application, the professional terms involved in the present application are first explained.

[0054] execnet is a Python library whose main functions and features can be summarized as follows:

[0055] 1. Main functions

[0056] Instantiation and Execution: execnet allows users to instantiate local or remote Python interpreters and execute code on those interpreters.

[0057] Data transfer: Through defined channels, execnet can send and receive data, making data communication across interpreters feasible. 2. Technical Background

[0059] As a Python library, execnet provides Python programmers with powerful cross-interpreter communication and execution capabilities. This allows users to execute Python code in parallel on different machines or devices and exchange data through simple APIs.

[0060] 3. Application Scenarios

[0061] Distributed computing: execnet can make distributed computing tasks easier. By instantiating the Python interpreter and executing code on different nodes, users can make full use of the computing resources of multiple machines.

[0062] Remote debugging: For situations where you need to debug Python code on a remote machine, execnet can be used as an effective remote execution and debugging tool.

[0063] Automated testing: In the field of automated testing, execnet can be used to execute test code in different environments to verify the cross-platform compatibility of the software.

[0064] Reference Figure 1 , shows a flowchart of a method and device for automatically testing a WEB application firewall based on a distributed scheduling mechanism of the present application, wherein the method may specifically include the following steps:

[0065] In step S101, a master-slave structure based on a distributed scheduling mechanism is provided, wherein the master process accesses different protection websites; the master process is the master process, which is responsible for executing test preconditions, allocating test cases, scheduling subprocesses, summarizing test results, and executing test postconditions; the subprocesses execute specific test tasks according to the instructions issued by the master process and report the execution results to the master process.

[0066] The distributed scheduling mechanism is a strategy or method for coordinating and managing resource allocation and task execution in a distributed system. It ensures high performance, reliability and scalability of the system by efficiently allocating tasks and coordinating resource usage among multiple computing nodes.

[0067] In step S102, test cases are collected and the main process performs test case grouping;

[0068] In step S103, the subprocess is initialized, and the main process allocates the test cases of different groups to the same number of working nodes as the number of protected websites;

[0069] In step S104, each working node executes in parallel, each working node receives the test case sent by the main process, executes the test case, and reports the test result to the main process;

[0070] In step S105, the master process collects the test results. Specifically, after all working nodes complete the test, the results are sent back to the master process. The master process collects the test results from each working node through execnet and performs summary analysis.

[0071] In step S106, the protection website is accessed;

[0072] Specifically, after summarizing the results, the master process disconnects the previously connected protection websites and their corresponding protection configurations to ensure that the protection resources are released reasonably.

[0073] In step S107, the master process generates the test results and sends the test report. The master process generates the test report and sends it to the relevant personnel via WeChat for Business. The report includes the test results of each protected website and the overall test situation.

[0074] This application groups the test cases to be tested, assigns the test cases of different groups to different protection websites, and adopts a distributed scheduling mechanism to concurrently execute the test cases to be tested through multiple processes. The corresponding sub-process is responsible for executing the test cases assigned to the corresponding protection website. Finally, each sub-process reports its own test results to the master node for summary.

[0075] According to the method of the present application, at the beginning of the test work, the master process will dynamically access the corresponding number of protection websites according to the number of working nodes specified at runtime. The master process will record the domain name of each protection website and create a new test case folder named after the domain name.

[0076] According to the method of the present application, the collecting of test cases comprises the following steps:

[0077] S101. Design test cases and design different test case templates for different protection modules;

[0078] S102, obtaining real attack traffic, and automatically updating the attack traffic under the corresponding test case;

[0079] S103. Set up a crawler module to regularly collect and classify 0day vulnerabilities published on the Internet, and automatically create new test cases.

[0080] Reference Figure 3 In order to solve the problem that the WEB application firewall cannot timely check whether the existing protection module can protect 0day vulnerabilities, the present invention introduces a crawler module to regularly collect 0day vulnerabilities published on the Internet, classify them according to their corresponding description categories, retain the attack traffic characteristics such as payload and headers in the corresponding POC use case, and automatically create a new test case with the corresponding attack traffic characteristics to verify whether the protection capability of the corresponding module is normal.

[0081] According to the method of the present application, the use case template includes a corresponding protection module configuration access submodule, an attack traffic triggering submodule, a WEB application firewall corresponding protection log acquisition submodule, and a protection module verification submodule.

[0082] The corresponding protection module configuration access submodule dynamically confirms under which protection website the protection configuration is accessed by reading the folder name of the folder where it is located.

[0083] The attack traffic triggering submodule determines which protection website to attack by reading the folder name of the folder where it is located. The configuration of its attack request parameters is derived from the configuration file corresponding to the attack traffic. The configuration file sets the URI (Uniform Resource Identifier), port (port), headers (message header) and other information of the attack traffic.

[0084] The protection log acquisition submodule corresponding to the WEB application firewall obtains the protection log information of the WEB application firewall in real time by using the folder name of the folder where it is located and the time when the attack traffic is sent as parameters.

[0085] The protection module verification submodule confirms whether the protection module is effective by comparing the expected protection information set in the configuration file with the protection information obtained in the log.

[0086] Reference Figure 2 According to the method of the present application, the actual attack traffic is obtained and the attack traffic under the corresponding test case is automatically updated, including:

[0087] Obtain the real attack traffic of the corresponding protection module in the attack cluster log;

[0088] For the attack traffic of the corresponding module, retain the attack features such as payload, path, user_agent, and replace the attack domain name with the test domain name information;

[0089] Replace the corresponding module test case in the test file with the generated new test case.

[0090] In order to solve the problem of the difference between the attack traffic in the use case construction and the real website attack traffic. This application uses a scheduled task to regularly obtain the real attack traffic of the corresponding protection module collected by the online attack cluster log module, retain the attack features such as payload, path, user_agent, etc., generate a new attack traffic configuration file for the corresponding module, and automatically update the attack traffic under the corresponding test case to ensure the authenticity of the constructed use case.

[0091] According to the method of the present application, the main process performs test case grouping, including:

[0092] The main process scans all test cases under the specified test case folder, classifies the test cases according to the protection modules, and evenly distributes the protection modules into corresponding folders named after the domain name.

[0093] Specifically, after accessing the protection website, the master process scans all test cases under the specified test folder, classifies the cases according to the protection module, and evenly distributes the protection modules into corresponding folders named after the domain name. This ensures that each working node only processes the test cases of the corresponding protection module assigned to the corresponding protection website. Through this operation, during multi-process concurrent testing, since different working nodes correspond to different protection websites and test different protection modules, it can be ensured that the test cases of the CC protection module executed by working node 1 do not affect the test cases of the web basic protection module executed by working node 2.

[0094] Reference Figure 4 According to the method of the present application, the main process allocates different groups of test cases to the same number of working nodes as the number of protected websites, including:

[0095] The main process creates a gateway through execnet and connects to each working node;

[0096] When sending a task, the main process uses the send method of execnet to send the test case path to the working node;

[0097] The working node returns the test results to the main process through the receive method of execnet.

[0098] Working principle:

[0099] The main process creates a gateway through execnet, which serves as a connection point with each working node (working process); the main process uses the send method of execnet to send the test case path or other task information to the working node; after the working node completes the task, it returns the test results or other execution results to the main process through the receive method of execnet.

[0100] The master process starts the same number of worker nodes as the protected websites. The worker nodes can be local or remote. The master and worker nodes communicate using execnet and its gateway to ensure efficient and reliable task allocation and result return.

[0101] execnet provides a simple and flexible way to implement distributed computing, such as distributed task dispatching, distributed data processing, etc. In specific application scenarios, such as natural language processing (NLP), execnet can significantly accelerate the processing of tasks. By dividing the text into chunks and processing it in parallel on multiple processes or nodes, execnet can help improve computing efficiency and complete NLP-related tasks faster.

[0102] In the communication network, each process can be accessed through the data communication gateway. The channel allows data exchange between processes (which can be exchanged locally or remotely). The main process master creates a gateway through execnet and connects to each working node. When sending a task, the master uses the send method of execnet to send the test case path to the working node; the working node uses the receive method of execnet to return the test results to the master process.

[0103] Reference Figure 4 According to the method of the present application, the process communication between the main process and the working node includes the following steps:

[0104] S201, based on the polling scheduling method, the main process sends about 30% of the test cases in each folder to the corresponding working node;

[0105] S202, based on the detection method, the main process sends about 70% of the test cases in each folder to the corresponding working node;

[0106] S203, when there are 5% of the test cases to be executed by the working node, the working node will send a "hungry" signal to the main process, and the main process will continue to send new test cases to the corresponding working node after receiving the signal;

[0107] S204, when the main process has no more test tasks, a "shutdown" signal is sent to all working nodes, and the working nodes exit the process after receiving the signal;

[0108] S205: After the main process waits for all working nodes to exit, it executes the protection website access and report sending operations.

[0109] According to the method of the present application, each working node is executed in parallel, including:

[0110] After receiving the task, each working node executes the assigned test cases sequentially in an independent environment;

[0111] After collecting a complete set of test sets, the worker node will send the collected test IDs to the main process that does not undertake the execution task.

[0112] A WEB application firewall automated testing device based on a distributed scheduling mechanism comprises a processor and a memory for storing processor executable instructions; wherein the processor is configured to execute the WEB application firewall automated testing method based on a distributed scheduling mechanism as described in any one of the above aspects.

[0113] The technical problems solved by this embodiment are:

[0114] (1) A distributed scheduling mechanism is introduced to assign the testing work of the corresponding modules to different sub-processes through the main process. The protection website domain name is used as a folder to store the test cases of each protection module in a classified manner. The distributed scheduling mechanism is used to execute the test cases assigned to the corresponding domain name in parallel, and the test case dependency relationship when executing a single protection domain name is eliminated. The whole process of accessing the protection website and protection configuration, triggering the attack traffic of each module, and verifying the protection capability of each module of the WEB application firewall is automatically completed, solving the problem that the traditional testing method has a long testing time and seriously affects the online speed.

[0115] (2) In the design of the use case, the present invention uses the real attack traffic collected by the online attack cluster to dynamically update the attack traffic in the test case, solving the problem of the difference between the attack traffic and the real website attack traffic in the traditional method; the crawler module regularly collects 0day vulnerabilities published on the Internet and automatically matches the test cases of the module according to their categories, solving the problem that the WEB application firewall cannot timely verify whether the existing protection module can protect against 0day vulnerabilities.

[0116] The technical solution provided by this embodiment may have the following beneficial effects:

[0117] (1) This application introduces a distributed scheduling mechanism, which allocates the testing work of corresponding modules to different sub-processes through the main process, uses the protected website domain name as a folder, and stores the test cases of each protection module in a classified manner. The distributed scheduling mechanism is used to execute the test cases assigned to the corresponding domain name in parallel to eliminate the test case dependency when executing a single protection domain name, thereby shortening the testing time of the WEB application firewall;

[0118] (2) In the design of the use case, the present invention uses the real attack traffic collected by the online attack cluster to expand the request traffic in the test case, solving the problem of the difference between the attack traffic in the use case construction and the real website attack traffic. In addition, the present invention regularly collects 0day vulnerabilities published on the Internet through the crawler module, and automatically corresponds to the test case of the module according to its category, so as to solve the problem that the WEB application firewall cannot timely verify whether the existing protection module can protect against 0day vulnerabilities;

[0119] (3) This application can automatically complete the entire process of accessing the protection website and protection configuration, triggering the attack traffic of each module, and verifying the protection capabilities of each module of the WEB application firewall, thus saving the manpower investment in testing to the greatest extent.

[0120] This application provides a mature automated testing solution for Web application firewalls; provides a solution for test scenarios where there are dependencies between use cases and concurrent testing cannot be introduced; provides a solution for the construction of complex test cases; and provides a set of efficient and complete tools for real-time detection of website security protection.

[0121] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the present application.

[0122] Optionally, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0123] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0124] Figure 5 800 is a block diagram of an electronic device 800 shown in the present application. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0125] Reference Figure 5 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0126] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0127] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, images, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0128] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0129] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0130] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0131] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0132] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0133] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0134] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0135] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by a processor 820 of an electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0136] Figure 619 is a block diagram of a computer-readable storage medium 1900 shown in the present application. For example, the computer-readable storage medium 1900 may be provided as a server.

[0137] Reference Figure 6 , the computer-readable storage medium 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0138] The computer readable storage medium 1900 may also include a power supply component 1926 configured to perform power management of the computer readable storage medium 1900, a wired or wireless network interface 1950 configured to connect the computer readable storage medium 1900 to a network, and an input / output (I / O) interface 1958. The computer readable storage medium 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™ or the like.

[0139] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0140] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0141] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0142] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0143] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0144] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0145] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0146] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0147] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0148] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A WEB application firewall automatic testing method based on distributed scheduling mechanism, characterized in that: The method comprises: Based on a one-master-multiple-slave structure of a distributed scheduling mechanism, the master process accesses a preset number of protection websites, where the preset number is the same as the number of protection modules; Collect test cases, and the main process groups test cases; Initialize the child process, and the main process assigns different groups of test cases to the same number of worker nodes as the number of protected websites; Each working node executes in parallel. Each working node receives the test case sent by the main process, executes the test case, and reports the test result to the main process; The main process collects test results; The main process generates test results and sends test reports.

2. The method for automatically testing a WEB application firewall based on a distributed scheduling mechanism according to claim 1 is characterized in that: The main process accesses a preset number of protection websites, including: The main process will dynamically connect to the corresponding number of protection websites based on the number of working nodes specified at runtime; The main process records the domain name of each protected website and creates a new test case folder named after the domain name.

3. The automatic testing method for WEB application firewall based on distributed scheduling mechanism according to claim 2 is characterized in that: The collecting of test cases comprises the following steps: S101. Design test cases and design different test case templates for different protection modules; S102, obtaining real attack traffic, and automatically updating the attack traffic under the corresponding test case; S103. Set up a crawler module to regularly collect and classify 0day vulnerabilities published on the Internet, and automatically create new test cases.

4. The method for automatically testing a WEB application firewall based on a distributed scheduling mechanism according to claim 3 is characterized in that: The use case template includes a corresponding protection module configuration access submodule, an attack traffic triggering submodule, a WEB application firewall corresponding protection log acquisition submodule and a protection module verification submodule. The corresponding protection module configuration access submodule dynamically confirms under which protection website the protection configuration is accessed by reading the folder name of the folder where it is located; the attack traffic triggering submodule confirms which protection website to attack by reading the folder name of the folder where it is located, and the configuration of its attack request parameters is derived from the configuration file corresponding to the attack traffic, and the URI, port, headers and other information of the attack traffic are set in the configuration file; the WEB application firewall corresponding protection log acquisition submodule obtains the protection log information of the WEB application firewall in real time by using the folder name of the folder where it is located and the time when the attack traffic is sent as parameters; the protection module verification submodule confirms whether the protection module is effective by comparing the expected protection information set in the configuration file with the protection information obtained in the log.

5. The method for automatically testing a WEB application firewall based on a distributed scheduling mechanism according to claim 3 is characterized in that: The obtaining of the real attack traffic and automatically updating the attack traffic under the corresponding test case includes: Obtain the real attack traffic of the corresponding protection module in the attack cluster log; For the attack traffic of the corresponding module, retain the attack features such as payload, path, user_agent, and replace the attack domain name and other information with the test domain name information; Replace the corresponding module test case in the test file with the generated new test case.

6. The method for automatically testing a WEB application firewall based on a distributed scheduling mechanism according to claim 3 is characterized in that: The main process performs test case grouping, including: The main process scans all test cases under the specified test case folder, classifies the test cases according to the protection modules, and evenly distributes the protection modules into corresponding folders named after the domain name.

7. The automatic testing method for WEB application firewall based on distributed scheduling mechanism according to claim 1 is characterized in that: The master process distributes different groups of test cases to the same number of worker nodes as the number of protected websites, including: The main process creates a gateway through execnet and connects to each working node; When sending a task, the main process uses the send method of execnet to send the test case path to the working node; The working node returns the test results to the main process through the receive method of execnet.

8. The method for automatically testing a WEB application firewall based on a distributed scheduling mechanism according to claim 7 is characterized in that: The process communication between the main process and the working node includes the following steps: S201, based on the polling scheduling method, the main process sends about 30% of the test cases in each folder to the corresponding working node; S202, based on the detection method, the main process sends about 70% of the test cases in each folder to the corresponding working node; S203, when there are 5% of the test cases to be executed by the working node, the working node will send a "hungry" signal to the main process, and the main process will continue to send new test cases to the corresponding working node after receiving the signal; S204, when the main process has no more test tasks, a "shutdown" signal is sent to all working nodes, and the working nodes exit the process after receiving the signal; S205: After the main process waits for all working nodes to exit, it executes the protection website access and report sending operations.

9. The method for automatically testing a WEB application firewall based on a distributed scheduling mechanism according to claim 1, characterized in that: Each working node executes in parallel, including: After receiving the task, each working node executes the assigned test cases sequentially in an independent environment; After collecting a complete set of test sets, the worker node will send the collected test IDs to the main process that does not undertake the execution task.

10. A WEB application firewall automatic testing device based on distributed scheduling mechanism, characterized in that: It comprises a processor and a memory for storing processor executable instructions; wherein the processor is configured to execute the method for automated testing of a WEB application firewall based on a distributed scheduling mechanism as described in any one of claims 1-9.

Images