Fuzzy test method and device based on VPC, computer equipment and readable storage medium

Abstract

The invention relates to a VPC-based fuzz testing method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: in a current round, intercepting initial message data based on a target IP and port information corresponding to a to-be-tested service; grouping the initial message data based on a preset grouping rule to obtain at least one message group; for any message group, cleaning the message group and the target message data determined in the previous round based on a preset cleaning rule, and determining the target message data corresponding to the current round; if the current round is not the Nth round, entering the next round, and repeatedly executing the step of intercepting the initial message data based on the target IP and port information corresponding to the service to be tested until the Nth round is executed; and packaging the target message data determined in the Nth round into a test flow packet, and sending the test flow packet to the target equipment. By adopting the method, the testing efficiency of the cloud security product can be improved.

Description

Technical Field

[0001] The present application relates to the field of testing technology, and in particular to a VPC-based fuzz testing method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] Cloud security products are solutions designed to protect data, applications, and infrastructure in cloud computing environments. With the widespread use of cloud computing, cloud security products are becoming increasingly important.

[0003] As the user base of cloud security products expands, the number of customers and product types become increasingly diverse, which undoubtedly increases the difficulty of testing cloud security products and leads to low testing efficiency of cloud security products. Summary of the invention

[0004] Based on this, it is necessary to provide a VPC-based fuzz testing method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve the testing efficiency of cloud security products in response to the above technical problems.

[0005] In a first aspect, the present application provides a VPC-based fuzzy testing method, which is applied to a gateway. The method includes:

[0006] In the current round, the initial message data is intercepted based on the target IP and port information corresponding to the service to be tested;

[0007] Grouping the initial message data based on a preset grouping rule to obtain at least one message group;

[0008] For any message group, the message group and the target message data determined in the previous round are cleaned based on the preset cleaning rules to determine the target message data corresponding to the current round;

[0009] If the current round is not the Nth round, then enter the next round and repeat the step of intercepting the initial message data based on the target IP and port information corresponding to the service to be tested until the Nth round is reached, where N is an integer greater than 0;

[0010] The target message data determined in the Nth round is encapsulated into a test traffic packet, and the test traffic packet is sent to a target device, so that the target device performs a fuzzy test on the service to be tested based on the test traffic packet, wherein the service to be tested is installed in the target device, and the target device and the gateway are deployed in the same VPC network environment.

[0011] In one embodiment, the cleaning of the message group and the target message data determined in the previous round based on the preset cleaning rule to determine the target message data corresponding to the current round includes:

[0012] Acquire a preset number of candidate message data from the message group and the target message data determined in the previous round;

[0013] Based on the stability of each of the candidate message data, the target message data corresponding to the current round is determined from each of the candidate message data.

[0014] In one of the embodiments, obtaining a preset number of candidate message data from the message group and the target message data determined in the previous round includes:

[0015] For any message data in the message group, obtaining a feature value corresponding to each feature dimension of the message data, and determining a testable score of the message data based on the feature value corresponding to each feature dimension;

[0016] Determine first target message data and second target message data from the message group and the target message data determined in the previous round, wherein the first target message data is message data in the message group that is repeated with the target message data determined in the previous round, and the second message data is message data in the message group and the target message data determined in the previous round except the first target message data;

[0017] For the first target message data, accumulating the testability score of the first target message data determined in the previous round and the testability score determined in the current round, and updating the testability score of the first target message data based on the accumulation result;

[0018] The message data whose testable scores satisfy the fuzzy test conditions among the first target message data and the second target message data are determined as candidate message data.

[0019] In one embodiment, determining the message data whose testable scores satisfy the fuzzy test condition among the first target message data and the second target message data as candidate message data includes:

[0020] Sorting the first target message data and the second target message data in descending order according to the testable scores to obtain a message queue;

[0021] A preset number of message data in the message queue are used as candidate message data.

[0022] In one of the embodiments, determining the target message data corresponding to the current round from each of the candidate message data based on the stability of each of the candidate message data includes:

[0023] For any of the candidate message data, replay the candidate message data m times, and determine the testable score of the candidate message data during each replay test;

[0024] Based on the testable scores corresponding to the candidate message data in the current round and the testable scores corresponding to each replay test process, the target message data corresponding to the current round is determined from the candidate message data.

[0025] In one embodiment, the feature dimensions include message length, response time, and connection time, and obtaining the feature value corresponding to each feature dimension of the message data, and determining the testable score of the message data based on the feature value corresponding to each feature dimension, includes:

[0026] Obtain the message length, response time and connection time corresponding to the message data;

[0027] Determine a first score of the message data based on the message length, determine a second score of the message data based on the response time, and determine a third score of the message data based on the connection time, wherein the first score is positively correlated with the message length, the second score is positively correlated with the message length, and the third score is positively correlated with the connection time;

[0028] A testable score of the message data is determined according to the first score, the second score, and the third score.

[0029] In a second aspect, the present application further provides a VPC fuzzy testing device, which is applied to a gateway, and the device includes:

[0030] The acquisition module is used to intercept the initial message data based on the target IP and port information corresponding to the service to be tested in the current round;

[0031] A grouping module, used for grouping the initial message data based on a preset grouping rule to obtain at least one message group;

[0032] A cleaning module, for cleaning any message group and the target message data determined in the previous round based on a preset cleaning rule, and determining the target message data corresponding to the current round;

[0033] A judgment module, used for entering the next round if the current round is not the Nth round, and repeatedly executing the step of intercepting the initial message data based on the target IP and port information corresponding to the service to be tested until the Nth round is executed, where N is an integer greater than 0;

[0034] A test module is used to encapsulate the target message data determined in the Nth round into a test traffic packet, and send the test traffic packet to a target device so that the target device performs a fuzzy test on the service to be tested based on the test traffic packet, wherein the service to be tested is installed in the target device, and the target device and the gateway are deployed in the same VPC network environment.

[0035] In one embodiment, the cleaning module is specifically used for:

[0036] Acquire a preset number of candidate message data from the message group and the target message data determined in the previous round;

[0037] Based on the stability of each of the candidate message data, the target message data corresponding to the current round is determined from each of the candidate message data.

[0038] In one embodiment, the cleaning module is specifically used for:

[0039] For any message data in the message group, obtaining a feature value corresponding to each feature dimension of the message data, and determining a testable score of the message data based on the feature value corresponding to each feature dimension;

[0040] Determine first target message data and second target message data from the message group and the target message data determined in the previous round, wherein the first target message data is message data in the message group that is repeated with the target message data determined in the previous round, and the second message data is message data in the message group and the target message data determined in the previous round except the first target message data;

[0041] For the first target message data, accumulating the testability score of the first target message data determined in the previous round and the testability score determined in the current round, and updating the testability score of the first target message data based on the accumulation result;

[0042] The message data whose testable scores satisfy the fuzzy test conditions among the first target message data and the second target message data are determined as candidate message data.

[0043] In one embodiment, the cleaning module is specifically used for:

[0044] Sorting the first target message data and the second target message data in descending order according to the testable scores to obtain a message queue;

[0045] A preset number of message data in the message queue are used as candidate message data.

[0046] In one embodiment, the cleaning module is specifically used for:

[0047] For any of the candidate message data, replay the candidate message data m times, and determine the testable score of the candidate message data during each replay test;

[0048] Based on the testable scores corresponding to the candidate message data in the current round and the testable scores corresponding to each replay test process, the target message data corresponding to the current round is determined from the candidate message data.

[0049] In one embodiment, the characteristic dimensions include message length, response time, and connection time, and the cleaning module is specifically used to:

[0050] Obtain the message length, response time and connection time corresponding to the message data;

[0051] Determine a first score of the message data based on the message length, determine a second score of the message data based on the response time, and determine a third score of the message data based on the connection time, wherein the first score is positively correlated with the message length, the second score is positively correlated with the message length, and the third score is positively correlated with the connection time;

[0052] A testable score of the message data is determined according to the first score, the second score, and the third score.

[0053] In a third aspect, the present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements any of the above VPC-based fuzz testing methods when executing the computer program.

[0054] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, it implements any of the above VPC-based fuzz testing methods.

[0055] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements any of the above VPC-based fuzz testing methods when executed by a processor.

[0056] The above-mentioned VPC-based fuzzy testing method, device, computer equipment, computer-readable storage medium and computer program product can intercept the passing traffic directly from the gateway for the service to be tested, and automatically screen and analyze the effective traffic from the intercepted traffic based on the preset cleaning rules, and perform fuzzy testing on the service to be tested in the network environment of the VPC based on the screened effective traffic. That is, the VPC-based fuzzy testing method, device, computer equipment, computer-readable storage medium and computer program product provided by the embodiments of the present application can mine effective traffic from existing network communications in a secure environment, and perform extensive fuzzy performance testing on the service to be tested. The data is more real and can cover more cloud security products. The transport layer traffic is directly intercepted for traffic screening and analysis, and the data construction is simple. The fuzzy test can be completed without manually creating and screening specific performance test scenarios and test data. Therefore, the efficiency of fuzzy testing for cloud security products can be greatly improved, and it has the advantages of low production cost, wide range of use, and high portability. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A schematic diagram of a flow chart of a VPC-based fuzzy testing method in an embodiment;

[0059] Figure 2 is a flow chart of step 106 in one embodiment;

[0060] Figure 3 is a flow chart of step 202 in one embodiment;

[0061] Figure 4 is a flow chart of step 302 in one embodiment;

[0062] Figure 5 is a flow chart of step 308 in one embodiment;

[0063] Figure 6 is a flow chart of step 204 in one embodiment;

[0064] Figure 7 is a schematic diagram of a VPC-based fuzzy testing method in an embodiment;

[0065] Figure 8 is a schematic diagram of a VPC-based fuzzy testing method in an embodiment;

[0066] Fig. 9 is a schematic diagram of a VPC-based fuzzy testing method in an embodiment;

[0067] Fig.10 is a structural block diagram of a VPC-based fuzzy testing device in one embodiment;

[0068] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0070] As the user groups of cloud security products expand, the number of customers and product types are becoming more and more diverse. Among the related technologies, performance testing for cloud products has the following shortcomings:

[0071] (1) There are many types of cloud security products. Every time a new product function is launched, it is necessary to manually screen specific scenarios for performance testing. Due to the wide variety of protocols and functions, it is necessary to construct actual scenarios and then analyze and screen out effective protocol scenarios. This consumes a lot of manpower and material resources, resulting in low testing efficiency and high costs.

[0072] (2) The data construction process is cumbersome and non-reusable. The test data that is constructed after spending a lot of effort is only applicable to the current test scenario. When new functions are added later, the previous analysis, screening and construction process needs to be repeated, which also consumes a lot of manpower and material resources, resulting in low test efficiency and high costs.

[0073] (3) The test scope is not comprehensive. Due to the cumbersomeness of the above two points, it is impossible to conduct targeted analysis and testing on all protocols, which may cause important scenarios to be missed, resulting in greater losses, that is, poor test results.

[0074] (4) Potential security risks. Because server resources are limited, multiple services are often deployed on one network. When conducting traffic attack tests on a particular product, it is easy to accidentally damage other services.

[0075] In order to solve the above technical problems, an embodiment of the present application provides a fuzzy testing method based on VPC (Virtual Private Cloud), which is described and introduced below.

[0076] In one embodiment, Figure 1As shown, a VPC-based fuzzy testing method is provided. This embodiment uses the method applied to a gateway as an example. In this embodiment, the method includes the following steps 102 to 110, wherein:

[0077] Step 102: In the current round, initial message data is intercepted based on the target IP and port information corresponding to the service to be tested.

[0078] In the embodiment of the present application, the service to be tested is a service in the cloud security product to be fuzz tested. The service to be tested is deployed on the target device. The target device and the gateway are deployed in the same VPC network environment. The gateway usually serves as a traffic entry, responsible for receiving requests from external or internal networks and forwarding them to the target service. Among them, the gateway can intercept the initial message data corresponding to the service to be tested through multiple rounds of traffic interception operations. In each round, the gateway server can perform initial message interception based on the target IP and port information corresponding to the service to be tested.

[0079] Exemplarily, the target IP and port of the service to be tested can be first determined. For example, the target IP is 10.0.0.10 and the port is 8080. Further determine the network card information on the gateway, for example: use commands such as ifconfig or ip addr show to determine the name of the network card used for traffic entry, such as eth0. Furthermore, the packet capture tool installed on the gateway (for example: Wireshark, tcpdump, tshark, etc.) can be used to capture the traffic data flowing through the eth0 network card, with the target IP being 10.0.0.10 and the port being 8080, as the initial message data.

[0080] Step 104: group the initial message data based on a preset grouping rule to obtain at least one message group.

[0081] In an embodiment of the present application, for the captured initial message data, the initial message data can be grouped based on a preset grouping rule to obtain at least one message group. Exemplarily, the preset grouping rule can include grouping according to protocol type, for example: messages corresponding to the TCP (Transmission Control Protocol) protocol are divided into one message group, and messages corresponding to the UDP (User Datagram Protocol) protocol are divided into one message group.

[0082] In this way, we can obtain message groups corresponding to different protocol types, implement targeted analysis and testing of all protocol types involved in the service, avoid missing important scenario tests, increase the test scope and coverage of fuzz testing, and improve test results.

[0083] Step 106: for any message group, the message group and the target message data determined in the previous round are cleaned based on the preset cleaning rule to determine the target message data corresponding to the current round.

[0084] In the embodiment of the present application, after dividing into multiple message groups, for each message group, a preset cleaning rule can be used to clean the message group and the target message data determined in the previous round, so as to screen out valid message data with test value from the multiple message data, and participate in the next round of message screening. The preset cleaning rule can be a pre-set rule for screening valid message data with test value based on the service characteristics of the service to be tested, and can be set by a person skilled in the art based on demand.

[0085] For example, if the service to be tested is sensitive to response time and connection implementation, that is, messages with longer response time and connection time are more likely to be outliers, then corresponding cleaning rules can be set based on response time and connection time to filter out messages with longer response time and connection time as target message data.

[0086] Step 108, if the current round is not the Nth round, enter the next round and repeat the step of intercepting the initial message data based on the target IP and port information corresponding to the service to be tested until the Nth round is reached, where N is an integer greater than 0.

[0087] In the embodiment of the present application, there are a total of N rounds of intercepting message data. If the current round is not the Nth round, the next round can be entered to repeatedly perform the operation of intercepting the initial message data based on the target IP and port information corresponding to the service to be tested until the Nth round is reached.

[0088] Step 110, encapsulate the target message data determined in the Nth round into a test traffic packet, and send the test traffic packet to the target device, so that the target device performs a fuzzy test on the service to be tested based on the test traffic packet, wherein the service to be tested is installed in the target device, and the target device and the gateway are deployed in the same VPC network environment.

[0089] In an embodiment of the present application, after the Nth round of message screening is completed, the screened target messages can be assembled into formal test traffic packets and distributed to the target device to initiate large-scale fuzzy testing.

[0090] The VPC-based fuzzy testing method provided in the embodiment of the present application can intercept the passing traffic directly from the gateway for the service to be tested, and automatically screen and analyze the effective traffic from the intercepted traffic based on the preset cleaning rules, and perform fuzzy testing on the service to be tested in the network environment of the VPC based on the screened effective traffic. That is, the fuzzy testing method provided in the embodiment of the present application can mine effective traffic from existing network communications in a secure environment, and perform extensive fuzzy performance testing on the service to be tested. The data is more realistic and can cover more cloud security products. The transport layer traffic is directly intercepted for traffic screening and analysis, and the data construction is simple. The fuzzy test can be completed without manually creating and screening specific performance test scenarios and test data. Therefore, the efficiency of fuzzy testing for cloud security products can be greatly improved, and it has the advantages of low production cost, wide application range, and high portability.

[0091] In an exemplary embodiment, referring to Figure 2 As shown, in step 106, based on the preset cleaning rule, the message group and the target message data determined in the previous round are cleaned to determine the target message data corresponding to the current round, which may include the following steps 202 to 204, wherein:

[0092] Step 202, obtaining a preset number of candidate message data from the message group and the target message data determined in the previous round;

[0093] In an embodiment of the present application, for any message group, a preset number of candidate message data can be further screened from the message data corresponding to the message group and the target message data screened out from the message group for the protocol type in the previous round. The preset number can be a preset number of messages or a number of messages determined based on a preset ratio and the total number of messages. The embodiment of the present application does not make any specific limitation on this.

[0094] In an exemplary embodiment, referring to Figure 3 As shown, in step 202, obtaining a preset number of candidate message data from the message group and the target message data determined in the previous round may include the following steps 302 to 308, wherein:

[0095] Step 302: For any message data in the message group, obtain the feature value corresponding to each feature dimension of the message data, and determine the testable score of the message data based on the feature value corresponding to each feature dimension.

[0096] In an embodiment of the present application, each feature dimension can be preset based on the product characteristics corresponding to the service to be tested. For example, the preset feature dimensions are message length, response time, and connection time. The testable score of the message data can be determined based on the feature values ​​corresponding to the message data in each feature dimension. For example, based on the feature values ​​corresponding to each feature dimension, the score for the feature dimension is determined, and the scores of each feature dimension are accumulated to obtain the testable score of the message data.

[0097] In an exemplary embodiment, the characteristic dimensions include message length, response time, and connection time. Figure 4 As shown, in step 302, obtaining the feature value corresponding to each feature dimension of the message data, and determining the testable score of the message data based on the feature value corresponding to each feature dimension, may include the following steps 402 to 406, wherein:

[0098] Step 402, obtaining the message length, response time and connection time corresponding to the message data;

[0099] Step 404, determining a first score of the message data based on the message length, determining a second score of the message data based on the response time, and determining a third score of the message data based on the connection time, wherein the first score is positively correlated with the message length, the second score is positively correlated with the message length, and the third score is positively correlated with the connection time;

[0100] Step 406: Determine the testability score of the message data according to the first score, the second score, and the third score.

[0101] In an embodiment of the present application, the message length, response time and connection time of the message data can be analyzed and obtained, and a first score of the message data can be determined based on the message length, and the first score is positively correlated with the message length, that is, the longer the message length, the higher the test value of the message data, and the corresponding first score is higher; the second score of the message data is determined based on the response time, and the second score is positively correlated with the response time, that is, the longer the response time, the higher the test value of the message data, and the corresponding second score is higher; the third score of the message data is determined based on the connection time, and the third score is positively correlated with the connection time, that is, the longer the connection time, the higher the test value of the message data, and the corresponding third score is higher.

[0102] The first score, the second score and the third score may be accumulated to obtain a testable score for the message data, or the weights of the feature dimensions may be pre-set and the first score, the second score and the third score may be weighted and summed according to the weights to obtain a testable score for the message data.

[0103] Step 304, determine the first target message data and the second target message data from the message group and the target message data determined in the previous round, the first target message data is the message data in the message group that is repeated with the target message data determined in the previous round, and the second message data is the message data in the message group and the target message data determined in the previous round except the first target message data.

[0104] Step 306: for the first target message data, the testability score of the first target message data determined in the previous round is accumulated with the testability score determined in the current round, and the testability score of the first target message data is updated based on the accumulation result.

[0105] Step 308: Determine the message data whose testable scores satisfy the fuzzy test condition among the first target message data and the second target message data as candidate message data.

[0106] In an embodiment of the present application, the target message data can be determined by comparing the current message group with the previous round, and the repeated message data therein can be used as the first target message data, and the remaining message data other than the first target message data can be used as the second target message data.

[0107] For the first target message data, the testable score determined in the current round and the testable score determined in the previous round of the first target message data can be accumulated, and the testable score of the first target message data can be updated based on the accumulated result. Afterwards, based on the preset fuzzy test conditions, the candidate message data whose testable score meets the fuzzy test conditions is determined from the first target message data and the second target message data. Exemplarily, the fuzzy test conditions may include the top TOPx, or the top y%, where x and y are both numerical values ​​set by those skilled in the art, and can be taken based on the test scale. For example, the larger the test scale, the larger the values ​​of x and y can be set.

[0108] In an exemplary embodiment, referring to Figure 5 As shown, in step 308, the message data whose testable scores satisfy the fuzzy test conditions in the first target message data and the second target message data are determined as candidate message data, which may include the following steps 502 to 504, wherein:

[0109] Step 502, sorting the first target message data and the second target message data in descending order according to the testable scores to obtain a message queue;

[0110] Step 504: Use the first preset number of message data in the message queue as candidate message data.

[0111] In the embodiment of the present application, the pre-preset number can be a preset TOPx, or can be calculated based on the length of the message queue and the preset y%. That is, in each round, the pre-preset number of message data in the message queue can be taken as candidate message data, and the remaining messages will be discarded. In this way, only message data with high test value is screened to participate in subsequent screening, which can improve the test effect and test efficiency.

[0112] In this way, the target message data of the current round can be screened out from the message group in the current round and the target message data screened in the previous round.

[0113] Step 204: based on the stability of each candidate message data, determine the target message data corresponding to the current round from each candidate message data.

[0114] In an embodiment of the present application, after the candidate message data is screened in the current round, the stability of each candidate message data can be determined through a replay test, and the candidate message data whose stability meets the fuzzy test requirements can be used as the target message data corresponding to the current round and participate in the next round of screening.

[0115] In an exemplary embodiment, referring to Figure 6 As shown, in step 204, based on the stability of each candidate message data, determining the target message data corresponding to the current round from each candidate message data may include the following steps 602 to 604, wherein:

[0116] Step 602: for any candidate message data, replay the candidate message data m times, and determine the testable score of the candidate message data during each replay test;

[0117] Step 604: based on the testable scores corresponding to the candidate message data in the current round and the testable scores corresponding to each replay test process, determine the target message data corresponding to the current round from the candidate message data.

[0118] In an embodiment of the present application, the number of replay tests can be preset, for example, set to m times. For any candidate message data, m replay tests can be performed, and the testable score of the candidate message data is recalculated during each replay test. Finally, a discrete variance calculation is performed based on the testable score calculated by the m replay tests and the testable score of the candidate message data calculated in the current round, and the stability corresponding to the candidate message data is determined based on the variance. Exemplarily, the larger the variance, the worse the stability can be considered. A variance that is too large (for example, exceeding a preset variance threshold) has no test reference significance and can be discarded; the smaller the variance, the smaller the discrete trend, which indicates good stability and sustainable test significance, and can be used as the target message data corresponding to the current round.

[0119] In this way, in each round, the message data with better stability is selected to participate in the next round of screening. After multiple rounds of screening and cleaning, the target message data finally obtained has a higher test value, which can improve the test effect and efficiency.

[0120] In order to enable those skilled in the art to better understand the embodiments of the present application, the embodiments of the present application are described below through specific examples.

[0121] Reference Figure 7 As shown, this example includes service A to be tested, service B to be tested, and service C that does not need to be tested, wherein service A to be tested and service B to be tested are respectively deployed in load machines in the VPC network environment, and service C is deployed outside the VPC network environment, and a VPN (Virtual Private Network) gateway is deployed in the VPC network environment.

[0122] Reference Figure 8 As shown, the VPN gateway can intercept the original traffic sent to the service A to be tested based on the IP and port corresponding to the service A to be tested, and clean the original traffic according to the preset cleaning rules through the traffic cleaning system to obtain the final target message data, wherein the preset cleaning rules can be rules set based on the service characteristics of the service A to be tested, including scoring rules and screening rules. Based on the target message data, a formal test traffic packet is assembled and distributed to the load machine where the service A to be tested is located, and a fuzzy test of the traffic layer is sent. Exemplarily, the preset cleaning rules can be adjusted based on the test results of the service A to be tested, for example: adjusting the scoring rules or screening rules, etc.

[0123] For example, this example includes the following parts:

[0124] (1) Intercepting the original traffic resources

[0125] Deploy the service to be tested in a specific VPC environment. Monitor and intercept the traffic of the network card used on the gateway server at the traffic entrance. Intercept the passing messages based on the target IP and port of the service to be tested.

[0126] (2) Scoring according to characteristic rules

[0127] The intercepted original traffic is split into multiple levels and grouped according to the protocol characteristic rules (such as protocol type, message length, response time, and connection keep-alive time). Among them, the same protocol type can be divided into the same group, and the same protocol group is scored according to the message length, response time, and connection time. The higher the value of the unit characteristic, the higher the score. This rule can be freely customized according to the characteristics of different system products.

[0128] (3) Replay screening part

[0129] Each protocol group is replayed according to the traffic data of TOPn (the value of n is determined by the amount of data to be tested) with the highest score, and the variance is used to determine the degree of dispersion. The purpose of the retry is to distinguish whether the traffic can be directly tested, so as to screen out the traffic data that can be repeatedly tested for a long time.

[0130] (4) Automatic learning and promotion part

[0131] The results after the retry are classified and scored again, and put into the next new traffic package grouping for sorting, and the traffic after TOPn is discarded. If there is duplication between the new traffic package and the last "promoted" traffic, it can be directly merged into one valid traffic, and the score is accumulated. After several rounds of cleaning, the result is the most valuable and most measurable data.

[0132] (5) Encapsulate the official traffic packet and distribute it to the load machines in the VPC environment for testing

[0133] The cleaned testable traffic is assembled into a formal test traffic collection and distributed to the load machines in the VPC to initiate large-scale testing.

[0134] Reference Fig. 9 As mentioned above, this example includes the following steps:

[0135] Because the content to be tested is confidential and cannot be confused with other networks, the test components need to be deployed in a secure, independent, and confidential specific VPC network environment. A traffic cleaning system is deployed on the gateway of the specific VPC, and a packet capture tool is prepared to intercept the original traffic.

[0136] First, the intercepted original traffic is grouped according to the protocol type of the test target data, and the test targets of different protocol types are distinguished. The grouped message queues are then scored according to the same-level characteristics (message length, response time, connection keep-alive time). Based on the characteristics of the protocol, the higher the unit value, the greater the significance of the traffic, so the higher the score. Finally, the TOPn traffic is retained and "advanced" to the next round;

[0137] The obtained TOPn promotion traffic is replayed and re-scored, repeated n times, and the discrete variance is calculated by calculating the n-time values ​​and the first value. The larger the variance, the worse the stability. The variance that is too large has no test reference significance and can be discarded; the smaller the variance, the smaller the discrete trend, the better the stability, and has sustainable test significance.

[0138] The sustainable test data obtained in the previous step is scored together with the original flow that continues to flow in, and then sorted and cleaned according to the previous steps. Repeat this process three times to obtain the final testable flow. The obtained testable flow is encapsulated into a formal flow package and distributed to each load machine in a specific vpc, so that large-scale flow layer performance testing can be performed using the formal flow package in the vpc.

[0139] The embodiment of the present application provides a VPC-based fuzzy testing method, which does not need to consider product functions, mines effective traffic from existing network communications, and conducts extensive fuzzy performance testing on the tested services. The data is more realistic and can cover more products. The transport layer traffic is directly intercepted for screening and analysis, and the data construction is simple, fast and convenient, saving time and cost. The method has extremely low proprietary characteristics and can be adapted to most products and systems. It can be ported to other platforms at any time and can be tested as long as it passes through the network traffic. The test environment is in an independent vpc environment, in a virtual isolated network, and a large number of traffic tests will not affect other services.

[0140] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0141] Based on the same inventive concept, the embodiment of the present application also provides a VPC-based fuzzy testing device for implementing the VPC-based fuzzy testing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more VPC-based fuzzy testing device embodiments provided below can refer to the limitations of the VPC-based fuzzy testing method above, and will not be repeated here.

[0142] In an exemplary embodiment, Fig.10 As shown, a VPC-based fuzzy testing device is provided, including: an acquisition module 1002, a grouping module 1004, a cleaning module 1006, a judgment module 1008 and a testing module 1010, wherein:

[0143] The acquisition module 1002 is used to intercept the initial message data based on the target IP and port information corresponding to the service to be tested in the current round;

[0144] A grouping module 1004, configured to group the initial message data based on a preset grouping rule to obtain at least one message group;

[0145] A cleaning module 1006 is used to clean any message group and the target message data determined in the previous round based on a preset cleaning rule to determine the target message data corresponding to the current round;

[0146] The judgment module 1008 is used to enter the next round if the current round is not the Nth round, and repeatedly execute the step of intercepting the initial message data based on the target IP and port information corresponding to the service to be tested until the Nth round is executed, where N is an integer greater than 0;

[0147] The test module 1010 is used to encapsulate the target message data determined in the Nth round into a test traffic packet, and send the test traffic packet to the target device, so that the target device performs a fuzzy test on the service to be tested based on the test traffic packet, wherein the service to be tested is installed in the target device, and the target device and the gateway are deployed in the same VPC network environment.

[0148] The VPC-based fuzzy testing device provided in the embodiment of the present application can mine effective traffic from existing network communications in a secure environment, and perform extensive fuzzy performance testing on the tested services. The data is more realistic and can cover more cloud security products. It can directly intercept the transport layer traffic for traffic screening and analysis, and the data construction is simple. Fuzzy testing can be completed without manually creating and screening specific performance test scenarios and test data. Therefore, the efficiency of fuzzy testing for cloud security products can be greatly improved, and it has the advantages of low production cost, wide application range, and high portability.

[0149] In one embodiment, the cleaning module 1006 is specifically used for:

[0150] Acquire a preset number of candidate message data from the message group and the target message data determined in the previous round;

[0151] Based on the stability of each of the candidate message data, the target message data corresponding to the current round is determined from each of the candidate message data.

[0152] In one embodiment, the cleaning module 1006 is specifically used for:

[0153] For any message data in the message group, obtaining a feature value corresponding to each feature dimension of the message data, and determining a testable score of the message data based on the feature value corresponding to each feature dimension;

[0154] Determine first target message data and second target message data from the message group and the target message data determined in the previous round, wherein the first target message data is message data in the message group that is repeated with the target message data determined in the previous round, and the second message data is message data in the message group and the target message data determined in the previous round except the first target message data;

[0155] For the first target message data, accumulating the testability score of the first target message data determined in the previous round and the testability score determined in the current round, and updating the testability score of the first target message data based on the accumulation result;

[0156] The message data whose testable scores satisfy the fuzzy test conditions among the first target message data and the second target message data are determined as candidate message data.

[0157] In one embodiment, the cleaning module 1006 is specifically used for:

[0158] Sorting the first target message data and the second target message data in descending order according to the testable scores to obtain a message queue;

[0159] A preset number of message data in the message queue are used as candidate message data.

[0160] In one embodiment, the cleaning module 1006 is specifically used for:

[0161] For any of the candidate message data, replay the candidate message data m times, and determine the testable score of the candidate message data during each replay test;

[0162] Based on the testable scores corresponding to the candidate message data in the current round and the testable scores corresponding to each replay test process, the target message data corresponding to the current round is determined from the candidate message data.

[0163] In one embodiment, the characteristic dimensions include message length, response time, and connection time, and the cleaning module 1006 is specifically used to:

[0164] Obtain the message length, response time and connection time corresponding to the message data;

[0165] Determine a first score of the message data based on the message length, determine a second score of the message data based on the response time, and determine a third score of the message data based on the connection time, wherein the first score is positively correlated with the message length, the second score is positively correlated with the message length, and the third score is positively correlated with the connection time;

[0166] A testable score of the message data is determined according to the first score, the second score, and the third score.

[0167] Each module in the above VPC-based fuzzy testing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0168] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. When the computer program is executed by the processor, a fuzzy testing method based on VPC is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0169] Those skilled in the art will understand that Fig.11The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0170] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0171] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0172] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0173] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0174] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0175] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0176] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A VPC-based fuzz testing method, characterized in that: Applied to a gateway, the method comprises: In the current round, the initial message data is intercepted based on the target IP and port information corresponding to the service to be tested; Grouping the initial message data based on a preset grouping rule to obtain at least one message group; For any message group, the message group and the target message data determined in the previous round are cleaned based on the preset cleaning rules to determine the target message data corresponding to the current round; If the current round is not the Nth round, then enter the next round and repeat the step of intercepting the initial message data based on the target IP and port information corresponding to the service to be tested until the Nth round is reached, where N is an integer greater than 0; The target message data determined in the Nth round is encapsulated into a test traffic packet, and the test traffic packet is sent to a target device, so that the target device performs a fuzzy test on the service to be tested based on the test traffic packet, wherein the service to be tested is installed in the target device, and the target device and the gateway are deployed in the same VPC network environment.

2. The method according to claim 1, characterized in that: The step of cleaning the message group and the target message data determined in the previous round based on the preset cleaning rule to determine the target message data corresponding to the current round includes: Acquire a preset number of candidate message data from the message group and the target message data determined in the previous round; Based on the stability of each of the candidate message data, the target message data corresponding to the current round is determined from each of the candidate message data.

3. The method according to claim 2, characterized in that The step of obtaining a preset number of candidate message data from the message group and the target message data determined in the previous round includes: For any message data in the message group, obtaining a feature value corresponding to each feature dimension of the message data, and determining a testable score of the message data based on the feature value corresponding to each feature dimension; Determine first target message data and second target message data from the message group and the target message data determined in the previous round, wherein the first target message data is message data in the message group that is repeated with the target message data determined in the previous round, and the second message data is message data in the message group and the target message data determined in the previous round except the first target message data; For the first target message data, accumulating the testability score of the first target message data determined in the previous round and the testability score determined in the current round, and updating the testability score of the first target message data based on the accumulation result; The message data whose testable scores satisfy the fuzzy test conditions among the first target message data and the second target message data are determined as candidate message data.

4. The method according to claim 3, characterized in that The step of determining, among the first target message data and the second target message data, message data whose testable scores satisfy the fuzzy test condition as candidate message data includes: Sorting the first target message data and the second target message data in descending order according to the testable scores to obtain a message queue; A preset number of message data in the message queue are used as candidate message data.

5. The method according to any one of claims 2 to 4, characterized in that The determining, based on the stability of each of the candidate message data, target message data corresponding to the current round from each of the candidate message data includes: For any of the candidate message data, replay the candidate message data m times, and determine the testable score of the candidate message data during each replay test; Based on the testable scores corresponding to the candidate message data in the current round and the testable scores corresponding to each replay test process, the target message data corresponding to the current round is determined from the candidate message data.

6. The method according to claim 3, characterized in that The characteristic dimensions include message length, response time, and connection time, and obtaining the characteristic value corresponding to each characteristic dimension of the message data, and determining the testable score of the message data based on the characteristic value corresponding to each characteristic dimension, includes: Obtain the message length, response time and connection time corresponding to the message data; Determine a first score of the message data based on the message length, determine a second score of the message data based on the response time, and determine a third score of the message data based on the connection time, wherein the first score is positively correlated with the message length, the second score is positively correlated with the message length, and the third score is positively correlated with the connection time; A testable score of the message data is determined according to the first score, the second score, and the third score.

7. A fuzzy testing device for VPC, characterized in that: Applied to a gateway, the device comprises: The acquisition module is used to intercept the initial message data based on the target IP and port information corresponding to the service to be tested in the current round; A grouping module, used for grouping the initial message data based on a preset grouping rule to obtain at least one message group; A cleaning module, for cleaning any message group and the target message data determined in the previous round based on a preset cleaning rule, and determining the target message data corresponding to the current round; A judgment module, used for entering the next round if the current round is not the Nth round, and repeatedly executing the step of intercepting the initial message data based on the target IP and port information corresponding to the service to be tested until the Nth round is executed, where N is an integer greater than 0; A test module is used to encapsulate the target message data determined in the Nth round into a test traffic packet, and send the test traffic packet to a target device so that the target device performs a fuzzy test on the service to be tested based on the test traffic packet, wherein the service to be tested is installed in the target device, and the target device and the gateway are deployed in the same VPC network environment.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images