Interface testing method and related equipment

Abstract

The embodiment of the invention discloses an interface testing method and related equipment, which are used for improving the interface testing efficiency. The method comprises the steps of determining a change interface indicated by a test instruction; obtaining a test scene containing the changed interface in corresponding to-be-tested interfaces, wherein the test scene comprises a plurality of to-be-tested interfaces and a calling sequence of the to-be-tested interfaces in the test scene; based on the interface information of each to-be-tested interface, the preset attack load of the change interface in the test scene and the calling sequence of each to-be-tested interface, constructing a use case acquisition statement; inputting the case acquisition statement into a generative language model to obtain a test case output by the generative language model; and based on a test case output by the generative language model, executing a test on the change interface.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of software testing, and in particular to interface testing methods and related equipment. Background Art

[0002] API (Application Programming Interface) is a set of predefined functions that provide services for data interaction and function triggering between programs. API security testing is an important part of ensuring the security of API interfaces.

[0003] The current API security testing solution mainly relies on manually writing test cases. Then, the test cases are used to simulate real attack scenarios and send attack requests to the API. Finally, by comparing the response data of the API after receiving the attack request with the response data of the API after receiving the normal request, the result verification rules of all fields and different logical combinations are used to flexibly analyze whether there are security vulnerabilities.

[0004] However, the test cases in the above security testing scheme rely entirely on manual writing, which has high manpower and time costs, and the interface testing efficiency is low. Summary of the invention

[0005] The embodiments of the present application provide an interface testing method and related equipment for improving interface testing efficiency.

[0006] A first aspect of an embodiment of the present application provides an interface testing method, comprising:

[0007] Determine the change interface indicated by the test instruction;

[0008] Obtaining a test scenario of the corresponding interface to be tested that includes the changed interface, wherein the test scenario includes multiple interfaces to be tested and a calling order of each of the interfaces to be tested in the test scenario;

[0009] Constructing a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested;

[0010] Inputting the use case acquisition statement into a generative language model to obtain a test case output by the generative language model;

[0011] Based on the test cases output by the generative language model, a test on the changed interface is performed.

[0012] In a specific implementation, before constructing the use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested, the method further includes:

[0013] Extracting static analysis data from the source code of the changed interface;

[0014] If the static analysis data hits any preset static data rule, the vulnerability type corresponding to the static data rule is determined as the first vulnerability type of the change interface;

[0015] The preset attack payload belonging to the first vulnerability type is determined as the preset attack payload of the change interface in the test scenario.

[0016] In a specific implementation, constructing a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested includes:

[0017] Obtaining an input template that guides the generative language model to output a test case;

[0018] The interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling order of each interface to be tested are filled into the corresponding area in the input template to obtain the use case acquisition statement, and the use case acquisition statement is used to guide the generative language model to output multiple test cases.

[0019] In a specific implementation, the interface of the target program includes the change interface, and before executing the test for the change interface based on the test case output by the generative language model, the method further includes:

[0020] Placing a preset stub program in a device running the target program;

[0021] The test case outputted based on the generative language model is used to perform a test on the changed interface, including:

[0022] Running the test case and obtaining response data of the change interface during the running of the test case;

[0023] Acquiring the operation data generated by the target program during the running of the test case through the plugging program;

[0024] A test result of the changed interface is determined based on the response data of the changed interface and the running data generated by the target program.

[0025] In a specific implementation, determining the test result of the changed interface based on the response data of the changed interface and the running data generated by the target program includes:

[0026] If the expected output of the change interface and the response data of the change interface in the test case hit any preset response data rule, the vulnerability type corresponding to the response data rule is determined as the second vulnerability type of the change interface;

[0027] If the operation data generated by the target program matches any preset operation data rule, the vulnerability type corresponding to the operation data rule is determined as the third vulnerability type of the change interface;

[0028] A test result of the change interface is determined according to a first vulnerability type, a second vulnerability type, and a third vulnerability type, wherein the first vulnerability type is determined based on a source code of the change interface.

[0029] In a specific implementation, before determining the changed interface indicated by the test instruction, the method further includes:

[0030] In response to the adjustment of the change interface, generating a test instruction for the change interface;

[0031] or,

[0032] In response to the adjustment of the change interface, a test task of the change interface is generated, the test task has a corresponding trigger time; if the trigger time of the test task is reached, a test instruction for the change interface is generated;

[0033] or,

[0034] A test task for the changed interface is generated at a preset time interval, and the test task has a corresponding trigger time; if the trigger time of the test task is reached, a test instruction for the changed interface is generated.

[0035] A second aspect of an embodiment of the present application provides an interface testing system, including:

[0036] A determination unit, used for determining a change interface indicated by a test instruction;

[0037] An acquisition unit, configured to acquire a test scenario of a corresponding interface to be tested that includes the changed interface, wherein the test scenario includes a plurality of interfaces to be tested and a calling sequence of each of the interfaces to be tested in the test scenario;

[0038] A construction unit, configured to construct a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested;

[0039] A testing unit, used for inputting the use case acquisition statement into a generative language model to obtain a test case output by the generative language model;

[0040] The testing unit is further used to perform testing on the changed interface based on the test cases output by the generative language model.

[0041] In a specific implementation, before constructing the use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested, the interface testing system further includes: an extraction unit;

[0042] The extraction unit is used to extract static analysis data from the source code of the change interface;

[0043] The determining unit is further configured to determine the vulnerability type corresponding to the static data rule as the first vulnerability type of the change interface if the static analysis data hits any preset static data rule;

[0044] The determining unit is further configured to determine a preset attack payload belonging to the first vulnerability type as a preset attack payload of the change interface in the test scenario.

[0045] In a specific implementation, the interface information based on each interface to be tested and the construction unit are specifically used to obtain an input template that guides the generative language model to output a test case; the interface information of each interface to be tested, the preset attack load of the change interface in the test scenario, and the calling order of each interface to be tested are filled into the corresponding area in the input template to obtain the use case acquisition statement, and the use case acquisition statement is used to guide the generative language model to output multiple test cases.

[0046] In a specific implementation, the interface of the target program includes the change interface, and before the test case output based on the generative language model is executed for the test of the change interface, the interface testing system further includes: a placement unit;

[0047] The placement unit is used to place a preset stub program in a device running the target program;

[0048] The test unit is specifically used to run the test case and obtain the response data of the change interface during the running of the test case; obtain the running data generated by the target program during the running of the test case through the plug-in program; and determine the test result of the change interface based on the response data of the change interface and the running data generated by the target program.

[0049] In a specific implementation, the determination unit is specifically used to determine the vulnerability type corresponding to the response data rule as the second vulnerability type of the change interface if the expected output of the change interface and the response data of the change interface in the test case hit any preset response data rule; if the running data generated by the target program hits any preset running data rule, the vulnerability type corresponding to the running data rule is determined as the third vulnerability type of the change interface; and determine the test result of the change interface according to the first vulnerability type, the second vulnerability type and the third vulnerability type, the first vulnerability type being determined based on the source code of the change interface.

[0050] In a specific implementation, before determining the changed interface indicated by the test instruction, the method further includes:

[0051] In response to the adjustment of the change interface, generating a test instruction for the change interface;

[0052] or,

[0053] In response to the adjustment of the change interface, a test task of the change interface is generated, the test task has a corresponding trigger time; if the trigger time of the test task is reached, a test instruction for the change interface is generated;

[0054] or,

[0055] A test task for the changed interface is generated at a preset time interval, and the test task has a corresponding trigger time; if the trigger time of the test task is reached, a test instruction for the changed interface is generated.

[0056] A third aspect of an embodiment of the present application provides a computer device, including:

[0057] CPU, memory and input / output interface;

[0058] The memory is a transient storage memory or a persistent storage memory;

[0059] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method described in the first aspect.

[0060] A fourth aspect of the embodiments of the present application provides a computer program product comprising instructions, and when the computer program product is run on a computer, the computer is caused to execute the method described in the first aspect.

[0061] A fifth aspect of an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores instructions, and when the instructions are executed on a computer, the computer executes the method described in the first aspect.

[0062] It can be seen from the above technical scheme that the embodiment of the present application has the following advantages: after determining the change interface indicated by the test instruction, the test scenario containing the change interface in the corresponding interface to be tested will be obtained. Then, the use case acquisition statement is constructed based on the interface information of each interface to be tested in the test scenario, the preset attack load of the change interface in the test scenario, and the call sequence of each interface to be tested. Then, the use case acquisition statement is input into the generative language model to obtain the test case output by the generative language model. Finally, the test for the change interface can be performed based on the test case output by the generative language model. In the whole test process, only the test scenario and the preset attack load under different test scenarios need to be pre-configured, and the test case required for the test change interface can be automatically generated, which reduces the manual intervention of the test case generation, improves the security and test efficiency of the interface test, and can better adapt to the rapid iteration of the product development process. At the same time, when automatically generating test cases, the test cases are obtained by relying on the generative language model capability, which enhances the coverage of the test, ensures the comprehensiveness and depth of the test, and reduces the risk of missing reports. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 A flow chart of the interface testing method disclosed in the embodiment of the present application;

[0064] Figure 2 A system architecture diagram of the interface testing system disclosed in the embodiment of the present application;

[0065] Figure 3 Another schematic diagram of the interface testing method disclosed in the embodiment of the present application;

[0066] Figure 4 A schematic diagram of the structure of the interface testing system disclosed in the embodiment of the present application;

[0067] Figure 5 A schematic diagram of the structure of a computer device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0069] The embodiments of the present application provide an interface testing method and related equipment for improving interface testing efficiency.

[0070] See also Figure 1 The embodiment of the present application also provides an interface testing method, which is applied to an interface testing system and includes the following steps:

[0071] 101. Determine the change interface indicated by the test instruction.

[0072] When an interface test is required, the interface test system will obtain a test instruction. Different interfaces may have different test contents. Therefore, after obtaining the test instruction, the interface test method of the embodiment of the present application first needs to determine the changed interface indicated by the test instruction.

[0073] Generally, a test command is usually initiated for a certain interface.

[0074] 102. Obtain a test scenario that includes a changed interface in the corresponding interface to be tested, where the test scenario includes multiple interfaces to be tested and a calling sequence of each interface to be tested in the test scenario.

[0075] Based on the foregoing content, it can be known that the test content required for different interfaces will also be different. In the embodiment of the present application, the test scenarios are divided according to the different business scenarios involved in the interface. Among them, each business scenario involves interactions between multiple interfaces. For example, the business scenario of adding a form may involve a login interface, a new interface, and an audit interface, etc., and in the aforementioned business scenarios, each interface has a calling sequence. Similarly, each test scenario includes multiple interfaces to be tested and the calling sequence of each interface to be tested in the test scenario. Among them, since some interfaces to be tested may be called multiple times, in a test scenario, the interface to be tested may have multiple calling sequences.

[0076] 103. Construct a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the change interface in the test scenario, and the calling sequence of each interface to be tested.

[0077] The test case simulates some scenarios and judges whether the feedback of the interface in the corresponding scenario is normal based on the response of the interface. Based on the above embodiments, the embodiment of the present application divides the test scenarios according to the different business scenarios involved in the interface. On this basis, different types of vulnerabilities may exist in different test scenarios, and there will also be different preset attack payloads.

[0078] In addition, for interface testing, it is also necessary to accurately call each interface to be tested and parse the response of the interface to be tested based on the interface information of each interface to be tested. Generally, the interface document contains interface information such as interface definition, request parameters, response format, etc. of different interfaces. Therefore, the interface information of each interface to be tested can be imported from interface documents such as Swagger and OpenAPI that support API, which is not limited here.

[0079] In an embodiment of the present application, the use case acquisition statement includes interface information based on each interface to be tested, a preset attack load of the changed interface in the test scenario, and a calling order of each interface to be tested, wherein the attack load is injected into the request parameters of the changed interface.

[0080] 104. Input the use case acquisition statement into the generative language model to obtain the test case output by the generative language model.

[0081] Based on the above embodiments, it can be known that the use case acquisition statement includes the interface information based on each interface to be tested, the preset attack load of the change interface in the test scenario, and the calling order of each interface to be tested. In other words, the calling order of each interface to be tested in the test case output by the generative language model, the preset attack load in the request parameter, and even the request message of each interface to be tested (determined by the interface information) should be consistent with the corresponding input.

[0082] 105. Based on the test cases output by the generative language model, execute the test on the changed interface.

[0083] In the embodiment of the present application, during the entire test process, only the test scenarios and the preset attack loads under different test scenarios need to be pre-configured, and the test cases required for testing the interface change can be automatically generated, which reduces the manual intervention in the generation of test cases, improves the security and test efficiency of interface testing, and can better adapt to the rapid iteration of product development processes. At the same time, when automatically generating test cases, the test cases are obtained by relying on the generative language model capability, which enhances the coverage of the test, ensures the comprehensiveness and depth of the test, and reduces the risk of missed reports.

[0084] In some specific implementations, before the aforementioned step 103, the embodiment of the present application also includes: extracting static analysis data from the source code of the change interface; if the static analysis data hits any preset static data rule, determining the vulnerability type corresponding to the static data rule as the first vulnerability type of the change interface; and determining the preset attack load belonging to the first vulnerability type as the preset attack load of the change interface in the test scenario.

[0085] Specifically, the vulnerability identification algorithm adopted in the embodiment of the present application belongs to static code analysis, which mainly performs a deep scan on the source code of the interface, and identifies potential coding errors and security vulnerabilities through static analysis data such as syntax, semantics, data flow, and call path in the interface source code and preset static data rules, that is, identifying the first type of vulnerability that may exist in the changed interface from the code level. Generally, multiple sets of static data rules will be preset, and each set of static data rules is obtained based on the analysis of the normal source code of the interface and the abnormal source code of the interface, including but not limited to: code checkpoints, check conditions, expected results, grammatical structure and logic, etc., which can determine whether the static analysis data contains a certain type of vulnerability. The specific configuration can be as needed, and the embodiment of the present application does not limit it.

[0086] It should be noted that in the process of analyzing the normal source code of the interface and the abnormal source code of the interface and obtaining static data rules, the embodiment of the present application will obtain various static analysis data from the normal source code and obtain its security commonality, and may also obtain various static analysis data from the abnormal source code and obtain its vulnerability commonality, or simultaneously obtain security commonality and vulnerability commonality from different types of source code, and based on the security commonality and / or vulnerability commonality, configure static data rules that can identify whether the static analysis data (extracted from the source code of the changed interface) exhibits vulnerability commonality. If the static analysis data extracted from the source code of the changed interface exhibits a certain vulnerability commonality, it means that the changed interface is likely to have a vulnerability type corresponding to the vulnerability commonality.

[0087] In actual applications, the first vulnerability type obtained by using static code analysis technology alone has a high false alarm rate. Therefore, the embodiment of the present application does not directly determine the first vulnerability type obtained by static code analysis technology as a vulnerability that actually exists in the change interface, but rather determines the preset attack payload belonging to the first vulnerability type as the preset attack payload of the change interface in the test scenario, and uses test cases with these preset attack payloads to check whether the change interface has the first vulnerability type.

[0088] It is understandable that in order to better manage the preset attack payloads, an existing or self-built security vulnerability database can be introduced, and the attack feature vectors in the security vulnerability database and the vulnerability types to which they belong can be used as preset attack payloads, that is, the source of the preset attack payloads; and the source code of the interface supports local import and / or remote connection to the code management system to pull, such as pulling from a Git repository, which is not limited in the embodiments of the present application.

[0089] In addition to identifying the first vulnerability type that may exist in the change interface through the source code of the change interface, and determining the preset attack load based on the first vulnerability type, in other specific implementations, considering that the vulnerability types that may appear in different test scenarios are generally fixed, these vulnerability types can be configured as preset vulnerability types in the corresponding test scenarios, and the preset attack load is determined based on the preset vulnerability type. Before the aforementioned step 103, the embodiment of the present application also includes: obtaining the vulnerability type to be tested for the change interface in the test scenario; determining the preset attack load belonging to the vulnerability type as the preset attack load of the change interface in the test scenario.

[0090] Based on the foregoing, it can be seen that the embodiments of the present application can also configure default vulnerability types for different test scenarios as the vulnerability types to be tested in the test scenario. In this way, the corresponding preset attack load can be obtained directly according to the vulnerability type to be tested in the test scenario without the need to obtain the required preset attack load through static code analysis. Among them, the vulnerability types to be tested in different test scenarios can be configured by the user during the historical test process, or preset in the interface test system, which is not limited here.

[0091] On the basis of the aforementioned embodiments, in some specific implementation methods, the aforementioned step 103 can be specifically implemented in the following manner: obtaining an input template that guides the generative language model to output test cases; filling in the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling order of each interface to be tested into the corresponding area in the input template to obtain a use case acquisition statement, and the use case acquisition statement is used to guide the generative language model to output multiple test cases.

[0092] The above-mentioned multiple test cases may be any test cases including valid input or abnormal input of the change interface.

[0093] It can be understood that the prompt can help the generative language model output a use case acquisition statement that better meets the requirements of the embodiment of the present application. Therefore, this can be achieved by configuring an input template that guides the generative language model to output test cases. The input template reserves the interface information of each interface to be tested, the preset attack load of the change interface in the test scenario, the calling order of each interface to be tested, and even the vulnerability type and test scenario and other configuration information. Fully guide the model to use the configuration information therein to input more reasonable test cases.

[0094] In practical applications, the interface may come from programs such as operating systems, applications or software systems, and the programs need to run on wearable devices, portable devices, computers, servers and other devices. Therefore, the change interface of the embodiment of the present application also comes from the target program running on the device. After knowing that the interface of the target program includes the change interface and the device running the target program, the embodiment of the present application can also obtain the running data generated by the target program during the running of the test case by setting a plug-in program in the device, and determine the type of vulnerability that may exist in the change interface based on this. Specifically, before the aforementioned step 105, the embodiment of the present application also includes: placing a preset plug-in program in the device running the target program; on this basis, step 105 specifically includes: running the test case and obtaining the response data of the change interface during the running of the test case; obtaining the running data generated by the target program during the running of the test case through the plug-in program; based on the response data of the change interface and the running data generated by the target program, determine the test result of the change interface.

[0095] First, the plug-in program deployed in the device can be designed as needed, and the behavior data of the interface can be collected and analyzed by inserting probes in the device, that is, the operation data generated by the target program during the test case execution is obtained. It can be understood that no matter what kind of program the target program is, in the process of calling the target interface, the logic that the target program needs to execute is generally consistent. Therefore, for a unified operation logic, the operation data at different operation nodes can be obtained through a unified plug-in program.

[0096] Secondly, after deploying the stub program, the stub program can obtain various running data generated by the target program at the probe during the running of the test case. Finally, by combining the response data of the changed interface and the running data generated by the target program, the vulnerability analysis of the changed interface can be performed to obtain the corresponding test results.

[0097] Therefore, in the embodiment of the present application, the response data of each interface to be tested during the running of the test case and the running data generated by the program during the running of the test case are used to perform a security analysis on the changed interface to obtain the corresponding test results. Compared with the solution of using only one kind of data and one analysis method for security analysis, the technical solution of the embodiment of the present application combining multiple analysis methods can obviously reduce the underreporting rate of vulnerability types.

[0098] Furthermore, the aforementioned step of "determining the test result of the changed interface based on the response data of the changed interface and the running data generated by the target program" can be specifically implemented in the following way: if the expected output of the changed interface and the response data of the changed interface in the test case hit any preset response data rule, the vulnerability type corresponding to the response data rule is determined as the second vulnerability type of the changed interface; if the running data generated by the target program hits any preset running data rule, the vulnerability type corresponding to the running data rule is determined as the third vulnerability type of the changed interface; based on the first vulnerability type, the second vulnerability type and the third vulnerability type, the test result of the changed interface is determined, and the first vulnerability type is determined based on the source code of the changed interface.

[0099] Specifically, by combining the target program's running data with known security vulnerabilities and attack patterns, the target program's change interface's potential vulnerability types are identified through rules. This analysis method is based on application interaction-based security analysis. By simulating real attack scenarios through test cases, different attack payloads are filled in the test case's request parameters, and then based on the comparison between the response data of the change interface after receiving the corresponding request and the expected response data, potential vulnerability types are flexibly analyzed. This analysis method is based on simulated attack-based security testing analysis.

[0100] In the security test analysis based on simulated attacks, the real attack scenario is simulated through the use case intelligent generation module, and the attack payloads such as SQL injection, XSS cross-site scripting, and unauthorized access are injected into the interface request. The comparison result is obtained by comparing the response data of the changed interface and the expected output that the normal interface should return. According to whether the comparison result meets a certain response data rule, it is flexibly analyzed whether there is a security vulnerability. In addition, the response data rules of the embodiment of the present application support rule configuration based on different logical combinations and support rule configuration based on all response fields in each response data; the design of the response data rules can refer to the static data rules, which will not be repeated here.

[0101] It should be noted that different logic combinations in the embodiments of the present application refer to different logics for configuring static data rules. The difference in logic can be reflected in the following aspects, including but not limited to: 1. Different screening methods. Positive screening means that those that meet the static data rules have vulnerabilities, or reverse screening means that those that do not meet the static data rules have vulnerabilities. 2. Different selections of response fields. Select different response fields, select some response fields, or select all response fields.

[0102] In the security analysis based on application interaction, the probe is inserted into the application system server using the plugging technology to collect and analyze the behavior data of the target program. During the execution of the test case, various information of the target program during operation is collected by means of taint tracking algorithms, including but not limited to its request and response data, code execution path, input verification, access control, authentication, authorization, etc. Using the collected operation data, the potential security vulnerabilities of the change interface are discovered by including operation data rules such as value matching and business logic detection. Among them, the taint tracking algorithm is to identify the propagation path of the data in the target program by marking and tracking potential "tainted" data, that is, data that may contain malicious input or unverified data, and to determine whether it is at risk of being maliciously exploited; the operation data rule containing value matching is based on whether the value between the response data and the expected output matches the rule to determine whether there is a potential vulnerability. If there is response data that does not match the expected output (including various types of responses such as response output and response operation), it may indicate that there is a vulnerability. In addition, the design of the operation data rules of the embodiment of the present application can refer to the static data rules, which will not be repeated here.

[0103] Finally, based on the first vulnerability type, the second vulnerability type, and the third vulnerability type, the test result of the change interface can be obtained. For example, the test result of the change interface can be a result including all the aforementioned vulnerability types, or a vulnerability including the aforementioned vulnerability types whose occurrence ratio or number of occurrences exceeds a preset threshold, which is not limited here. In addition, for the various vulnerability types included in the test results of the change interface, the test results of the embodiment of the present application also include the authenticity identification of each vulnerability type, and the authenticity identification indicates the possibility that the corresponding vulnerability type actually exists. Due to the different accuracy of different vulnerability analysis methods, the authenticity identification is related to the number of occurrences of the vulnerability type in the aforementioned multiple vulnerability types, and the authenticity weight corresponding to the vulnerability analysis method that identifies the vulnerability type, which is not specifically limited here.

[0104] The embodiment of the present application combines three vulnerability analysis methods, namely, security analysis based on application interaction, security test analysis based on simulated attacks, and security analysis based on static code, and determines the test results of the change interface by combining the first vulnerability type, the second vulnerability type, and the third vulnerability type obtained by the three analysis methods. This can effectively improve the vulnerability coverage of the test results and reduce the vulnerability false alarm rate.

[0105] It should be noted that the vulnerability types in the embodiments of the present application, such as the first vulnerability type, the second vulnerability type and the third vulnerability type, may include but are not limited to: logical vulnerability type, unauthorized access type, unauthorized access type, injection type and command execution type, etc.

[0106] On the basis of the aforementioned embodiments, in some specific implementations, the generation of the test instruction in step 101 of the embodiment of the present application can be achieved by including but not limited to the following steps. Before the aforementioned step 101, the embodiment of the present application also includes: in response to the adjustment of the change interface, generating a test instruction for the change interface; or, in response to the adjustment of the change interface, generating a test task for the change interface, the test task has a corresponding trigger time; if the trigger time of the test task is reached, generating a test instruction for the change interface; or, generating a test task for the change interface at a preset time interval, the test task has a corresponding trigger time; if the trigger time of the test task is reached, generating a test instruction for the change interface.

[0107] Specifically, when the interface is changed and adjusted, a test instruction for the changed interface can be generated in real time; or, when the interface is changed and adjusted, a test task for the changed interface is automatically generated. Unlike the test instruction, the test task has a corresponding trigger time, which is used to generate the corresponding test instruction after the corresponding trigger time is reached; or, it is not triggered by the adjustment of the interface change, but a preset time interval is set, and according to the preset time interval, a test task for the changed interface is generated every certain period of time. Among them, each test task also includes a corresponding test scope, that is, after the test task is triggered, a test instruction for each interface within the test scope needs to be generated. It should be noted that the construction and management of test tasks can be embedded in the existing CI (Continuous Integration) / CD (Continuous Delivery) process as a control node in the process to ensure that each interface release update can automatically trigger security testing. It can be understood that the embodiments of the present application support third-party CI / CD tools such as Jenkins and GitLab CI.

[0108] It is understandable that the embodiment of the present application can generate a test instruction for changing the interface by including but not limited to the above three methods. The embodiment of the present application is not limited.

[0109] To better implement this application interface test method, please refer to Figure 2 , an embodiment of the present application provides an interface testing system, the implementation of which relies on three core layers: a use case intelligent generation module, a multi-dimensional security detection engine, and continuous integration and automated management. The three core layers are described one by one below.

[0110] The use case intelligent generation module includes three parts: syntax and semantic analysis, security vulnerability library and intelligent generation algorithm. Among them, syntax and semantic analysis is used to support the import of interface information into the interface document and the online editing of the interface document. The system's preset security vulnerability database (such as OWASPTop 10) includes preset attack payloads corresponding to different vulnerability types. The intelligent generation algorithm can generate an interface request based on the interface information in the interface document, and obtain the first vulnerability type by calling the static code security analysis module, and obtain the corresponding preset attack payload in combination with the security vulnerability database. Finally, based on the aforementioned content, a use case acquisition statement is constructed and input into the generative language model to obtain a test case in which the preset attack payload is inserted into the interface request parameter.

[0111] The following is a detailed analysis and example of test case generation. The business logic process of the delivery notice is: log in to the system, create a new delivery note, review the delivery note, execute the delivery, and send the delivery notice. During the security test, first enter the interface to be tested involved in the business logic process, select the vulnerability type to be tested, and the intelligent generation algorithm automatically generates security test cases for different scenarios. For example, the login user and password parameters, test security risks such as empty user names, SQL injections, and password cross-authentication; whether the delivery can be executed if the delivery note has not been reviewed and approved; whether the system verifies the validity of the data after repeated delivery; whether users who are not assigned delivery note permissions can exceed their authority to execute delivery and other security use cases.

[0112] The multi-dimensional security detection engine obtains the first vulnerability type, the second vulnerability type, and the third vulnerability type through three vulnerability analysis methods: security analysis based on application interaction, security test analysis based on simulated attacks, and security analysis based on static code, thereby achieving multi-dimensional and high-coverage interface testing for the changed interface.

[0113] Continuous integration and automation management are used to build test tasks and manage vulnerability repair tasks. Among them, continuous integration, continuous delivery and continuous deployment belong to the concept of DevOps, which refers to the transformation of manual intervention in a series of processes such as code construction, testing, deployment and infrastructure configuration in the traditional development process into automation, and the realization of rapid application delivery through automation. The automated test task module is used to support the management and configuration of test tasks. The security vulnerability management module is used to generate test results based on the multiple vulnerability types and authenticity identifications obtained by the multi-dimensional security detection engine, and attach vulnerability repair solutions suitable for changing interfaces obtained from preset different types of vulnerability repair solutions according to the vulnerability types in the test results. Finally, it also supports vulnerability repair task distribution and progress tracking.

[0114] In addition, the interface testing system also provides an interface layer, which is used to provide a user operation interface for users to edit interface documents online, adjust test cases output by the generative language model, and other functions that rely on the user operation interface.

[0115] See next Figure 3 , the following describes the detailed process steps of the interface testing solution of the embodiment of the present application based on the framework of the aforementioned interface testing system:

[0116] First, prepare the environment. First, upload the source code of the changed interface in the target program in advance to the interface test system or configure the source code in the online code repository for static code security analysis. Second, install the application interaction agent as a plug-in program on the device running the target program. The application interaction agent collects the running data and transmits it to the interface test system. Third, provide the interface document of the changed interface or the path of the interface document to obtain the interface information of the changed interface. Fourth, configure the local or remote security vulnerability library to obtain the required preset attack payload.

[0117] Then, the test case is generated through the use case intelligent generation module based on the first vulnerability type determined by the static code security analysis, the interface document, and the security vulnerability library. Next, the test case is executed, and the platform simultaneously performs multi-dimensional security analysis such as simulated attack security testing and application interaction security analysis, and combines the first vulnerability type of static code security analysis, the third vulnerability type based on application interaction security analysis, and the second vulnerability type based on simulated attack security test analysis to obtain test results, and performs vulnerability repair based on the aforementioned security vulnerability management module. Finally, the discovered security vulnerabilities are repaired and closed-loop vulnerability management is performed. In addition, according to actual business needs, CI / CD tool integration or scheduled tasks are configured to automatically perform interface testing.

[0118] During the interface testing process, if only a single security detection technology is used, such as simulated attack security testing, only some security risks can be discovered. The embodiments of the present application combine the advantages of multiple analysis technologies to make up for the shortcomings of a single technology and comprehensively explore the security risks of the interface. It is understandable that the interface testing system and interface testing method in each embodiment of the present application can be deployed in a computer device or a computer device cluster in the form of software, and the embodiments of the present application are not limited thereto.

[0119] See also Figure 4 , the embodiment of the present application provides an interface testing system, including:

[0120] A determination unit 401, used to determine a change interface indicated by a test instruction;

[0121] An acquisition unit 402 is used to acquire a test scenario including a changed interface in a corresponding interface to be tested, wherein the test scenario includes multiple interfaces to be tested and a calling sequence of each interface to be tested in the test scenario;

[0122] The construction unit 403 is used to construct a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the change interface in the test scenario, and the calling sequence of each interface to be tested;

[0123] The testing unit 404 is used to input the use case acquisition statement into the generative language model to obtain the test case output by the generative language model;

[0124] The testing unit 404 is further used to execute testing on the changed interface based on the test cases output by the generative language model.

[0125] In a specific implementation, before constructing a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the change interface in the test scenario, and the calling sequence of each interface to be tested, the interface test system further includes: an extraction unit;

[0126] An extraction unit, used for extracting static analysis data from source code of the changed interface;

[0127] The determination unit 401 is further configured to determine the vulnerability type corresponding to the static data rule as the first vulnerability type of the change interface if the static analysis data hits any preset static data rule;

[0128] The determining unit 401 is further configured to determine a preset attack payload belonging to the first vulnerability type as a preset attack payload of the change interface in the test scenario.

[0129] In a specific implementation method, based on the interface information of each interface to be tested, the construction unit 403 is specifically used to obtain an input template for guiding the generative language model to output test cases; the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling order of each interface to be tested are filled into the corresponding area in the input template to obtain a use case acquisition statement, and the use case acquisition statement is used to guide the generative language model to output multiple test cases.

[0130] In a specific implementation, the interface of the target program includes a change interface, and before executing a test for the change interface based on the test case output by the generative language model, the interface testing system further includes: a placement unit;

[0131] A placement unit, used for placing a preset stub program in a device running a target program;

[0132] The test unit 404 is specifically used to run the test case and obtain the response data of the interface change during the test case running process; obtain the running data generated by the target program during the test case running process through the plug-in program; and determine the test result of the interface change based on the response data of the interface change and the running data generated by the target program.

[0133] In a specific implementation, the determination unit 401 is specifically used to determine the vulnerability type corresponding to the response data rule as the second vulnerability type of the changed interface if the expected output of the changed interface and the response data of the changed interface in the test case hit any preset response data rule; if the running data generated by the target program hits any preset running data rule, the vulnerability type corresponding to the running data rule is determined as the third vulnerability type of the changed interface; and the test result of the changed interface is determined according to the first vulnerability type, the second vulnerability type and the third vulnerability type, and the first vulnerability type is determined based on the source code of the changed interface.

[0134] In a specific implementation, before determining the changed interface indicated by the test instruction, the method further includes:

[0135] In response to the adjustment of the changed interface, generating a test instruction for the changed interface;

[0136] or,

[0137] In response to the adjustment of the change interface, a test task of the change interface is generated, and the test task has a corresponding trigger time; if the trigger time of the test task is reached, a test instruction for the change interface is generated;

[0138] or,

[0139] A test task for the changed interface is generated at a preset time interval, and the test task has a corresponding trigger time; if the trigger time of the test task is reached, a test instruction for the changed interface is generated.

[0140] Figure 5 It is a schematic diagram of a computer device structure provided in an embodiment of the present application. The computer device 500 may include one or more central processing units (CPU) 501 and a memory 505. The memory 505 stores one or more application programs or data.

[0141] The memory 505 may be a volatile storage or a persistent storage. The program stored in the memory 505 may include one or more modules, each of which may include a series of instruction operations in the computer device. Furthermore, the central processing unit 501 may be configured to communicate with the memory 505 and execute a series of instruction operations in the memory 505 on the computer device 500.

[0142] The computer device 500 may also include one or more power supplies 502, one or more wired or wireless network interfaces 503, one or more input and output interfaces 504, and / or one or more operating systems, such as Windows Server 2008. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM wait.

[0143] The CPU 501 can execute the aforementioned Figures 1 to 4 The operations performed by the interface testing system in the illustrated embodiment will not be described in detail here.

[0144] It should be noted that, although the steps in the flowcharts involved in the embodiments are drawn in sequence according to the instructions of the arrows, unless otherwise clearly stated in this document, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0145] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0146] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0147] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0148] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0149] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

[0150] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the interface testing method as described above.

Claims

1. An interface testing method, characterized in that: include: Determine the change interface indicated by the test instruction; Obtaining a test scenario of the corresponding interface to be tested that includes the changed interface, wherein the test scenario includes multiple interfaces to be tested and a calling order of each of the interfaces to be tested in the test scenario; Constructing a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested; Inputting the use case acquisition statement into a generative language model to obtain a test case output by the generative language model; Based on the test cases output by the generative language model, a test on the changed interface is performed.

2. The method according to claim 1, characterized in that Before constructing the use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested, the method further includes: Extracting static analysis data from the source code of the changed interface; If the static analysis data hits any preset static data rule, the vulnerability type corresponding to the static data rule is determined as the first vulnerability type of the change interface; The preset attack payload belonging to the first vulnerability type is determined as the preset attack payload of the change interface in the test scenario.

3. The method according to claim 1, characterized in that The constructing of a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested includes: Obtaining an input template that guides the generative language model to output a test case; The interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling order of each interface to be tested are filled into the corresponding area in the input template to obtain the use case acquisition statement, and the use case acquisition statement is used to guide the generative language model to output multiple test cases.

4. The method according to claim 1, characterized in that: The interface of the target program includes the change interface. Before executing the test for the change interface based on the test case output by the generative language model, the method further includes: Placing a preset stub program in a device running the target program; The test case output based on the generative language model is used to perform a test on the changed interface, including: Running the test case and obtaining response data of the change interface during the running of the test case; Acquiring the operation data generated by the target program during the running of the test case through the plugging program; A test result of the changed interface is determined based on the response data of the changed interface and the running data generated by the target program.

5. The method according to claim 4, characterized in that The step of determining the test result of the changed interface based on the response data of the changed interface and the running data generated by the target program includes: If the expected output of the change interface and the response data of the change interface in the test case hit any preset response data rule, the vulnerability type corresponding to the response data rule is determined as the second vulnerability type of the change interface; If the operation data generated by the target program matches any preset operation data rule, the vulnerability type corresponding to the operation data rule is determined as the third vulnerability type of the change interface; A test result of the change interface is determined according to a first vulnerability type, a second vulnerability type, and a third vulnerability type, wherein the first vulnerability type is determined based on a source code of the change interface.

6. The method according to any one of claims 1 to 5, characterized in that: Before determining the changed interface indicated by the test instruction, the method further includes: In response to the adjustment of the change interface, generating a test instruction for the change interface; or, In response to the adjustment of the change interface, a test task of the change interface is generated, the test task has a corresponding trigger time; if the trigger time of the test task is reached, a test instruction for the change interface is generated; or, A test task for the changed interface is generated at a preset time interval, and the test task has a corresponding trigger time; if the trigger time of the test task is reached, a test instruction for the changed interface is generated.

7. An interface testing system, characterized in that: include: A determination unit, used for determining a change interface indicated by a test instruction; An acquisition unit, used to acquire a test scenario of a corresponding interface to be tested that includes the changed interface, wherein the test scenario includes multiple interfaces to be tested and a calling sequence of each of the interfaces to be tested in the test scenario; A construction unit, configured to construct a use case acquisition statement based on the interface information of each interface to be tested, the preset attack load of the changed interface in the test scenario, and the calling sequence of each interface to be tested; A testing unit, used for inputting the use case acquisition statement into a generative language model to obtain a test case output by the generative language model; The testing unit is further used to perform testing on the changed interface based on the test cases output by the generative language model.

8. A computer device, characterized in that: include: CPU, memory and input / output interface; The memory is a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 6.

9. A computer program product comprising instructions, characterized in that When the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.

10. A computer storage medium, characterized in that: The computer storage medium stores instructions, and when the instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.

Images