Fuzzy test method and system based on particle swarm optimization

Abstract

The invention discloses a fuzzy testing method and system based on particle swarm optimization, and the method comprises the following steps: initializing a seed queue, generating an initial seed, and enabling the initial seed to generate a test case; constructing a seed preparation exploration queue and a seed variation utilization queue, and putting the initial seeds into the seed preparation exploration queue; performing optimization screening on the seeds in the seed preparation exploration queue by adopting a multi-arm bandit model, and selecting the seeds most conforming to expectation to enter a seed variation utilization queue; and performing variation on the seed variation by utilizing seed distribution energy in the queue to generate a test case, and applying the test case to vulnerability detection. The invention provides a double-queue seed selection method, a multi-arm bandit mode is adopted to calculate seed predicted income so as to screen seeds, a classified particle swarm optimization seed mutation method is provided, and mutation operation is iteratively screened according to classification. And the vulnerability detection efficiency is improved from the aspects of path exploration speed, path exploration total quantity, vulnerability quantity and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability mining, and in particular to a fuzzy testing method and system based on particle swarm optimization. Background Art

[0002] Fuzz testing is an efficient automated vulnerability discovery technology that is widely used in the field of software security. Its performance is highly dependent on seed selection strategies and mutation scheduling schemes.

[0003] In terms of seed selection strategies, existing methods mainly directly select seeds based on the order in which they are queued or randomly, or prefer smaller and faster seeds, ignoring the importance of seed sorting, resulting in over-screening of some high-frequency seeds and difficulty in correctly selecting high-quality seeds with vulnerability mining potential to help enhance vulnerability mining effects.

[0004] In terms of seed mutation scheduling, existing methods mainly use random scheduling strategies to treat all mutation operations. Due to the lack of recognition that different mutation operations will correspond to different benefits, various mutation operations of the seed are given the same mutation weight indiscriminately, and mutation operations are only performed in simple repetition and sequence, which makes the mutation scheduling very random, generates a large number of invalid test cases, and leads to resource consumption. It will also inevitably ignore some valid mutation operations, thus affecting the performance of fuzz testing. Summary of the invention

[0005] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a fuzzy testing method and system based on particle swarm optimization. For seed selection in fuzzy testing, a double-queue seed selection method is proposed, and the expected seed returns are calculated in a multi-armed bandit manner to screen seeds. A seed mutation method for classified particle swarm optimization is proposed, and mutation operations are screened iteratively according to classification. By improving seed selection and mutation methods, the efficiency of vulnerability detection is improved in terms of path exploration speed, total path exploration amount and number of vulnerabilities.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a fuzzy testing method based on particle swarm optimization, the testing method comprising the following steps:

[0007] The seed queue is initialized to generate the initial seed, which can generate test cases;

[0008] Construct a seed preparation exploration queue and a seed mutation utilization queue, and put the initial seed into the seed preparation exploration queue;

[0009] The multi-armed bandit model is used to optimize and screen the seeds in the seed preparation exploration queue, and the most expected seeds are selected to enter the seed mutation utilization queue;

[0010] The seed mutation utilizes the energy allocated to the seeds in the queue to generate test cases, and the test cases are used for vulnerability detection.

[0011] In a preferred embodiment, a multi-armed bandit model is used to optimize and screen the seeds in the seed preparation exploration queue, and the most desired seeds are selected to enter the seed mutation utilization queue, including the following steps:

[0012] Exploration phase: treat each seed in the seed preparation exploration queue as a seed arm, and all seeds in the seed preparation exploration queue as a whole. Roll down the pull rod of the seed arm in turn, independently calculate the variance estimate of each seed relative to the whole, and calculate the expected return of the seed arm;

[0013] Utilization phase: Sort the expected returns of various seeds, set the screening rate, output the seeds with high expected returns to the seed mutation utilization queue, and return the remaining seeds to the seed preparation exploration queue and mark them as seeds with calculated expected returns.

[0014] In a preferred embodiment, the method for calculating the expected return of the seed arm is the upper confidence bound variance-aware algorithm UCB-V, comprising the following steps:

[0015] Calculate the sum of the benefits of all seeds in the seed preparation exploration queue:

[0016] R[i]+=G[i]i=1,2,…,S_total,

[0017] Where G[i] represents the revenue of the i-th seed, S_total is the number of seeds in the seed preparation exploration queue, and R[i] represents the sum of the G[i] values ​​in the seed preparation exploration queue;

[0018] Calculate the variance estimates of various seeds in the seed preparation exploration queue. The variance estimate of the i-th seed is calculated as follows:

[0019]

[0020] R all + = G[i] × G[i],

[0021] Where Variance[i] represents the variance estimate of the i-th seed, R all represents the sum of squares of all seeds G[i] in the seed preparation exploration queue, and N[i] represents the number of times the i-th seed is selected;

[0022] Calculate the upper confidence bound estimates of various seeds in the seed preparation exploration queue. The upper confidence bound estimate of the i-th seed is calculated as follows:

[0023]

[0024] Where UCB_V[i] represents the upper confidence bound estimate of the i-th seed.

[0025] In a preferred embodiment, a feedback reward mechanism is integrated into the upper confidence bound variance perception algorithm UCB-V, and the feedback reward mechanism gives the seed arm a new weight 1+P i , and obtain the adjusted upper confidence bound UCB_V_W[i], the calculation formula is as follows:

[0026] UCB_V_W[i]=UCB_V[i]×(1+P i ),

[0027] UCB_V[i] represents the upper confidence bound estimate of the ith seed, P i It represents the weight adjustment amplitude of the i-th seed, and UCB_V_W[i] represents the upper confidence bound value of the i-th seed after adjustment.

[0028] In a preferred embodiment, the seed mutation utilizing the seed allocation energy in the queue is used to generate a test case, including the following steps:

[0029] The mutation operation is regarded as particles, and the particles are divided into multiple particle groups. The particle groups are classified to find the best particle group to calculate the probability distribution and guide the seed mutation. During the seed mutation process, a pilot engine and a working engine are set up for mutation optimization.

[0030] In a preferred embodiment, in the pilot engine, a classification linear reduction strategy is adopted to divide multiple particle swarms into three categories: a large-scale search strong detection particle swarm S1, a fine search strong development particle swarm S2, and an adaptive fast speed particle swarm S3. The inertia weight ω is linearly decayed in S1, S2, and S3 to control the speed of the particles. The inertia weight ω of S1, S2, and S3 is calculated as follows:

[0031]

[0032] where ω max and ω min The maximum and minimum inertia weights set for the particle group, t max is the maximum number of iterations set, and t is the current number of iterations;

[0033] Set different maximum inertia weights ω for S1, S2, and S3 max and the minimum value ω min ;

[0034] Evaluate the local optimal position L of S1, S2, and S3 respectively best and the global optimal position G best ;

[0035] Local optimal position L best To generate more interesting test cases after mutation, we use local efficiency now To measure, eff now The number of interesting test cases that contributed to this mutation operation. now Divided by the number of calls M of the mutation operation in one iteration times , the position with the largest ratio is L best ;

[0036]

[0037] The global optimal position G best The position that produces the most interesting test cases for all mutation operations. Different particles have different global optimal positions. Find the best particle group.

[0038] In a preferred embodiment, in the working engine, the optimal probability distribution is generated by the proportion of each mutation operation of the optimal particle group, and the test case is generated by the mutation of the optimal probability distribution. Then, the particle group is iterated through the global and local efficiency information, and the speed and position information of each particle are updated to continue the next round of mutation optimization.

[0039] A fuzzy testing system based on particle swarm optimization includes an initialization module, a queue construction module, a screening module, and a mutation testing module;

[0040] Initialization module: Initialize the seed queue and generate the initial seed, which can generate test cases;

[0041] Queue construction module: constructs a seed preparation exploration queue and a seed mutation utilization queue, and puts the initial seeds into the seed preparation exploration queue;

[0042] Screening module: Use the multi-armed bandit model to optimize and screen the seeds in the seed preparation exploration queue, and select the most expected seeds to enter the seed mutation utilization queue;

[0043] Mutation testing module: The seed mutation uses the seed allocation energy in the queue to generate test cases, and the test cases are used for vulnerability detection.

[0044] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0045] In view of the seed selection problem in fuzzy testing, the present invention constructs two queues, a seed preparation exploration queue and a seed mutation utilization queue, and uses a multi-armed gambling machine to optimize and screen the seeds in the seed preparation exploration queue to select the most desired seeds to enter the seed mutation utilization queue, and integrates the feedback reward mechanism in the optimization and screening process, so that the seeds in the seed mutation utilization queue can better discover vulnerabilities after mutation. In view of the seed mutation problem in fuzzy testing, the present invention regards the mutation operation as a particle, constructs a particle swarm, and divides the particle swarm into three categories. Each class formulates a search strategy, and then evaluates the local and global effectiveness of the particle swarm, selects appropriate mutation operations to generate test cases, and improves the test case path exploration speed and the ability of the total amount of path exploration. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0047] Figure 1 It is a schematic diagram of the method flow of the present invention;

[0048] Figure 2 Schematic diagram of seed mutation and test case analysis;

[0049] Figure 3 Schematic diagram of the cooperation mode and transformation path among particle groups. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Example 1: Please refer to Figure 1 As shown, the fuzzy testing method based on particle swarm optimization described in this embodiment includes the following steps:

[0052] Step 1: Initialize the seed queue and generate a batch of legal program inputs as initial seeds. These initial seeds can generate test cases.

[0053] Step 2: Construct a seed preparation exploration queue and a seed mutation utilization queue, and put the initial seed into the seed preparation exploration queue;

[0054] Step 3: Use the multi-armed bandit model to optimize and screen the seeds in the seed preparation exploration queue, and select the most expected seeds to enter the seed mutation utilization queue;

[0055] Exploration phase:

[0056] Consider each seed in the seed preparation exploration queue as a seed arm, and all seeds in the seed preparation exploration queue as a whole. Pull down the pull rods of the seed arms one by one, independently calculate the variance estimate of each seed relative to the global one, and calculate the expected return of the seed arm.

[0057] The method for calculating the expected return of a seed arm in the present invention is the upper confidence bound variance-aware algorithm UCB-V, which introduces a variance variable on the classic upper confidence bound algorithm UCB. The UCB-V algorithm first calculates the variance of the return estimate of each seed arm; then, the algorithm uses the variance as a measurement factor and selects the seed arm in combination with the estimated upper confidence bound. The larger the variance, the more uncertain the return estimate of the seed arm. In the present invention, the seed arm with a larger variance will have a higher probability of being selected during the selection process, so as to allow for more exploration. The UCB-V algorithm of the present invention can balance the strategies of exploration and utilization, and can not only utilize the existing return estimation information, but also try to use those seed arms with greater uncertainty for exploration.

[0058] The UCB-V algorithm is as follows:

[0059] Calculate the sum of the benefits of all seeds in the seed preparation exploration queue:

[0060] R[i]+=G[i]i=1,2,…,S_total,

[0061] Where G[i] represents the benefit of the i-th seed, that is, the benefit brought by the number of inputs that trigger new unique paths or crashes when the i-th seed in the seed preparation exploration queue is selected, S_total is the number of seeds in the seed preparation exploration queue, and R[i] represents the sum of the G[i] values ​​in the seed preparation exploration queue.

[0062] Calculate the variance estimates of various seeds in the seed preparation exploration queue. The variance estimate of the i-th seed is calculated as follows:

[0063]

[0064] R all + = G[i] × G[i],

[0065] Where Variance[i] represents the variance estimate of the i-th seed, R allrepresents the sum of squares of all seeds G[i] in the seed preparation exploration queue, and N[i] represents the number of times the i-th seed is selected.

[0066] Calculate the upper confidence bound estimates of various seeds in the seed preparation exploration queue. The upper confidence bound estimate of the i-th seed is calculated as follows:

[0067]

[0068] Where UCB_V[i] represents the upper confidence bound estimate of the ith seed. It can be seen that if a seed finds more unique paths and crashes and is selected less times in history, the upper confidence bound estimate of the seed will be higher.

[0069] When the fuzz test is just started, most paths are not explored, and the number of times the seeds in the seed preparation exploration queue are selected is almost equal. The UCB-V algorithm will have the problem of too uniform upper confidence bound valuation in the middle of the entire fuzz test process. The present invention sets up a feedback reward mechanism to make the seeds with potential exploration ability and those seeds that improve the upper confidence bound valuation due to variance perception methods widen the gap.

[0070] The feedback reward mechanism is integrated into the upper confidence bound variance perception algorithm UCB-V. The feedback reward mechanism gives the seed arm with a high frequency of new path transfer a new weight of 1+P i , and obtain the adjusted upper confidence bound UCB_V_W[i], the calculation formula is as follows:

[0071] UCB_V_W[i]=UCB_V[i]×(1+P i ),

[0072] UCB_V[i] represents the upper confidence bound estimate of the ith seed, P i It represents the weight adjustment amplitude of the i-th seed, and UCB_V_W[i] represents the upper confidence bound value of the i-th seed after adjustment.

[0073] Exploitation phase:

[0074] The utilization phase mainly involves sorting and screening. Sorting is to sort the expected returns of various seeds (i.e., the upper confidence bound UCB_V_W[i]), and output the seeds with high expected returns to the seed mutation utilization queue, which is used for subsequent seed mutation to generate test cases.

[0075] The default screening rate is set to 0.65 to screen out seeds with high expected returns for output, and the remaining seeds are returned to the seed preparation exploration queue and marked as seeds with calculated expected returns, reducing the amount of calculation in the next round of screening.

[0076] By continuously updating the reward estimation and the number of selections, the UCB-V algorithm gradually adjusts the confidence upper bound of each seed arm to achieve a balance between the exploration phase and the utilization phase. In the early stage, it is more inclined to explore seed arms with potential high expected returns, and in the later stage, it gradually turns to utilizing seed arms with known higher expected returns.

[0077] Step 4: Utilize the energy allocated to the seeds in the seed mutation queue to mutate and generate test cases, and use the test cases for vulnerability detection.

[0078] For seed mutation, the seeds in the queue are used to allocate energy according to the upper confidence limit value to generate test cases. The present invention regards the mutation operation as particles and proposes a seed mutation method based on classified particle swarm optimization, such as Figure 2 As shown in the figure, the particles are divided into multiple particle groups, and the particle groups are classified to find the best particle group to calculate the probability distribution and guide the seed mutation. In the seed mutation process, a pilot engine and a working engine are set up for mutation optimization. The seed mutation operation includes the operations in the deterministic mutation stage and the Havoc operation and Splice operation in the non-deterministic mutation stage.

[0079] In the pilot engine, the present invention proposes a classification linear decreasing strategy to divide multiple particle swarms into three categories: large-scale search strong detection particle swarm S1, fine search strong development particle swarm S2, and adaptive speed fast particle swarm S3. Each type of particle swarm implements a different exploration strategy, and calculates the local efficiency of each particle swarm according to the number and proportion of interesting seeds, and finds the particle swarm with the best effect.

[0080] Among them, particle swarm S1 adopts a large-scale search strategy and has strong detection capability; particle swarm S2 adopts a fine search strategy and has strong development capability; particle swarm S3 adopts an adaptive speed update strategy and has fast search speed capability.

[0081] Since the inertia weight ω is introduced into the particle swarm, it can be used to control the speed of the particles after each round of update. When the inertia weight is increased, the particles have a faster moving speed. Compared with particles at normal speed, the reduction in movement cost makes the particle search range larger, making the particles have a stronger large-scale search capability. Similarly, when the inertia weight is reduced, the search range becomes smaller, then the particles will pay more attention to the development of adjacent areas, and the local search capability is stronger at this time. The classified linear decrease strategy of the present invention linearly decays the inertia weight ω in particle swarms S1, S2, and S3 to control the speed of the particles, thereby indirectly giving different exploration and development capabilities to different subgroups. The inertia weight ω of particle swarms S1, S2, and S3 is calculated as follows:

[0082]

[0083] where ωmax and ω min The maximum and minimum inertia weights set for the particle group, t max is the maximum number of iterations set, and t is the current number of iterations.

[0084] By setting different maximum inertia weights ω for particle groups S1, S2, and S3 max and the minimum value ω min , differentiate the exploration and development capabilities of each particle group. The maximum inertia weight ω corresponding to the exploration strategy of particle groups S1, S2, and S3 max and the minimum value ω min They are:

[0085] 1) Large-scale search strategy:

[0086]

[0087] 2) Refined search strategy:

[0088]

[0089] 3) Adaptive speed search strategy:

[0090]

[0091] Evaluate the local optimal position L of particle swarms S1, S2, and S3 respectively best and the global optimal position G best .

[0092] Local optimal position L best The location where more interesting test cases are generated after performing the mutation operation (for example, when the particle performs the x1 operation, more interesting test cases are generated than when it performs the x2 operation). now To measure, eff now The number of interesting test cases that contributed to this mutation operation. now Divided by the number of calls M of the mutation operation in one iteration times , the position with the largest ratio is L best .

[0093]

[0094] The global optimal position G best The position that produces the most interesting test cases for all mutation operations. Different particles have different global optimal positions.

[0095] Each particle group cooperates by sharing their current optimal position information. The cooperation mode and transformation path between particle groups are as follows: Figure 3As shown in Figure 2, the subswarm optimality of one particle swarm can be transformed into the global optimality of another particle swarm.

[0096] In the working engine, the optimal probability distribution is generated by the proportion of each mutation operation of the optimal particle group, and the test cases are generated by the mutation of the optimal probability distribution. Then, the particle group is iterated through the global and local efficiency information, and the speed and position information of each particle are updated to continue the next round of mutation optimization.

[0097] The seed is mutated to generate test cases, which are then input into the program for vulnerability detection. If the test case analysis shows that the seed discovers new paths, new vulnerabilities, etc., the seed is considered an interesting seed and is put back into the seed queue.

[0098] The present invention invents a multi-armed bandit model for seed selection, constructs a seed preparation exploration queue and a seed mutation utilization queue, and selects high-quality seeds from the seed preparation exploration queue to the seed mutation utilization queue according to the upper confidence bound value through the upper confidence bound variance perception algorithm (UCB-V) and the feedback reward mechanism. For seed mutation, the mutation operation is regarded as particles, and the particles are divided into three particle groups. Different exploration modes are used to gradually reduce the particle group inertia weight according to the classified linear decreasing strategy, and the local optimal position and global optimal position of the particle group are calculated, so as to find the best particle group, and the test case analysis generated by the operation corresponding to the best particle group is performed, and the information of each particle is updated to perform particle group iteration. The present invention can improve the efficiency of vulnerability detection in terms of path exploration speed, total path exploration amount and number of vulnerabilities.

[0099] Embodiment 2: A fuzzy testing system based on particle swarm optimization described in this embodiment includes an initialization module, a queue construction module, a screening module, and a mutation testing module;

[0100] Initialization module: Initialize the seed queue and generate the initial seed, which can generate test cases;

[0101] Queue construction module: constructs a seed preparation exploration queue and a seed mutation utilization queue, and puts the initial seeds into the seed preparation exploration queue;

[0102] Screening module: Use the multi-armed bandit model to optimize and screen the seeds in the seed preparation exploration queue, and select the most expected seeds to enter the seed mutation utilization queue;

[0103] Mutation testing module: The seed mutation uses the seed allocation energy in the queue to generate test cases, and the test cases are used for vulnerability detection.

[0104] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0105] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A fuzzy testing method based on particle swarm optimization, characterized in that: The test method comprises the following steps: The seed queue is initialized to generate the initial seed, which can generate test cases; Construct a seed preparation exploration queue and a seed mutation utilization queue, and put the initial seed into the seed preparation exploration queue; The multi-armed bandit model is used to optimize and screen the seeds in the seed preparation exploration queue, and the most expected seeds are selected to enter the seed mutation utilization queue; The seed mutation utilizes the energy allocated to the seeds in the queue to generate test cases, and the test cases are used for vulnerability detection.

2. The fuzzy testing method based on particle swarm optimization according to claim 1, characterized in that: The multi-armed bandit model is used to optimize and screen the seeds in the seed preparation exploration queue, and the most desired seeds are selected to enter the seed mutation utilization queue, including the following steps: Exploration phase: treat each seed in the seed preparation exploration queue as a seed arm, and all seeds in the seed preparation exploration queue as a whole. Roll down the pull rod of the seed arm in turn, independently calculate the variance estimate of each seed relative to the whole, and calculate the expected return of the seed arm; Utilization phase: Sort the expected returns of various seeds, set the screening rate, output the seeds with high expected returns to the seed mutation utilization queue, and return the remaining seeds to the seed preparation exploration queue and mark them as seeds with calculated expected returns.

3. The fuzzy testing method based on particle swarm optimization according to claim 2, characterized in that: The method for calculating the expected return of the seed arm is the upper confidence bound variance-aware algorithm UCB-V, which includes the following steps: Calculate the sum of the benefits of all seeds in the seed preparation exploration queue: R[i]+=G[i]i=1,2,…,S_total, Where G[i] represents the revenue of the i-th seed, S_total is the number of seeds in the seed preparation exploration queue, and R[i] represents the sum of the G[i] values ​​in the seed preparation exploration queue; Calculate the variance estimates of various seeds in the seed preparation exploration queue. The variance estimate of the i-th seed is calculated as follows: R all +=G[i]×G[i], Where Variance[i] represents the variance estimate of the i-th seed, R all represents the sum of squares of all seeds G[i] in the seed preparation exploration queue, and N[i] represents the number of times the i-th seed is selected; Calculate the upper confidence bound estimates of various seeds in the seed preparation exploration queue. The upper confidence bound estimate of the i-th seed is calculated as follows: Where UCB_V[i] represents the upper confidence bound estimate of the i-th seed.

4. The fuzzy testing method based on particle swarm optimization according to claim 3 is characterized in that: The feedback reward mechanism is integrated into the upper confidence bound variance-aware algorithm UCB-V, which gives the seed arm a new weight 1+P i , and obtain the adjusted upper confidence bound UCB_V_W[i], the calculation formula is as follows: UCB_V_W[i]=UCB_V[i]×(1+P i ), UCB_V[i] represents the upper confidence bound estimate of the ith seed, P i It represents the weight adjustment amplitude of the i-th seed, and UCB_V_W[i] represents the upper confidence bound value of the i-th seed after adjustment.

5. The fuzzy testing method based on particle swarm optimization according to claim 4 is characterized in that: The seed mutation uses the seed allocation energy in the queue to generate test cases, including the following steps: The mutation operation is regarded as particles, and the particles are divided into multiple particle groups. The particle groups are classified to find the best particle group to calculate the probability distribution and guide the seed mutation. During the seed mutation process, a pilot engine and a working engine are set up for mutation optimization.

6. The fuzzy testing method based on particle swarm optimization according to claim 5, characterized in that: In the pilot engine, a classification linear reduction strategy is used to divide multiple particle swarms into three categories: large-scale search strong detection particle swarm S1, fine search strong development particle swarm S2, and adaptive speed fast particle swarm S3. The inertia weight ω is linearly decayed in S1, S2, and S3 to control the speed of the particles. The inertia weight ω of S1, S2, and S3 is calculated as follows: where ω max and ω min The maximum and minimum inertia weights set for the particle group, t max is the maximum number of iterations set, and t is the current number of iterations; Set different maximum inertia weights ω for S1, S2, and S3 max and the minimum value ω min ; Evaluate the local optimal position L of S1, S2, and S3 respectively best and the global optimal position G best ; Local optimal position L best To generate more interesting test cases after mutation, we use local efficiency now To measure, eff now The number of interesting test cases that contributed to this mutation operation. no w divided by the number of calls to the mutation operation in one iteration M times , the position with the largest ratio is L best ; The global optimal position G best The position that produces the most interesting test cases for all mutation operations. Different particles have different global optimal positions. Find the best particle group.

7. The fuzzy testing method based on particle swarm optimization according to claim 6 is characterized in that: In the working engine, the optimal probability distribution is generated by the proportion of each mutation operation of the optimal particle group, and the test cases are generated by the mutation of the optimal probability distribution. Then, the particle group is iterated through the global and local efficiency information, and the speed and position information of each particle are updated to continue the next round of mutation optimization.

8. A fuzzy testing system based on particle swarm optimization, used to implement the testing method according to any one of claims 1 to 7, characterized in that: Includes initialization module, queue construction module, screening module, and mutation testing module; Initialization module: Initialize the seed queue and generate the initial seed, which can generate test cases; Queue construction module: constructs a seed preparation exploration queue and a seed mutation utilization queue, and puts the initial seeds into the seed preparation exploration queue; Screening module: Use the multi-armed bandit model to optimize and screen the seeds in the seed preparation exploration queue, and select the most expected seeds to enter the seed mutation utilization queue; Mutation testing module: The seed mutation uses the seed allocation energy in the queue to generate test cases, and the test cases are used for vulnerability detection.

Images