Database fuzz testing method and system based on deep feedback and semantic preservation

Abstract

The present invention relates to the field of computer software security technology, and provides a database fuzz testing method and system based on deep feedback and semantic preservation. The method includes collecting standard query templates to set a mutation rule library, generating a mutation strategy through a mutation strategy generator; sending the mutation strategy to a target database for fuzz testing, and recording the target database's response information to the mutation strategy; obtaining the response information in real time through a deep feedback mechanism, and dynamically optimizing the mutation strategy; generating test cases through a semantic preservation strategy; dynamically adjusting the priority of test tasks and allocating resources through an intelligent scheduling module; executing the test cases and obtaining test results. The present invention significantly improves the effectiveness and reliability of database fuzz testing, greatly enhances the ability to discover deep-level security vulnerabilities, and provides strong support for protecting databases from threats from various unknown attack modes.

Description

Technical Field

[0001] The present invention relates to the field of computer software security technology, and in particular to a database fuzz testing method and system based on deep feedback and semantic preservation. Background Art

[0002] With the development of information technology, database systems are increasingly used. However, vulnerabilities in database systems can lead to serious data leakage or loss. While traditional fuzz testing methods can detect some basic issues, they are ineffective when dealing with complex data structures and often ignore semantic information, leading to insufficient test coverage, high false positive rates, and low efficiency. Summary of the Invention

[0003] The present invention aims to address at least one of the technical problems existing in the related art. To this end, it provides a database fuzz testing method and system based on deep feedback and semantic preservation. This method significantly improves the effectiveness and reliability of database fuzz testing, greatly enhances the ability to discover deep-seated security vulnerabilities, and provides strong support for protecting databases from various unknown attack patterns.

[0004] The present invention provides a database fuzz testing method based on deep feedback and semantic preservation, comprising:

[0005] S1: Collect standard query templates, screen and annotate the standard query templates, set basic variation rules according to the standard query templates, and build and regularly update a variation rule library based on the basic variation rules;

[0006] S2: Using a mutation strategy generator, the query input is automatically generated into a mutation strategy based on a mutation rule library; the mutation strategy is sent to a target database for fuzz testing, and the response information of the target database to the mutation strategy is recorded;

[0007] S3: obtaining response information of the target database to the mutation strategy in real time through a deep feedback mechanism, and dynamically optimizing the mutation strategy using the response information;

[0008] S4: Generate syntactically correct and semantically consistent test cases based on the optimized mutation strategy using the semantics-preserving strategy;

[0009] S5: Dynamically adjust the priority of test tasks and allocate resources through the intelligent scheduling module; execute test cases and obtain test results.

[0010] Furthermore, in step S1,

[0011] Collect standard SQL query templates from public resources and internal accumulation, wherein the standard SQL query templates include CRUD operations;

[0012] The standard SQL query template is screened and annotated, wherein the screening includes reviewing the quality and applicability of the standard SQL query template, and the annotation includes the scope of application, expected output, and precautions.

[0013] Furthermore, the basic mutation rules include random character replacement, keyword insertion or deletion, and numerical value change.

[0014] Furthermore, the depth feedback mechanism includes:

[0015] Using a standard database connection interface to obtain the database's response information to the mutation strategy in real time;

[0016] Adopt a multi-level caching mechanism, use memory cache to quickly store the response information, persist important data to disk or distributed file system, and back up regularly;

[0017] Using machine learning algorithms to perform data analysis on the response information to identify normal behavior, abnormal behavior, and potential security threats;

[0018] By combining reinforcement learning algorithms with genetic algorithms, mutation strategies are optimized based on abnormal behaviors and potential security threats.

[0019] Furthermore, the adopting of a machine learning algorithm to perform data analysis on the response information to identify normal behavior, abnormal behavior and potential security threats includes:

[0020] Use unsupervised learning algorithms to identify normal behavior;

[0021] Use supervised learning algorithms to train models to identify abnormal behaviors and potential security threats.

[0022] Furthermore, the response information includes the returned data set, execution time, error code and status information;

[0023] The machine learning algorithm includes any one of K-means clustering, ARIMA model, support vector machine, random forest, convolutional neural network and long short-term memory network.

[0024] Furthermore, the semantic preservation strategy includes:

[0025] A SQL language parser is designed using a recursive descent parsing method, wherein the SQL language parser supports nested queries and conditional expressions;

[0026] Parse SQL queries and their variants through the SQL language parser;

[0027] The parsed SQL queries and their variant versions are used as training data to evaluate the impact of the variant queries on semantics by training a deep learning model.

[0028] A semantic consistency check is performed after each mutation query to verify semantic consistency by comparing the query result sets or expected invariants before and after the mutation.

[0029] Furthermore, the deep learning model is a recurrent neural network or a long short-term memory network.

[0030] Furthermore, the intelligent scheduling module includes:

[0031] Dynamically adjust task priorities based on current test progress and resource usage,

[0032] Use load balancing algorithms to distribute tasks among multiple test nodes;

[0033] Provides a graphical interface to support users to customize the test scope and mutation strategy.

[0034] The present invention also provides a database fuzz testing system based on deep feedback and semantic preservation, which is used to execute any of the above-mentioned database fuzz testing methods based on deep feedback and semantic preservation, including:

[0035] a variation rule library acquisition module, which collects standard query templates, screens and annotates the standard query templates, sets basic variation rules based on the standard query templates, and constructs and regularly updates a variation rule library based on the basic variation rules;

[0036] A fuzzy testing module, which uses a mutation strategy generator to automatically generate a mutation strategy based on a mutation rule library based on a query input; sends the mutation strategy to a target database for fuzz testing, and records the target database's response information to the mutation strategy;

[0037] A deep feedback module, which obtains response information of the target database to the mutation strategy in real time through a deep feedback mechanism, and uses the response information to dynamically optimize the mutation strategy;

[0038] A semantics-preserving module, which generates test cases that are grammatically correct and semantically consistent with expectations using a semantics-preserving strategy and an optimized mutation strategy;

[0039] The intelligent scheduling module dynamically adjusts the priority of the test tasks and allocates resources through the intelligent scheduling module; executes the test cases and obtains the test results.

[0040] The above one or more technical solutions in the embodiments of the present invention have at least one of the following technical effects:

[0041] It significantly improves the effectiveness and reliability of database fuzz testing, greatly enhances the ability to discover deep-seated security vulnerabilities, and provides strong support for protecting databases from threats from various unknown attack patterns.

[0042] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 This is a flowchart of a database fuzz testing method based on deep feedback and semantic preservation provided by the present invention.

[0045] Figure 2 This is a structural diagram of a database fuzzy testing system based on deep feedback and semantic preservation provided by the present invention.

[0046] Reference numerals:

[0047] 101. Mutation rule library acquisition module; 102. Fuzz testing module; 103. Deep feedback module; 104. Semantic preservation module; 105. Intelligent scheduling module. DETAILED DESCRIPTION

[0048] To make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below. Obviously, the embodiments described are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. The following embodiments are used to illustrate the present invention, but are not used to limit the scope of the present invention.

[0049] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0050] The following combination Figures 1 to 2 The present invention describes a database fuzz testing method and system based on deep feedback and semantic preservation.

[0051] like Figure 1 As shown, a database fuzz testing method based on deep feedback and semantic preservation includes:

[0052] S1: Collect standard query templates, screen and annotate them, set basic mutation rules based on the standard query templates, and build and regularly update the mutation rule library based on the basic mutation rules;

[0053] Standard SQL query templates are collected from public resources and internal accumulation. Standard SQL query templates cover CRUD operations and other complex query scenarios; CRUD operations include Create, Read, Update, and Delete.

[0054] Screening and annotating the standard SQL query templates. The screening includes reviewing the quality and applicability of the standard SQL query templates. The annotation includes the scope of application, expected output, and precautions.

[0055] Each template is rigorously screened to ensure its representativeness, and a dedicated review committee is established to examine the quality and suitability of the templates.

[0056] Provide detailed comments for each template, explaining its scope of application, expected output, and any special considerations. Provide specific example input and output to help users understand the specific purpose of the template.

[0057] Basic mutation rules include random character replacement, keyword insertion / deletion, and numerical value changes.

[0058] Regularly update the mutation rule library and add new mutation rules to cope with ever-changing security threats.

[0059] S2: Using a mutation strategy generator, the query input is automatically generated into a mutation strategy based on a mutation rule library; the mutation strategy is sent to a target database for fuzz testing, and the response information of the target database to the mutation strategy is recorded;

[0060] The mutation strategy generator can automatically generate suitable mutation strategies based on user input.

[0061] S3: obtaining response information of the target database to the mutation strategy in real time through a deep feedback mechanism, and dynamically optimizing the mutation strategy using the response information;

[0062] Deep feedback mechanisms include:

[0063] Using a standard database connection interface to obtain the database's response information to the mutation strategy in real time;

[0064] The standard database connection interface is JDBC or ODBC. The response information includes the returned data set, execution time, error code, and status information.

[0065] Adopt a multi-level caching mechanism, use memory cache to quickly store the response information, persist important data to disk or distributed file system, and back up regularly;

[0066] In order to handle data flow in high concurrency situations, a multi-level cache mechanism is used to store response information.

[0067] The response information is analyzed using a machine learning algorithm to identify normal behavior, abnormal behavior, and potential security threats, including:

[0068] Use unsupervised learning algorithms to identify normal behavior;

[0069] Clustering is performed by calculating the distance between samples (such as Euclidean distance). The calculation expression of its objective function is:

[0070]

[0071] in, is the objective function of clustering, is the number of clusters, is the sample set of the i-th cluster, is the center of the i-th cluster, is the sample point, ||·|| is the Euclidean distance, To find the minimum function.

[0072] Use supervised learning algorithms to train models to identify abnormal behaviors and potential security threats;

[0073] Autoregressive Moving Average (ARIMA) model is used to predict time series to monitor long-term trends and cyclical changes, helping to identify potential security threats. Given time series data , the calculation expression of the ARIMA model is:

[0074]

[0075] in, is the backshift operator, , for Time series data at the moment, is the number of steps backward, is the polynomial of the autoregressive (AR) part, with order p, is the difference operation, used to make the time series stationary. is the difference order, is the polynomial of the moving average (MA) part, with an order of , is a white noise sequence that obeys the normal distribution , is the variance.

[0076] The machine learning algorithms include any one of K-means clustering, ARIMA model, support vector machine, random forest, convolutional neural network and long short-term memory network.

[0077] Once an abnormality is detected, the feedback mechanism is immediately triggered to adjust the subsequent test strategy. The preset success / failure criteria are used to determine whether the test result is abnormal. If an abnormality is found, the input is saved as a valuable test case and the subsequent mutation strategy is adjusted accordingly.

[0078] By combining reinforcement learning algorithms with genetic algorithms, we optimize mutation strategies based on abnormal behaviors and potential security threats.

[0079] Reinforcement learning algorithms (such as Q-learning) select the best action based on the state of the environment and combine with genetic algorithms to simulate the natural selection process and gradually optimize the mutation strategy, including:

[0080] Initialize the expected return and calculate the expression:

[0081]

[0082] Among them, S is the state space, A is the action space, In state Take action The expected return, is the assignment symbol;

[0083] Combining greedy strategy and random noise selection Momentary action , the calculation expression is:

[0084]

[0085] in, for The state of the moment, In state Take action The expected return, for The exploration rate at any moment, , Gradually decreases over time, is random noise, , Used to simulate detection behavior, To maximize the function value.

[0086] Update the expected return according to the Bellman equation, and the calculation expression is:

[0087]

[0088] in, The updated status Take action The expected return, In state Take action The expected return, is the learning rate, , Control the update step size, is the discount factor, , Weigh the importance of future rewards, is the immediate reward at the current time step, for The state of the moment, for The state of the moment, for The action of the moment, In state Take the action that maximizes the expected reward, In state Take action the maximum expected return;

[0089] When the environment returns a termination signal, the current round ends and the above process is repeated until all rounds are completed.

[0090] In the early stages of testing, we adopted a more conservative mutation strategy, such as simple operations like character replacement and word swapping, to ensure that we covered as many basic scenarios as possible. We also built a library of mutation rules, allowing users to select the appropriate rule combination based on their needs.

[0091] Continuously collect and analyze data generated during the testing process, and use incremental learning methods to continuously update model parameters, enabling more intelligent selection of mutation paths.

[0092] S4: Generate syntactically correct and semantically consistent test cases based on the optimized mutation strategy using the semantics-preserving strategy;

[0093] A SQL language parser is designed using a recursive descent parsing method, wherein the SQL language parser supports nested queries and conditional expressions;

[0094] The SQL language parser has a large number of built-in grammar rules and supports user-defined rules. It supports multiple SQL languages ​​and has good scalability.

[0095] Parse SQL queries and their variants through the SQL language parser;

[0096] The parsed SQL query and its variant versions are used as training data to evaluate the impact of the variant query on semantics by training a deep learning model; the deep learning model is a recurrent neural network or a long short-term memory network.

[0097] A semantic consistency check is performed after each mutation query to verify semantic consistency by comparing the query result sets or expected invariants before and after the mutation.

[0098] After each mutation, a semantic consistency check is performed to ensure that the mutated query still meets the original intent. This consistency check is achieved by comparing the query result sets before and after the mutation or verifying certain expected invariants.

[0099] By using a semantic preservation strategy, we ensure that the mutated SQL query still conforms to the original intent when performing a SQL query mutation, avoiding false positives caused by the mutation operation. This not only improves the accuracy of test results, but also reduces the impact on normal business logic.

[0100] By using machine learning algorithms to analyze historical data, we can predict which types of inputs may lead to abnormal behavior or security vulnerabilities and take preventive measures in advance.

[0101] S5: Dynamically adjust the priority of test tasks and allocate resources through the intelligent scheduling module; execute test cases and obtain test results;

[0102] Dynamically adjust task priorities based on current test progress and resource usage, and dynamically calculate task priorities based on factors such as task historical performance and potential value.

[0103] Continuously monitor multiple key indicators such as CPU utilization, memory usage, disk I / O rate, etc. to ensure the smooth operation of the testing process.

[0104] Provides an intuitive graphical interface that allows users to set focus points (such as specific types of SQL injection attacks) or exclude certain uninteresting parts (such as issues specific to older database versions) based on their needs. Configuration options: Provides a wealth of configuration options covering multiple aspects such as test scope and mutation strategy.

[0105] Use load balancing algorithms to distribute tasks among multiple test nodes;

[0106] It can dynamically adjust task priorities based on the current test progress and resource usage, reasonably allocate computing resources, prevent resource waste or excessive occupation, and improve overall efficiency.

[0107] Provides a graphical interface to support user-defined configuration of test scope and mutation strategy;

[0108] It provides an intuitive graphical interface to simplify the operation process. Even non-technical personnel can easily use the tool to perform database security testing.

[0109] Supporting international requirements, the interface supports multi-language switching and provides online document viewing and downloading functions, allowing users to easily access relevant information and technical support services at any time.

[0110] The test results are divided into three categories: normal, warning, and abnormal, corresponding to no impact, slight impact, and serious problems respectively. Users can view the test progress and results in real time, and the test results are intuitively displayed in charts and other forms to help users quickly understand the test overview.

[0111] like Figure 2 As shown, a database fuzz testing system based on deep feedback and semantic preservation is used to execute the above-mentioned database fuzz testing method based on deep feedback and semantic preservation, including:

[0112] The variation rule library acquisition module 101 collects standard query templates, screens and annotates the standard query templates, sets basic variation rules based on the standard query templates, and regularly updates the variation rule library;

[0113] The fuzz testing module 102 automatically generates a mutation strategy based on the query input and the mutation rule library through the mutation strategy generator; sends the mutation strategy to the target database for fuzz testing, and records the response information of the target database to the mutation strategy;

[0114] The deep feedback module 103 obtains the response information of the target database to the mutation strategy in real time through the deep feedback mechanism, and uses the response information to dynamically optimize the mutation strategy;

[0115] The semantics preservation module 104 generates test cases that are grammatically correct and semantically consistent with expectations based on the optimized mutation strategy using the semantics preservation strategy;

[0116] The intelligent scheduling module 105 dynamically adjusts the priority of the test tasks and allocates resources through the intelligent scheduling module; executes the test cases and obtains the test results.

[0117] The collaborative work of these modules, coupled with a deep feedback mechanism for real-time monitoring and analysis of database responses, enables immediate identification of potential security threats or performance bottlenecks, and dynamic adjustment of testing strategies accordingly. This adaptive mutation strategy adjustment mechanism makes the testing process more intelligent, effectively increasing the probability of discovering deep-seated security vulnerabilities. An automated script batch sends mutated queries to the target database and records all response details, significantly improving testing efficiency. A semantics-preserving strategy ensures that mutated SQL queries remain consistent with the original intent during mutation, avoiding false positives caused by mutation operations. This not only improves the accuracy of test results but also minimizes the impact on normal business logic. Machine learning algorithms analyze historical data to predict which input types may lead to abnormal behavior or security vulnerabilities, enabling proactive preventative measures. A built-in intelligent scheduling module dynamically adjusts task priorities based on current test progress and resource usage, rationally allocating computing resources and preventing resource waste or overconsumption. A load balancing algorithm distributes tasks across multiple test nodes, improving overall efficiency. A multi-level cache mechanism is introduced to effectively handle the large amount of data streams generated under high concurrency conditions, ensure the stability and response speed of the system, provide an intuitive graphical interface, simplify the operation process, and even non-technical personnel can easily use the tool to perform database security testing. It supports internationalization needs, the interface supports multi-language switching, and provides online document viewing and downloading functions, so that users can easily access relevant information and technical support services at any time. The model parameters are continuously updated through the continuous learning mechanism, so that the system can more intelligently select mutation paths and adapt to new threat patterns. The mutation strategy is gradually optimized through the incremental learning method to ensure that the system is always in the best state. The model is retrained regularly to adapt to new threat patterns, and the generalization ability and accuracy of the model are continuously improved in combination with the transfer learning method. The present invention not only significantly improves the effectiveness and reliability of database fuzz testing, but also greatly enhances the ability to discover deep-seated security vulnerabilities, providing strong support for protecting the database from threats from various unknown attack patterns.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A database fuzz testing method based on deep feedback and semantic preservation, characterized in that: include: S1: Collect standard query templates, screen and annotate the standard query templates, set basic variation rules according to the standard query templates, and build and regularly update a variation rule library based on the basic variation rules; S2: Using a mutation strategy generator, the query input is automatically generated into a mutation strategy based on a mutation rule library; the mutation strategy is sent to a target database for fuzz testing, and the response information of the target database to the mutation strategy is recorded; S3: obtaining response information of the target database to the mutation strategy in real time through a deep feedback mechanism, and dynamically optimizing the mutation strategy using the response information; The depth feedback mechanism includes: Using a standard database connection interface to obtain the database's response information to the mutation strategy in real time; Adopt a multi-level caching mechanism, use memory cache to quickly store the response information, persist important data to disk or distributed file system, and back up regularly; Using machine learning algorithms to perform data analysis on the response information to identify normal behavior, abnormal behavior, and potential security threats; By combining reinforcement learning algorithms with genetic algorithms, mutation strategies are optimized based on abnormal behaviors and potential security threats. S4: Generate syntactically correct and semantically consistent test cases based on the optimized mutation strategy using a semantics-preserving strategy. The semantic preservation strategy includes: A SQL language parser is designed using a recursive descent parsing method, wherein the SQL language parser supports nested queries and conditional expressions; Parse SQL queries and their variants through the SQL language parser; The parsed SQL queries and their variant versions are used as training data to evaluate the impact of the variant queries on semantics by training a deep learning model. Perform semantic consistency checks after each mutation query, verifying semantic consistency by comparing query result sets or expected invariants before and after the mutation; S5: Dynamically adjust the priority of test tasks and allocate resources through the intelligent scheduling module; execute test cases and obtain test results.

2. A database fuzz testing method based on deep feedback and semantic preservation according to claim 1, characterized in that: In step S1, Collect standard SQL query templates from public resources and internal accumulation, wherein the standard SQL query templates include CRUD operations; The standard SQL query template is screened and annotated, wherein the screening includes reviewing the quality and applicability of the standard SQL query template, and the annotation includes the scope of application, expected output, and precautions.

3. The database fuzz testing method based on deep feedback and semantic preservation according to claim 1 is characterized in that: The basic mutation rules include random character replacement, keyword insertion or deletion, and numerical value change.

4. The database fuzz testing method based on deep feedback and semantic preservation according to claim 1 is characterized in that: The adopting of a machine learning algorithm to perform data analysis on the response information to identify normal behavior, abnormal behavior and potential security threats includes: Use unsupervised learning algorithms to identify normal behavior; Use supervised learning algorithms to train models to identify abnormal behaviors and potential security threats.

5. The database fuzz testing method based on deep feedback and semantic preservation according to claim 1 is characterized in that: The response information includes the returned data set, execution time, error code and status information; The machine learning algorithm includes any one of K-means clustering, ARIMA model, support vector machine, random forest, convolutional neural network and long short-term memory network.

6. The database fuzz testing method based on deep feedback and semantic preservation according to claim 1 is characterized in that: The deep learning model is a recurrent neural network or a long short-term memory network.

7. The database fuzz testing method based on deep feedback and semantic preservation according to claim 1 is characterized in that: The intelligent scheduling module includes: Dynamically adjust task priorities based on current test progress and resource usage, Use load balancing algorithms to distribute tasks among multiple test nodes; Provides a graphical interface to support users to customize the test scope and mutation strategy.

8. A database fuzz testing system based on deep feedback and semantic preservation, characterized in that: A method for performing a database fuzz testing method based on deep feedback and semantic preservation as claimed in any one of claims 1 to 7, comprising: a variation rule library acquisition module, which collects standard query templates, screens and annotates the standard query templates, sets basic variation rules based on the standard query templates, and constructs and regularly updates a variation rule library based on the basic variation rules; A fuzzy testing module, which uses a mutation strategy generator to automatically generate a mutation strategy based on a mutation rule library based on a query input; sends the mutation strategy to a target database for fuzz testing, and records the target database's response information to the mutation strategy; A deep feedback module, which obtains response information of the target database to the mutation strategy in real time through a deep feedback mechanism, and uses the response information to dynamically optimize the mutation strategy; A semantics-preserving module, which generates test cases that are grammatically correct and semantically consistent with expectations using a semantics-preserving strategy and an optimized mutation strategy; The intelligent scheduling module dynamically adjusts the priority of the test tasks and allocates resources through the intelligent scheduling module; executes the test cases and obtains the test results.

Images