A fuzz testing method and system based on program control flow

Abstract

This invention relates to the field of industrial automation control system testing technology, specifically disclosing a fuzzy testing method and system based on program control flow. The method includes: acquiring parameter data; analyzing process parameter data and environmental disturbance data to obtain mutation points; eliminating process parameter data whose mutations are caused by interference from environmental disturbance data based on the mutation points to obtain target process parameter data; extracting environmental disturbance data, execution path data, and production quality data within an event window; generating triplet data; performing cluster analysis on the triplet data within the same event window to determine abnormal clusters and corresponding anomaly types; and constructing fuzzy test cases based on the abnormal triplet data. This invention avoids misjudging parameter fluctuations under normal operating conditions as system anomalies, effectively distinguishes between internal system defects and external interference factors, and achieves accurate filtering of external environmental interference.

Description

Technical Field

[0001] This invention relates to the field of industrial automation control system testing technology, specifically to a fuzzy testing method and system based on program control flow. Background Technology

[0002] In industrial automation control systems, the reliability of software control logic directly affects the stability of the production process and product quality. Fuzz testing, as a dynamic testing technique, discovers potential software defects by inputting unexpected random or semi-random data into the target program, triggering abnormal program behavior.

[0003] However, existing fuzz testing methods have significant limitations in the application of industrial control systems, especially in their insufficient ability to detect anomalies in control flow paths. They cannot accurately identify abnormal execution paths caused by a combination of sudden changes in process parameters and environmental disturbances. Furthermore, they are not associated with production quality data, making it impossible to determine whether abnormal execution paths lead to product quality problems. The generated fuzz test cases are not targeted enough, and some key defects are difficult to detect during the testing phase, which may lead to production accidents or quality fluctuations. Summary of the Invention

[0004] To address the aforementioned problems, the purpose of this invention is to provide a fuzzy testing method and system based on program control flow, which avoids misjudging parameter fluctuations under normal operating conditions as system anomalies, effectively distinguishes between internal system defects and external interference factors, and achieves accurate filtering of external environmental interference.

[0005] This invention provides a fuzz testing method based on program control flow, comprising:

[0006] Acquire parameter data; the parameter data includes process parameter data, environmental disturbance data, execution path data, and production quality data;

[0007] By analyzing the process parameter data and the environmental disturbance data using the sliding window technique, abrupt change points can be obtained.

[0008] Based on the mutation point, process parameter data that has mutated due to environmental disturbance data interference are removed from the process parameter data to obtain the target process parameter data;

[0009] An event window is set centered on the mutation point of the target process parameter data, and environmental disturbance data, execution path data and production quality data are extracted within the event window.

[0010] The execution path data within the same event window is decomposed into multiple branch decision points, and a triplet of parameter-branch decision point-production quality data is generated based on the process parameter data, environmental disturbance data, and production quality data corresponding to each branch decision point.

[0011] Perform cluster analysis on triplet data within the same event window to identify abnormal clusters and their corresponding anomaly types;

[0012] The probability of occurrence of each abnormal cluster is calculated based on preset historical data;

[0013] When the probability of an abnormal clustering occurring is greater than a first preset threshold, the abnormal clustering is determined to be a true abnormal clustering.

[0014] When the number of triples in the true abnormal cluster is greater than the second preset threshold, the triples are determined to be abnormal triples.

[0015] Based on the abnormal triplet data, construct fuzz test cases.

[0016] In one possible implementation, obtaining the parameter data includes:

[0017] Obtain the raw parameter data;

[0018] The original parameter data is timestamped to obtain first parameter data that is unified to the same time zone;

[0019] Identify outliers and missing values ​​in the first parameter data, remove the outliers, and fill in the missing values ​​using linear interpolation to obtain the parameter data.

[0020] In one possible implementation, the step of analyzing the process parameter data and the environmental disturbance data using the sliding window technique to obtain the abrupt change point includes:

[0021] The process parameter data and environmental disturbance data are segmented using a sliding window of fixed length;

[0022] Calculate the mean values ​​of process parameter data and environmental disturbance data within each sliding window;

[0023] Calculate the change in the average process parameter data based on the average process parameter data within the current sliding window and the average process parameter data within the previous sliding window.

[0024] When the change in the average value of the process parameter data is greater than the preset mutation threshold, the starting time of the current sliding window is determined as the mutation point;

[0025] When the change values ​​of multiple consecutive sliding windows are all greater than a preset mutation threshold, the window center time of the first sliding window among the multiple consecutive sliding windows is determined as the mutation point.

[0026] In one possible implementation, the step of removing process parameter data that has changed due to environmental disturbances from the process parameter data based on the mutation point to obtain the target process parameter data includes:

[0027] Calculate the change in the mean of the environmental disturbance data within the sliding window where the mutation point is located;

[0028] Calculate the correlation coefficient between the change in the mean of process parameter data and the change in the mean of environmental disturbance data within the same sliding window;

[0029] When the correlation coefficient is greater than the preset coefficient, the process parameter data in the sliding window is removed.

[0030] In one possible implementation, the correlation coefficient is calculated according to the following formula. :

[0031] ;

[0032] In the formula, Represents the correlation coefficient. This represents the change in the mean of the process parameter data. This represents the change in the mean of environmental disturbance data. This indicates the calculation of covariance. The standard deviation of the mean value of process parameter data. It represents the standard deviation of the change in the mean of environmental disturbance data.

[0033] In one possible implementation, the step of performing cluster analysis on triplet data within the same event window to determine abnormal clusters and corresponding anomaly types includes:

[0034] Cluster analysis is performed on the feature vectors of triplet data within the same event window to divide the triplet data into multiple clusters.

[0035] Calculate the local outlier factor for the triplet data within each cluster, and determine the outlier score of the cluster based on the local outlier factor;

[0036] When the anomaly score is greater than a preset anomaly threshold, the cluster is determined to be an abnormal cluster;

[0037] The feature vectors of the abnormal clusters are matched with a preset anomaly type criterion statistical table to determine the anomaly type of the abnormal clusters.

[0038] In one possible implementation, determining that the abnormal cluster is a true abnormal cluster when the probability of the abnormal clustering occurring is greater than a first preset threshold includes:

[0039] Count the number of times each anomaly cluster occurs across all event windows for each anomaly type;

[0040] The probability of occurrence of anomaly clusters for each anomaly type is calculated based on the number of occurrences.

[0041] When the probability of an abnormal clustering is greater than the first preset threshold, a significance test is performed on the probability of an abnormal clustering of an abnormal type, and the significance test result is output.

[0042] When the probability of an abnormal clustering occurring is less than the significance threshold, the abnormal clustering is determined to be a true abnormal clustering.

[0043] In one possible implementation, determining that the triplet data is abnormal triplet data when the triplet data in the true abnormal cluster is greater than a second preset threshold includes:

[0044] Obtain triple data within all the aforementioned true anomaly clusters;

[0045] Extract the key fields of the triplet data within the actual anomaly clusters;

[0046] When the data corresponding to the key field is greater than the second preset threshold, the triplet data is determined to be abnormal triplet data.

[0047] In one possible implementation, constructing fuzz test cases based on the abnormal triplet data includes:

[0048] Extract the numerical distribution characteristics of process parameter data and environmental disturbance data within the abnormal triplet data, and generate fuzzy test cases based on the numerical distribution characteristics of process parameter data and environmental disturbance data.

[0049] Obtain the execution path data of the fuzz test cases;

[0050] When the deviation between the execution path data of the fuzz test case and the expected abnormal path is greater than the preset fault tolerance threshold, the fuzz test is re-executed to generate new fuzz test cases.

[0051] The final fuzz test case will be generated when the deviation between the execution path data of the fuzz test case and the expected abnormal path exceeds the preset fault tolerance threshold.

[0052] This invention also provides a fuzz testing system based on program control flow, used to execute any of the above-described fuzz testing methods, comprising:

[0053] The acquisition module is used to acquire parameter data; the parameter data includes process parameter data, environmental disturbance data, execution path data, and production quality data.

[0054] The analysis module is used to analyze the process parameter data and the environmental disturbance data using sliding window technology to obtain abrupt change points;

[0055] The elimination module is used to eliminate process parameter data that has changed due to environmental disturbance data based on the mutation point, so as to obtain the target process parameter data.

[0056] The extraction module is used to set an event window centered on the mutation point of the target process parameter data, and extract environmental disturbance data, execution path data and production quality data within the event window;

[0057] The triplet module is used to decompose the execution path data within the same event window into multiple branch decision points, and generate triplet data of parameter-branch decision point-production quality based on the process parameter data, environmental disturbance data and production quality data corresponding to each branch decision point.

[0058] The clustering module is used to perform cluster analysis on triplet data within the same event window to determine abnormal clusters and their corresponding anomaly types.

[0059] The calculation module is used to calculate the probability of occurrence of each abnormal cluster based on preset historical data;

[0060] When the probability of an abnormal clustering occurring is greater than a first preset threshold, the abnormal clustering is determined to be a true abnormal clustering.

[0061] When the number of triples in the true abnormal cluster is greater than the second preset threshold, the triples are determined to be abnormal triples.

[0062] The construction module is used to construct fuzz test cases based on the abnormal triplet data.

[0063] The fuzzy testing method and system based on program control flow provided by this invention can effectively identify pseudo-abnormal data caused by external interference by introducing bivariate correlation analysis, achieve accurate filtering of external environmental interference, avoid misjudging parameter fluctuations under normal operating conditions as system anomalies, and effectively distinguish between internal system defects and external interference factors. Attached Figure Description

[0064] Figure 1 A flowchart illustrating a fuzz testing method based on program control flow provided for an embodiment of the present invention. Detailed Implementation

[0065] The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. The following detailed description of the embodiments and the accompanying drawings are used to illustrate the principles of the present invention by way of example, but should not be used to limit the scope of the present invention. That is, the present invention is not limited to the described preferred embodiments, and the scope of the present invention is defined by the claims.

[0066] In the description of this invention, it should be noted that, unless otherwise stated, "a plurality of" means two or more; the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance; those skilled in the art can understand the specific meaning of the above terms in this invention as appropriate.

[0067] In existing technologies, fuzzy testing methods for industrial automation control systems suffer from insufficient ability to detect anomalies in control flow paths, particularly in identifying abnormal execution paths caused by the combined effects of sudden changes in process parameters and environmental disturbances. Existing technologies do not incorporate production quality data into their analysis framework, resulting in test cases that fail to cover abnormal paths that truly impact product quality. For example, in injection molding production lines, voltage fluctuations may cause sudden changes in temperature parameters, leading to deviations in the control system's execution path from expectations. However, existing methods cannot distinguish whether these parameter changes are caused by environmental disturbances or equipment malfunctions, resulting in test cases that lack specificity.

[0068] To address the aforementioned issues, the inventors observed that the generation of abnormal paths in industrial control systems is often accompanied by the coupling effect of sudden changes in process parameters and environmental disturbances. Existing methods, which focus only on a single data source, result in a high false positive rate. Through analysis of historical data, it was found that there is a strong correlation between production quality indicators and abnormal execution paths, but existing test case generation mechanisms have not established this correlation. Based on this, the inventors proposed to perform spatiotemporal alignment analysis on process parameters, environmental disturbances, execution paths, and production quality data, and to construct fuzzy test cases by dynamically filtering abnormal triplet data.

[0069] Figure 1 A flowchart illustrating the fuzz testing method based on program control flow provided for embodiments of the present invention is shown below. Figure 1 As shown, this invention provides a fuzz testing method based on program control flow, comprising:

[0070] Step S1: Obtain parameter data;

[0071] In one possible implementation, the original parameter data is obtained; the original parameter data is timestamped to obtain first parameter data that is unified to the same time zone; outliers and missing values ​​in the first parameter data are identified, outliers are removed and missing values ​​are filled in by linear interpolation to obtain parameter data.

[0072] The parameter data includes process parameter data, environmental disturbance data, execution path data, and production quality data. Process parameter data includes time-series parameters such as temperature, pressure, and flow rate. Environmental disturbance data includes voltage, current, temperature and humidity, and electromagnetic interference. Execution path data includes event sequences such as control flow logs, state transition records, and branch jumps. Production quality data includes pass rate, number of non-conforming products, defect type, and inspection indicators.

[0073] Process parameter data refers to the core physical quantities that reflect the operating status of industrial automation control systems. Specifically, they can be collected in real time using industrial instruments such as temperature sensors, pressure transmitters, and flow meters to characterize the steady-state characteristics of the production process.

[0074] Environmental disturbance data refers to external interference factors that may affect the stability of the control system. Specifically, it can be collected using equipment such as power monitoring devices, temperature and humidity sensors, and electromagnetic field detectors to identify the coupling effect of uncontrolled variables on process parameters.

[0075] Execution path data refers to the records of logical branches generated during the operation of the control program. Specifically, it can be extracted through the event log of the PLC controller or the debugging interface of the embedded system, and is used to track the dynamic changes in the control flow.

[0076] Production quality data refers to quantitative indicators that reflect the results of product manufacturing. Specifically, it can be obtained using visual inspection systems, quality analyzers, or manual sampling records, and is used to establish the correlation between control flow anomalies and quality defects.

[0077] Timestamp standardization refers to unifying the time base of multi-source heterogeneous data to the same time zone. This can be achieved by using network time protocols or hardware clock synchronization modules to eliminate timing deviations between data acquisition devices.

[0078] Outlier removal refers to identifying and removing outlier data points that exceed a reasonable range. This can be achieved using box plots or standard deviation thresholding to avoid interference from sensor malfunctions or transient disturbances in subsequent analysis.

[0079] Missing value imputation refers to the numerical restoration of gaps caused by interruptions in data acquisition. Specifically, it can be implemented using a linear interpolation algorithm between adjacent data points to ensure the continuity of the data sequence.

[0080] Specifically, in industrial automation control systems, process parameters such as temperature and pressure are collected in real time through a distributed sensor network, forming time-series data at the second or millisecond level; environmental disturbance data such as voltage fluctuations and electromagnetic interference are collected through independent monitoring devices, forming a parallel data stream with the control system's operating data; control process logs record branch jump events during PLC program execution, while state transition records save the switching times of equipment operating modes; production quality data is periodically generated by online detection equipment, reflecting the distribution characteristics of batch product pass rates; after collection, multi-source data is first timestamped, for example, by converting equipment clocks in different time zones to Coordinated Universal Time (UTC) to ensure the temporal consistency of the event sequence; then, anomaly detection is performed on the data, for example, when a pressure sensor records a sudden increase exceeding the equipment's safety threshold, the data point is marked as abnormal and removed; for data loss due to network interruption, the average of two consecutive valid data points is used for interpolation to fill the gap, forming a complete time-series dataset.

[0081] Traditional methods typically only collect process parameters and execution path data, ignoring the potential impact of environmental disturbances on the control system. This results in a lack of correlation evidence between external interference factors in anomaly path analysis. Existing data cleaning technologies often employ single threshold filtering, which cannot distinguish between outliers caused by sensor malfunctions and environmental disturbances, easily leading to the accidental deletion of valid information. This invention establishes a complete causal chain between control flow anomalies, external interference, and quality defects by constructing a multi-dimensional data system that includes environmental disturbances and production quality. It employs timestamp standardization to solve the time sequence misalignment problem caused by differences in the acquisition frequency of multi-source data, such as matching the millisecond-level logs of the PLC controller with the minute-level quality inspection data on the time axis. The combined strategy of outlier removal and missing value imputation eliminates invalid noise while maintaining data continuity. For example, in voltage drop events, it retains process parameter fluctuations caused by real disturbances and only removes outliers caused by sensor malfunctions.

[0082] This invention effectively solves the problems of fragmented and asynchronous multi-source data acquisition in industrial scenarios, providing a highly complete data foundation for subsequent anomaly path identification. Timestamp standardization ensures accurate correspondence between control flow events and process parameter changes, for example, establishing a millisecond-level correlation between branch jump times and environmental temperature and humidity fluctuations. An outlier cleaning mechanism eliminates interference from equipment fault data, enabling accurate identification of process parameter mutations caused by real-world environmental disturbances. Missing value imputation maintains the continuity of the data sequence, avoiding event window analysis failure due to acquisition interruptions. The construction of a multi-dimensional data system enables control flow anomalies to not only be associated with execution path characteristics but also to simultaneously analyze external interference factors and quality indicator changes, providing more comprehensive input conditions for fuzzy test case generation.

[0083] Step S2: Analyze process parameter data and environmental disturbance data using sliding window technology to obtain the mutation point;

[0084] In one possible implementation, a fixed-length sliding window is used to segment the process parameter data and environmental disturbance data; the mean value of the process parameter data and the mean value of the environmental disturbance data are calculated in each sliding window; the change value of the mean value of the process parameter data is calculated based on the mean value of the process parameter data in the current sliding window and the mean value of the process parameter data in the previous sliding window; when the change value of the mean value of the process parameter data is greater than a preset mutation threshold, the starting time of the current sliding window is determined as the mutation point; when the change values ​​of multiple consecutive sliding windows are all greater than the preset mutation threshold, the window center time of the first sliding window in the multiple consecutive sliding windows is determined as the mutation point.

[0085] Among them, the sliding window technique refers to the technique of segmenting time series data using a fixed-length time window. Specifically, it can be implemented by using a window with a length of 5 seconds and a sliding step of 1 second to capture the abrupt changes in process parameters and environmental disturbances.

[0086] Among them, the fixed-length sliding window refers to dividing the time series data into multiple continuous data segments of equal length. Specifically, it can be implemented using a time series segmentation algorithm, which is used to dynamically analyze the correlation between process parameters and environmental disturbances.

[0087] The mean of process parameter data and environmental disturbance data refers to the arithmetic mean of the data within each sliding window. Specifically, it can be calculated by summing the data within the window and dividing by the window length. This is used to eliminate the interference of random fluctuations on the detection of mutation points.

[0088] The mutation threshold is a critical value used to determine whether a process parameter has changed significantly. It can be set by statistical analysis of historical data or by expert experience to distinguish between normal fluctuations and abnormal mutations.

[0089] Multiple consecutive sliding windows refer to multiple consecutive data segments that all meet the mutation condition. Specifically, a counter can be used to record the number of windows that continuously meet the condition, which can be used to eliminate misjudgments caused by occasional environmental disturbances.

[0090] Specifically, process parameter data and environmental disturbance data are divided into fixed-length sliding windows. The mean value within each window is calculated and compared with the mean value of the preceding window. When the change in the mean value of the process parameter exceeds a preset mutation threshold, the starting point of the window is marked as a candidate mutation point. If the change in the mean value of the process parameter in multiple subsequent consecutive windows exceeds the threshold, the center moment of the first window is determined to be the real mutation point. Through the judgment condition of consecutive windows, single mutations caused by occasional environmental disturbances are filtered out, and only data segments with continuous abnormal changes are retained, thereby accurately identifying the real anomalies caused by the coupling effect of environmental disturbances and process parameters.

[0091] Traditional methods typically employ single-point mutation detection or static threshold judgment, which cannot distinguish between transient disturbances caused by environmental disturbances and actual process anomalies. This invention, through dynamic sliding window analysis combined with continuous window mutation consistency verification, can effectively eliminate sporadic noise interference and improve the accuracy of mutation point detection. For example, existing technologies may misjudge temperature parameter jumps caused by instantaneous voltage fluctuations as process anomalies, while this invention can identify such transient disturbances through a continuous window verification mechanism, avoiding false screening.

[0092] This invention can accurately identify real mutation points in process parameter data caused by environmental disturbances, avoiding misjudging data fluctuations caused by occasional disturbances as process anomalies; the selected mutation points provide a reliable time benchmark for subsequent analysis, ensuring that the correlation analysis between abnormal execution paths and production quality data is based on real abnormal data, thereby improving the relevance of fuzzy test cases.

[0093] Step S3: Based on the mutation point, process parameter data that has mutated due to interference from environmental disturbance data is removed from the process parameter data to obtain the target process parameter data;

[0094] In one possible implementation, the change in the mean of environmental disturbance data within the sliding window where the mutation point is located is calculated; the correlation coefficient between the change in the mean of process parameter data and the change in the mean of environmental disturbance data within the same sliding window is calculated; when the correlation coefficient is greater than a preset coefficient, the process parameter data within the sliding window is removed.

[0095] In one possible implementation, the correlation coefficient is calculated according to the following formula. :

[0096] ;

[0097] In the formula, Represents the correlation coefficient. This represents the change in the mean of the process parameter data. This represents the change in the mean of environmental disturbance data. This indicates the calculation of covariance. The standard deviation of the mean value of process parameter data. It represents the standard deviation of the change in the mean of environmental disturbance data.

[0098] Among them, the change value of the mean value of environmental disturbance data in the sliding window where the mutation point is located refers to the fluctuation range of environmental parameters obtained by the sliding window analysis method during the mutation period. Specifically, it can be calculated by the mean difference method of adjacent windows, which is used to characterize the potential influence of environmental factors on process parameters.

[0099] The correlation coefficient refers to the correlation between the changing trends of process parameters and environmental disturbances within the same time window. Specifically, it can be calculated using the Pearson correlation coefficient algorithm to quantify the synchronicity of the changes between the two.

[0100] The preset coefficient refers to the pre-configured screening threshold, which can be dynamically adjusted according to the tolerance of environmental interference in the industrial scenario. It is used to distinguish the boundary conditions between internal system anomalies and external interference.

[0101] Specifically, after detecting a sudden change in process parameters, the mean change in environmental disturbance data corresponding to that time window is extracted simultaneously. By calculating the correlation coefficient between process parameters and environmental disturbance changes, it can be determined whether the two show a significant positive or negative correlation. When the correlation coefficient exceeds a set threshold, it indicates that the sudden change in process parameters is mainly caused by environmental factors. At this time, the process parameter data in that window is marked as invalid data and a rejection operation is performed. For example, in the temperature parameter sudden change window, if the correlation coefficient between voltage fluctuation and temperature change reaches 0.85 and the set threshold is 0.8, it is determined that the temperature change is a normal fluctuation caused by external interference, and thus the interference of this data on subsequent analysis is eliminated.

[0102] Traditional methods rely solely on the magnitude of sudden changes in process parameters to determine anomalies, without considering the coupling relationship between environmental disturbances and process parameters. This invention, by introducing bivariate correlation analysis, can effectively identify pseudo-anomaly data caused by external interference. For example, existing technologies may misjudge temperature fluctuations caused by sudden voltage drops as temperature control system malfunctions, while this invention can accurately identify such interference events by calculating the correlation coefficient between the two.

[0103] Through the above technical solution, the present invention achieves accurate filtering of external environmental interference, avoids misjudging parameter fluctuations under normal operating conditions as system anomalies, effectively distinguishes between internal system defects and external interference factors, and provides a high-quality data foundation for subsequent anomaly detection.

[0104] Step S4: Set an event window centered on the mutation point of the target process parameter data, and extract the environmental disturbance data, execution path data and production quality data within the event window;

[0105] The event window refers to a time interval centered on the parameter mutation point, for example, set to 3 seconds before and after the mutation point, used to capture control flow branch decisions associated with parameter mutations.

[0106] Step S5: Decompose the execution path data within the same event window into multiple branch decision points, number them, and generate a triplet of parameter-branch decision point-production quality data based on the process parameter data, environmental disturbance data, and production quality data corresponding to each branch decision point. For example: process parameter + environmental disturbance, branch decision point + number, production quality.

[0107] Among them, triplet data refers to binding branch decision points with corresponding process parameters, environmental disturbances and quality indicators at the time. Specifically, this can be achieved through timestamp alignment to form structured data records.

[0108] Summarize the triplet data of all branch decision points to form a structured table of triplet data, as shown in Table 1 below.

[0109] Table 1

[0110]

[0111] Among them, the branch decision point refers to the logical judgment node in the control flow that triggers the switching of the program execution path;

[0112] Triplet data refers to a data unit consisting of a combination of process parameters and environmental disturbance parameters, branch decision point numbers, and production quality indicators.

[0113] Structured tables refer to a data storage format arranged in the order of branch decision point numbers. Specifically, they can be implemented through database tables or two-dimensional array structures, and are used to standardize the storage of multi-dimensional related data for batch processing.

[0114] Specifically, during the operation of an industrial automation control system, the execution path data is decomposed into N branch decision points and assigned a unique number. For each branch decision point, process parameters and environmental disturbance data within a set time range before and after its trigger time are extracted, and the corresponding production quality indicators for that time period are associated, such as obtaining the defect rate data of that batch of products. By merging process parameters and environmental disturbance data into combined parameters and binding them with branch decision point numbers and quality indicators, triplet data with spatiotemporal correlation is formed. The data of all branch decision points are summarized into a structured table.

[0115] Traditional methods only record execution path switching events without establishing a dynamic association between branch decision points and process parameters. This invention achieves dynamic matching of control flow branches with process parameters and environmental disturbances by decomposing branch decision points and constructing a triplet data structure. In the prior art, production quality data is usually stored independently in the statistical system, while this invention directly associates it with branch decision points, thereby revealing the causal relationship between abnormal paths and quality problems.

[0116] Through the above technical solution, the present invention solves the problem of difficulty in correlation analysis caused by the fragmented storage of control flow branches, process parameters, and quality data, and realizes the spatiotemporal alignment and structured integration of multi-source heterogeneous data; this data correlation mechanism provides a directly processable data foundation for subsequent analysis of the impact of abnormal execution paths on product quality.

[0117] Step S6: Perform cluster analysis on the triplet data within the same event window to determine the abnormal clusters and their corresponding anomaly types;

[0118] In one possible implementation, cluster analysis is performed on the feature vectors of triplet data within the same event window to divide the triplet data into multiple clusters; the local anomaly factor of the triplet data within each cluster is calculated, and the anomaly score of the cluster is determined based on the local anomaly factor; when the anomaly score is greater than a preset anomaly threshold, the cluster is determined to be an anomalous cluster; the feature vectors of the anomalous clusters are matched with a preset anomaly type criterion statistical table to determine the anomaly type of the anomalous clusters.

[0119] Anomaly clustering analysis refers to classifying multidimensional feature vectors using density-based clustering algorithms, such as the DBSCAN algorithm for identifying outlier clusters. Feature vectors include core features such as cluster center parameters, branches, and production quality. Anomaly type criteria statistics are shown in Table 2 below.

[0120] Table 2

[0121]

[0122] Feature vector processing refers to transforming three types of heterogeneous data—process parameters, branch decision points, and production quality—into numerical vectors of a unified dimension. This can be achieved using normalization and principal component analysis methods to eliminate differences in data dimensions and extract key features.

[0123] The local anomaly factor is an indicator that measures the difference in density between a data point and its neighboring data. Specifically, it can be achieved by calculating the ratio of the average reachability distance between each data point and its K nearest neighbors, and is used to quantify the degree of anomaly in the data within a cluster.

[0124] Anomaly type criterion statistics table refers to a pre-established mapping relationship table between anomaly features and quality defects. Specifically, it can be constructed using a historical failure case library and is used to quickly match anomaly types based on clustering core features.

[0125] Specifically, firstly, process parameters, environmental disturbances, branch decision points, and production quality data are transformed into standardized feature vectors to eliminate the impact of parameter unit differences on the analysis. Then, a clustering algorithm is used to divide the triplet data within the same event window into several clusters, and abnormal clusters formed by isolated points are identified through density distribution. For each abnormal cluster, its local anomaly factor is calculated and converted into anomaly score. When the anomaly score exceeds a preset threshold, it is determined to be an abnormal cluster. Finally, the central feature parameters of the abnormal clusters are extracted and matched with the parameter fluctuation range, branch jump mode, and quality defect type recorded in the preset criterion table to determine whether the anomaly type is parameter over-limit anomaly or control logic error anomaly.

[0126] Existing methods rely solely on a single threshold to determine parameter anomalies, neglecting the correlation between control flow branches and quality data, leading to a high false positive rate. This invention, by fusing multidimensional data through feature vectors and combining cluster analysis with local anomaly factor calculation, can accurately identify clustered anomaly clusters caused by both parameter mutations and control flow anomalies. Simultaneously, by matching anomaly types through a preset criterion table, it directly correlates data anomalies with quality defects, solving the problem that existing technologies cannot determine whether anomaly paths affect product quality.

[0127] This invention can accurately identify abnormal execution paths caused by a combination of sudden changes in process parameters and environmental disturbances, and clarify the anomaly type based on production quality data. By associating anomaly clustering with quality defects, it effectively filters out the abnormal paths that truly affect product quality, providing data support for generating targeted fuzzy test cases, thereby improving the accuracy and effectiveness of industrial control system testing.

[0128] Step S7: Calculate the probability of occurrence of each abnormal cluster based on preset historical data;

[0129] In one possible implementation, the probability of occurrence refers to the frequency of occurrence of a specific abnormal pattern based on historical data, such as by using a Bayesian probability model to calculate the conditional probability.

[0130] The probability of occurrence is calculated using the following formula:

[0131] ;

[0132] In the formula, Indicates the exception type The probability of abnormal clustering occurring. Indicates the exception type The number of times anomaly clusters occur across all event windows. Indicates the total number of event windows.

[0133] Step S8: When the probability of an abnormal clustering occurs is greater than the first preset threshold, the abnormal clustering is determined to be a true abnormal clustering.

[0134] In one possible implementation, the occurrence frequency of each anomaly cluster type within all event windows is counted; the occurrence probability of each anomaly cluster type is calculated based on the occurrence frequency; when the occurrence probability of an anomaly cluster type is greater than a first preset threshold, a significance test is performed on the occurrence probability of the anomaly cluster type, and the significance test result is output; when the occurrence probability of an anomaly cluster type is less than the significance threshold, the anomaly cluster is determined to be a true anomaly cluster.

[0135] Among them, counting the number of occurrences of each anomaly cluster in all event windows means recording the anomaly cluster type and its frequency of occurrence by traversing all event windows. This can be implemented using a hash table or a counter to quantify the frequency characteristics of anomalies.

[0136] Calculating the probability of occurrence based on the number of occurrences means dividing the number of occurrences of a certain type of anomaly cluster by the total number of event windows. This can be achieved using frequency statistics to filter high-frequency anomaly types.

[0137] Significance testing refers to verifying the statistical hypothesis of the probability of occurrence of high-frequency anomalies. Specifically, it can be achieved using the chi-square test or the t-test to verify whether the anomaly pattern is statistically significant.

[0138] Determining whether the significance test result is less than the significance threshold involves comparing the p-value obtained from the test with a preset significance level. This can be achieved using a numerical comparator to determine the statistical confidence of the abnormal clustering.

[0139] Specifically, anomaly clustering first filters out high-frequency anomaly types whose occurrence probability exceeds a preset threshold through frequency statistics. For example, when a certain type of anomaly occurs 20 times in 100 event windows, its occurrence probability is 20%.

[0140] Subsequently, a significance test was performed on high-frequency anomalies exceeding the threshold, for example, using a chi-square test to verify whether the probability of the anomaly occurring was significantly higher than the normal fluctuation level of the system.

[0141] If the p-value obtained from the test is less than the significance threshold of 0.05, it is determined to be a true anomaly cluster. This dual verification mechanism reduces the interference of random anomalies through frequency screening and eliminates the influence of random fluctuations through statistical testing, and finally identifies the true anomaly patterns with statistical significance.

[0142] Existing methods typically rely on a single frequency threshold to identify anomalies, such as directly setting an occurrence rate of more than 5 times as a genuine anomaly. This approach cannot distinguish between high-frequency random fluctuations and systematic anomalies, and is prone to misjudging anomalies caused by temporary environmental interference as genuine defects. This invention introduces a significance test, adding statistical inference verification on top of frequency screening. For example, if an anomaly has a high probability of occurrence but the statistical test shows that it is not significantly different from a random distribution, it is still excluded. This dual verification mechanism significantly improves the accuracy of anomaly identification.

[0143] This invention effectively solves the problem of misjudgment of anomalies caused by environmental disturbances in industrial control systems. It verifies the significance of high-frequency anomaly patterns through statistical testing, avoiding the inclusion of accidental anomalies caused by temporary interference in the generation of test cases. The significance test can identify anomaly patterns with stable statistical characteristics, such as a certain type of anomaly showing a significant high incidence in different time periods of the morning, noon and evening, thereby ensuring that the constructed fuzzy test cases can cover real control flow defects.

[0144] Step S9: When the number of triples in the real abnormal cluster is greater than the second preset threshold, the triples are determined to be abnormal triples.

[0145] In one possible implementation, the triplet data within all real abnormal clusters are obtained; key fields of the triplet data within the real abnormal clusters are extracted; when the data corresponding to the key field is greater than a second preset threshold, the triplet data is determined to be abnormal triplet data.

[0146] The second preset threshold refers to the critical value used to quantitatively judge production quality abnormalities. Specifically, it can be implemented by using a non-conforming rate threshold, a defect type proportion threshold, or a parameter extreme value threshold. For example, when the proportion of a certain type of defect exceeds 5%, a judgment is triggered. This threshold is set through statistical analysis of historical quality data and is used to filter abnormal data that directly affects product quality.

[0147] Key field extraction refers to separating process parameters, control flow branch identifiers, and production quality indicators from triples. Specifically, structured query statements can be used to filter fields and establish a correlation model between control flow paths and quality defects.

[0148] Specifically, after obtaining the proven anomaly clusters that have undergone probability verification, the first step is to load the dataset of all triples within that cluster. A second preset threshold is dynamically configured through a quality inspection standard database; for example, the threshold for the number of non-conforming products is set to 2% of the batch output. The data parsing module extracts key fields from the triples, such as the range of process parameter fluctuations, the number of control flow branch jumps, and the distribution of defect types. The non-conforming rate index for each triple is compared item by item with the criterion threshold. When a triple is found to have parameter fluctuations exceeding the safety threshold and accompanied by a specific defect type, it is determined to be an anomalous triple. This process, through a quality correlation verification mechanism, ensures that the selected anomalous data simultaneously meets the dual conditions of control flow anomaly and quality defect.

[0149] Traditional fuzz testing methods generate test cases based solely on program execution path anomalies, without establishing a correlation analysis between control flow anomalies and production quality data. This invention introduces a multi-dimensional criterion system, using quality defect indicators as necessary conditions for anomaly determination, such as requiring abnormal paths to lead to an increase in the non-conformance rate or the generation of specific defects. Existing technologies often cover invalid abnormal paths in their test cases, while this invention, through a dual verification mechanism, retains only abnormal data that actually affects product quality as the basis for test case generation, significantly improving test effectiveness.

[0150] Through the above technical solutions, this invention solves the problem that fuzzy test cases cannot effectively cover actual quality defects, and achieves accurate correlation between control flow anomalies and production quality defects; by setting quantitative criterion thresholds, non-quality-related program anomalies can be filtered out; by extracting key fields and comparing them with thresholds, abnormal paths that directly affect product pass rates can be identified; and by jointly analyzing quality indicators and control flow data, it ensures that the generated test cases target actual production defects, thereby improving the targeting and reliability of industrial control system testing.

[0151] Step S10: Construct fuzz test cases based on the abnormal triplet data.

[0152] In one possible implementation, the numerical distribution characteristics of process parameter data and environmental disturbance data within the abnormal triplet data are extracted. Fuzzy test cases are generated based on these characteristics. The execution path data of the fuzzy test cases is obtained. When the deviation between the execution path data of the fuzzy test cases and the expected abnormal path is greater than a preset fault tolerance threshold, the fuzz test is re-executed to generate new fuzzy test cases. The process continues until the deviation between the execution path data of the fuzzy test cases and the expected abnormal path is greater than the preset fault tolerance threshold, at which point the generated fuzzy test cases are used as the final fuzzy test cases.

[0153] Among them, the numerical distribution characteristics refer to the statistical regularity of process parameters and environmental disturbances in the abnormal triplet. Specifically, it can be modeled using probability density functions or Gaussian mixture models to describe the correlation between parameter fluctuation range and abnormal conditions.

[0154] Fuzzy test cases refer to test input sets generated based on abnormal data characteristics. Specifically, they can be generated through Monte Carlo sampling or genetic algorithms to simulate the combination of sudden changes in process parameters and environmental disturbances in actual production environments.

[0155] The deviation between the execution path data and the expected abnormal path refers to the degree of difference between the actual control flow branch and the preset abnormal path. Specifically, Hamming distance or cosine similarity can be used to calculate the effectiveness of test cases triggering abnormal paths.

[0156] The fault tolerance threshold refers to the maximum range of deviations allowed in the execution path. It can be set based on the statistical variance of historical normal paths and is used to determine whether test cases need iterative optimization.

[0157] The fuzz test is re-executed by test case iteration signals. Test case iteration signals are instructions that trigger the regeneration of test cases. Specifically, this can be achieved by setting a threshold for the number of times the deviation value exceeds the limit, which is used to establish a dynamic optimization mechanism.

[0158] Specifically, after extracting the numerical distribution characteristics of process parameters and environmental disturbances from the abnormal triplet data, fuzzy test cases with similar statistical characteristics are generated through a probability model. After these fuzzy test cases are injected into the industrial automation control system, system execution path data and production quality data are collected in real time. By comparing the deviation values ​​between the actual execution path and the expected abnormal path, it can be verified whether the test cases effectively trigger the target abnormal path. When the deviation value exceeds the fault tolerance threshold, the system automatically triggers the test case iteration process and regenerates optimized fuzzy test cases based on the latest collected data.

[0159] In some specific implementations, the numerical distribution characteristics of process parameters and environmental disturbances can be modeled using a Gaussian mixture model. For example, the joint distribution of temperature parameters and voltage disturbances can be decomposed into multiple Gaussian components. The fault tolerance threshold can be set to three times the standard deviation of the Hamming distance of the historical normal path. For example, when the actual deviation exceeds this threshold, the system automatically marks the test case as an inefficient test case and starts the iteration.

[0160] Traditional fuzz testing methods rely on random input generation, which cannot correlate the synergistic effect of sudden changes in process parameters and environmental disturbances, and lack a dynamic optimization mechanism based on execution path deviation. This invention uses abnormal triplet data feature extraction and closed-loop verification feedback to enable test cases to accurately reproduce abnormal conditions in the real production environment, and continuously improves test coverage through iterative optimization.

[0161] Through the above technical solution, this invention solves the problem that traditional fuzzy test cases cannot cover the combined effects of sudden changes in process parameters and environmental disturbances, ensuring that test inputs can effectively trigger path branches that lead to production quality abnormalities; by calculating deviation values ​​and judging fault tolerance thresholds, it realizes the quantitative evaluation and dynamic optimization of test case effectiveness, avoiding the repeated execution of invalid test cases.

[0162] In summary, after the process parameter data and environmental disturbance data are processed through a sliding window, parameter mutation points are identified by mean change detection. For example, in the temperature control scenario of an injection molding machine, a mutation point is marked when the average temperature within a certain window changes by more than 10°C compared to the previous window. Subsequently, the correlation coefficient between the environmental disturbance parameters and process parameters within that window is calculated. When the correlation coefficient is greater than 0.7, it is determined to be a pseudo-mutation caused by environmental interference and is removed. For true mutation points, a 30-second event window is set with that point as the center, and environmental disturbance data, execution path data, and production quality data within that time period are extracted simultaneously. Each branch decision point is decomposed into an independent decision unit, such as a condition judgment node in the PLC control flow, and a triplet data is constructed with the corresponding environmental disturbance data, execution path data, and production quality data. In the cluster analysis phase, features such as temperature fluctuation amplitude, branch jump frequency, and product defect rate in the triplet data are standardized. Abnormal clusters are identified through clustering algorithms. For example, if a cluster of data is found to have a combination of high temperature deviation, frequent branch jump, and high defect rate, it is determined to be an overheating anomaly. By calculating the probability of this type of anomaly occurring in historical events, when the probability exceeds a preset threshold, it is determined to be a real abnormal cluster that needs to be tested. Then, abnormal triplets that meet the criterion threshold are extracted to generate test cases.

[0163] Traditional methods typically analyze environmental disturbance data or process parameters in isolation, without establishing multi-dimensional data correlations. For example, in the testing of a certain injection molding machine control system, existing tools detect abnormal temperature parameters but fail to correlate them with voltage fluctuation data, resulting in generated test cases that fail to reproduce the real fault scenario. In contrast, this method analyzes environmental disturbances and process parameter changes simultaneously through event windows. Furthermore, existing test case generators do not consider production quality data and may perform redundant testing on abnormal paths that do not affect product quality. This invention, however, uses threshold filtering to generate test cases only for abnormal execution paths that lead to product defects.

[0164] This invention can effectively distinguish between pseudo-anomalies caused by environmental disturbances and real equipment failures, and accurately locate abnormal execution paths that lead to a decline in product quality. By establishing a dynamic correlation model between control flow branches and process parameters, environmental disturbances, and quality indicators, it significantly improves the relevance and effectiveness of test cases.

[0165] This invention also provides a fuzz testing system based on program control flow, used to execute any of the above-described fuzz testing methods, comprising:

[0166] The acquisition module is used to acquire parameter data, including process parameter data, environmental disturbance data, execution path data, and production quality data.

[0167] The analysis module is used to analyze process parameter data and environmental disturbance data using sliding window technology to identify abrupt change points;

[0168] The elimination module is used to eliminate process parameter data that has changed due to environmental disturbances based on the mutation point, so as to obtain the target process parameter data.

[0169] The extraction module is used to set an event window centered on the mutation point of the target process parameter data, and extract environmental disturbance data, execution path data and production quality data within the event window;

[0170] The triplet module is used to decompose the execution path data within the same event window into multiple branch decision points, and generate triplet data of parameter-branch decision point-production quality based on the process parameter data, environmental disturbance data and production quality data corresponding to each branch decision point.

[0171] The clustering module is used to perform cluster analysis on triplet data within the same event window to determine abnormal clusters and their corresponding anomaly types.

[0172] The calculation module is used to calculate the probability of occurrence of each abnormal cluster based on preset historical data;

[0173] When the probability of an abnormal clustering occurs is greater than a first preset threshold, the abnormal clustering is determined to be a true abnormal clustering.

[0174] When the number of triples in a true abnormal cluster exceeds the second preset threshold, the triples are identified as abnormal triples.

[0175] The construction module is used to construct fuzz test cases based on abnormal triplet data.

[0176] Compared with existing technologies, the beneficial effects of the fuzz testing method and system based on program control flow provided by this invention include:

[0177] 1) By introducing bivariate correlation analysis, this invention can effectively identify pseudo-abnormal data caused by external interference, achieve accurate filtering of external environmental interference, avoid misjudging parameter fluctuations under normal operating conditions as system anomalies, and effectively distinguish between internal system defects and external interference factors.

[0178] 2) This invention integrates multidimensional data through feature vector fusion, and combines cluster analysis and local anomaly factor calculation to accurately identify cluster anomaly clusters caused by parameter mutations and control flow anomalies. At the same time, by matching anomaly types through a preset criterion table, it directly associates data anomalies with quality defects, solving the problem that existing technologies cannot determine whether anomaly paths affect product quality, and providing data support for generating targeted fuzzy test cases.

[0179] 3) This invention enables test cases to accurately reproduce abnormal conditions in the real production environment through abnormal triplet data feature extraction and closed-loop verification feedback. It also continuously improves test coverage through iterative optimization, solving the problem that traditional fuzzy test cases cannot cover the combined effects of sudden changes in process parameters and environmental disturbances, and ensuring that test inputs can effectively trigger path branches that lead to abnormal production quality.

[0180] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A fuzz testing method based on program control flow, characterized in that, include: Acquire parameter data; the parameter data includes process parameter data, environmental disturbance data, execution path data, and production quality data; By analyzing the process parameter data and the environmental disturbance data using the sliding window technique, abrupt change points can be obtained. Based on the mutation point, process parameter data that has mutated due to environmental disturbance data interference are removed from the process parameter data to obtain the target process parameter data; An event window is set centered on the mutation point of the target process parameter data, and environmental disturbance data, execution path data and production quality data are extracted within the event window. The execution path data within the same event window is decomposed into multiple branch decision points, and a triplet of parameter-branch decision point-production quality data is generated based on the process parameter data, environmental disturbance data, and production quality data corresponding to each branch decision point. Perform cluster analysis on triplet data within the same event window to identify abnormal clusters and their corresponding anomaly types; The probability of occurrence of each abnormal cluster is calculated based on preset historical data; When the probability of an abnormal clustering occurring is greater than a first preset threshold, the abnormal clustering is determined to be a true abnormal clustering. When the number of triples in the true abnormal cluster is greater than the second preset threshold, the triples are determined to be abnormal triples. Based on the abnormal triplet data, construct fuzzy test cases; The cluster analysis of triplet data within the same event window to determine abnormal clusters and corresponding anomaly types includes: Cluster analysis is performed on the feature vectors of triplet data within the same event window to divide the triplet data into multiple clusters. Calculate the local outlier factor for the triplet data within each cluster, and determine the outlier score of the cluster based on the local outlier factor; When the anomaly score is greater than a preset anomaly threshold, the cluster is determined to be an abnormal cluster; The feature vectors of the abnormal clusters are matched with a preset anomaly type criterion statistical table to determine the anomaly type of the abnormal clusters.

2. The fuzz testing method according to claim 1, characterized in that, The acquired parameter data includes: Obtain the raw parameter data; The original parameter data is timestamped to obtain first parameter data that is unified to the same time zone; Identify outliers and missing values ​​in the first parameter data, remove the outliers, and fill in the missing values ​​using linear interpolation to obtain the parameter data.

3. The fuzz testing method according to claim 1, characterized in that, The step change points obtained by analyzing the process parameter data and environmental disturbance data using the sliding window technique include: The process parameter data and environmental disturbance data are segmented using a sliding window of fixed length; Calculate the mean values ​​of process parameter data and environmental disturbance data within each sliding window; Calculate the change in the average process parameter data based on the average process parameter data within the current sliding window and the average process parameter data within the previous sliding window. When the change in the average value of the process parameter data is greater than the preset mutation threshold, the starting time of the current sliding window is determined as the mutation point; When the change values ​​of multiple consecutive sliding windows are all greater than a preset mutation threshold, the window center time of the first sliding window among the multiple consecutive sliding windows is determined as the mutation point.

4. The fuzz testing method according to claim 3, characterized in that, The process parameter data obtained by removing process parameter data that has changed due to environmental disturbances based on the mutation point to obtain the target process parameter data includes: Calculate the change in the mean of the environmental disturbance data within the sliding window where the mutation point is located; Calculate the correlation coefficient between the change in the mean of process parameter data and the change in the mean of environmental disturbance data within the same sliding window; When the correlation coefficient is greater than the preset coefficient, the process parameter data in the sliding window is removed.

5. The fuzz testing method according to claim 1, characterized in that, The step of determining that the abnormal cluster is a true abnormal cluster when the probability of the abnormal clustering is greater than a first preset threshold includes: Count the number of times each anomaly cluster occurs across all event windows for each anomaly type; The probability of occurrence of anomaly clusters for each anomaly type is calculated based on the number of occurrences. When the probability of an abnormal clustering is greater than the first preset threshold, a significance test is performed on the probability of an abnormal clustering of an abnormal type, and the significance test result is output. When the probability of an abnormal clustering occurring is less than the significance threshold, the abnormal clustering is determined to be a true abnormal clustering.

6. The fuzz testing method according to claim 1, characterized in that, The step of determining that the triplet data is abnormal triplet data when the triplet data in the true abnormal cluster is greater than the second preset threshold includes: Obtain triple data within all the aforementioned true anomaly clusters; Extract the key fields of the triplet data within the actual anomaly clusters; When the data corresponding to the key field is greater than the second preset threshold, the triplet data is determined to be abnormal triplet data.

7. The fuzz testing method according to claim 1, characterized in that, The construction of fuzz test cases based on the abnormal triplet data includes: Extract the numerical distribution characteristics of process parameter data and environmental disturbance data within the abnormal triplet data, and generate fuzzy test cases based on the numerical distribution characteristics of process parameter data and environmental disturbance data. Obtain the execution path data of the fuzz test cases; When the deviation between the execution path data of the fuzz test case and the expected abnormal path is greater than the preset fault tolerance threshold, the fuzz test is re-executed to generate new fuzz test cases. The final fuzz test case will be generated when the deviation between the execution path data of the fuzz test case and the expected abnormal path exceeds the preset fault tolerance threshold.

8. A fuzz testing system based on program control flow, used to execute the fuzz testing method according to any one of claims 1-7, characterized in that, include: The acquisition module is used to acquire parameter data; The parameter data includes process parameter data, environmental disturbance data, execution path data, and production quality data; The analysis module is used to analyze the process parameter data and the environmental disturbance data using sliding window technology to obtain abrupt change points; The elimination module is used to eliminate process parameter data that has changed due to environmental disturbance data based on the mutation point, so as to obtain the target process parameter data. The extraction module is used to set an event window centered on the mutation point of the target process parameter data, and extract environmental disturbance data, execution path data and production quality data within the event window; The triplet module is used to decompose the execution path data within the same event window into multiple branch decision points, and generate triplet data of parameter-branch decision point-production quality based on the process parameter data, environmental disturbance data and production quality data corresponding to each branch decision point. The clustering module is used to perform cluster analysis on triplet data within the same event window to determine abnormal clusters and their corresponding anomaly types. The calculation module is used to calculate the probability of occurrence of each abnormal cluster based on preset historical data; When the probability of an abnormal clustering occurring is greater than a first preset threshold, the abnormal clustering is determined to be a true abnormal clustering. When the number of triples in the true abnormal cluster is greater than the second preset threshold, the triples are determined to be abnormal triples. The construction module is used to construct fuzz test cases based on the abnormal triplet data; The clustering module is also used to perform cluster analysis on the feature vectors of triplet data within the same event window, dividing the triplet data into multiple clusters; Calculate the local outlier factor for the triplet data within each cluster, and determine the outlier score of the cluster based on the local outlier factor; When the anomaly score is greater than a preset anomaly threshold, the cluster is determined to be an abnormal cluster; The feature vectors of the abnormal clusters are matched with a preset anomaly type criterion statistical table to determine the anomaly type of the abnormal clusters.

Images