An automated test case construction method and system for private protocol testing

Abstract

The application discloses a kind of automation case construction methods and systems for private protocol test, it is related to communication protocol test technical field. Including: step one, through traffic sniffing and deep packet analysis, identify the field structure of private protocol, state transition rule and dependent relationship;Step two, based on reinforcement learning algorithm, combine protocol state machine and historical test results, dynamically generate test case set covering normal scene, boundary scene and abnormal scene;Step three, inject the test traffic generated in the simulation environment, monitor the response data of target system in real time, calculate the evaluation value and adjust the generation strategy of test case according to the value.The application realizes efficient and robust verification of private protocol through adaptive execution and multidimensional abnormal analysis in simulation environment, and significantly improves test efficiency and protocol security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication protocol testing, in particular to an automatic case construction method and system for private protocol testing. BACKGROUND

[0002] Private communication protocols are widely used in industrial control, Internet of Things devices and special communication scenarios due to their closed and customized characteristics, but such protocols lack public specifications, which brings many challenges to testing and verification.

[0003] Traditional private protocol testing relies on manual reverse analysis of protocol format and manual writing of test cases, which is not only inefficient but also difficult to cover complex scenarios in protocol interaction. Due to the lack of unified standards, testers need to derive protocol rules through repeated trial and error, resulting in long testing cycles and high labor costs. At the same time, manually designed test cases are often limited to normal scenarios, and the coverage of boundary conditions (such as field critical values, state transition edge cases) and abnormal scenarios (such as illegal field combinations, malicious attack traffic) is insufficient, making it difficult to expose deep logical errors and security vulnerabilities of the protocol.

[0004] In addition, existing testing methods lack dynamic adjustment mechanisms, and test case generation strategies are fixed, which cannot optimize coverage priorities based on historical test results, resulting in a high proportion of redundant test cases and low vulnerability discovery efficiency. The analysis of test responses relies mainly on manual comparison, making it difficult to quantitatively identify hidden problems such as resource leakage and permission bypass, which seriously hinders the robustness and security verification effect of private protocols. Therefore, the present application provides an automatic case construction method for private protocol testing to solve such problems. SUMMARY

[0005] Technical problems to be solved

[0006] In view of the deficiencies of the prior art, the present application provides an automatic case construction method and system for private protocol testing to solve the problems raised in the background art.

[0007] Technical scheme

[0008] To achieve the above purpose, the present application is implemented by the following technical scheme: an automatic case construction method for private protocol testing, comprising:

[0009] Step 1: Identify the field structure, state transition rules and dependency relationships of the private protocol through traffic sniffing and deep packet analysis;

[0010] Step 2: Based on the reinforcement learning algorithm, combine the protocol state machine and historical test results to dynamically generate a test case set covering normal scenarios, boundary scenarios and abnormal scenarios;

[0011] Step three, inject the generated test traffic in the simulation environment, monitor the response data of the target system in real time, calculate the adjustment evaluation value and adjust the generation strategy of the test case according to the value;

[0012] The adjustment evaluation value is obtained and calculated as follows: the number of valid triggers of the test case generated by the same strategy, the number of consecutive invalid times, and the time interval between the last execution and the current time are counted, and the adjustment evaluation value is calculated through the above parameters;

[0013] The adjustment evaluation value is obtained as follows:

[0014]

[0015] In the formula, represents the adjustment evaluation value, represents the number of valid triggers, represents the number of consecutive invalid times, represents the time interval between the last execution and the current time, is a decay constant;

[0016] Step four, using semantic analysis and machine learning model, calculate the vulnerability evaluation value of the monitored response data, and automatically identify logical errors, resource leaks and security vulnerabilities in the private protocol based on the value.

[0017] Preferably, the specific steps of identifying the field structure, state transition rule and dependency relationship of the private protocol are as follows: identifying the field boundary based on entropy value analysis, modeling the state transition probability, and constructing the dependency relationship graph between fields.

[0018] Preferably, the specific steps of dynamically generating the test case set covering normal scene, boundary scene and abnormal scene are as follows: using hybrid generation strategy, including generating abnormal field combination based on syntax variation, covering normal scene by traversing protocol state machine path based on model checking, covering boundary scene by simulating attack traffic through generative adversarial network, and dynamically adjusting the priority of each strategy according to historical test results combining with reinforcement learning algorithm.

[0019] Preferably, the adjustment evaluation value is obtained and calculated as follows: the number of valid triggers of the test case generated by the same strategy, the number of consecutive invalid times, and the time interval between the last execution and the current time are counted, and the adjustment evaluation value is calculated through the above parameters.

[0020] Preferably, the vulnerability evaluation value is obtained and calculated as follows: extracting the logical error feature value, resource leak feature value and security vulnerability matching value of the response data, and calculating the vulnerability evaluation value combining with the high-risk feature library.

[0021] Preferably, the logic error characteristic value acquisition step is as follows: extracting protocol rules from the dependency graph, parsing the response data and comparing the rules to count the number of logical conflicts, and normalizing the number of conflicts to obtain the logic error characteristic value.

[0022] Preferably, the resource leakage characteristic value acquisition step is as follows: collecting the CPU usage and memory occupation of the target system through the system probe, inputting the preprocessed data into the pre-trained anomaly detection model, and outputting the fluctuation anomaly probability as the resource leakage characteristic value.

[0023] Preferably, the security vulnerability matching value acquisition step is as follows: constructing a vulnerability feature library based on the abnormal behavior knowledge base, extracting the packet structure features and system behavior features of the response data, and calculating the maximum similarity with the vulnerability feature library through the feature matching algorithm as the security vulnerability matching value.

[0024] Preferably, the high-risk feature library construction step is as follows: based on the historical vulnerability cases in the abnormal behavior knowledge base, extracting the feature parameters of logic errors, resource leaks and security vulnerabilities to form a high-risk feature library.

[0025] An automatic case construction system for private protocol testing, comprising:

[0026] A data analysis module for identifying the field structure, state transition rules and dependencies of the private protocol through traffic sniffing and deep packet analysis;

[0027] A case generation module for dynamically generating a test case set covering normal, boundary and abnormal scenarios based on reinforcement learning algorithms, combined with protocol state machines and historical test results;

[0028] An adaptive execution module for injecting the generated test traffic in a simulation environment, monitoring the response data of the target system in real time, calculating an adjustment evaluation value and adjusting the generation strategy of the test cases according to the value;

[0029] The adjustment evaluation value acquisition and calculation step is as follows: counting the number of valid triggers, the number of consecutive invalid triggers and the time interval between the last execution and the current time of the test cases generated by the same strategy, and calculating the adjustment evaluation value through the above parameters;

[0030] The adjustment evaluation value is obtained as follows:

[0031]

[0032] In the formula, represents the adjustment evaluation value, represents the number of valid triggers, represents the number of consecutive invalid triggers, represents the time interval between the last execution and the current time, is a decay constant;

[0033] The abnormality analysis module is used for calculating a vulnerability evaluation value of the monitored response data by using semantic analysis and a machine learning model, and automatically identifying logical errors, resource leaks and security vulnerabilities in the private protocol based on the value.

[0034] Advantages

[0035] The present application has the following advantages:

[0036] (1) The automatic case construction method and system for private protocol testing can realize efficient and robust verification of the private protocol by real-time adjustment of the test strategy and accurate identification of logical errors, resource leaks and security vulnerabilities through adaptive execution and multi-dimensional abnormality analysis in the simulation environment, and significantly improve the test efficiency and protocol security.

[0037] (2) The automatic case construction method and system for private protocol testing can solve the problems of incomplete case coverage and dependence on manual modeling in traditional testing by identifying protocol core features through traffic sniffing and deep packet analysis, and dynamically generating a test case set covering normal, boundary and abnormal scenarios in combination with a reinforcement learning algorithm, thereby improving the systematicness and integrity of the test.

[0038] Of course, implementing any product of the present application does not necessarily require all the advantages described above. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is a flowchart of the automatic case construction method for private protocol testing of the present application;

[0040] Figure 2 is a structural diagram of the automatic case construction system for private protocol testing of the present application. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0042] The present application provides a technical solution: an automatic case construction method for private protocol testing, as shown in Figure 1 , comprising:

[0043] Step one, identify the field structure, state transition rules and dependency relationship of the private protocol through traffic sniffing and deep packet analysis.

[0044] Step two, based on reinforcement learning algorithm, combine protocol state machine and historical test results to dynamically generate test case set covering normal scene, boundary scene and abnormal scene;

[0045] Step three, inject the generated test traffic in the simulation environment, monitor the response data of the target system in real time, calculate the adjustment evaluation value and adjust the generation strategy of the test case according to the value;

[0046] Step four, use semantic analysis and machine learning model to calculate the vulnerability evaluation value of the monitored response data, and automatically identify logical errors, resource leaks and security vulnerabilities in the private protocol based on the value.

[0047] Specifically, the specific steps of identifying the field structure, state transition rule and dependency relationship of the private protocol are as follows: based on entropy value analysis to identify field boundary, model state transition probability, and construct field dependency graph.

[0048] Specifically, the specific steps of dynamically generating test case set covering normal scene, boundary scene and abnormal scene are as follows:

[0049] Structurally analyze the syntax rules (field format, length constraint, value range) of the private protocol, and sort out the "legal feature library" of the core field (such as the temperature field needs to be-40~125℃, the length field needs to be consistent with the actual data byte number). Generate abnormal field combination through random mutation operator:

[0050] Randomly select fields (such as temperature, length, instruction), perform "boundary replacement" on field values (such as temperature changed to 130℃); perform "illegal tampering" on field length (such as actual data 8 bytes, length field changed to 5); insert special characters (such as ;, %) in string field; force to disturb field order (such as moving authentication field to data field), generate abnormal messages containing "field conflict, format error, logical contradiction", cover abnormal scenes in protocol interaction (such as executing control instruction without authentication, data length mismatch causing parsing error).

[0051] A state machine model of the private protocol is constructed to clearly define the state transition rules of the whole process from the "initial state" to the "termination state". The core states of "unauthenticated, authentication in progress, authenticated, data transmission, instruction response, and connection closed" are defined, and the "allowed operations" in each state are marked (such as only receiving authentication instructions in the unauthenticated state, and executing data read and write in the authenticated state). The "trigger conditions" for state transition are sorted out (such as the need to carry a correct token for successful authentication, and the need to complete initialization before data transmission). Through a depth-first traversal algorithm, test cases that meet the protocol specifications are generated one by one: starting from the initial state, following the "authentication, data transmission, and instruction response" normal path, generating interactive messages that strictly comply with the protocol process (carrying a legal token, matching field length, and correct status code); covering all "legal state transition branches" (such as returning an error code for authentication failure, and triggering retransmission for data transmission timeout); ensuring that the test cases include the "complete life cycle of normal protocol interaction" (from connection establishment to closure), covering normal scenarios.

[0052] Using normal protocol interaction traffic collected in a simulation environment (typical interactive messages covering the entire life cycle of the protocol) as training samples, a generative adversarial network (GAN) is constructed: the generator learns the distribution of the protocol fields (such as the probability distribution of the temperature field -40~125℃, and the relationship between the length field and the data volume); the discriminator distinguishes between normal traffic and attack traffic. After multiple rounds of adversarial training, the generator outputs "near boundary condition" attack messages: generate length-critical messages (such as the protocol specifies a length limit of 100 bytes, generate 99 / 101 byte messages); generate permission-critical instructions (such as carrying a special permission marker but not fully meeting the authorization conditions); generate threshold-critical data (such as a humidity field of 90% threshold value, and a temperature field of -40℃ boundary value), covering "boundary scenarios" of protocol interaction (field values reaching the legal threshold edge, and permission marker critical state).

[0053] A reinforcement learning algorithm (Q-learning) is introduced to establish a "reward-priority" linkage mechanism with "vulnerability discovery rate and scenario coverage rate" as reward signals: define a "reward function", give a positive reward (+0.1 weight) when a test case generated by a certain strategy discovers a new vulnerability (such as authentication bypass or buffer overflow), and increase the weight by 10% (such as from 30% to 33%) based on the original strategy weight, while proportionally reducing the weights of other strategies to ensure the total weight remains 100%; design a "priority adjustment mechanism", if the fuzzing strategy discovers more than 3 vulnerabilities in the near term, its generation weight is increased from 30% to 40%, and if the state machine traversal strategy has covered 90% of the normal scenarios, its weight is decreased from 40% to 30%; update the strategy weight after each test to let the test case set "dynamically adapt to the protocol vulnerability distribution" - strategies with high vulnerability rates are given priority, and strategies that have covered scenarios are reduced in frequency, achieving dynamic adaptation of strategies.

[0054] Specifically, the steps for obtaining and calculating the adjustment evaluation value are as follows: count the number of valid triggers, the number of consecutive invalid triggers, and the time interval between the last execution and the current time for test cases generated by the same strategy, and calculate the adjustment evaluation value using the above parameters;

[0055] The method for obtaining the adjusted evaluation value is as follows:

[0056]

[0057] In the formula, This indicates an adjustment to the evaluation value, specifically used to quantify the "current value priority" of test cases for testing private protocols. A higher value indicates that this type of test case is more likely to discover protocol issues and should be generated first in subsequent tests. This indicates the number of valid triggers, specifically the total number of times the "protocol exception response" or "new state path" was triggered during the historical execution of test cases generated by this strategy. This indicates the number of consecutive invalid occurrences, specifically the number of times that this type of test case has been executed consecutively without triggering an exception or exploring a new state path. This indicates the time interval between the last execution and the current time. Specifically, it represents the interval between the last execution time of the test cases generated by this strategy and the current time, in minutes. The decay constant is set to 30 to control the decay effect of the time interval on the evaluation value. The longer the interval, the greater the decay effect of the evaluation value due to the exponential term. The more pronounced the attenuation.

[0058] Specifically, the steps for obtaining and calculating the vulnerability assessment value are as follows: extract the logical error feature value, resource leakage feature value, and security vulnerability matching value of the response data, and construct a feature vector for the logical error feature value, resource leakage feature value, and security vulnerability matching value to quantify the vulnerability risk dimension of the private protocol response data. Combine the high-risk feature library to calculate the Euclidean distance between the current feature vector and all cases in the high-risk feature library, take the minimum distance value and the maximum case distance value, and comprehensively calculate the minimum distance value and the maximum distance value to obtain the vulnerability assessment value.

[0059] The vulnerability assessment value is obtained in the following ways:

[0060]

[0061] In the formula, This represents the vulnerability assessment value; a higher value indicates a higher vulnerability risk. This represents the minimum distance, specifically the minimum Euclidean distance between the current feature vector and the high-risk feature database. This represents the maximum case distance value, specifically the maximum Euclidean distance among all cases in the high-risk feature database. The setting is used to avoid the denominator being 0.

[0062] The logic error characteristic value is obtained as follows: from the dependency graph, three types of core rules of the private protocol are automatically extracted by the system. The field constraint rule clearly requires the field format, and the numerical field cannot appear as a string; the length matching standard is specified, and the data length field needs to be consistent with the actual data byte number; the value range boundary is limited, and the temperature field cannot exceed -40℃~125℃. The state transition rule divides the allowed operations of the protocol in different interaction stages, and the control instruction cannot be received in the uncompleted authentication state, and the error code must be returned in the fault state. The field association rule defines the linkage logic between multiple fields, and when the humidity is greater than 90%, the dehumidification instruction flag bit must be 1; when the alarm level is “emergency”, the response delay cannot exceed 100ms.

[0063] The monitored target system response data is deeply analyzed, including the returned message, the state code and the interaction log. The specific value of each field is extracted from the message, such as temperature=130℃, humidity=95%, and dehumidification flag=0; the current state of the protocol is obtained from the state log, such as unauthenticated, and the execution result, such as no error after receiving the control instruction.

[0064] The response data obtained by analysis is compared with the extracted protocol rules one by one, and the total number of logic conflicts is counted. The data length field in the response is 10 but the actual data byte number is 15, triggering 1 field constraint conflict; the control instruction is successfully received in the unauthenticated state, triggering 1 state transition conflict; the humidity is 95% and the dehumidification flag is 0, triggering 1 field association conflict.

[0065] Combined with the number of protocol fields and the complexity of state transition, the maximum threshold of logic conflict is preset (such as 5 times for a protocol containing more than 10 core fields), and if it exceeds this value, it is determined as a serious logic anomaly. The logic error characteristic value is calculated by ratio: taking the actual conflict number as the numerator and the maximum threshold as the denominator, the ratio of the two is calculated; if the ratio is greater than 1, the logic error characteristic value is 1; if the ratio is less than 0, the logic error characteristic value is 0; otherwise, the calculated ratio is directly taken as the logic error characteristic value. In this way, the actual conflict number is normalized to the interval [0, 1], forming a quantifiable logic error characteristic value.

[0066] The resource leakage characteristic value is obtained as follows: deploy system probes to collect the CPU usage and memory occupancy of the target system in real time. The probe is set to continuously monitor at a fixed frequency (such as 1 time / second), and the collection period completely covers the execution period of the test case and the 30 seconds after the execution ends, capturing the dynamic changes of resource usage.

[0067] The collected CPU and memory data is preprocessed:

[0068] Identify and eliminate abnormal fluctuation points to avoid interference with real resource leakage judgment;

[0069] Strictly match CPU usage and memory usage by timestamp to ensure that resource data at the same time form a corresponding relationship, facilitating analysis of abnormal linkage of the two;

[0070] Extract the resource data of the first 30 seconds before the execution of the test case, and take the average value as the resource baseline value, representing the resource consumption level when the protocol is normally interacted.

[0071] Input the preprocessed resource data into the pre-trained anomaly detection model (the model is trained based on historical normal interaction resource data of similar private protocols, and has learned the normal fluctuation range of CPU and memory). The model learns the resource fluctuation rules during normal protocol interaction, and identifies resource usage behaviors that deviate from the normal mode.

[0072] The model directly outputs the fluctuation anomaly probability as the resource leakage feature value, with a value range of [0, 1]. The higher the probability, the greater the possibility of resource abnormal consumption. Through this process, the abnormal state of resource usage is converted into a quantifiable feature value.

[0073] The security vulnerability matching value is obtained as follows: Based on the abnormal behavior knowledge base, sort out the feature patterns of known security vulnerabilities, and build a vulnerability feature library. For common buffer overflow, authentication bypass, and instruction injection vulnerabilities of private protocols, extract the core features of each type of vulnerability:

[0074] Buffer overflow: define features such as "message length exceeds the upper limit specified by the protocol" "return code fixed as 0x05" "memory address field appears illegal overwrite mark";

[0075] Authentication bypass: clearly define features such as "carrying no authentication token but successfully executing privileged operations" "status code returns 200" "log records have no permission check behavior";

[0076] Instruction injection: summarize features such as "message contains special characters" "system log appears syntax error prompt" "execution result is completely inconsistent with expected instruction".

[0077] Perform feature extraction on the response data monitored during the test process:

[0078] Message structure features: analyze the length of the message, the specific value of each field, whether it contains special symbols (such as %, $), and whether the field order conforms to the default rules of the protocol;

[0079] System behavior features: collect the status code returned by the target system, protocol state changes, and system log information.

[0080] The extracted response features are compared with the feature patterns of each vulnerability in the vulnerability feature library by calling the cosine similarity or edit distance algorithm:

[0081] If the buffer overflow vulnerability is compared, the difference ratio between the response message length and the "protocol specified upper limit", whether the return code matches 0x05, etc. are calculated to generate a matching score;

[0082] If the authentication bypass vulnerability is compared, the conditions such as 'whether the operation is performed without token', 'whether the state code is abnormally returned to normal (such as returning 200 without authentication)' are checked, and the corresponding matching degree is output;

[0083] If the command injection vulnerability is compared, the special characters in the message, system log syntax errors, etc. are detected, and the matching degree is counted.

[0084] After traversing all the vulnerability types, the maximum similarity value is selected, which is directly used as the security vulnerability matching value, with a value range of [0, 1]. The closer the value is to 1, the more consistent the response data is with the known security vulnerability features, indicating that the private protocol has a higher risk of corresponding security vulnerabilities. The potential threat of security vulnerabilities is quantified.

[0085] Specifically, the construction steps of the high-risk feature library are as follows:

[0086] Based on the historical vulnerability cases deposited in the abnormal behavior knowledge base, the core parameters of private protocol vulnerability cases covering logical errors, resource leaks, and security vulnerabilities are extracted one by one. For logical error type, the field conflict type, state jump contradiction point and system response are analyzed; for resource leak type, the CPU peak fluctuation range, memory occupation growth trend and abnormal duration are extracted; for security vulnerability type, the trigger condition, exploitation path and feature pattern are sorted out;

[0087] The extracted parameters are standardized. Numerical features are normalized to the [0, 1] interval by formula, enumeration features are converted to one-hot encoding, and text features are converted to numerical vectors with the help of word vector models;

[0088] Store the features according to 'case ID + feature type + standardized parameter', and establish an index for retrieval by vulnerability type and feature parameter range, to build a high-risk feature library.

[0089] An automatic case construction system for private protocol testing, as shown in Figure 2 includes:

[0090] A data analysis module for identifying the field structure, state transition rules and dependencies of the private protocol through traffic sniffing and deep packet analysis;

[0091] A use case generation module is configured to dynamically generate a test case set covering normal scenarios, boundary scenarios and abnormal scenarios based on a reinforcement learning algorithm, in combination with a protocol state machine and historical test results;

[0092] An adaptive execution module is configured to inject the generated test traffic in the simulation environment, monitor the response data of the target system in real time, calculate an adjustment evaluation value and adjust the generation strategy of the test case according to the value;

[0093] In the simulation environment, 100 normal protocol interaction use cases are executed, and the fluctuation range of CPU and memory and the peak occurrence frequency are collected;

[0094] The baseline data is stored in the normal resource feature library as a basis for judging resource leakage;

[0095] An abnormal analysis module is configured to calculate a vulnerability evaluation value for the monitored response data by using semantic analysis and a machine learning model, and automatically identify logical errors, resource leakage and security vulnerabilities in the private protocol based on the value;

[0096] After the abnormal analysis module identifies the logical errors, resource leakage and security vulnerabilities, it synchronously generates vulnerability scenario labels (such as logical error-field conflict and security vulnerability-authentication bypass), and pushes them to the use case generation module in real time through a strategy synchronization interface; the use case generation module triggers a special use case generation process for the vulnerability scenario, supplements test cases covering similar scenarios according to the labels, and marks them as high-priority execution;

[0097] After the adaptive execution module receives the vulnerability scenario labels, it temporarily increases the test traffic injection intensity of the corresponding scenario by 50% (for example, from 10 cases per second to 15 cases per second), and extends the monitoring time (additional monitoring for 60 seconds after execution), to ensure the integrity of vulnerability reproduction and repair verification.

[0098] It should be noted that, in this document, relational terms such as first and second and the like can merely be used to distinguish one entity or action from another, without necessarily requiring or implying any such actual relationship or order between or among the entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0099] The preferred embodiments of the application disclosed above are only to facilitate the elucidation of the application. The preferred embodiments do not describe all the details of the application and limit the application to the specific embodiments described. Obviously, many modifications and variations can be made in light of the teachings above. The description is chosen and described in order to best explain the principles of the application and its practical application to thereby enable others skilled in the art to best utilize the application and get the best results from the application. The application is only limited by the claims and their full scope and equivalents.

Claims

1. A method for automation of test case construction for private protocol testing, characterized in that, Comprising: Step one, through flow sniffing and deep packet analysis, identify the field structure, state transition rules and dependency of private protocol; Step two, based on reinforcement learning algorithm, combine protocol state machine and historical test results to dynamically generate test case set covering normal scenario, boundary scenario and abnormal scenario; Step three, inject the generated test traffic in the simulation environment, monitor the response data of the target system in real time, calculate the adjustment evaluation value and adjust the generation strategy of the test case according to the value; The acquisition and calculation of the adjustment evaluation value are as follows: count the effective trigger times, continuous invalid times and time interval of the last execution of the test case generated by the same strategy, and calculate the adjustment evaluation value through the above parameters; The acquisition method of the adjustment evaluation value is as follows: In the formula, represents the adjustment evaluation value, represents the effective trigger number, represents the continuous invalid number, represents the time interval between the last execution and the present, is the decay constant; Step four, use semantic analysis and machine learning model to calculate the vulnerability evaluation value of the monitored response data, and automatically identify the logical errors, resource leaks and security vulnerabilities in the private protocol based on the value.

2. The method for automation of test case construction for private protocol as claimed in claim 1 wherein: The specific steps of identifying the field structure, state transition rules and dependency of private protocol are as follows: based on entropy analysis, identify the field boundary, model the state transition probability, and construct the dependency graph between fields.

3. The method for automation of test case construction for private protocol as claimed in claim 1 wherein: The specific steps of dynamically generating test case set covering normal scenario, boundary scenario and abnormal scenario are as follows: adopt hybrid generation strategy, including generating abnormal field combination based on syntax variation, covering normal scenario by traversing protocol state machine path based on model checking, covering boundary scenario by simulating attack traffic through adversarial generation network, and dynamically adjusting the priority of each strategy according to historical test results based on reinforcement learning algorithm.

4. The method for automation of test case construction for private protocol as claimed in claim 1 wherein: The acquisition and calculation steps of the vulnerability evaluation value are as follows: extract the logical error feature value, resource leak feature value and security vulnerability matching value of the response data, and calculate the vulnerability evaluation value combined with the high-risk feature library.

5. The method for automation of use case construction for private protocol testing as claimed in claim 4 wherein: The acquisition steps of the logical error feature value are as follows: extract the protocol rules from the dependency graph, parse the response data and compare the rules to count the number of logical conflicts, and normalize the conflict number to obtain the logical error feature value.

6. The method for automation of test case construction for private protocol as claimed in claim 4 wherein: The acquisition steps of the resource leak feature value are as follows: collect the CPU usage and memory occupancy of the target system through system probes, input the preprocessed data into the pre-trained anomaly detection model, and output the fluctuation anomaly probability as the resource leak feature value.

7. The method for automation of test case construction for private protocol as claimed in claim 4 wherein: The acquisition steps of the security vulnerability matching value are as follows: based on the abnormal behavior knowledge base, construct the vulnerability feature library, extract the packet structure features and system behavior features of the response data, and calculate the maximum similarity with the vulnerability feature library as the security vulnerability matching value through the feature matching algorithm.

8. The method for automation of test case construction for private protocol as claimed in claim 4 wherein: The construction steps of the high-risk feature library are as follows: based on the historical vulnerability cases in the abnormal behavior knowledge base, extract the feature parameters of logical errors, resource leaks and security vulnerabilities to form the high-risk feature library.

9. An automated test case construction system for private protocol testing, for implementing the automated test case construction method for private protocol testing according to any one of claims 1 to 8, characterized in that, Comprising: Data analysis module, used for identifying the field structure, state transition rules and dependency of private protocol through flow sniffing and deep packet analysis; The use case generation module is configured to dynamically generate a test case set covering normal scenarios, boundary scenarios and abnormal scenarios based on a reinforcement learning algorithm, in combination with a protocol state machine and historical test results; The adaptive execution module is configured to inject the generated test traffic in the simulation environment, monitor response data of the target system in real time, calculate an adjustment evaluation value and adjust the generation strategy of the test case according to the value. The adjustment evaluation value is calculated according to the following steps: counting the number of valid triggers, the number of consecutive invalid triggers and the time interval between the last execution and the current time of the test case generated by the same strategy, and calculating the adjustment evaluation value according to the above parameters. The adjustment evaluation value is calculated according to the following steps: In the formula, represents the adjustment evaluation value, represents the effective trigger number, represents the continuous invalid number, represents the time interval between the last execution and the current time, is a decay constant; The anomaly analysis module is configured to calculate a vulnerability evaluation value of the monitored response data by using a semantic analysis and a machine learning model, and automatically identify logical errors, resource leaks and security vulnerabilities in the private protocol based on the value.

Images