Test case generation model processing method, and network protocol fuzzing method

Abstract

The application relates to a test case generation model processing method and a network protocol fuzzy test method. The method comprises the following steps: obtaining sample traffic data; the sample traffic data is data transmitted by a test target based on a target communication protocol; extracting a protocol request message and a protocol response message from the sample traffic data; obtaining a protocol state of the target communication protocol from a preset protocol state model according to the protocol request message and the protocol response message; generating a sample test message according to the protocol state; and training a test case generation model to be trained according to the sample test message, so as to obtain a trained test case generation model, which can improve the coverage of the fuzzy test and further improve the fuzzy test efficiency.

Description

Test case generation model processing methods, fuzz testing methods for network protocols Technical Field

[0001] This application relates to the field of fuzz testing technology, and in particular to a test case generation model processing method, a fuzz testing method and apparatus for network protocols, and a computer device. Background Technology

[0002] Fuzz testing is a software testing technique that discovers vulnerabilities or errors in software by providing unexpected inputs to the target system and monitoring the abnormal results.

[0003] Based on the method of test case generation, fuzzing techniques can be divided into two categories: mutation-based fuzzing and generation-based fuzzing. Mutation-based fuzzing creates test cases by mutating existing data samples. This method typically involves randomly modifying or replacing input data such as files and network packets to generate new test cases. Generation-based fuzzing models the protocols or file formats used by the system under test and generates test cases based on these models. This method requires a deeper understanding of the internal structure and behavior of the system under test.

[0004] Currently, the coverage of fuzz test cases generated based on models is limited, resulting in low efficiency of fuzz testing. Summary of the Invention

[0005] Based on this, it is necessary to provide a test case generation model processing method, a network protocol fuzzing method, apparatus, and computer equipment that can improve the efficiency of fuzzing, addressing the aforementioned technical problems.

[0006] Firstly, this application provides a test case generation model processing method, including:

[0007] Acquire sample traffic data; sample traffic data is the data transmitted by the test target based on the target's communication protocol.

[0008] Extract protocol request messages and protocol response messages from sample traffic data; based on the protocol request messages and protocol response messages, obtain the protocol state of the target communication protocol from the preset protocol state model;

[0009] Generate sample test messages based on the protocol status;

[0010] Based on the sample test messages, the test case generation model to be trained is trained to obtain a trained test case generation model.

[0011] In one embodiment, the protocol state model includes the protocol states of the target communication protocol, the transition paths between the protocol states, and the transition conditions for each transition path. Based on protocol request messages and protocol response messages, the protocol state of the target communication protocol is obtained from a preset protocol state model, including:

[0012] Determine the protocol state transition conditions based on the protocol request message and the protocol response message;

[0013] Find the target transition condition that matches the protocol state transition condition from the protocol state model;

[0014] Based on the migration path according to the target migration conditions, obtain the protocol status of the target communication protocol.

[0015] In one embodiment, a sample test message is generated based on the protocol state, including:

[0016] From the protocol specification document of the target communication protocol, obtain the message types, message formats, and value ranges and constraints of each field in the message that the target communication protocol is allowed to send and receive in the protocol state.

[0017] Generate sample test messages based on message type, message format, and the value range and constraints of each field.

[0018] In one embodiment, the test case generation model to be trained is a multi-armed slot machine model, where each arm of the multi-armed slot machine model represents a candidate test case; the test case generation model to be trained is trained based on sample test messages to obtain a trained test case generation model, including:

[0019] Input the sample test message into the multi-armed slot machine model, and select one arm from the multi-armed slot machine model as the predicted test case;

[0020] Based on the predicted test cases and the preset tag test cases, calculate the reward value for each arm; the tag test cases are the response messages obtained after the test target processes the test messages;

[0021] Based on the reward value, update the arm statistics of each arm to obtain the updated arm statistics;

[0022] Based on the sample test messages and updated arm statistics, the multi-armed slot machine model is trained in multiple rounds until the average reward value of each arm fluctuates within a preset threshold range, thus obtaining a well-trained multi-armed slot machine model.

[0023] In one embodiment, inputting a test message into the multi-armed slot machine model includes:

[0024] The sample test messages are subjected to message feature extraction and word embedding processing to obtain message feature vectors;

[0025] Input the message feature vector into the multi-armed slot machine model.

[0026] Secondly, this application provides a fuzz testing method for network protocols, including:

[0027] Acquire traffic data generated by the test target during communication; the test target communicates based on the target communication protocol;

[0028] Obtain initial test cases from traffic data; input the initial test cases into the trained test case generation model to obtain a test case sequence; the trained test case generation model is trained using any of the test case generation model processing methods described above;

[0029] Perform a mutation operation on the test case sequence to obtain the target test case sequence;

[0030] Based on the target test case sequence, perform fuzz testing on the target communication protocol and obtain the fuzz test results.

[0031] In one embodiment, initial test cases are obtained from traffic data, including:

[0032] Extract several data packets from the traffic data;

[0033] Parse each data packet to obtain the IP address and port number;

[0034] Based on the IP address and port number, the data packets are reassembled to obtain multiple message sequences;

[0035] Use at least one of the multiple message sequences as the initial test case.

[0036] In one embodiment, fuzz testing is performed on the target communication protocol based on the target test case sequence to obtain fuzz test results, including:

[0037] Send the target test case sequence to the test target and receive the response status information from the test target;

[0038] The fuzz test results are obtained based on the response status information.

[0039] In one embodiment, after obtaining the fuzz test result based on the response status information, the method further includes:

[0040] If the response status information triggers a change in the protocol status of the target communication protocol, the target test case sequence is determined to be valid; or,

[0041] If the response status information indicates improved code coverage of the test target, then the target test case sequence is deemed effective; or...

[0042] If the response status information indicates that the running state of the test target has terminated, the sequence of test cases for the target is deemed valid.

[0043] Thirdly, this application also provides a test case generation model processing apparatus, comprising:

[0044] The sample traffic data acquisition module is used to acquire sample traffic data; the sample traffic data is the data transmitted by the test target based on the target communication protocol.

[0045] The protocol status acquisition module is used to extract protocol request messages and protocol response messages from sample traffic data; and to obtain the protocol status of the target communication protocol from a preset protocol status model based on the protocol request messages and protocol response messages.

[0046] The sample test message generation module is used to generate sample test messages based on the protocol status.

[0047] The model training module is used to train the test case generation model based on the sample test messages, and obtain the trained test case generation model.

[0048] Fourthly, this application also provides a fuzz testing apparatus for network protocols, comprising:

[0049] The traffic data acquisition module is used to acquire the traffic data generated by the test target during communication; the test target communicates based on the target communication protocol.

[0050] The test case sequence acquisition module is used to obtain initial test cases from traffic data; input the initial test cases into the trained test case generation model to obtain the test case sequence; the trained test case generation model is trained using any of the test case generation model processing methods mentioned above;

[0051] The target test case sequence acquisition module is used to perform mutation operations on the test case sequence to obtain the target test case sequence.

[0052] The fuzz test result acquisition module is used to perform fuzz testing on the target communication protocol based on the target test case sequence and obtain the fuzz test results.

[0053] Fifthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method steps of the first or second aspect.

[0054] The aforementioned test case generation model processing method, apparatus, and computer equipment acquire sample traffic data; the sample traffic data is the data transmitted by the test target based on the target communication protocol; protocol request messages and protocol response messages are extracted from the sample traffic data; based on the protocol request messages and protocol response messages, the protocol state of the target communication protocol is obtained from a preset protocol state model; sample test messages are generated based on the protocol state; and the test case generation model to be trained is trained based on the sample test messages to obtain a trained test case generation model. As can be seen from the above, this application, based on the protocol state model, can accurately identify the protocol state of the target communication protocol. The sample test messages generated based on the protocol state can effectively simulate the abnormal behavior that the target communication protocol may exhibit in actual operation, improving the coverage of fuzz testing and thus improving fuzz testing efficiency. Using these sample test messages to train the test case generation model, the test cases generated by the trained test case generation model can explore the various states and behaviors of the target communication protocol more deeply, improving the coverage of fuzz testing and thus improving fuzz testing efficiency. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 is an application environment diagram of the test case generation model processing method in one embodiment;

[0057] Figure 2 is a flowchart illustrating the test case generation model processing method in one embodiment;

[0058] Figure 3 is a flowchart illustrating a fuzz testing method for a network protocol in one embodiment;

[0059] Figure 4 is a schematic diagram of the architecture of a fuzz testing method for a network protocol in one embodiment;

[0060] Figure 5 is a structural block diagram of a test case generation model processing device in one embodiment;

[0061] Figure 6 is a structural block diagram of a fuzz testing device for a network protocol in one embodiment;

[0062] Figure 7 is an internal structure diagram of a computer device in one embodiment. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0064] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0065] The test case generation model processing method provided in this application embodiment can be applied to the application environment shown in Figure 1. The terminal 102 communicates with the server 104 via a network. A data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104 or placed on a cloud or other network server. The terminal 102 acquires sample traffic data; the sample traffic data is the data transmitted by the test target based on the target communication protocol; it extracts protocol request messages and protocol response messages from the sample traffic data; based on the protocol request messages and protocol response messages, it obtains the protocol state of the target communication protocol from a preset protocol state model; based on the protocol state, it generates sample test messages; based on the sample test messages, it trains the test case generation model to be trained, obtaining a trained test case generation model. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart vehicle devices, projection devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Headset devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0066] In one embodiment, as shown in Figure 2, a test case generation model processing method is provided. This embodiment illustrates the method by applying it to a terminal testing tool. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0067] Step S210: Obtain sample traffic data; the sample traffic data is the data transmitted by the test target based on the target communication protocol.

[0068] The test target can be a device, software, or program that communicates using a target communication protocol. Specifically, the test target can be an embedded software system. Embedded software systems typically consist of multiple modules, each responsible for different tasks, such as sensor data acquisition, data analysis, and decision execution. These modules need to collaborate closely and provide real-time feedback.

[0069] The target communication protocol is the communication protocol to be fuzzed. Specifically, the target communication protocol includes, but is not limited to, TCP, HTTP, and SMTP protocols.

[0070] In this embodiment, a traffic collection tool can be used to capture traffic data generated when the test target communicates with other devices via the target communication protocol. The traffic collection tool can be Wireshark or tcpdump, etc. The traffic data includes multiple data packets and can be saved as a pcap file.

[0071] Step S220: Extract protocol request messages and protocol response messages from the sample traffic data; based on the protocol request messages and protocol response messages, obtain the protocol state of the target communication protocol from the preset protocol state model.

[0072] Protocol request messages are messages sent by clients to servers to request specific operations or resources. Specifically, a protocol request message typically includes a request line, request headers, a blank line, and a request body (for POST requests). The request line specifies the request method (e.g., GET, POST), URL, and HTTP protocol version; the request headers contain basic client information, the requested data format, and the expected return content type; a blank line separates the request headers and the request body; and the request body contains the data to be submitted to the server via the POST method.

[0073] Protocol response messages are messages returned by the server to the client after receiving a request message, based on the content and status of the request. These messages also follow the format and structure specified by the protocol to ensure that the client can correctly parse and process them. Specifically, protocol response messages typically include a status line, response headers, a blank line, and a response body. The status line specifies the protocol version, status code, and a description text for the status code; the response header contains basic information about the server, the format of the returned data, and the content length; a blank line separates the response header and the response body; and the response body contains the resource content or error information returned by the server to the client.

[0074] The preset protocol state model is constructed based on the various protocol states of the target communication protocol and the transition conditions that trigger state transitions for each protocol state. The transition conditions for each protocol state include protocol request messages and protocol response messages. For example, the protocol request message and protocol response message that trigger the transition from protocol state S1 to protocol state S2 are i1 and o1, respectively, and the protocol request message and protocol response message that trigger the transition from protocol state S2 to protocol state S3 are i2 and o2, respectively.

[0075] In this embodiment, each data packet in the sample traffic data is parsed to obtain protocol request messages and protocol response messages. Based on the protocol request messages and protocol response messages, the corresponding transition conditions in the protocol state model are determined. Based on the transition conditions, the protocol state of the target communication protocol is obtained.

[0076] Step S230: Generate a sample test message according to the protocol status.

[0077] In this embodiment of the application, a fuzzing tool is used to construct extreme and abnormal sample test messages based on the protocol state, such as messages containing illegal parameters, excessively long fields, or incorrect formats. For example, in fuzzing the HTTP protocol, the URL length in normal traffic data is usually limited, so sample test messages containing excessively long URLs can be generated.

[0078] Step S240: Train the test case generation model to be trained based on the sample test message to obtain the trained test case generation model.

[0079] The test case generation model to be trained can be a reinforcement learning model.

[0080] In this embodiment, the sample test message is used as input, the execution result of the test target is used as the state, the next test case is selected from the pre-prepared test library as the action, and a reward function is designed to maximize the cumulative reward value to iteratively train the model and obtain a trained test case generation model.

[0081] The aforementioned test case generation model processing method involves acquiring sample traffic data; this sample traffic data represents the data transmitted by the test target based on the target communication protocol; extracting protocol request messages and protocol response messages from the sample traffic data; obtaining the protocol state of the target communication protocol from a preset protocol state model based on the protocol request messages and protocol response messages; generating sample test messages based on the protocol state; and training the test case generation model to be trained using the sample test messages to obtain a trained test case generation model. As can be seen from the above, this application, based on the protocol state model, can accurately identify the protocol state of the target communication protocol. The sample test messages generated based on the protocol state can effectively simulate abnormal behaviors that may occur in the actual operation of the target communication protocol, improving the coverage of fuzz testing and thus improving fuzz testing efficiency. Using these sample test messages to train the test case generation model, the test cases generated by the trained test case generation model can explore the various states and behaviors of the target communication protocol more deeply, improving the coverage of fuzz testing and thus improving fuzz testing efficiency.

[0082] In one embodiment, the protocol state model includes the protocol states of the target communication protocol, the transition paths between the protocol states, and the transition conditions for each transition path. Based on protocol request messages and protocol response messages, the protocol state of the target communication protocol is obtained from the preset protocol state model, including:

[0083] Step S222: Determine the protocol state transition conditions based on the protocol request message and the protocol response message;

[0084] Step S224: Find the target transition condition that matches the protocol state transition condition from the protocol state model;

[0085] Step S226: Obtain the protocol status of the target communication protocol based on the migration path of the target migration conditions.

[0086] In this embodiment, for ease of describing the protocol state model, a quadruple N = {S, I, O, T} is defined, where S = {s0, s1, ..., Sn}, the S set is the set of states of the target communication protocol, where s0 is the initial state of the target communication protocol, and data communication begins from state s0. Furthermore, at any given time, the target communication protocol can only be in one state, denoted by si. I = {i1, i2, ..., in}, the I set is the set of protocol request messages, denoted by ii. O = {o1, o2, ..., on}, the O set is the set of protocol response messages, denoted by oi. T is the set of termination states.

[0087] After obtaining the protocol request message and protocol response message, protocol state transition conditions are constructed based on these messages. A set of transition conditions is constructed based on the set of protocol request messages and the set of protocol response messages in the protocol state model. The protocol state transition conditions are matched against each other to obtain the target transition condition. The target transition condition is used to transition the current state to the target state (the path between the current state and the target state, i.e., the transition path of the target transition condition), and the target state becomes the protocol state of the target communication protocol.

[0088] In one embodiment, a sample test message is generated based on the protocol state, including:

[0089] Step S232: Obtain from the protocol specification document of the target communication protocol the message types, message formats, and value ranges and constraints of each field in the message that the target communication protocol is allowed to send and receive in the protocol state.

[0090] Step S234: Generate a sample test message based on the message type, message format, and the value range and constraints of each field.

[0091] In this embodiment, the protocol specification document of the target communication protocol is parsed to obtain the various protocol states of the target communication protocol, as well as the allowed message types and formats to be sent and received in each protocol state, and the value range and constraints of each field in the message. For example, in the TCP protocol, there are multiple states such as connection establishment (SYN_SENT, SYN_RECEIVED, etc.), data transmission (ESTABLISHED), and connection release (FIN_WAIT_1, FIN_WAIT_2, etc.). In the HELO waiting state of the SMTP protocol, the server expects to receive a HELO command message sent by the client, and the format of this message should conform to the SMTP specification and contain valid domain name information.

[0092] Having obtained the message type, message format, and the value range and constraints of each field, you can modify the message type, message format, or individual fields of the message to obtain sample test messages. For example, you can make a certain field of the message exceed its corresponding value range.

[0093] In one embodiment, the test case generation model to be trained is a multi-armed slot machine model, where each arm of the multi-armed slot machine model represents a candidate test case; based on sample test messages, the test case generation model to be trained is trained to obtain a trained test case generation model, including:

[0094] Step S242: Input the sample test message into the multi-armed slot machine model, and select an arm from the multi-armed slot machine model as the predicted test case;

[0095] Step S244: Calculate the reward value for each arm based on the predicted test cases and the preset tag test cases; the tag test cases are the response messages obtained after the test target processes the test messages.

[0096] Step S246: Update the arm statistics of each arm according to the reward value to obtain the updated arm statistics.

[0097] Step S248: Based on the sample test message and the updated arm statistics, perform multiple rounds of cyclic training on the multi-armed slot machine model until the average reward value of each arm fluctuates within a preset range threshold, and obtain the trained multi-armed slot machine model.

[0098] The preset range threshold can be set as needed.

[0099] In this embodiment, the multi-armed slot machine model selects one of multiple candidate requests (i.e., the arms of the multi-armed slot machine) as the predicted subsequent request (i.e., the predicted test case) based on the input request (i.e., the sample test message). After the model provides the predicted request, it needs to wait for user feedback. If the model's predicted request matches the actual subsequent request (i.e., the preset labeled test case), the prediction is correct, and the reward value is increased by 1; if the prediction is incorrect, the reward value remains unchanged or is adjusted appropriately according to the specific situation.

[0100] The reward for each arm is calculated based on user feedback. For example, if a prediction request for a particular arm is correctly identified by the user, the reward value for that arm increases by 1. Then, the statistics for each arm are updated based on the calculated rewards, such as increasing the number of attempts and the total reward value for that arm. This statistical information will be used in subsequent decision-making processes to help the model better evaluate the performance of each arm.

[0101] The process of model prediction, user feedback, reward calculation, and arm statistics updates is repeated multiple times for training. In each training round, the model adjusts its prediction strategy based on the current arm statistics and learning experience to improve prediction accuracy. As the number of training rounds increases, the average reward for each arm gradually stabilizes, indicating that the model has learned the patterns and rules of protocol interactions and can predict subsequent requests relatively accurately.

[0102] Once the average reward value of each arm stabilizes, the model is considered to have completed training. At this point, for an input request, the model will select the request with the highest score from multiple candidate requests based on the learned knowledge and strategies, and return the probability and score of that request.

[0103] In one embodiment, inputting a test message into a multi-armed slot machine model includes:

[0104] Step S2422: Extract message features and perform word embedding processing on the sample test message to obtain the message feature vector;

[0105] Step S2424: Input the message feature vector into the multi-armed slot machine model.

[0106] In this embodiment, message feature information is extracted from sample test messages, and word embedding processing is performed on the message feature information to obtain a message feature vector. The message feature vector is then input into a multi-armed slot machine model. The message feature information includes, but is not limited to, message length, protocol type, the order of fields in the message, and payload content.

[0107] Referring to Figure 3, this application also provides a fuzz testing method for network protocols, the method comprising:

[0108] Step S310: Obtain traffic data generated by the test target during communication; the test target communicates based on the target communication protocol;

[0109] Step S320: Obtain initial test cases from traffic data; input the initial test cases into the trained test case generation model to obtain a test case sequence; the trained test case generation model is trained using any of the test case generation model processing methods described above.

[0110] Step S330: Perform a mutation operation on the test case sequence to obtain the target test case sequence;

[0111] Step S340: Perform fuzz testing on the target communication protocol according to the target test case sequence to obtain the fuzz test results.

[0112] In this embodiment, multiple message sequences can be constructed based on each data packet in the traffic data, and one of these message sequences can be selected as the initial test case. The initial test case is input into a trained test case generation model, which outputs a test case sequence. The model continues to generate test case sequences until the required length is met.

[0113] Use sequence mutation or parameter mutation methods to mutate the test case sequence to obtain the target test case sequence. Sequence mutation methods include, but are not limited to, message order mutation, message duplication mutation, and message insertion mutation. Parameter mutation methods include, but are not limited to, parameter value range mutation, parameter type mutation, and parameter missing mutation. The parameters are obtained based on the category query of the test case sequence.

[0114] In one embodiment, obtaining initial test cases from traffic data includes:

[0115] Step S322: Extract several data packets from the traffic data;

[0116] Step S324: Parse each data packet to obtain the IP address and port number;

[0117] Step S326: Reassemble the data packets according to the IP address and port number to obtain multiple message sequences;

[0118] Step S328: Use at least one message sequence from the multiple message sequences as the initial test case.

[0119] In this embodiment, the global header of the pcap file is parsed to obtain global information such as byte order and link type. Each data packet record is read sequentially, including timestamp, capture length, and raw data. Data packets are divided into different sessions based on source / destination IP address, port number, and protocol type (e.g., TCP / UDP).

[0120] Packets within the same session are sorted by timestamp to ensure the processing order conforms to the actual communication flow. Ethernet frame headers (MAC addresses, etc.) are stripped to obtain network layer data (such as IP packets). IP headers (source / destination IP addresses, TTL, etc.) are parsed to determine the transport layer protocol (TCP / UDP) and extract the payload. The application protocol (such as HTTP / 80) is identified based on the port number, and sequence numbers (SEQ), acknowledgment numbers (ACK), and flags (SYN / ACK / FIN) are parsed to determine the packet type (connection establishment, data transmission, connection termination).

[0121] Out-of-order packets are sorted using sequence numbers (SEQ) and window size to ensure data is reassembled in the order it was sent. Multiple TCP segments belonging to the same application layer (such as large file fragments) are merged into a complete message. Bidirectional communication is reassembled into a message sequence (such as HTTP request + response) using "Trace TCP Stream" features (such as Wireshark's Follow TCP Stream).

[0122] In one embodiment, fuzz testing is performed on the target communication protocol based on the target test case sequence to obtain fuzz test results, including:

[0123] Step S342: Send the target test case sequence to the test target and receive the response status information from the test target;

[0124] Step S344: Obtain the fuzz test result based on the response status information.

[0125] In this embodiment, a target test case sequence is sent to the test target. The test target processes the received target test case sequence according to its internal protocol logic and returns corresponding response status information. Analyzing the response status information yields the fuzzing results.

[0126] In one embodiment, after obtaining the fuzz test result based on the response status information, the method further includes:

[0127] Step S410: If the response status information triggers a change in the protocol status of the target communication protocol, determine that the target test case sequence is valid; or,

[0128] Step S420: If the response status information indicates improved code coverage of the test target, determine that the target test case sequence is valid; or,

[0129] Step S430: If the response status information indicates that the running status of the test target has terminated, determine that the target test case sequence is valid.

[0130] The response status information includes, but is not limited to, new protocol status, improved code coverage, and test target crash.

[0131] A new protocol state refers to the target communication protocol entering a state that has not occurred before.

[0132] Improved code coverage is an important metric for measuring the adequacy of tests; it reflects the extent to which the target program's code is executed during testing. Types of code coverage include statement coverage, branch coverage, and path coverage.

[0133] A test target crash occurs when the target program, upon receiving modified test cases, fails to continue running normally, leading to abnormal program termination. Crashes may manifest as unresponsiveness, error dialog boxes, or forced process termination.

[0134] In this embodiment, the emergence of a new protocol state indicates that the target test case sequence has triggered protocol processing logic in the target program that differs from the normal flow. Therefore, the target test case sequence can be considered a valid test case sequence.

[0135] Increased code coverage indicates that the target test case sequence can explore more different code areas in the target program, increasing the breadth and depth of testing. Therefore, the target test case sequence can be considered an effective test case sequence.

[0136] The target program crashing indicates that the variant test cases discovered a defect in the target program that could lead to system instability or security issues. Therefore, the target test case sequence can be considered a valid test case sequence.

[0137] To facilitate understanding of the above method implementation, as shown in Figure 4, it includes three stages: traffic collection, traffic analysis and feature extraction, and fuzzing. In the traffic collection stage, traffic collection tools such as Wireshark or tcpdump are used to capture traffic data generated by the target embedded software communication and save it as a pcap file; the pcap file is parsed and message sequences are extracted. In the traffic analysis and sequence feature extraction stage, the protocol states of the message sequences are identified, test packets are generated, and feature extraction and word embedding are performed on the test packets to obtain packet feature vectors. In the fuzzing stage, the reinforcement learning model is trained using the packet feature vectors to obtain a trained reinforcement learning model. Initial test cases are extracted from the traffic data and input into the trained reinforcement learning model to obtain a test case sequence. The test case sequence undergoes sequence mutation or parameter mutation, and the mutated test case sequence is sent to the target embedded software through a proxy. If the target embedded software triggers a new protocol state, improves code coverage, or triggers a new program crash during execution, the mutated test case sequence will be used as a sample for subsequent reinforcement learning model training. This allows for the exploration of all protocol states of the target embedded software and improves the accuracy of the reinforcement learning model.

[0138] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0139] Based on the same inventive concept, this application also provides a test case generation model processing apparatus for implementing the test case generation model processing method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more test case generation model processing apparatus embodiments provided below can be found in the limitations of the test case generation model processing method described above, and will not be repeated here.

[0140] In one exemplary embodiment, referring to Figure 5, a test case generation model processing apparatus is provided, including:

[0141] The sample traffic data acquisition module 510 is used to acquire sample traffic data; the sample traffic data is the data transmitted by the test target based on the target communication protocol.

[0142] The protocol status acquisition module 520 is used to extract protocol request messages and protocol response messages from sample traffic data; and to obtain the protocol status of the target communication protocol from a preset protocol status model based on the protocol request messages and protocol response messages.

[0143] The sample test message generation module 530 is used to generate sample test messages according to the protocol status.

[0144] The model training module 540 is used to train the test case generation model based on the sample test messages to obtain the trained test case generation model.

[0145] In one embodiment, the protocol state model includes the protocol states of the target communication protocol, the transition paths between the protocol states, and the transition conditions for each transition path. Based on protocol request messages and protocol response messages, the protocol state of the target communication protocol is obtained from a preset protocol state model, including:

[0146] Determine the protocol state transition conditions based on the protocol request message and the protocol response message;

[0147] Find the target transition condition that matches the protocol state transition condition from the protocol state model;

[0148] Based on the migration path according to the target migration conditions, obtain the protocol status of the target communication protocol.

[0149] In one embodiment, a sample test message is generated based on the protocol state, including:

[0150] From the protocol specification document of the target communication protocol, obtain the message types, message formats, and value ranges and constraints of each field in the message that the target communication protocol is allowed to send and receive in the protocol state.

[0151] Generate sample test messages based on message type, message format, and the value range and constraints of each field.

[0152] In one embodiment, the test case generation model to be trained is a multi-armed slot machine model, where each arm of the multi-armed slot machine model represents a candidate test case; the test case generation model to be trained is trained based on sample test messages to obtain a trained test case generation model, including:

[0153] Input the sample test message into the multi-armed slot machine model, and select one arm from the multi-armed slot machine model as the predicted test case;

[0154] Based on the predicted test cases and the preset tag test cases, calculate the reward value for each arm; the tag test cases are the response messages obtained after the test target processes the test messages;

[0155] Based on the reward value, update the arm statistics of each arm to obtain the updated arm statistics;

[0156] Based on the sample test messages and updated arm statistics, the multi-armed slot machine model is trained in multiple rounds until the average reward value of each arm fluctuates within a preset threshold range, thus obtaining a well-trained multi-armed slot machine model.

[0157] In one embodiment, inputting a test message into the multi-armed slot machine model includes:

[0158] The sample test messages are subjected to message feature extraction and word embedding processing to obtain message feature vectors;

[0159] Input the message feature vector into the multi-armed slot machine model.

[0160] Each module in the aforementioned test case generation model processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0161] In one exemplary embodiment, referring to Figure 6, a fuzz testing apparatus for a network protocol is provided, comprising:

[0162] The traffic data acquisition module 610 is used to acquire traffic data generated by the test target during communication; the test target communicates based on the target communication protocol.

[0163] The test case sequence acquisition module 620 is used to obtain initial test cases from traffic data; input the initial test cases into the trained test case generation model to obtain the test case sequence; the trained test case generation model is trained using any of the test case generation model processing methods mentioned above;

[0164] The target test case sequence acquisition module 630 is used to perform mutation operations on the test case sequence to obtain the target test case sequence.

[0165] The fuzz test result acquisition module 640 is used to perform fuzz testing on the target communication protocol based on the target test case sequence and obtain fuzz test results.

[0166] In one embodiment, initial test cases are obtained from traffic data, including:

[0167] Extract several data packets from the traffic data;

[0168] Parse each data packet to obtain the IP address and port number;

[0169] Based on the IP address and port number, the data packets are reassembled to obtain multiple message sequences;

[0170] Use at least one of the multiple message sequences as the initial test case.

[0171] In one embodiment, fuzz testing is performed on the target communication protocol based on the target test case sequence to obtain fuzz test results, including:

[0172] Send the target test case sequence to the test target and receive the response status information from the test target;

[0173] The fuzz test results are obtained based on the response status information.

[0174] In one embodiment, after obtaining the fuzz test result based on the response status information, the method further includes:

[0175] If the response status information triggers a change in the protocol status of the target communication protocol, the target test case sequence is determined to be valid; or,

[0176] If the response status information indicates improved code coverage of the test target, then the target test case sequence is deemed effective; or...

[0177] If the response status information indicates that the running state of the test target has terminated, the sequence of test cases for the target is deemed valid.

[0178] The modules in the aforementioned fuzzy testing device for network protocols can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0179] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram is shown in Figure 7. The computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used for exchanging information between the processor and external devices. The communication interface of the computer device is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a test case generation model processing method. The display unit of the computer device is used to form a visually visible image and may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0180] Those skilled in the art will understand that the structure shown in Figure 7 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. A specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements. In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the aforementioned test case generation model processing method. The steps of the test case generation model processing method here may be steps from one of the test case generation model processing methods in the various embodiments described above.

[0181] In one embodiment, a computer-readable storage medium is provided, storing a computer program that, when executed by a processor, causes the processor to perform the steps of the test case generation model processing method described above. The steps of the test case generation model processing method described here can be steps from one of the test case generation model processing methods in the various embodiments described above.

[0182] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, causes the processor to perform the steps of the test case generation model processing method described above. The steps of the test case generation model processing method described here may be steps from one of the test case generation model processing methods in the various embodiments described above.

[0183] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0184] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0185] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0186] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A test case generation model processing method, characterized in that, The method includes: acquiring sample traffic data; the sample traffic data being data transmitted by the test target based on a target communication protocol; extracting protocol request messages and protocol response messages from the sample traffic data; obtaining the protocol state of the target communication protocol from a preset protocol state model based on the protocol request messages and the protocol response messages; the protocol state model including each protocol state of the target communication protocol, the migration path between each protocol state, and the migration conditions of each migration path; determining the protocol state migration conditions based on the protocol request messages and the protocol response messages; finding a target migration condition that matches the protocol state migration conditions from the protocol state model; obtaining the protocol state of the target communication protocol based on the migration path of the target migration conditions; generating sample test messages based on the protocol states; and testing the target communication protocol based on the sample test messages. The test case generation model is trained to obtain a trained test case generation model. The test case generation model to be trained is a multi-armed slot machine model, where each arm of the multi-armed slot machine model represents a candidate test case. The sample test message is input into the multi-armed slot machine model, and an arm is selected from the multi-armed slot machine model as a predicted test case. Based on the predicted test case and preset labeled test cases, the reward value of each arm is calculated. The labeled test case is the response message obtained by the test target after processing the sample test message. Based on the reward value, the arm statistics of each arm are updated to obtain the updated arm statistics. Based on the sample test message and the updated arm statistics, the multi-armed slot machine model is trained in multiple rounds until the average reward value of each arm fluctuates within a preset threshold range, thus obtaining the trained multi-armed slot machine model.

2. The method according to claim 1, characterized in that, The step of generating a sample test message based on the protocol state includes: obtaining from the protocol specification document of the target communication protocol the message types, message formats, and value ranges and constraints of each field in the message that the target communication protocol is allowed to send and receive under the protocol state; and generating the sample test message based on the message types, the message formats, and value ranges and constraints of each field.

3. The method according to claim 1, characterized in that, The step of inputting the sample test message into the multi-armed slot machine model includes: performing message feature extraction and word embedding processing on the sample test message to obtain a message feature vector; and inputting the message feature vector into the multi-armed slot machine model.

4. A fuzz testing method for a network protocol, characterized in that, The method includes: acquiring traffic data generated by the test target during communication; the test target communicating based on a target communication protocol; acquiring initial test cases from the traffic data; inputting the initial test cases into a trained test case generation model to obtain a test case sequence; the trained test case generation model is trained using the test case generation model processing method as described in any one of claims 1 to 3; performing a mutation operation on the test case sequence to obtain a target test case sequence; and performing fuzz testing on the target communication protocol based on the target test case sequence to obtain fuzz test results.

5. The method according to claim 4, characterized in that, The step of obtaining initial test cases from the traffic data includes: extracting several data packets from the traffic data; parsing each data packet to obtain an IP address and a port number; reassembling each data packet according to the IP address and the port number to obtain multiple message sequences; and using at least one message sequence from the multiple message sequences as the initial test case.

6. The method according to claim 4, characterized in that, The step of performing fuzz testing on the target communication protocol based on the target test case sequence to obtain fuzz test results includes: sending the target test case sequence to the test target and receiving the response status information of the test target; and obtaining the fuzz test results based on the response status information.

7. The method according to claim 6, characterized in that, After obtaining the fuzz test result based on the response status information, the method further includes: determining that the target test case sequence is valid when the response status information triggers a change in the protocol status of the target communication protocol; or, determining that the target test case sequence is valid when the response status information indicates an increase in the code coverage of the test target; or, determining that the target test case sequence is valid when the response status information indicates that the running state of the test target has terminated.

8. A test case generation model processing device, characterized in that, The apparatus includes: a sample traffic data acquisition module for acquiring sample traffic data; the sample traffic data being data transmitted by the test target based on a target communication protocol; a protocol state acquisition module for extracting protocol request messages and protocol response messages from the sample traffic data; acquiring the protocol state of the target communication protocol from a preset protocol state model based on the protocol request messages and the protocol response messages; the protocol state model including each protocol state of the target communication protocol, the migration path between each protocol state, and the migration conditions of each migration path; determining the protocol state migration conditions based on the protocol request messages and the protocol response messages; finding a target migration condition that matches the protocol state migration conditions from the protocol state model; and acquiring the protocol state of the target communication protocol based on the migration path of the target migration conditions; a sample test message generation module for generating sample test messages based on the protocol state; and model training. The module is used to train a test case generation model to be trained based on the sample test messages, thereby obtaining a trained test case generation model. The test case generation model to be trained is a multi-armed slot machine model, where each arm of the multi-armed slot machine model represents a candidate test case. The sample test messages are input into the multi-armed slot machine model, and an arm is selected from the multi-armed slot machine model as a predicted test case. The reward value of each arm is calculated based on the predicted test case and a preset labeled test case. The labeled test case is the response message obtained by the test target after processing the sample test messages. The arm statistics of each arm are updated based on the reward values ​​to obtain updated arm statistics. The multi-armed slot machine model is trained in multiple rounds based on the sample test messages and the updated arm statistics until the average reward value of each arm fluctuates less than a preset threshold, thereby obtaining the trained multi-armed slot machine model.

9. A fuzz testing device for a network protocol, characterized in that, The apparatus includes: a traffic data acquisition module for acquiring traffic data generated by the test target during communication; the test target communicates based on a target communication protocol; a test case sequence acquisition module for acquiring initial test cases from the traffic data; inputting the initial test cases into a trained test case generation model to obtain a test case sequence; the trained test case generation model is trained using the test case generation model processing method as described in any one of claims 1 to 3; a target test case sequence acquisition module for performing a mutation operation on the test case sequence to obtain a target test case sequence; and a fuzz test result acquisition module for performing fuzz testing on the target communication protocol based on the target test case sequence to obtain a fuzz test result.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

Images