Vulnerability testing method and device, electronic equipment and program product

Abstract

The invention discloses a vulnerability testing method and device, electronic equipment and a program product, and relates to the technical field of artificial intelligence, and the testing method comprises the steps: extracting a plurality of code features of a target program, inputting all the code features into a graph neural network model, and obtaining an abnormal score value of each input point; for each input point, under the condition that the abnormal score value is greater than a preset score threshold value, generating an initial test case for the input point based on a genetic algorithm; calculating a variation parameter value of the initial test case based on the abnormal score value; and based on each variation parameter value, performing variation on each initial test case to obtain a test case set, and executing all test cases in the test case set to obtain a test data set. According to the method and the device, the technical problem that the detection accuracy of vulnerabilities is relatively low due to the fact that the test case cannot be accurately generated in related technologies is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to a vulnerability testing method and device, electronic equipment and program product. BACKGROUND

[0002] Currently, security fuzzing (a security testing method that triggers program exceptions (such as crashes, memory leaks) to detect vulnerabilities by mutating input data) mainly relies on the following methods: (1) random mutation: there is blindness in the mutation strategy, which will lead to a large number of invalid tests when facing complex program structures, and the mutation parameters are fixed and cannot adapt to the dynamic state changes of the program; (2) static rule library detection: based on the detection rules predefined based on known vulnerability characteristics, only the disclosed vulnerabilities can be identified, and unknown vulnerability patterns cannot be detected, resulting in a low vulnerability detection rate.

[0003] In view of the above problems, no effective solution has been proposed so far. SUMMARY

[0004] The embodiments of the present application provide a vulnerability testing method and device, electronic equipment and program product to at least solve the technical problem that test cases cannot be accurately generated in the related art, resulting in a low accuracy of vulnerability detection.

[0005] According to an aspect of an embodiment of the present application, a vulnerability testing method is provided, comprising: extracting a plurality of code features of a target program, and inputting all the code features into a graph neural network model to obtain an abnormal score value of each input point, wherein the input point is a function or a position where a code segment receives data in the target program; for each input point, if the abnormal score value is greater than a preset score threshold, generating an initial test case for the input point based on a genetic algorithm; calculating a mutation parameter value of the initial test case based on the abnormal score value; based on each mutation parameter value, mutating each initial test case to obtain a test case set, and executing all the test cases in the test case set to obtain a test data set, wherein the test data set at least includes triggered vulnerabilities.

[0006] Further, the step of extracting a plurality of code features of the target program comprises: based on a preset tool, extracting the calling relationship between all functions in the target program and the statement execution order within each function; based on all the calling relationships and all the statement execution orders, determining a control flow graph feature; extracting assignment statements and memory read-write functions in the target program, and based on all the assignment statements and all the memory read-write functions, determining a data transmission path, and based on the transmission path, determining a data flow graph feature; determining the functions in the target program in a preset function list as target functions, and based on the calling relationship between all the target functions, determining a subgraph feature.

[0007] Further, before inputting all code features into the graph neural network model to obtain the abnormal score value of each input point, further comprising: collecting a plurality of historical codes, and constructing a historical code feature set based on all historical codes; constructing an initial graph neural network model, wherein the network structure of the graph neural network model at least includes: a plurality of graph convolution layers; training the initial graph neural network model based on the historical code feature set to obtain the graph neural network model.

[0008] Further, the step of inputting all code features into the graph neural network model to obtain the abnormal score value of each input point comprises: inputting all code features into the graph neural network model to obtain node feature vectors, edge feature vectors and subgraph feature vectors; generating feature weights for the node feature vectors, edge feature vectors and subgraph feature vectors respectively; and calculating the abnormal score value based on the node feature vectors, edge feature vectors, subgraph feature vectors and all feature weights.

[0009] Further, after executing all test cases in the test case set to obtain the test data set, further comprising: adjusting the mutation parameter value based on the test data set using a reinforcement learning algorithm to obtain an adjusted mutation parameter value; and generating a sub-test case set based on the adjusted mutation parameter value.

[0010] Further, the step of adjusting the mutation parameter value based on the test data set using a reinforcement learning algorithm to obtain an adjusted mutation parameter value comprises: constructing a preset function based on a plurality of test parameters, and calculating a function value of the preset function based on the test data corresponding to the test parameters in the test data set; and in the case where the function value is greater than a preset function threshold, increasing the mutation parameter value, wherein the mutation parameter value at least includes: a mutation probability value and a mutation depth value; or in the case where the function value is less than the preset function threshold, reducing the mutation parameter value.

[0011] Further, after generating the sub-test case set based on the adjusted mutation parameter value, further comprising: executing all sub-test cases in the sub-test case set to obtain a sub-test data set, wherein the sub-test data in the sub-test data set at least includes: sub-test values of the plurality of test parameters, the sub-test values at least including: a preset code line number, a code exception number and a vulnerability pattern matching number, the preset code line number being a line number of code of the target program that is not executed in the historical test, and the vulnerability pattern matching number being a number of sub-vulnerabilities in the sub-test data matching the historical vulnerabilities; deleting the sub-test case corresponding to the sub-test data based on the preset code line number, the code exception number and the vulnerability pattern matching number to obtain a target test case set, wherein the target test data set is obtained by executing all target test cases in the target test case set; in a case where no vulnerabilities other than the vulnerabilities and the sub-vulnerabilities are detected for a plurality of times or a preset test duration is reached, stopping generating the sub-test case, and generating a vulnerability detection report based on the target test data set.

[0012] According to another aspect of the embodiments of the present application, a vulnerability testing device is also provided, comprising: an extraction unit configured to extract a plurality of code features of a target program and input all the code features into a graph neural network model to obtain an abnormal score value of each input point, wherein the input point is a function or a position where a code segment receives data in the target program; a generation unit configured to, for each input point, generate an initial test case for the input point based on a genetic algorithm in a case where the abnormal score value is greater than a preset score threshold; a calculation unit configured to calculate a mutation parameter value of the initial test case based on the abnormal score value; and an execution unit configured to mutate each initial test case based on each mutation parameter value to obtain a test case set, and execute all test cases in the test case set to obtain a test data set, wherein the test data set at least includes triggered vulnerabilities.

[0013] Further, the extraction unit comprises: a first extraction module configured to extract calling relationships between all functions in the target program and statement execution sequences within each function based on a preset tool; a first determination module configured to determine control flow graph features based on all the calling relationships and all the statement execution sequences; a second extraction module configured to extract assignment statements and memory read-write functions in the target program, and determine data transmission paths based on all the assignment statements and all the memory read-write functions, and determine data flow graph features based on the transmission paths; and a second determination module configured to determine functions in the target program in a preset function list as target functions, and determine subgraph features based on calling relationships between all the target functions.

[0014] Further, the vulnerability testing apparatus further comprises: a first acquisition module, configured to acquire a plurality of historical codes before inputting all code features into the graph neural network model to obtain the anomaly score value of each input point, and construct a historical code feature set based on all the historical codes; a first construction module, configured to construct an initial graph neural network model, wherein the network structure of the graph neural network model at least comprises a plurality of graph convolution layers; and a first training module, configured to train the initial graph neural network model based on the historical code feature set to obtain the graph neural network model.

[0015] Further, the extraction unit further comprises: a first input module, configured to input all code features into the graph neural network model to obtain the node feature vector, the edge feature vector and the subgraph feature vector; a first generation module, configured to generate feature weights for the node feature vector, the edge feature vector and the subgraph feature vector respectively; and a first calculation module, configured to calculate the anomaly score value based on the node feature vector, the edge feature vector, the subgraph feature vector and all the feature weights.

[0016] Further, the vulnerability testing apparatus further comprises: a first adjustment module, configured to adjust the mutation parameter value based on the test data set by using a reinforcement learning algorithm to obtain an adjusted mutation parameter value after executing all test cases in the test case set to obtain the test data set; and a second generation module, configured to generate a sub-test case set based on the adjusted mutation parameter value.

[0017] Further, the first adjustment module comprises: a first construction submodule, configured to construct a preset function based on a plurality of test parameters, and calculate a function value of the preset function based on test data corresponding to the test parameters in the test data set; a first increase submodule, configured to increase the mutation parameter value in a case where the function value is greater than a preset function threshold, wherein the mutation parameter value at least comprises a mutation probability value and a mutation depth value; and a first decrease submodule, configured to decrease the mutation parameter value in a case where the function value is less than the preset function threshold.

[0018] Further, the vulnerability testing apparatus further includes: a first execution module, configured to execute all sub test cases in the sub test case set based on the adjusted variation parameter value to obtain a sub test data set, wherein the sub test data in the sub test data set at least includes sub test values of the plurality of test parameters, and the sub test values at least include a preset code line number, a code exception number and a vulnerability pattern matching number, the preset code line number is a line number of code of the target program that is not executed in the historical test, and the vulnerability pattern matching number is a number of sub vulnerabilities in the sub test data matched with the historical vulnerabilities; a first deletion module, configured to delete the sub test case corresponding to the sub test data based on the preset code line number, the code exception number and the vulnerability pattern matching number to obtain a target test case set, wherein a target test data set is obtained by executing all target test cases in the target test case set; and a third generation module, configured to stop generating the sub test case in a case that no vulnerability other than the vulnerability and the sub vulnerability is detected for a plurality of times or a preset test duration is reached, and generate a vulnerability detection report based on the target test data set.

[0019] According to another aspect of the embodiments of the present application, a computer program product is also provided, including a nonvolatile computer readable storage medium, the nonvolatile computer readable storage medium storing a computer program, the computer program being executed by a processor to implement any of the vulnerability testing methods described above.

[0020] According to another aspect of the embodiments of the present application, an electronic device is also provided, including one or more processors and a memory, the memory being configured to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the vulnerability testing methods described above.

[0021] In the present application, a plurality of code features of a target program are extracted, and all code features are input to a graph neural network model to obtain an abnormal score value of each input point. For each input point, in a case that the abnormal score value is greater than a preset score threshold, an initial test case for the input point is generated based on a genetic algorithm, a variation parameter value of the initial test case is calculated based on the abnormal score value, each initial test case is varied based on each variation parameter value to obtain a test case set, and all test cases in the test case set are executed to obtain a test data set, thereby solving the technical problem in the related art that a test case cannot be accurately generated, resulting in a low detection accuracy of a vulnerability.

[0022] In the present application, the multi-level code features of the target program can be extracted by static analysis tools, including control flow graph, data flow graph and subgraph, then all the code features are input into the graph neural network model, the model uses multi-scale feature fusion technology to assign an abnormal score value to the key function or code segment position (i.e. input point) in the target program that receives external data, when the abnormal score value of any input point exceeds the preset score threshold, a set of initial test cases for high-risk input points can be intelligently generated by using genetic algorithm, and based on the abnormal score value, the genetic algorithm is guided and adjusted to adjust the mutation strength and direction of the initial test cases, thereby generating a test case set, and each test case is executed one by one, while monitoring and collecting the test data generated by each test, generating a test data set including triggered vulnerabilities, improving the accuracy and coverage of software security vulnerability detection. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings, which are included to provide a further understanding of the present application, form a part of the present application and illustrate the illustrative embodiments of the present application and together with the description, serve to explain the present application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing the vulnerability testing method is shown;

[0025] Figure 2 is a flowchart of the vulnerability testing method according to Embodiment 1 of the present application;

[0026] Figure 3 is an optional adaptive vulnerability detection system according to the present application;

[0027] Figure 4 is a schematic diagram of an optional vulnerability testing device according to the present application;

[0028] Figure 5 is a structure block diagram of an electronic device according to the present application. DETAILED DESCRIPTION

[0029] In order to enable persons skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative labor should belong to the scope of protection of the present application.

[0030] It should be noted that the terms "first", "second", and the like in the description and claims of the application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0031] It should be noted that the information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) collected and related to the present application are all authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards in relevant regions, necessary security measures are taken, public order and good customs are not violated, and appropriate operation portals are provided for users to choose authorization or refusal. For example, interfaces are provided between the system and related users or agencies, and before obtaining the relevant information, the interface needs to send a request to the aforementioned user or agency, and after receiving the consent information feedback from the aforementioned user or agency, the relevant information is obtained.

[0032] In the present application, by introducing a graph neural network (multi-scale feature fusion analysis is performed on the code structure, the mutation strategy of the genetic algorithm is guided, and the mutation parameters are dynamically adjusted according to the test feedback by using reinforcement learning, the problems of blind mutation, low efficiency and difficulty in detecting vulnerabilities in current fuzzy testing are solved, the coverage of high-risk areas is improved, the security testing is realized from random to intelligent, unknown vulnerabilities are mined through a self-learning mechanism, the demand for human intervention is reduced, and the automation and intelligence level of testing is improved.

[0033] The present application will be described in detail below in conjunction with various embodiments.

[0034] Embodiment 1

[0035] According to the embodiments of the present application, an embodiment of a vulnerability testing method is also provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0036] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a vulnerability testing method is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0037] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0038] The memory 104 can be used to store software programs of application software and modules, such as program instructions / data storage devices corresponding to the vulnerability testing method in the embodiments of the present application, and the processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implements the vulnerability testing method described above. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0039] The transmission device 106 is used to receive or send data via a network. Specific examples of the above-mentioned network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

[0040] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0041] Under the above operating environment, the present application provides a vulnerability testing method as shown in Figure 2 Figure 2 is a flowchart of the vulnerability testing method according to Embodiment 1 of the present application, as shown in Figure 2 The method comprises the following steps:

[0042] Step S201, a plurality of code features of a target program are extracted, and all the code features are input into a graph neural network model to obtain an anomaly score value of each input point, wherein the input point is a function or a position where a code segment receives data in the target program.

[0043] ​In the embodiments of the present application, the target program is a binary file or its code to be subjected to security vulnerability detection, and the code features are various information extracted from the target program, including but not limited to control flow graph data flow graph and various subgraph features, representing function call relationship, variable assignment path and specific code pattern. The plurality of code features of the target program can be extracted by a static analysis tool, and all the code features are input into a graph neural network model, which can output an abnormal score value of each input point (i.e. a position in the target program receiving external data, which can be a function parameter, a file reading point, a network data receiving point, etc.) by analyzing and understanding the structure and semantic features of the code.

[0044] In step S202, for each input point, if the abnormal score value is greater than a preset score threshold, an initial test case for the input point is generated based on a genetic algorithm.

[0045] In the embodiments of the present application, for each input point, if the abnormal score value is greater than a preset score threshold (such as 0.7, used to distinguish high-risk and low-risk input points), an initial test case capable of triggering a vulnerability can be randomly generated based on a genetic algorithm, such as generating an HTTP (HyperText Transfer Protocol, a network protocol) request containing an excessively long string to attempt to trigger a buffer overflow behavior in the strcpy() function.

[0046] In step S203, a mutation parameter value of the initial test case is calculated based on the abnormal score value.

[0047] In the embodiments of the present application, the fields of the high-risk input points can be subjected to directional mutation, and the mutation parameter value is positively correlated with the abnormal score value. Based on the abnormal score value Risk(vi), the mutation parameter value of the initial test case can be calculated, including mutation probability and depth (such as mutation probability P=0.2+0.6×Risk(vi) and mutation depth D=100+200×Risk(vi)). For the input points with higher scores, the calculated mutation probability is higher, and the mutation depth is deeper (such as 500 bytes), i.e. the genetic algorithm can mutate with a higher probability and a larger amount of data in order to discover more vulnerabilities related thereto. By generating test cases only for high-risk areas, the probability of the initial population triggering a crash can be improved.

[0048] In step S204, each initial test case is subjected to mutation based on each mutation parameter value to obtain a test case set, and all the test cases in the test case set are executed to obtain a test data set, wherein the test data set at least includes triggered vulnerabilities.

[0049] In the embodiment of the application, based on each variant parameter value, each initial test case is mutated to obtain a test case set, and then all test cases in the test case set are executed to obtain a test data set (such as crash information, the number of new code lines covered, triggered vulnerabilities, and the like). The test case set generated by the genetic algorithm mutation can detect the security of the program, and finally identify and record all triggered vulnerability behaviors.

[0050] In summary, the graph neural network model can analyze the code structure of the target program, extract key control flow graph, data flow graph and subgraph features, calculate the abnormal score value of each input point, and use the abnormal score value as the guidance basis for the mutation strategy. Then, the genetic algorithm generates initial test cases based on the high-risk input points determined by the graph neural network model, and dynamically calculates the mutation parameters, including mutation probability and depth, according to the risk score of each input point, to ensure efficient use of test resources. In the test execution phase, the genetic algorithm guided by the mutation parameters can perform deep mutation on the test cases to form a test case set and execute it to obtain a test data set, thereby solving the technical problem that the related art cannot accurately generate test cases, resulting in a low detection accuracy of vulnerabilities.

[0051] In order to accurately extract multiple code features of the target program, in the vulnerability testing method provided in Embodiment 1 of the present application, the calling relationship between all functions in the target program and the statement execution order within each function are extracted based on a preset tool; the control flow graph features are determined based on all calling relationships and all statement execution orders; the assignment statements and memory read-write functions in the target program are extracted, and the data transmission path is determined based on all assignment statements and all memory read-write functions, and the data flow graph features are determined based on the transmission path; the functions in the target program in the preset function list are determined as target functions, and the subgraph features are determined based on the calling relationship between all target functions.

[0052] In the embodiment of the present application, the calling relationship between all functions in the target program and the execution order of statements (such as conditional judgment and loop) in each function can be extracted based on a static analysis tool (i.e., a preset tool), so as to determine the control flow graph feature, and the assignment statement (i.e., the variable assignment relationship) in the target program and the memory read-write function (such as the strcpy() function, which can copy characters from a source buffer to another target buffer until the end-of-string marker is encountered) can be extracted, and based on all assignment statements and all memory read-write functions, the data transmission path can be determined, and based on the transmission path, the data flow graph feature can be determined. The function in the target program in the preset function list (including functions known to possibly cause security problems) is determined as a target function, and based on the calling relationship between all target functions, the subgraph feature is determined. By fusing the control flow graph feature, the data flow graph feature and the subgraph feature, compared with the limitation of analyzing only a single control flow graph feature, the accuracy of the risk score can be improved, the genetic algorithm is provided with the data basis of the high-risk area, and the blindness of random variation is avoided.

[0053] In order to accurately obtain the graph neural network model, in the vulnerability testing method provided in Embodiment 1 of the present application, a plurality of historical codes are collected, and based on all the historical codes, a historical code feature set is constructed; an initial graph neural network model is constructed, wherein the network structure of the graph neural network model at least includes a plurality of graph convolution layers; the initial graph neural network model is trained based on the historical code feature set, and the graph neural network model is obtained.

[0054] In the embodiment of the present application, a plurality of historical codes (i.e., historical codes known to have vulnerabilities) are collected, and the structural and behavioral features in the history code, such as the control flow graph feature, the data flow graph feature and the subgraph feature, are extracted to construct a historical code feature set, and at the same time, an initial graph neural network model including a plurality of graph convolution layers for processing graph structure data can be constructed, and then the initial graph neural network model can be trained based on the historical code feature set to obtain the graph neural network model.

[0055] In order to accurately calculate the anomaly score value, in the vulnerability testing method provided in Embodiment 1 of the present application, all code features are input into the graph neural network model to obtain node feature vectors, edge feature vectors and subgraph feature vectors; feature weights are generated for the node feature vectors, the edge feature vectors and the subgraph feature vectors respectively; and the anomaly score value is calculated based on the node feature vectors, the edge feature vectors, the subgraph feature vectors and all the feature weights.

[0056] In the embodiment of the present application, all the extracted code features are input into the graph neural network model, and node feature vectors, edge feature vectors and subgraph feature vectors are generated through graph convolution operation. Feature weights can be generated for the node feature vectors, edge feature vectors and subgraph feature vectors respectively. Based on the node feature vectors, edge feature vectors, subgraph feature vectors and all the feature weights, the abnormal score value (i.e. Risk(vi)=0.4×node feature vector+0.3×edge feature vector+0.3×subgraph feature vector) can be calculated through weighted summation.

[0057] In order to accurately generate the sub-test case set, in the vulnerability testing method provided in Embodiment 1 of the present application, the mutation parameter value is adjusted based on the test data set using a reinforcement learning algorithm to obtain an adjusted mutation parameter value; and the sub-test case set is generated based on the adjusted mutation parameter value.

[0058] In the embodiment of the present application, the mutation parameter value can be adjusted based on the test data set using a reinforcement learning algorithm to obtain an adjusted mutation parameter value. For example, the mutation yield can be calculated through a reinforcement learning model to dynamically optimize the mutation parameters of the genetic algorithm. Based on the adjusted mutation parameter value, the sub-test case set (i.e. a new group of test cases generated after the mutation operation on the test case set) can be generated again.

[0059] In order to accurately adjust the mutation parameter value to obtain an adjusted mutation parameter value, in the vulnerability testing method provided in Embodiment 1 of the present application, a preset function is constructed based on multiple test parameters, and the function value of the preset function is calculated based on the test data corresponding to the test parameters in the test data set; in the case where the function value is greater than the preset function threshold, the mutation parameter value is increased, wherein the mutation parameter value at least includes a mutation probability value and a mutation depth value; or in the case where the function value is less than the preset function threshold, the mutation parameter value is decreased.

[0060] In the embodiment of the present application, a preset function is constructed based on multiple test parameters (i.e. various parameters affecting the test effect and efficiency, including but not limited to new code line number parameter, code crash number parameter, vulnerability matching parameter, etc., to avoid single index deviation), for example, the yield function R=0.5×C+0.3×B+0.2×M, wherein C is the new code line number parameter, B is the code crash number parameter, and M is the vulnerability matching parameter. The function value of the preset function can be calculated based on the test data corresponding to the test parameters in the test data set, i.e. the number of new code lines covered, the number of crashes triggered and the number of times of matching known vulnerability patterns. In the case where the function value is greater than the preset function threshold (such as 15), the mutation probability value and the mutation depth value can be increased, and in the case where the function value is less than the preset function threshold, the mutation probability value and the mutation depth value can be decreased.

[0061] Optionally, the reward signal of reinforcement learning not only adjusts the genetic algorithm parameters, but also updates the feature weights of the graph neural network model online. For example, if the long string mutation triggers a crash, the weight of the long string feature in the graph neural network model can be increased.

[0062] Based on the adjusted mutation parameter value, the genetic algorithm can perform multi-strategy crossover mutation and selection on high-quality test cases (selected from all initial test cases). For example, two high-quality test cases (test case 1: “.. / .. / etc / passwd”, test case 2: “POST / login HTTP / 1.1\r\nContent-Length:1000000”) exchange their high-risk input point mutation fields (such as the URL path of test case 1 and the Content-Length field of test case 2), to generate child test cases, and the high-risk fields of the child test cases can be deeply mutated (such as inserting a super-long numerical value “1000000000” into the Content-Length field), and the mutation strategy is determined by the adjusted parameters of reinforcement learning, to obtain a set of sub-test cases. By constructing a preset function to quantify the test effect, calculating the function value based on the test data set, and dynamically adjusting the mutation parameter value accordingly, the mutation probability and depth are effectively managed, and the accuracy of mutation in high-risk areas is improved.

[0063] In order to accurately generate a vulnerability detection report, in the vulnerability testing method provided in Embodiment 1 of the present application, all sub-test cases in the set of sub-test cases are executed to obtain a set of sub-test data, wherein the sub-test data in the set of sub-test data at least includes: sub-test values of a plurality of test parameters, the sub-test values at least including: a preset code line number, a code exception number, and a vulnerability pattern matching number, the preset code line number being the line number of the code of the target program that has not been executed in the historical test, and the vulnerability pattern matching number being the number of sub-vulnerabilities in the sub-test data matching the historical vulnerabilities; based on the preset code line number, the code exception number, and the vulnerability pattern matching number, the sub-test data corresponding to the sub-test cases are deleted to obtain a set of target test cases, wherein all target test cases in the set of target test cases are executed to obtain a set of target test data; in the case of not detecting vulnerabilities other than the vulnerability and the sub-vulnerability for multiple times, or reaching a preset test duration, the generation of the sub-test cases is stopped, and a vulnerability detection report is generated based on the set of target test data.

[0064] In the embodiments of the present application, all sub-test cases in the sub-test case set are executed to obtain a sub-test data set, the sub-test cases triggering a crash, covering new code or matching a vulnerability pattern can be retained, invalid test cases are eliminated (i.e., based on a preset number of code lines, a number of code exceptions and a number of vulnerability pattern matches, the sub-test cases corresponding to the sub-test data are deleted), a target test case set can be obtained, all target test cases in the target test case set are executed to obtain a target test data set, when the test time reaches an upper limit (such as 24 hours) or no new vulnerability is detected for 10 generations in succession (i.e., in the case that no vulnerability other than a vulnerability and a sub-vulnerability is detected for multiple times or a preset test duration is reached), the iteration of generating sub-test cases is stopped, and a vulnerability detection report can be generated based on the target test data set.

[0065] Exemplarily, in the first generation test, the test case "ssh user@host -p 22" triggers a small memory leak (leaking 100 bytes), the probability of "long parameter variation" can be increased according to reinforcement learning (such as 1000 random characters after -p), in the second generation test, the sub-test case "ssh user@host -p 222222…2222" (1000 port parameters) triggers a large memory leak (leaking 10 KB), in the third generation test, the test case "ssh user@host -p 222222…2222 -oStrictHostKeyChecking no" (combining long parameters and dangerous options) is generated by cross variation, and triggers a memory leak chain (leaking 1 MB), if no larger leak is detected for 3 generations in succession, a vulnerability report (memory leak, the triggering test case is the third generation test case) is output.

[0066] Figure 3 According to the embodiments of the present application, an adaptive vulnerability detection system is provided, which comprises Figure 3As shown, the adaptive vulnerability fuzzing detection system based on AI (Artificial Intelligence) and genetic algorithm includes an input layer, a support technology layer, and a core processing layer. The core processing layer receives the target program (binary file / source code) of the input layer. The static analysis tool of the support technology layer extracts the code structure (code structure of the target program) and inputs the code structure into the multi-scale graph neural network model to obtain the dynamic risk score of the input point. Based on the dynamic risk score, the genetic algorithm in the support technology layer can prioritize mutation of high-risk areas to generate test cases, and the test cases can be executed. Then, the debugger in the support technology layer can monitor the program state, and the coverage data can be counted through the instrumentation tool to output multi-dimensional test feedback data. Then, the reinforcement learning algorithm in the support technology layer is used for parameter adjustment, that is, the reinforcement learning model is used to calculate the mutation return according to the feedback data, and the mutation parameters of the genetic algorithm are dynamically adjusted. The feature weights of the multi-scale graph neural network model can be updated online. The genetic algorithm is based on the latest risk score of the multi-scale graph neural network model (including the feature weights updated by the reinforcement learning) and the latest parameters of the reinforcement learning to cross, mutate and select high-quality test cases (exchange high-risk fields and deep mutation), continuously optimize the test strategy, realize adaptive mutation iteration, and finally output a vulnerability report.

[0067] The vulnerability test method provided by the embodiments of the present application can realize accurate and efficient intelligent detection of software security vulnerabilities by fusing a graph neural network and a genetic algorithm and assisting with a parameter dynamic adjustment mechanism of reinforcement learning. Specifically, a graph neural network model trained based on historical code features is first constructed, multi-scale feature fusion (node, edge, and subgraph features) is used to accurately evaluate high-risk areas of the code, and intelligent mutation guidance is provided for the genetic algorithm. Then, the genetic algorithm is used to generate initial test cases, and only high-scoring high-risk input points are mutated to improve resource utilization. Then, the reinforcement learning algorithm is used to adjust the mutation parameters, including mutation probability and depth, in real time according to the test feedback of the execution of the initial test cases, so as to optimize the test strategy and generate sub-test cases, thereby improving the vulnerability detection rate. At the same time, through an intelligent screening mechanism, inefficient sub-test cases are removed, and finally a target test case set is formed to improve the test efficiency. When a preset test duration is reached or no new vulnerability is found for consecutive multiple rounds, the test is automatically terminated and a comprehensive vulnerability detection report is generated, realizing intelligent and efficient software security testing and improving the vulnerability detection rate and the test efficiency.

[0068] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown.

[0069] Embodiment 2

[0070] The embodiment of the present application further provides a vulnerability testing device. It should be noted that the vulnerability testing device of the embodiment of the present application can be used to execute the vulnerability testing method provided by the embodiment of the present application. The vulnerability testing device provided by the embodiment of the present application is introduced as follows.

[0071] According to the embodiment of the present application, a device for implementing the vulnerability testing method described above is further provided. Figure 4 is a schematic diagram of an optional vulnerability testing device according to the embodiment of the present application, as shown in the figure, the vulnerability testing device can include an extraction unit 40, a generation unit 41, a calculation unit 42 and an execution unit 43. Figure 4

[0072] The extraction unit 40 is configured to extract a plurality of code features of a target program, and input all the code features to a graph neural network model to obtain an abnormal score value of each input point, wherein the input point is a function or a position where a code segment receives data in the target program.

[0073] The generation unit 41 is configured to, for each input point, generate an initial test case for the input point based on a genetic algorithm in a case where the abnormal score value is greater than a preset score threshold.

[0074] The calculation unit 42 is configured to calculate a mutation parameter value of the initial test case based on the abnormal score value.

[0075] The execution unit 43 is configured to mutate each initial test case based on each mutation parameter value to obtain a test case set, and execute all the test cases in the test case set to obtain a test data set, wherein the test data set at least includes a triggered vulnerability.

[0076] The vulnerability testing device provided by the embodiment of the present application can extract a plurality of code features of a target program through the extraction unit 40, and input all the code features to a graph neural network model to obtain an abnormal score value of each input point, can generate an initial test case for each input point based on a genetic algorithm in a case where the abnormal score value is greater than a preset score threshold through the generation unit 41, can calculate a mutation parameter value of the initial test case based on the abnormal score value through the calculation unit 42, and can mutate each initial test case based on each mutation parameter value to obtain a test case set, and execute all the test cases in the test case set to obtain a test data set through the execution unit 43.

[0077] ​Optionally, the extraction unit 40 comprises: a first extraction module configured to extract, based on a preset tool, calling relationships between all functions in the target program and execution sequences of statements within each function; a first determination module configured to determine a control flow graph feature based on all the calling relationships and all the execution sequences of the statements; a second extraction module configured to extract assignment statements and memory read-write functions in the target program, and determine a data transmission path based on all the assignment statements and all the memory read-write functions, and determine a data flow graph feature based on the transmission path; and a second determination module configured to determine functions in the target program in a preset function list as target functions, and determine a subgraph feature based on calling relationships between all the target functions.

[0078] Optionally, the vulnerability testing apparatus further comprises: a first acquisition module configured to acquire a plurality of historical codes and construct a historical code feature set based on all the historical codes, before inputting all the code features into the graph neural network model to obtain the abnormal score value of each input point; a first construction module configured to construct an initial graph neural network model, wherein the network structure of the graph neural network model at least comprises a plurality of graph convolution layers; and a first training module configured to train the initial graph neural network model based on the historical code feature set to obtain the graph neural network model.

[0079] Optionally, the extraction unit 40 further comprises: a first input module configured to input all the code features into the graph neural network model to obtain the node feature vector, the edge feature vector and the subgraph feature vector; a first generation module configured to generate feature weights for the node feature vector, the edge feature vector and the subgraph feature vector respectively; and a first calculation module configured to calculate the abnormal score value based on the node feature vector, the edge feature vector, the subgraph feature vector and all the feature weights.

[0080] Optionally, the vulnerability testing apparatus further comprises: a first adjustment module configured to adjust the mutation parameter value based on the test data set by using a reinforcement learning algorithm to obtain an adjusted mutation parameter value after executing all the test cases in the test case set to obtain the test data set; and a second generation module configured to generate a sub-test case set based on the adjusted mutation parameter value.

[0081] Optionally, the first adjustment module comprises: a first construction submodule configured to construct a preset function based on a plurality of test parameters, and calculate a function value of the preset function based on test data corresponding to the test parameters in the test data set; a first increase submodule configured to increase the mutation parameter value in a case where the function value is greater than a preset function threshold, wherein the mutation parameter value at least comprises a mutation probability value and a mutation depth value; and a first decrease submodule configured to decrease the mutation parameter value in a case where the function value is less than the preset function threshold.

[0082] Optionally, the vulnerability testing device further comprises: a first execution module, configured to execute all sub-test cases in the sub-test case set based on the adjusted mutation parameter value to obtain a sub-test data set, wherein the sub-test data in the sub-test data set at least includes sub-test values of the plurality of test parameters, and the sub-test values at least include a preset code line number, a code exception number and a vulnerability pattern matching number, the preset code line number is a line number of the code of the target program that is not executed in the historical test, and the vulnerability pattern matching number is a number of sub-vulnerabilities in the sub-test data matched with the historical vulnerabilities; a first deletion module, configured to delete the sub-test case corresponding to the sub-test data based on the preset code line number, the code exception number and the vulnerability pattern matching number to obtain a target test case set, wherein the target test data set is obtained by executing all target test cases in the target test case set; and a third generation module, configured to stop generating the sub-test case in a case that no vulnerabilities other than the vulnerability and the sub-vulnerability are detected for a plurality of times or a preset test duration is reached, and generate a vulnerability detection report based on the target test data set.

[0083] The vulnerability testing device described above can further comprise a processor and a memory, and the extraction unit 40, the generation unit 41, the calculation unit 42 and the execution unit 43 are all stored in the memory as program units, and the corresponding functions are realized by the processor executing the program units stored in the memory.

[0084] The processor described above comprises a core, and the core retrieves the corresponding program units from the memory. The core can be one or more, and each initial test case is mutated based on each mutation parameter value by adjusting the core parameters to obtain a test case set, and all test cases in the test case set are executed to obtain a test data set, wherein the test data set at least includes triggered vulnerabilities.

[0085] The memory described above can include a non-permanent memory in a computer readable medium, a random access memory (RAM) and / or a non-volatile memory such as a read-only memory (ROM) or a flash memory (flash RAM), and the memory includes at least one memory chip.

[0086] It should be noted that the extraction unit 40, the generation unit 41, the calculation unit 42, and the execution unit 43 correspond to steps S201 to S204 in Embodiment 1, and have the same instances and application scenarios as the corresponding steps, but are not limited to the disclosure of Embodiment 1. It should be noted that the above-mentioned units can be hardware components or software components stored in a memory (for example, the memory 104) and processed by one or more processors (for example, the processors 102a, 102b,..., 102n), or can be a part of the device and run in the computer terminal 10 provided in Embodiment 1.

[0087] Embodiment 3

[0088] Embodiments of the present application can provide a computer terminal, which can be any computer terminal device in a computer terminal group. Alternatively, in the present embodiment, the computer terminal can also be replaced by a mobile terminal or an electronic device or the like terminal device.

[0089] Alternatively, in the present embodiment, the computer terminal can be located in at least one network device of a plurality of network devices of a computer network.

[0090] In the present embodiment, the computer terminal can execute program codes of the following steps in the vulnerability testing method: extracting a plurality of code features of a target program, and inputting all the code features into a graph neural network model to obtain an anomaly score value of each input point, wherein the input point is a function or a position where a code segment receives data in the target program; for each input point, if the anomaly score value is greater than a preset score threshold, generating an initial test case for the input point based on a genetic algorithm; calculating a mutation parameter value of the initial test case based on the anomaly score value; based on each mutation parameter value, mutating each initial test case to obtain a test case set, and executing all the test cases in the test case set to obtain a test data set, wherein the test data set at least includes triggered vulnerabilities.

[0091] Alternatively, the computer terminal can execute program codes of the following steps in the vulnerability testing method: based on a preset tool, extracting calling relationships between all functions in a target program and statement execution sequences within each function; based on all the calling relationships and all the statement execution sequences, determining control flow graph features; extracting assignment statements and memory read-write functions in the target program, and based on all the assignment statements and all the memory read-write functions, determining data transmission paths, and based on the transmission paths, determining data flow graph features; determining functions in the target program in a preset function list as target functions, and based on calling relationships between all the target functions, determining subgraph features.

[0092] Optionally, the computer terminal can execute program codes of the following steps in the vulnerability testing method: collecting a plurality of historical codes, and constructing a historical code feature set based on all the historical codes; constructing an initial graph neural network model, wherein the network structure of the graph neural network model at least comprises a plurality of graph convolution layers; training the initial graph neural network model based on the historical code feature set to obtain the graph neural network model.

[0093] Optionally, the computer terminal can execute program codes of the following steps in the vulnerability testing method: inputting all the code features into the graph neural network model to obtain node feature vectors, edge feature vectors, and subgraph feature vectors; generating feature weights for the node feature vectors, the edge feature vectors, and the subgraph feature vectors respectively; and calculating an abnormal score value based on the node feature vectors, the edge feature vectors, the subgraph feature vectors, and all the feature weights.

[0094] Optionally, the computer terminal can execute program codes of the following steps in the vulnerability testing method: adjusting the mutation parameter value based on the test data set using a reinforcement learning algorithm to obtain an adjusted mutation parameter value; and generating a sub-test case set based on the adjusted mutation parameter value.

[0095] Optionally, the computer terminal can execute program codes of the following steps in the vulnerability testing method: constructing a preset function based on a plurality of test parameters, and calculating a function value of the preset function based on test data corresponding to the test parameters in the test data set; in a case where the function value is greater than a preset function threshold, increasing the mutation parameter value, wherein the mutation parameter value at least includes a mutation probability value and a mutation depth value; or in a case where the function value is less than the preset function threshold, decreasing the mutation parameter value.

[0096] Optionally, the computer terminal can execute program codes of the following steps in the vulnerability testing method: executing all the sub-test cases in the sub-test case set to obtain a sub-test data set, wherein the sub-test data in the sub-test data set at least includes sub-test values of a plurality of test parameters, the sub-test values at least include a preset code line number, a code exception number, and a vulnerability pattern matching number, the preset code line number is a line number of code of the target program that has not been executed in historical testing, and the vulnerability pattern matching number is a number of sub-vulnerabilities in the sub-test data matching historical vulnerabilities; deleting the sub-test case corresponding to the sub-test data based on the preset code line number, the code exception number, and the vulnerability pattern matching number to obtain a target test case set, wherein a target test data set is obtained by executing all the target test cases in the target test case set; in a case where no vulnerabilities other than the vulnerabilities and the sub-vulnerabilities are detected for a plurality of times or a preset test duration is reached, stopping the generation of the sub-test case, and generating a vulnerability detection report based on the target test data set.

[0097] Optionally, Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. As shown in the figure, the electronic device can include one or more (only one is shown in the figure) processors 502, a memory 504, a storage controller, and a peripheral interface, wherein the peripheral interface is connected with a radio frequency module, an audio module, and a display. Figure 5 Figure 5 The memory can be used to store software programs and modules, such as program instructions / modules corresponding to the vulnerability testing method and device in the embodiments of the present application. The processor executes various function applications and data processing by running the software programs and modules stored in the memory, that is, implements the vulnerability testing method described above. The memory can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory can further include a memory remotely arranged with respect to the processor, which can be connected to the terminal through a network. Examples of the network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0098] The processor can call information and application programs stored in the memory through the transmission device to execute the steps in the vulnerability testing method described above.

[0099] By using the embodiments of the present application, a vulnerability testing scheme is provided. Through the deep learning framework of fusing the graph neural network and the genetic algorithm, the high-risk code region in the software can be intelligently identified and preferentially mutated, the vulnerability detection efficiency is improved, and the proportion of invalid testing is reduced, thereby solving the technical problem that in the related art, the test case cannot be accurately generated, resulting in a low detection accuracy of the vulnerability.

[0100] Those skilled in the art can understand that The structure shown in the figure is only schematic, and the electronic device can also be a terminal device such as a smart phone, a tablet computer, a palm computer, and a mobile Internet device (MID).

[0101] It does not limit the structure of the electronic device described above. For example, the electronic device can further include more or fewer components (such as a network interface, a display device, etc.) than those shown in the figure, or have a different configuration from that shown in the figure. Figure 5 Figure 5 Figure 5 Figure 5

[0102] ​​​​Those skilled in the art can understand that all or part of the steps of various methods in the above embodiments can be completed by instructing the terminal device related hardware through programs, and the programs can be stored in a computer readable storage medium, which can include a flash disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0103] Embodiment 4

[0104] The embodiments of the present application further provide a storage medium. Optionally, in the embodiments, the storage medium can be used to save the program code executed by the vulnerability testing method provided in the embodiment 1.

[0105] Optionally, in the embodiments, the storage medium can be located in any one of the computer terminals in the computer terminal group in the computer network, or in any one of the mobile terminals in the mobile terminal group.

[0106] The present application further provides a computer program product, which, when executed on a data processing device, is adapted to execute the steps of the vulnerability testing method.

[0107] The above embodiment numbers of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

[0108] In the above embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0109] In several embodiments provided by the present application, it should be understood that the disclosed technology can be implemented in other ways. Of course, the unit embodiments described above are only schematic, and the division of units is only a logical function division, and there can be another division way in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, units or modules, and can be electrical or other forms.

[0110] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiments.

[0111] In addition, each of the functional units in the various embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0112] When the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application, essentially or in part, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various other media that can store program codes.

[0113] The above is only the preferred embodiment of the present application, and it should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A vulnerability testing method, characterized in that, include: Extract multiple code features from the target program and input all the code features into a graph neural network model to obtain an anomaly score value for each input point, wherein the input point is a function or the location where a code segment receives data in the target program; For each input point, if the abnormal score value is greater than a preset score threshold, an initial test case is generated for the input point based on a genetic algorithm. Based on the anomaly score, calculate the variation parameter value of the initial test case; Based on each of the mutation parameter values, each of the initial test cases is mutated to obtain a test case set, and all test cases in the test case set are executed to obtain a test data set, wherein the test data set includes at least: the triggered vulnerability.

2. The vulnerability testing method according to claim 1, characterized in that, The steps for extracting multiple code features from a target program include: Based on a preset tool, extract the call relationships between all functions in the target program and the execution order of statements within each function; Based on all the aforementioned call relationships and the execution order of all the aforementioned statements, the control flow graph characteristics are determined; Extract assignment statements and memory read / write functions from the target program, and determine the data transmission path based on all the assignment statements and all the memory read / write functions, and determine the data flow graph features based on the transmission path; The functions in the target program in the preset function list are identified as target functions, and the subgraph features are determined based on the calling relationships between all the target functions.

3. The vulnerability testing method according to claim 1, characterized in that, Before inputting all the aforementioned code features into the graph neural network model to obtain the anomaly score value for each input point, the process also includes: Collect multiple historical codes and construct a set of historical code features based on all of them; Construct an initial graph neural network model, wherein the network structure of the graph neural network model includes at least: multiple graph convolutional layers; Based on the historical code feature set, the initial graph neural network model is trained to obtain the graph neural network model.

4. The vulnerability testing method according to claim 1, characterized in that, The steps of inputting all the code features into a graph neural network model to obtain the anomaly score value for each input point include: All the code features are input into the graph neural network model to obtain node feature vectors, edge feature vectors, and subgraph feature vectors. Generate feature weights for the node feature vector, the edge feature vector, and the subgraph feature vector, respectively; The anomaly score is calculated based on the node feature vector, the edge feature vector, the subgraph feature vector, and all the feature weights.

5. The vulnerability testing method according to claim 1, characterized in that, After executing all test cases in the test case set to obtain the test data set, the process also includes: Based on the test dataset, a reinforcement learning algorithm is used to adjust the mutation parameter values ​​to obtain the adjusted mutation parameter values. Based on the adjusted mutation parameter values, a set of sub-test cases is generated.

6. The vulnerability testing method according to claim 5, characterized in that, Based on the test dataset, the step of adjusting the mutation parameter values ​​using a reinforcement learning algorithm to obtain the adjusted mutation parameter values ​​includes: Based on multiple test parameters, a preset function is constructed, and based on the test data corresponding to the test parameters in the test data set, the function value of the preset function is calculated; If the function value is greater than a preset function threshold, the mutation parameter value is increased, wherein the mutation parameter value includes at least: a mutation probability value and a mutation depth value; or, If the function value is less than the preset function threshold, the value of the mutation parameter is reduced.

7. The vulnerability testing method according to claim 5, characterized in that, After generating a set of sub-test cases based on the adjusted mutation parameter values, the process also includes: Execute all sub-test cases in the sub-test case set to obtain a sub-test data set. The sub-test data in the sub-test data set includes at least: sub-test values ​​of multiple test parameters. The sub-test values ​​include at least: a preset number of lines of code, the number of code exceptions, and the number of vulnerability pattern matches. The preset number of lines of code is the number of lines of code in the target program that have not been executed in historical tests. The number of vulnerability pattern matches is the number of sub-vulnerabilities in the sub-test data that match historical vulnerabilities. Based on the preset number of lines of code, the number of code exceptions, and the number of vulnerability pattern matches, the sub-test cases corresponding to the sub-test data are deleted to obtain a target test case set. The target test data set is obtained by executing all target test cases in the target test case set. If no vulnerabilities other than the stated vulnerability and its sub-vulnerabilities are detected multiple times, or if the preset test duration is reached, the generation of the sub-test cases will be stopped, and a vulnerability detection report will be generated based on the target test data set.

8. A vulnerability testing device, characterized in that, include: An extraction unit is used to extract multiple code features of the target program and input all the code features into a graph neural network model to obtain an anomaly score value for each input point, wherein the input point is a function or the location where a code segment receives data in the target program; The generation unit is used to generate initial test cases for each input point based on a genetic algorithm when the abnormal score value is greater than a preset score threshold. The calculation unit is used to calculate the variation parameter value of the initial test case based on the anomaly score value; An execution unit is configured to mutate each initial test case based on each mutation parameter value to obtain a test case set, and execute all test cases in the test case set to obtain a test data set, wherein the test data set includes at least: triggered vulnerabilities.

9. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements a testing method for the vulnerability described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the vulnerability testing method according to any one of claims 1 to 7.

Images