Automatic test method for HTTP (Hyper Text Transport Protocol) interface oriented to service sequence
By combining Markov decision processes and deep reinforcement learning with a business semantic state space and reward function, end-to-end HTTP interface test cases are generated, solving the problems of high maintenance cost and low efficiency of test cases in existing technologies, and realizing efficient and secure interface testing.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ZHENGZHOU HENGDA INTELLIGENT CONTROL TECHNOLOGY CO LTD
- Filing Date
- 2025-12-15
- Publication Date
- 2026-04-17
AI Technical Summary
Existing HTTP interface testing methods rely on manually designed test cases, which are costly to maintain and difficult to exhaust all possible parameter combinations and state sequences. Furthermore, existing automated testing methods such as fuzz testing and reinforcement learning have limitations in efficiency and security, and cannot effectively explore unknown states of interfaces and business logic vulnerabilities.
Test cases are generated by an agent based on a partially observable Markov decision process. Combined with a business-semantic state space and reward function, and with expert guidance and feedback, an HTTP simulation environment is constructed, and end-to-end test cases are generated using deep reinforcement learning.
The generated test cases can autonomously explore the unknown states and business logic vulnerabilities of the interface, improve testing efficiency and coverage, ensure the security and efficiency of the training process, and the generated test cases conform to real user behavior, verifying the correctness of complex business across multiple interfaces.
Smart Images
Figure CN121880175A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of test automation technology, specifically relating to an automated testing method for HTTP interfaces oriented towards business sequences. Background Technology
[0002] With the widespread adoption of internet technology and microservice architecture, modern software systems, especially web applications and backend services, commonly communicate and exchange data through numerous HTTP (HyperText Transfer Protocol) interfaces. Ensuring the correctness, stability, security, and high performance of these interfaces has become a crucial part of the software development lifecycle.
[0003] Currently, quality assurance for HTTP interfaces primarily relies on two main categories of technologies: 1. Static Test Case Automation: This is currently standard industry practice. Test engineers pre-write detailed test cases based on the interface documentation and execute them using frameworks such as Postman Collections, JUnit, Selenium, or code-based testing frameworks (such as REST Assured). These test cases cover normal business logic (Happy Path) and some common exceptions. However, this approach has significant bottlenecks: Highly dependent on manual design: The comprehensiveness of the test depends on the tester's experience and understanding of the system, making it difficult to exhaust all possible parameter combinations, state sequences, and edge cases.
[0004] High maintenance costs: When the interface changes (such as adding new parameters or modifying the return structure), a large number of existing test cases need to be updated synchronously, otherwise they will become invalid, which is a heavy burden in agile development with rapid iteration.
[0005] Insufficient exploration capabilities: Unable to independently discover unknown interface relationships, undocumented behaviors, or deep-seated business logic vulnerabilities and security vulnerabilities (such as unauthorized access or inconsistent states).
[0006] 2. Automated Fuzz Testing: To improve automation, fuzz testing techniques for APIs have emerged. This method typically involves randomly constructing HTTP requests (e.g., invalid parameters, malformed JSON bodies, excessively long strings, etc.) and sending them to the target interface in order to trigger unhandled exceptions or crashes on the server side. While fuzz testing is effective in discovering certain low-level program defects (such as buffer overflows), its application to HTTP interface testing has fundamental limitations: Lack of state awareness: Most fuzz tests are stateless, treating each request as an independent entity. They cannot understand and maintain a valid session state (e.g., requiring login to obtain a token before accessing user information), resulting in a large number of requests being rejected for reasons such as unauthorized access, leading to inefficient testing.
[0007] Blindness and weak feedback: Its test vector generation is usually random, lacking understanding and guidance of system behavior. It can only determine whether defects have been found through very limited feedback such as HTTP status codes (such as 500) or response time, and cannot verify the correctness of complex business logic.
[0008] In recent years, reinforcement learning, as an artificial intelligence technology capable of autonomously learning sequential decision-making strategies through interaction with the environment, has achieved great success in fields such as games and robot control. Its core mechanisms of "trial and error exploration" and "reward-based optimization" are theoretically very suitable for solving sequence dependency and autonomous exploration problems in HTTP interface testing. However, directly applying reinforcement learning to real-world HTTP interface testing environments faces significant challenges: Security Risks: Reinforcement learning agents may engage in a large amount of random, invalid, or even harmful exploration during the initial training phase. For example, it might frequently write junk data to the database, repeatedly call payment interfaces with idempotency risks, or trigger critical alerts in production environments, which is unacceptable in real-world projects.
[0009] Low training efficiency: The response speed of real backend services is limited by network, computing resources and database performance, resulting in high response latency. This makes data collection and strategy iteration extremely slow, and the training cycle may take several weeks or even months, which is not feasible.
[0010] Reproducing test scenarios is difficult: It is difficult to stably and repeatably simulate specific abnormal scenarios (such as service delays, network interruptions, specific data states, etc.) in a real environment, which is exactly what comprehensive testing is necessary.
[0011] Current HTTP API testing heavily relies on pre-written test cases, which require manual design based on API documentation. This approach fails to adaptively explore unknown states, exception boundaries, and potential business logic vulnerabilities within the API. This is particularly problematic in microservice architectures, where test case maintenance is extremely costly and coverage is difficult to guarantee. While automated testing techniques like fuzzing exist, they are typically random and stateless, failing to understand the business logic relationships between APIs. For example, testing the "place an order" API requires first calling the "login" and "add to cart" APIs; fuzzing struggles to maintain this stateful session flow.
[0012] Some scholars have proposed a test case generation method based on reinforcement learning, but this method has the following problems: 1. Lack of domain knowledge guidance leads to low training efficiency: This approach relies entirely on the RL agent's "blind exploration" from scratch. It fails to leverage the testers' existing expert experience regarding the system's business logic (e.g., "the order placement interface must be called after login," "the payment amount cannot be negative"). This "search-heavy, guidance-light" approach results in slow convergence, or even failure to converge, in complex business systems, leading to poor practicality.
[0013] 2. Low Business Value of Generated Test Cases: Because its reward function is designed as "interface-oriented" or "error-oriented" rather than "business-oriented," the optimal strategies and test case sequences it generates are often bizarre combinations designed to boost scores and do not reflect real user behavior. While these test cases may uncover some low-level program errors, they cannot effectively verify the correctness and stability of core business logic across multiple interfaces, which is precisely the most critical and core value of software testing.
[0014] Furthermore, both traditional automated testing and the aforementioned pure reinforcement learning testing solutions face a common underlying challenge: the lack of a high-fidelity, controllable, and reproducible simulation training environment. Directly conducting testing on real systems not only poses security risks such as data corruption and service interruption, but its slow response time also severely restricts training efficiency. Therefore, building an HTTP interface simulation platform capable of accurately simulating the state transitions and business logic of real backend services has become a key technical prerequisite for achieving efficient and secure reinforcement learning training, especially for generating valuable business test cases. However, existing mock services are typically too static and simplistic to meet this requirement.
[0015] Therefore, there is an urgent need in this field for a technical solution that can overcome the above-mentioned shortcomings, fully utilize the autonomous exploration capabilities of reinforcement learning, and ensure that the training process is safe, efficient, and controllable. Summary of the Invention
[0016] To address the shortcomings and problems of traditional automated testing, this invention provides an automated testing method for HTTP interfaces oriented towards business sequences.
[0017] This invention provides an automated testing method for HTTP interfaces oriented towards business sequences, comprising the following steps: Step 1: Simulate the decision-making process of the agent to generate test cases based on a partially observable Markov decision process. This process includes constructing the state space, action space, state transition probabilities, reward function, and discount factor. Step 2: Build an HTTP simulation environment; Step 3: Discretize the data and construct a dataset; Step 4: Using the experience replay mechanism, N sets of data in the form of (s,a,r) tuples are taken from the dataset each time, and the data is used for network training. Step 5: After the model training is completed, use the trained model to automatically generate test cases to achieve automated testing at the business level.
[0018] The aforementioned automated testing method for HTTP interfaces oriented towards business sequences, wherein the state space is a state space containing state attributes, including session features C, recent request-response features D, historical trajectory features E, and business target progress features F; the state space is represented as a quadruple S=(C,D,E,F).
[0019] The aforementioned automated testing method for HTTP interfaces oriented towards business sequences defines the action space as the range of available actions that the agent can execute, including HTTP methods, interface paths, and request parameter values.
[0020] In the aforementioned automated testing method for HTTP interfaces oriented towards business sequences, the state transition probability is the probability that state s changes according to the state transition probability after performing an action 'a'. , .
[0021] The above-described automated testing method for HTTP interfaces oriented towards business sequences, in step one, constructs a reward function based on comprehensive environmental indicators and additional rewards from expert guidance and feedback. These comprehensive indicators include business progress status, interface coverage status, and system health status. The reward function is calculated using the following formula:
[0022] In the formula: This represents the reward for generating different feature terms. This represents the weight transpose of various rewards within the environment, used to balance the importance of different features; This represents an additional reward for expert guidance and feedback, helping the agent train faster.
[0023] The aforementioned automated testing method for HTTP interfaces oriented towards business sequences includes a business progress reward corresponding to the business progress status. for:
[0024] In the formula: It is an indicator function that takes the value 1 when the agent completes the i-th sub-objective in this step, and 0 otherwise; It is the reward score for completing the corresponding sub-goal, which is set by experts based on the importance of the sub-goal in the business process.
[0025] The aforementioned automated testing method for HTTP interfaces oriented towards business sequences includes an interface coverage reward corresponding to the interface coverage status. for:
[0026] In the formula: κ is an indicator function that takes the value 1 when the agent accesses a new interface path that has not been accessed in this round of training, and 0 otherwise; κ is a fixed reward value for discovering a new interface.
[0027] The aforementioned automated testing method for HTTP interfaces oriented towards business sequences includes a system health reward corresponding to the system health status. for:
[0028] In the formula: and It is an indicator function that is triggered when the response status code is a client error or a server error; It is an indicator function that is triggered when the agent's behavior violates the business rules defined by the expert; These are the corresponding penalty weights, all of which are negative.
[0029] The above-mentioned automated testing method for HTTP interfaces oriented towards business sequences includes the following additional reward for expert guidance and feedback:
[0030] In the formula: β is an indicator function that takes the value 1 when the agent’s current state-action pair (s, a) is judged to be of high value by a predefined expert rule base; β is the score of the extra reward.
[0031] The above-described automated testing method for HTTP interfaces oriented towards business sequences, wherein the discount factor ranges from [value missing]. The larger the value, the more the agent values future rewards.
[0032] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention combines machine intelligence represented by reinforcement learning with transfer learning represented by expert experience. During the agent training process, it utilizes expert experience to generate test cases centered on business functions, thereby improving the quality of agent training data and accelerating the agent's training speed. Simultaneously, this invention guides the agent to prioritize learning how to complete complete and meaningful business processes (such as user shopping and order processing) through a business-semantic state space and a reward function centered on business progress. The generated test cases are end-to-end integration test scenarios, which can be directly used to verify the correctness of complex business processes across multiple interfaces, thus increasing their testing value. Attached Figure Description
[0033] Figure 1 This is a flowchart of the training process for the testing method of this invention; Figure 2 This is a flowchart illustrating the algorithm execution of the testing method of the present invention. Detailed Implementation
[0034] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.
[0035] Example 1: This example provides an automated testing method for HTTP interfaces oriented towards business sequences. The method includes the following steps: Step 1, Environment Modeling: Based on a partially observable Markov decision process, simulate the decision-making process of the agent in generating test cases. This process consists of a state space, an action space, state transition probabilities, a reward function, and a discount factor.
[0036] Step 2: Construct a state space S containing state attributes. The state space describes the problem scenario and is a finite set of states. The state attributes include session features C, recent request / response features D, historical trajectory features E, and business target progress features F. The state space is represented as a quadruple S = (C, D, E, F). Then, at time t, the current environment state is... ,in, .
[0037] To avoid the impact of data from different dimensions on neural network training, this patent uses a formula.
[0038] Normalize the data.
[0039] Step 3: Construct the action space. The action space describes the range of available actions that the agent can perform. In this embodiment, the wind turbine is abstracted as an agent, and the HTTP method, interface path, and request parameter values are used as the action space that the agent can execute.
[0040] Step 4: State transition probability (status transition matrix). When executing a certain... After the action, the state According to the state transition probability, it becomes ;in Mathematically described The state transition probability is an inherent state transition mechanism of the environment and is independent of external information changes. This embodiment adopts a fixed state transition mechanism, that is, in the state... Next action Then, the state transitions to The probability is 1.
[0041] Step 5: Construct the reward function. The reward is used to evaluate the agent's actions and guide the agent to choose more appropriate actions. In this embodiment, a comprehensive environmental index is selected as the reward function, which includes business progress status, interface coverage status, and system health status. The reward function calculation formula is as follows:
[0042] In the formula: This represents the reward for generating different feature terms. This represents the weight transpose of various rewards within the environment, used to balance the importance of different features. This indicates that expert guidance and feedback will be rewarded with additional incentives to help the agent train faster.
[0043] As a feasible example, this embodiment sets a weight vector for business progress rewards, interface coverage rewards, and system health rewards. The values are [0.5, 0.3, 0.2], emphasizing the completion of business processes as the primary objective. The calculation methods are as follows: (1) Business progress reward Business progress rewards guide agents to complete meaningful end-to-end business processes and are the core of the reward function. The formula for business progress rewards is as follows:
[0044] In the formula: It is an indicator function that takes the value 1 when the agent completes the i-th sub-goal in this step, and 0 otherwise. It is the reward score for completing the corresponding sub-goal, which is set by experts based on the importance of the sub-goal in the business process.
[0045] For example, for the "user shopping" business, the following settings can be configured: Login successful: ; Successfully added items to cart: ; Order created successfully: (Ultimate goal).
[0046] (2) Interface coverage reward The interface coverage reward incentivizes agents to explore untested interfaces in order to improve test coverage. The details are as follows:
[0047] In the formula: κ is an indicator function that takes the value 1 when the agent visits a new interface path that has not been visited in this round of training, and 0 otherwise. κ is a fixed reward value for discovering a new interface (e.g., κ = +10).
[0048] (3) System health rewards System health rewards serve as a safety constraint, penalizing behaviors that lead to system errors or violations, ensuring the standardization and security of testing. The formula is:
[0049] In the formula: and It is an indicator function that is triggered when the response status code is a client error or a server error; It is an indicator function that is triggered when the agent's behavior violates the business rules defined by the expert (e.g., unauthorized access). These are the corresponding penalty weights, all of which are negative. .
[0050] (4) Additional rewards for expert guidance and feedback Expert guidance and feedback, along with additional rewards, are key to injecting expert experience, directly rewarding the agent for performing "smart" behaviors that align with expert expectations.
[0051] In the formula: β is an indicator function that takes the value 1 when the agent’s current state-action pair (s, a) is judged as “high value” by a predefined expert rule base; β is the score of the extra reward (β = +5).
[0052] As a feasible example: an example of expert database rules could be: Rule 1: When the status is "not logged in", the action "call / api / login" is a high-value behavior.
[0053] Rule 2: When the status is "Items in shopping cart", the action "call / api / checkout" is a high-value behavior.
[0054] Rule 3: Using the order_id dynamically extracted from the previous response as a parameter for this request is a high-value behavior.
[0055] Step 6: Set the discount factor; the range of discount factor values in this embodiment is... The larger the value, the more the agent values future rewards. This patent sets the discount factor to 0.99, indicating that the agent pays more attention to long-term rewards.
[0056] Step 7: Build an HTTP simulation environment.
[0057] Step 8: Dataset construction. Discretize the data to reduce the correlation between data points.
[0058] Step 9: Model training. Using the experience replay mechanism, N sets of data in the form of (s,a,r) tuples are taken from the dataset each time, and the data is used to train the Deep Q-Network (DQN). Step 10: Complete model training and use the model to automatically generate test cases, thereby achieving automated testing at the business level.
[0059] The above description is only a preferred embodiment of the present invention and does not limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. An automated testing method for HTTP interfaces oriented towards business sequences, characterized in that: Includes the following steps: Step 1: Simulate the decision-making process of the agent to generate test cases based on a partially observable Markov decision process. This process includes constructing the state space, action space, state transition probabilities, reward function, and discount factor. Step 2: Build an HTTP simulation environment; Step 3: Discretize the data and construct a dataset; Step 4: Using the experience replay mechanism, N sets of data in the form of (s,a,r) tuples are taken from the dataset each time, and the data is used for network training. Step 5: After the model training is completed, use the trained model to automatically generate test cases to achieve automated testing at the business level.
2. The automated testing method for HTTP interfaces oriented towards business sequences according to claim 1, characterized in that: The state space is a state space containing state attributes, including session features C, recent request response features D, historical trajectory features E, and business target progress features F; the state space is represented as a quadruple S=(C,D,E,F).
3. The HTTP interface automated testing method oriented towards business sequences according to claim 1, characterized in that: The action space is the range of available actions that the agent can perform, including HTTP methods, interface paths, and request parameter values.
4. The HTTP interface automated testing method oriented towards business sequences according to claim 1, characterized in that: The state transition probability is the probability that state s changes according to the state transition probability after performing an action 'a'. , .
5. The automated testing method for HTTP interfaces oriented towards business sequences according to claim 1, characterized in that: In step one, a reward function is constructed based on comprehensive environmental indicators and additional rewards from expert guidance and feedback. These comprehensive indicators include business progress status, interface coverage status, and system health status. The reward function is calculated using the following formula: ； In the formula: This represents the reward for generating different feature terms. This represents the weight transpose of various rewards within the environment, used to balance the importance of different features; This represents an additional reward for expert guidance and feedback, helping the agent train faster.
6. The HTTP interface automated testing method oriented towards business sequences according to claim 5, characterized in that: The business progress reward corresponding to the business progress status for: ； In the formula: It is an indicator function that takes the value 1 when the agent completes the i-th sub-objective in this step, and 0 otherwise; It is the reward score for completing the corresponding sub-goal, which is set by experts based on the importance of the sub-goal in the business process.
7. The HTTP interface automated testing method oriented towards business sequences according to claim 5, characterized in that: The interface coverage reward corresponding to the interface coverage status is: ； In the formula: κ is an indicator function that takes the value 1 when the agent accesses a new interface path that has not been accessed in this round of training, and 0 otherwise; κ is a fixed reward value for discovering a new interface.
8. The HTTP interface automated testing method oriented towards business sequences according to claim 5, characterized in that: The system health reward corresponding to the system health status is: ； In the formula: and It is an indicator function that is triggered when the response status code is a client error or a server error; It is an indicator function that is triggered when the agent's behavior violates the business rules defined by the expert; These are the corresponding penalty weights, all of which are negative.
9. The HTTP interface automated testing method oriented towards business sequences according to claim 5, characterized in that: The additional reward for expert guidance and feedback is: ； In the formula: β is an indicator function that takes the value 1 when the agent’s current state-action pair (s, a) is judged to be of high value by a predefined expert rule base; β is the score of the extra reward.
10. The automated testing method for HTTP interfaces oriented towards business sequences according to claim 1, characterized in that: The discount factor range is: The larger the value, the more the agent values future rewards.