Test case generation method and device, electronic device, and program product

Abstract

The application discloses a test case generation method and device, electronic equipment and program product, and relates to the field of financial technology, wherein the generation method comprises: analyzing an initial test case to obtain an abstract syntax tree; identifying a plurality of target path branches involved when the initial test case is executed, determining the path type of each target path branch and the structure data relied on; finding a first node identifier same as a second node identifier, determining the corresponding first node as a target first node, calculating the node activity level of each target first node and the object activity level of each database object based on the path type, and thus mutating the target first node, generating a mutated test case based on the mutated node; and generating a target test case based on the execution result of each mutated test case. The application solves the technical problem that the invalid test cases generated in the related art are more, which leads to inefficient testing.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and more specifically, to a method, apparatus, electronic device, and program product for generating test cases. Background Technology

[0002] Currently, fuzzing relies on random mutation and execution feedback, which often fails to generate valid output when faced with deep branches containing complex syntactic constraints in database management systems. While mutation-based fuzzing can easily uncover some simple, shallow vulnerabilities in the early stages of testing, the large number of invalid test cases leads to a significant decline in testing efficiency as testing progresses. Symbolic execution, on the other hand, can explore specific paths by solving constraints, but due to the path explosion problem, it struggles to handle the massive codebase of database management systems, thus failing to improve testing efficiency.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and program product for generating test cases, to at least solve the technical problem in related technologies where a large number of invalid test cases are generated, resulting in inefficient testing.

[0005] According to one aspect of the embodiments of this application, a method for generating test cases is provided, comprising: determining initial test cases and parsing the initial test cases to obtain an abstract syntax tree, wherein the abstract syntax tree includes at least: multiple first nodes and database objects associated with the first nodes, and each first node has a corresponding first node identifier; identifying multiple target path branches involved in executing the initial test cases based on taint marking, and determining the path type of each target path branch, and determining the structural data that each target path branch depends on during execution, wherein the structural data includes at least: multiple second nodes, each second node has a corresponding second node identifier; for each second node identifier, searching for a first node identifier that is the same as the second node identifier among the multiple first node identifiers, and determining the first node corresponding to the first node identifier as the target first node, and calculating the node activity level of each target first node and the object activity level of each database object based on the path type; mutating the target first nodes based on the node activity level and the object activity level to obtain mutated nodes, and generating mutated test cases based on the mutated nodes; executing each mutated test case to obtain the execution result of each mutated test case, and generating target test cases based on the execution result.

[0006] Furthermore, the path type includes at least: covered path branches and uncovered path branches. The step of determining the path type of each target path branch includes: for each target path branch, determining whether a target path branch exists among multiple path branches, wherein the multiple path branches are obtained by executing historical initial test cases; if a target path branch exists among multiple path branches, determining the path type of the target path branch as a covered path branch; if a target path branch does not exist among multiple path branches, determining the path type of the target path branch as an uncovered path branch.

[0007] Further, the steps of calculating the node activity level of each target first node and the object activity level of each database object based on the path type include: for each target first node, determining the target path branch where the second node corresponding to the target first node is located; if the path type of the target path branch is an uncovered path branch, calculating the first hotspot value of the target first node based on the initial hotspot value and the first preset value; calculating the second hotspot value of the database object based on the initial hotspot value and the second preset value; if the path type of the target path branch is an covered path branch, calculating the third hotspot value of the target first node based on the initial hotspot value and the third preset value; calculating the fourth hotspot value of the database object based on the initial hotspot value and the third preset value, wherein the first preset value is greater than the second preset value, and the second preset value is greater than the third preset value; determining the node activity level based on all first hotspot values ​​and all third hotspot values, and determining the object activity level based on all second hotspot values ​​and all fourth hotspot values.

[0008] Furthermore, the step of determining the node activity level based on all first hotspot values ​​and all third hotspot values ​​includes: determining the maximum value among all first hotspot values ​​and all third hotspot values; normalizing the hotspot value of each target first node based on the maximum value to obtain a normalized node hotspot value; and determining the node activity level based on the normalized node hotspot value.

[0009] Further, the step of determining the node activity level based on the normalized node hotspot value includes: when the normalized node hotspot value is greater than a first preset hotspot threshold, determining the node activity level of the target first node corresponding to the normalized node hotspot value as the first activity level; when the normalized node hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold, determining the node activity level of the target first node corresponding to the normalized node hotspot value as the second activity level; when the normalized node hotspot value is less than or equal to the second preset hotspot threshold, determining the node activity level of the target first node corresponding to the normalized node hotspot value as the third activity level, wherein the first preset hotspot threshold is greater than the second preset hotspot threshold, the first activity level is greater than the second activity level, and the second activity level is greater than the third activity level.

[0010] Furthermore, the step of determining the object activity level based on all second hotspot values ​​and all fourth hotspot values ​​includes: determining the maximum value among all second hotspot values ​​and all fourth hotspot values; normalizing the hotspot value of each database object based on the maximum value to obtain a normalized object hotspot value; and determining the object activity level based on the normalized object hotspot value.

[0011] Furthermore, the step of determining the object activity level based on the normalized object hotspot value includes: when the normalized object hotspot value is greater than a first preset hotspot threshold, determining the object activity level of the database object corresponding to the normalized object hotspot value as the first activity level; when the normalized object hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold, determining the object activity level of the database object corresponding to the normalized object hotspot value as the second activity level; and when the normalized object hotspot value is less than or equal to the second preset hotspot threshold, determining the object activity level of the database object corresponding to the normalized object hotspot value as the third activity level.

[0012] Further, the step of generating target test cases based on execution results includes: obtaining the set of mutated path branches involved in executing mutated test cases, and obtaining the historical global path branch set, wherein the historical global path branch set is obtained by executing historical test cases; deleting mutated test cases if the execution result indicates an execution error; identifying mutated test cases as target test cases if the execution result indicates normal execution and there are mutated path branches in the mutated path branch set that are not in the historical global path branch set; monitoring the path coverage change rate of the mutated path branch set if the execution result indicates normal execution and all mutated path branches in the mutated path branch set are in the historical global path branch set, wherein the path coverage change rate is the path change value between the mutated test case and the previous mutated test case, and the execution time of the previous mutated test case is earlier than the execution time of the mutated test case; determining whether the path coverage change rate is less than a preset change threshold, obtaining the determination result, and generating target test cases based on the determination result.

[0013] According to another aspect of the embodiments of this application, a test case generation apparatus is also provided, comprising: a parsing unit, configured to determine initial test cases and parse the initial test cases to obtain an abstract syntax tree, wherein the abstract syntax tree includes at least: a plurality of first nodes and database objects associated with the first nodes, and each first node corresponds to a first node identifier; and a determining unit, configured to identify multiple target path branches involved in executing the initial test cases based on taint marking, and determine the path type of each target path branch, and determine the structural data that each target path branch depends on during execution, wherein the structural data includes at least: a plurality of second nodes, each second node corresponding to a second node identifier. The system comprises: an identifier; a lookup unit, used to find the first node identifier that is the same as the second node identifier among multiple first node identifiers for each second node identifier, and determine the first node corresponding to the first node identifier as the target first node; and to calculate the node activity level of each target first node and the object activity level of each database object based on the path type; a mutation unit, used to mutate the target first node based on the node activity level and the object activity level to obtain mutated nodes, and to generate mutation test cases based on the mutated nodes; and a generation unit, used to execute each mutation test case, obtain the execution result of each mutation test case, and generate target test cases based on the execution result.

[0014] Furthermore, the path type includes at least: covered path branches and uncovered path branches. The determining unit includes: a first judgment module, used to determine whether a target path branch exists among multiple path branches for each target path branch, wherein the multiple path branches are obtained by executing historical initial test cases; a first determining module, used to determine the path type of the target path branch as a covered path branch when the target path branch exists among multiple path branches; and a second determining module, used to determine the path type of the target path branch as an uncovered path branch when the target path branch does not exist among multiple path branches.

[0015] Further, the search unit includes: a third determining module, used to determine the target path branch where the second node corresponding to each target first node is located; a first calculation module, used to calculate the first hotspot value of the target first node based on the initial hotspot value and a first preset value when the path type of the target path branch is an uncovered path branch; a second calculation module, used to calculate the second hotspot value of the database object based on the initial hotspot value and a second preset value; a third calculation module, used to calculate the third hotspot value of the target first node based on the initial hotspot value and a third preset value when the path type of the target path branch is an uncovered path branch; a fourth calculation module, used to calculate the fourth hotspot value of the database object based on the initial hotspot value and a third preset value, wherein the first preset value is greater than the second preset value, and the second preset value is greater than the third preset value; and a fourth determining module, used to determine the node activity level based on all first hotspot values ​​and all third hotspot values, and to determine the object activity level based on all second hotspot values ​​and all fourth hotspot values.

[0016] Furthermore, the fourth determining module includes: a first determining submodule, used to determine the maximum value among all first hotspot values ​​and all third hotspot values; a first normalization submodule, used to normalize the hotspot value of each target first node based on the maximum value to obtain a normalized node hotspot value; and a second determining submodule, used to determine the node activity level based on the normalized node hotspot value.

[0017] Further, the second determining submodule includes: a first determining subunit, configured to determine the node activity level of the target first node corresponding to the normalized node hotspot value as a first activity level when the normalized node hotspot value is greater than a first preset hotspot threshold; a second determining subunit, configured to determine the node activity level of the target first node corresponding to the normalized node hotspot value as a second activity level when the normalized node hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold; and a third determining subunit, configured to determine the node activity level of the target first node corresponding to the normalized node hotspot value as a third activity level when the normalized node hotspot value is less than or equal to the second preset hotspot threshold, wherein the first preset hotspot threshold is greater than the second preset hotspot threshold, the first activity level is greater than the second activity level, and the second activity level is greater than the third activity level.

[0018] Furthermore, the fourth determination module includes: a third determination submodule, used to determine the maximum value among all second hotspot values ​​and all fourth hotspot values; a second normalization subunit, used to normalize the hotspot value of each database object based on the maximum value to obtain a normalized object hotspot value; and a fourth determination submodule, used to determine the object activity level based on the normalized object hotspot value.

[0019] Furthermore, the fourth determining submodule includes: a fourth determining subunit, used to determine the object activity level of the database object corresponding to the normalized object hotspot value as the first activity level when the normalized object hotspot value is greater than the first preset hotspot threshold; a fifth determining subunit, used to determine the object activity level of the database object corresponding to the normalized object hotspot value as the second activity level when the normalized object hotspot value is less than or equal to the first preset hotspot threshold and greater than the second preset hotspot threshold; and a sixth determining subunit, used to determine the object activity level of the database object corresponding to the normalized object hotspot value as the third activity level when the normalized object hotspot value is less than or equal to the second preset hotspot threshold.

[0020] Further, the generation unit includes: a first acquisition module, used to acquire the set of mutated path branches involved in executing mutated test cases, and to acquire the historical global path branch set, wherein the historical global path branch set is obtained by executing historical test cases; a first deletion module, used to delete mutated test cases when the execution result indicates an execution error; a fifth determination module, used to determine mutated test cases as target test cases when the execution result indicates normal execution, and there are mutated path branches in the mutated path branch set that are not in the historical global path branch set; a first monitoring module, used to monitor the path coverage change rate of the mutated path branch set when the execution result indicates normal execution, and all mutated path branches in the mutated path branch set are in the historical global path branch set, wherein the path coverage change rate is the path change value between the mutated test case and the previous mutated test case, and the execution time of the previous mutated test case is earlier than the execution time of the mutated test case; and a first generation module, used to determine whether the path coverage change rate is less than a preset change threshold, obtain a determination result, and generate target test cases based on the determination result.

[0021] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method for generating any of the above-described test cases.

[0022] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to implement the method for generating test cases described above.

[0023] In this invention, initial test cases are determined and parsed to obtain an abstract syntax tree. The abstract syntax tree includes at least multiple first nodes and database objects associated with each first node, with each first node having a corresponding first node identifier. Based on taint labeling, multiple target path branches involved in executing the initial test cases are identified, and the path type of each target path branch is determined. The structural data that each target path branch depends on during execution is also determined, with the structural data including at least multiple second nodes, each with a corresponding second node identifier. For each second node identifier, a first node identifier identical to the second node identifier is searched among the multiple first node identifiers, and the first node corresponding to the second node identifier is determined as the target first node. Based on the path type, the node activity level of each target first node and the object activity level of each database object are calculated. Based on the node activity level and object activity level, the target first nodes are mutated to obtain mutated nodes. Based on the mutated nodes, mutated test cases are generated. Each mutated test case is executed, and the execution result of each mutated test case is obtained. Based on the execution result, target test cases are generated. This solves the technical problem in related technologies where a large number of invalid test cases are generated, leading to inefficient testing.

[0024] In this invention, initial test cases are first determined and an abstract syntax tree containing multiple first nodes and associated database objects is generated. Each node has a unique identifier. A taint-based method is used to trace the target path branches involved in executing the initial test cases, identifying their path types and dependent structural data (i.e., second nodes). By matching the first node identifiers with the second node identifiers, dependencies are determined and the target first node is locked. Then, combined with the path type, the node activity level of each target first node and the object activity level of each database object are calculated. Subsequently, based on the calculated activity levels, the target first nodes are mutated to generate mutated test cases. After executing the mutated test cases, the results are filtered to generate the target test cases. This avoids the high inefficiency caused by global random mutation in fuzzing, reduces the generation of invalid test cases, improves mutation efficiency, and thus improves testing efficiency. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0026] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a test case generation method is shown.

[0027] Figure 2This is a flowchart of the test case generation method according to Embodiment 1 of this application;

[0028] Figure 3 This is a flowchart illustrating the generation of variant test cases according to an embodiment of this application;

[0029] Figure 4 This is a schematic diagram of a test case generation device according to an embodiment of this application;

[0030] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with the relevant laws, regulations, and standards of the relevant regions, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained. If the user chooses to refuse, the process enters the expert decision-making process.

[0034] While current fuzzing tools identify useful mutations through coverage feedback, this is a retrospective process; mutations must be performed and executed before their effectiveness is determined. For large input files such as SQL (Structured Query Language) and images, the proportion of invalid mutations may be high. If it were possible to know in advance which bytes affect which branches and which branches are not yet covered, then deep mutations could be applied only to bytes related to uncovered branches, while other bytes remained unchanged or only lightly mutated. In this invention, since each kernel branch of the database management system depends only on a small portion of the SQL syntax and a small portion of the metadata in the database state, by selecting highly active areas of nodes and database objects, the number of unnecessary randomly generated test cases in fuzzing can be reduced, improving testing efficiency. By solving complex constraints through symbolic execution, test cases capable of penetrating complex logic can be generated, effectively improving test coverage and increasing the probability of vulnerability discovery.

[0035] The present invention will now be described in detail with reference to various embodiments.

[0036] Example 1

[0037] According to an embodiment of this application, an embodiment of a test case generation method is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0038] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a test case generation method is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0039] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0040] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the test case generation method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned test case generation method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0041] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0042] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0043] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for generating test cases is shown. Figure 2 This is a flowchart of the test case generation method according to Embodiment 1 of this application, as follows: Figure 2 As shown, the method includes the following steps:

[0044] Step S201: Determine the initial test cases and parse the initial test cases to obtain an abstract syntax tree. The abstract syntax tree includes at least: multiple first nodes and database objects associated with the first nodes, and each first node has a first node identifier.

[0045] In this embodiment of the invention, an SQL statement (i.e., an initial test case) targeting the target program (i.e., the binary executable file of the database management system) can be initialized. After lexical and syntactic analysis of the initial test case, a tree-like data structure (i.e., an abstract syntax tree) is generated. The first node is the basic syntactic element in the abstract syntax tree, such as keywords (e.g., SELECT, WHERE), operators (e.g., >, AND, OR), column names (age, name), or function names in the SQL statement. The database object is the physical or logical database resource associated with the first node, including metadata information such as tables, columns, and indexes.

[0046] Step S202: Based on the taint marking method, identify multiple target path branches involved in the execution of the initial test case, determine the path type of each target path branch, and determine the structural data that each target path branch depends on when it is executed. The structural data includes at least: multiple second nodes, each second node having a corresponding second node identifier.

[0047] In this embodiment of the invention, taint marking is a program analysis technique that tracks the flow of data from input to the program and marks data affected by the input. By loading the target program and instrumenting it, and running initial test cases, taint marking can track the flow of input data during execution, record which branches are triggered (i.e., target path branches) and the specific SQL syntax nodes (i.e., second nodes) involved in the execution of the target path branches. It can also determine the path type of each target path branch, which includes at least: covered path branches (i.e., the target path branch is among multiple path branches) and uncovered path branches (i.e., the target path branch is not among multiple path branches). A path branch is a sequence of true and false, such as seq={q0,q1,……,qn}. When a variable executes a conditional statement and the result is true, q=true will be set within this sequence.

[0048] Step S203: For each second node identifier, find the first node identifier that is the same as the second node identifier among multiple first node identifiers, and determine the first node corresponding to the first node identifier as the target first node. Based on the path type, calculate the node activity level of each target first node and the object activity level of each database object.

[0049] In this embodiment of the invention, by identifier matching, the dynamically dependent nodes that are actually executed are matched with the static first node. The first node corresponding to the successfully matched first node identifier is determined as the target first node. Furthermore, based on the path type, the node activity level of each target first node and the object activity level of each database object can be calculated. That is, different path types result in different calculation methods for the node activity level of the target first node and the object activity level of each database object. For example, if the path type is an uncovered path branch, the corresponding target first node can be assigned a higher activity value (hotspot value), and the calculated node activity level will also be higher.

[0050] Step S204: Based on the node activity level and the object activity level, mutate the first target node to obtain the mutated node, and generate mutation test cases based on the mutated node.

[0051] In this embodiment of the invention, the selection of the mutation strategy depends on the node activity level of the target first node and the object activity level of each database object. For example, the higher the node activity level, the mutation can be performed only on the byte range corresponding to the target first node. Invalid mutations on irrelevant bytes (such as nodes with low activity levels) are avoided. Afterwards, the mutated node can be replaced back into the initial test case, and a new SQL statement (i.e., the mutated test case) can be reassembled. For example, for the node >, it is mutated to <. For the node age, considering that the "age" column has no index and high activity, a value that causes implicit type conversion can be injected, such as mutating 30 to 30a. At this point, the initial test case is: SELECT After the mutation: FROM usersWHERE age > 30, SELECT FROM users WHERE age < 30a.

[0052] It should be noted that the above examples are for illustrative purposes only and do not impose any restrictions on the generated variant test cases.

[0053] Step S205: Execute each variant test case, obtain the execution result of each variant test case, and generate the target test case based on the execution result.

[0054] In this embodiment of the invention, the execution result is the status feedback of the mutation test case after it runs in the database management system, mainly including: whether it crashed, whether it covered a new branch, and the execution time. The target test case is filtered by the indicators in the execution result (such as whether it crashed, whether it covered a new branch, etc.), retained and added to the seed queue for use in the next round of mutation test cases.

[0055] In summary, an abstract syntax tree containing the first node and database objects can be constructed by parsing the initial test cases. Tainted labeling is used to trace the target path branches and their dependent structural data (second nodes) during execution. The second nodes are mapped back to static nodes (i.e., the first node of the abstract syntax tree) using node identifiers to obtain the target first node. By calculating the node and object activity levels of the target first node and database objects, highly active nodes and database objects are identified. Based on this, targeted mutations are performed on the byte range corresponding to the target first node to generate mutation test cases. Then, the mutation test cases are executed, and the results are filtered to generate the target test cases. This solves the technical problem in related technologies where a large number of invalid test cases are generated, leading to inefficient testing.

[0056] The path type includes at least: covered path branches and uncovered path branches. In order to accurately determine the path type of the target path branch, in the test case generation method provided in Embodiment 1 of this application, for each target path branch, it is determined whether there is a target path branch among multiple path branches, wherein the multiple path branches are obtained by executing historical initial test cases; if there is a target path branch among multiple path branches, the path type of the target path branch is determined to be a covered path branch; if there is no target path branch among multiple path branches, the path type of the target path branch is determined to be an uncovered path branch.

[0057] In this embodiment of the invention, path types can be divided into covered path branches and uncovered path branches. First, the target path branch triggered during the current execution is obtained, and it is determined whether the target path branch exists in multiple path branches in the historical records. If the target path branch already exists in multiple path branches, then the target path branch has been previously covered, and its path type is determined to be a covered path branch. If the target path branch does not exist in multiple path branches, then the target path branch is a completely new branch that has not been previously explored, and its path type can be determined to be an uncovered path branch. By distinguishing between covered and uncovered path branches, the test value is quantitatively graded, and the node activity level and data object activity level of the target first node are dynamically adjusted accordingly.

[0058] To accurately determine the node activity level and object activity level, in the test case generation method provided in Embodiment 1 of this application, for each target first node, the target path branch where the second node corresponding to the target first node is located is determined; when the path type of the target path branch is an uncovered path branch, the first hotspot value of the target first node is calculated based on the initial hotspot value and the first preset value; the second hotspot value of the database object is calculated based on the initial hotspot value and the second preset value; when the path type of the target path branch is an covered path branch, the third hotspot value of the target first node is calculated based on the initial hotspot value and the third preset value; the fourth hotspot value of the database object is calculated based on the initial hotspot value and the third preset value, wherein the first preset value is greater than the second preset value, and the second preset value is greater than the third preset value; the node activity level is determined based on all first hotspot values ​​and all third hotspot values, and the object activity level is determined based on all second hotspot values ​​and all fourth hotspot values.

[0059] In this embodiment of the invention, an activity metric calculation needs to be performed on each target first node and its associated database object. First, the target path branch where the second node corresponding to each target first node is located is determined, and the path type of the target path branch (i.e., covered path branch or uncovered path branch) is identified. When the path type of the target path branch is an uncovered path branch, it means that the branch has not been explored before. At this time, the initial hotspot value (which can be set to 0) is added to a first preset value (a larger value, such as 10) to calculate the first hotspot value of the target first node. At the same time, the initial hotspot value is added to a second preset value (such as 8) to calculate the second hotspot value of the associated database object. Wherein, the first preset value is greater than the second preset value, indicating that the direct hotspot of the node is slightly higher than that of its associated object.

[0060] In this embodiment of the invention, when the target path branch is a coverage path branch, it indicates that the target path branch has been explored and has low mining value. At this time, the initial hotspot value is added to a third preset value (a smaller value, such as 1 point) to obtain the third hotspot value of the target first node. Alternatively, the initial hotspot value can be added to the third preset value to calculate the fourth hotspot value of the database object; that is, the fourth hotspot value equals the third hotspot value. In this case, the node's direct hotspot level is the same as its associated object. Then, based on all first and third hotspot values, the node's activity level is determined, and based on all second and fourth hotspot values, the object's activity level is determined. By calculating hotspot values ​​differentially, a refined evaluation of the activity of the target first node and the database object is achieved. Utilizing the relationship between the first, second, and third preset values, the activity of newly discovered branch-related elements can be increased in a short time, while the activity of historically existing branch-related elements is slowly accumulated. This allows fuzz testing to prioritize key syntax structures and database objects that can bring new coverage improvements, thereby guiding mutation strategies towards deeper and more difficult code paths, effectively improving the targeting and efficiency of vulnerability mining.

[0061] In order to accurately determine the node activity level, in the test case generation method provided in Embodiment 1 of this application, the maximum value among all first hotspot values ​​and all third hotspot values ​​is determined; based on the maximum value, the hotspot value of each target first node is normalized to obtain a normalized node hotspot value; based on the normalized node hotspot value, the node activity level is determined.

[0062] In this embodiment of the invention, after determining the first hotspot value and the third hotspot value of each target first node, a normalization calculation stage can be entered to eliminate the bias caused by the difference in absolute values ​​between different target first nodes, thereby fairly assessing their relative importance. First, the maximum value is extracted from the first hotspot value and the third hotspot value corresponding to all target first nodes, that is, the maximum value among all first hotspot values ​​and all third hotspot values. Based on this maximum value, the first hotspot value and the third hotspot value of each target first node are normalized. Specifically, the first hotspot value of each target first node is divided by the maximum value to obtain the normalized node hotspot value of that target first node; similarly, the third hotspot value of each target first node is divided by the maximum value to obtain the normalized node hotspot value of that target first node. Through this processing, the normalized node hotspot values ​​of all target first nodes are mapped to the interval between 0 and 1, eliminating the influence of dimensions. Then, based on the normalized node hotspot values ​​and combined with a preset hotspot threshold (e.g., 0.7, 0.3), the node activity level of each target first node can be determined.

[0063] To improve the accuracy of determining node activity levels, in the test case generation method provided in Embodiment 1 of this application, when the normalized node hotspot value is greater than a first preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the first activity level; when the normalized node hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the second activity level; when the normalized node hotspot value is less than or equal to the second preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the third activity level, wherein the first preset hotspot threshold is greater than the second preset hotspot threshold, the first activity level is greater than the second activity level, and the second activity level is greater than the third activity level.

[0064] In this embodiment of the invention, when the normalized node hotspot value is greater than a first preset hotspot threshold (e.g., 0.7), the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the first activity level. When the normalized node hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold (e.g., 0.3), the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the second activity level. When the normalized node hotspot value is less than or equal to the second preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the third activity level. For example, if the normalized node hotspot value of a target first node is greater than 0.7, its node activity level is determined to be a hot zone (i.e., the first activity level); if it is between 0.3 and 0.7, it is determined to be a warm zone (i.e., the second activity level); if it is less than or equal to 0.3, it is determined to be a cold zone (i.e., the second activity level). The first activity level is greater than the second activity level, and the second activity level is greater than the third activity level. Target first nodes with high activity levels belong to high-priority mutation regions, avoiding resource waste caused by random mutations. For example, nodes in the first activity level can be deeply mutated first, nodes in the second activity level can be moderately mutated, and nodes in the third activity level can be kept silent or only lightly mutated.

[0065] In order to accurately determine the activity level of an object, the test case generation method provided in Embodiment 1 of this application determines the maximum value among all second hotspot values ​​and all fourth hotspot values; based on the maximum value, the hotspot value of each database object is normalized to obtain a normalized object hotspot value; and based on the normalized object hotspot value, the activity level of the object is determined.

[0066] In this embodiment of the invention, the maximum value is extracted from the second and fourth hotspot values ​​corresponding to all database objects. This maximum value is then used to normalize the second and fourth hotspot values ​​of each database object. Specifically, the second hotspot value of each database object is divided by the maximum value to obtain the normalized object hotspot value; similarly, the fourth hotspot value of each database object is divided by the maximum value to obtain the normalized object hotspot value. By mapping the normalized object hotspot values ​​of all database objects to the range of 0 to 1, the influence of units is eliminated, making database objects of different sizes or access frequencies comparable. Based on the normalized object hotspot values ​​and a preset threshold (e.g., 0.7, 0.3), the object activity level of each database object is determined.

[0067] To improve the accuracy of determining the activity level of an object, in the test case generation method provided in Embodiment 1 of this application, when the normalized object hotspot value is greater than a first preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the first activity level; when the normalized object hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the second activity level; and when the normalized object hotspot value is less than or equal to the second preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the third activity level.

[0068] In this embodiment of the invention, when the normalized object hotspot value is greater than a first preset hotspot threshold (e.g., 0.7), the object activity level of the database object corresponding to the normalized object hotspot value is determined as the first activity level; when the normalized object hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold (e.g., 0.3), the object activity level of the database object corresponding to the normalized object hotspot value is determined as the second activity level; when the normalized object hotspot value is less than or equal to the second preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the third activity level.

[0069] Optionally, the first preset hotspot threshold and the second preset hotspot threshold of the normalized object hotspot value may be different from the first preset hotspot threshold and the second preset hotspot threshold of the normalized node hotspot value, respectively.

[0070] To improve the accuracy of generating target test cases, the test case generation method provided in Embodiment 1 of this application obtains the set of mutated path branches involved in executing mutated test cases and obtains the historical global path branch set, wherein the historical global path branch set is obtained by executing historical test cases; if the execution result indicates an execution error, the mutated test case is deleted; if the execution result indicates normal execution and there are mutated path branches in the mutated path branch set that are not in the historical global path branch set, the mutated test case is determined as the target test case; if the execution result indicates normal execution and all mutated path branches in the mutated path branch set are in the historical global path branch set, the path coverage change rate of the mutated path branch set is monitored, wherein the path coverage change rate is the path change value between the mutated test case and the previous mutated test case, and the execution time of the previous mutated test case is earlier than the execution time of the mutated test case; it is determined whether the path coverage change rate is less than a preset change threshold, a judgment result is obtained, and the target test case is generated based on the judgment result.

[0071] In this embodiment of the invention, feedback processing can be performed based on the execution results of the mutation test cases to generate the final target test cases. First, the set of mutation path branches involved in executing the mutation test case is obtained, and the historical global path branch set is accessed. The historical global path branch set records the set of all control flow branches that have been covered during the execution of all historical test cases. It is used as a benchmark to determine whether the current mutation has brought new exploration and whether the execution result indicates an execution exception (e.g., program crash). If the execution result indicates an execution exception, it means that the mutation test case is an invalid test case and can be directly deleted (or moved to an independent crash sample library and no longer used as a seed for subsequent mutations). If the execution result indicates normal execution (i.e., the program did not crash), it is further determined whether there is a mutation path branch in the mutation path branch set that is not in the historical global path branch set. If there is at least one such new branch, it means that the mutation test case has successfully covered the new code path. The mutation test case can be directly identified as the target test case and added to the seed queue so that deeper mutations can be performed based on this test case in the future. If all mutation path branches in the mutation path branch set are in the historical global path branch set, it means that although the mutation test case executes normally, no new code coverage is found, which is an inefficient mutation and can enter the evaluation stage.

[0072] During the evaluation phase, the path coverage change rate of the mutated path branch set is monitored. This path coverage change rate is the path coverage between the current mutated test case and the previous mutated test case (i.e., the test case that was executed earlier than the current test case). , ,in, This indicates the coverage of the previous variant test case. This indicates the coverage of the current variant test cases. This indicates the start time of the previous mutation test case. This indicates the time when the current mutation test case started execution. This can be obtained by calculating the ratio of the number of mutated path branches in the mutated path branch set to the total number of path branches in the historical global path branch set. Correspondingly, It can be obtained by calculating the ratio of the number of mutated path branches in its mutated path branch set to the total number of path branches in the historical global path branch set.

[0073] By determining whether the path coverage change rate is less than a preset change threshold, a judgment result can be obtained. If the judgment result is that the path coverage change rate is less than the preset change threshold (which can be set according to experience), it indicates that the test has stalled, triggering the intervention of the symbolic execution module. The symbolic execution module uses the instrumentation sub-function to solve the collected constraint set and obtain the actual value. If a solution is found, the obtained value replaces the input value in the mutation test case to obtain the target test case, which can be added to the seed queue. If it cannot be solved or the set timeout period is exceeded, the mutation test case is deleted.

[0074] Figure 3 This is a flowchart illustrating the generation of variant test cases according to an embodiment of this application, such as... Figure 3 As shown, the process includes 7 steps: Step 1: Input an initial test case as the initial seed; Step 2: Preprocess the target program involved in the initial test case (e.g., instrumentation) and build a seed queue; Step 3: Iterate through seed selection and mutation (i.e., generate mutated test cases), where seed selection and generation can be obtained through the above steps of mutating the first node of the target based on node activity level and object activity level; Step 4: Execute the target program using the generated test cases (i.e., mutated test cases) and determine whether a program crash is triggered and whether a new path is covered; Step 5-1: If a program crash is triggered during execution, record the crash and return to Step 3 to select a new seed; Step 5-2: If no crash is triggered after execution and a new branch (i.e., a new path that has never appeared before) is covered, then this test case is added to the seed queue as a new seed and the process returns to Step 3; Step 5-3: If no crash is triggered after execution and no new branch is covered, dynamically detect whether the coverage rate is less than a threshold (pre-set). If it is less than the threshold, proceed to Step 6; if it is not less than the threshold, return to Step 3. Step 6: Call the symbolic execution module to solve symbolic execution constraints. Through the instrumentation sub-function, solve the constraints based on the collected constraint set and output the specific SQL input values ​​that satisfy the uncovered path conditions. If a solution is found, convert the obtained values ​​into a standard format that the target database management system can recognize, generate a new test case, add the test case to the seed queue, and return to step 3. If a solution cannot be found or the set timeout period is exceeded, return directly to step 3. Step 7: End the run when the set time is reached or manual intervention is required.

[0075] The test case generation method provided in this application can trace branch dependencies through taint analysis, calculate the original hotspot values ​​of nodes and objects based on the differentiated weights of covered and uncovered branches, eliminate dimensional bias by using maximum value normalization, and then map the normalized values ​​to first, second, and third activity levels through first and second preset hotspot thresholds. This achieves hierarchical classification of key code regions and data objects, guides targeted mutations by accurately locating active areas, significantly reduces invalid random mutations, and dynamically filters high-value target test cases and adds them to the seed queue based on execution results and path coverage change rates. This achieves an organic combination of fuzz testing and symbolic execution, improving the targeting, depth, and overall efficiency of vulnerability discovery.

[0076] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0077] Example 2

[0078] This application also provides a test case generation apparatus. It should be noted that the test case generation apparatus of this application can be used to execute the test case generation method provided in this application. The test case generation apparatus provided in this application will be described below.

[0079] According to an embodiment of this application, an apparatus for implementing the above-described method for generating test cases is also provided. Figure 4 This is a schematic diagram of a test case generation device according to an embodiment of this application, such as... Figure 4 As shown, the test case generation device may include: a parsing unit 40, a determining unit 41, a searching unit 42, a mutation unit 43, and a generation unit 44.

[0080] The parsing unit 40 is used to determine the initial test cases and parse the initial test cases to obtain an abstract syntax tree. The abstract syntax tree includes at least: multiple first nodes and database objects associated with the first nodes, and each first node has a first node identifier.

[0081] The determination unit 41 is used to identify multiple target path branches involved in the execution of the initial test case based on the taint marking method, and to determine the path type of each target path branch and the structural data that each target path branch depends on when it is executed. The structural data includes at least: multiple second nodes, each second node having a corresponding second node identifier.

[0082] The lookup unit 42 is used to find the first node identifier that is the same as the second node identifier among multiple first node identifiers for each second node identifier, and determine the first node corresponding to the first node identifier as the target first node, and calculate the node activity level of each target first node and the object activity level of each database object based on the path type.

[0083] Mutation unit 43 is used to mutate the first target node based on the node activity level and the object activity level to obtain mutated nodes, and generate mutation test cases based on the mutated nodes.

[0084] The generation unit 44 executes each variant test case, obtains the execution result of each variant test case, and generates the target test case based on the execution result.

[0085] The test case generation apparatus provided in this application embodiment can determine initial test cases through parsing unit 40, parse the initial test cases to obtain an abstract syntax tree, identify multiple target path branches involved in executing the initial test cases through determination unit 41 based on taint marking method, determine the path type of each target path branch, and determine the structural data that each target path branch depends on during execution, and search unit 42 can search for a first node identifier that is the same as the second node identifier among multiple first node identifiers for each second node identifier, determine the first node corresponding to the first node identifier as the target first node, and calculate the node activity level of each target first node and the object activity level of each database object based on the path type, and mutate the target first node based on the node activity level and the object activity level through mutation unit 43 to obtain mutated nodes, generate mutated test cases based on mutated nodes, and execute each mutated test case through generation unit 44 to obtain the execution result of each mutated test case, and generate target test cases based on the execution result.

[0086] Optionally, the path type includes at least: covered path branches and uncovered path branches. The determining unit 41 includes: a first judging module, used to determine whether a target path branch exists among multiple path branches for each target path branch, wherein the multiple path branches are obtained by executing historical initial test cases; a first determining module, used to determine the path type of the target path branch as a covered path branch when the target path branch exists among multiple path branches; and a second determining module, used to determine the path type of the target path branch as an uncovered path branch when the target path branch does not exist among multiple path branches.

[0087] Optionally, the search unit 42 includes: a third determining module, used to determine, for each target first node, the target path branch where the second node corresponding to the target first node is located; a first calculation module, used to calculate the first hotspot value of the target first node based on the initial hotspot value and a first preset value when the path type of the target path branch is an uncovered path branch; a second calculation module, used to calculate the second hotspot value of the database object based on the initial hotspot value and a second preset value; a third calculation module, used to calculate the third hotspot value of the target first node based on the initial hotspot value and a third preset value when the path type of the target path branch is an covered path branch; a fourth calculation module, used to calculate the fourth hotspot value of the database object based on the initial hotspot value and a third preset value, wherein the first preset value is greater than the second preset value, and the second preset value is greater than the third preset value; and a fourth determining module, used to determine the node activity level based on all first hotspot values ​​and all third hotspot values, and to determine the object activity level based on all second hotspot values ​​and all fourth hotspot values.

[0088] Optionally, the fourth determining module includes: a first determining submodule, used to determine the maximum value among all first hotspot values ​​and all third hotspot values; a first normalization submodule, used to normalize the hotspot value of each target first node based on the maximum value to obtain a normalized node hotspot value; and a second determining submodule, used to determine the node activity level based on the normalized node hotspot value.

[0089] Optionally, the second determining submodule includes: a first determining subunit, configured to determine the node activity level of the target first node corresponding to the normalized node hotspot value as a first activity level when the normalized node hotspot value is greater than a first preset hotspot threshold; a second determining subunit, configured to determine the node activity level of the target first node corresponding to the normalized node hotspot value as a second activity level when the normalized node hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold; and a third determining subunit, configured to determine the node activity level of the target first node corresponding to the normalized node hotspot value as a third activity level when the normalized node hotspot value is less than or equal to the second preset hotspot threshold, wherein the first preset hotspot threshold is greater than the second preset hotspot threshold, the first activity level is greater than the second activity level, and the second activity level is greater than the third activity level.

[0090] Optionally, the fourth determining module includes: a third determining submodule, used to determine the maximum value among all second hotspot values ​​and all fourth hotspot values; a second normalization subunit, used to normalize the hotspot value of each database object based on the maximum value to obtain a normalized object hotspot value; and a fourth determining submodule, used to determine the object activity level based on the normalized object hotspot value.

[0091] Optionally, the fourth determining submodule includes: a fourth determining subunit, used to determine the object activity level of the database object corresponding to the normalized object hotspot value as the first activity level when the normalized object hotspot value is greater than the first preset hotspot threshold; a fifth determining subunit, used to determine the object activity level of the database object corresponding to the normalized object hotspot value as the second activity level when the normalized object hotspot value is less than or equal to the first preset hotspot threshold and greater than the second preset hotspot threshold; and a sixth determining subunit, used to determine the object activity level of the database object corresponding to the normalized object hotspot value as the third activity level when the normalized object hotspot value is less than or equal to the second preset hotspot threshold.

[0092] Optionally, the generation unit 44 includes: a first acquisition module, used to acquire the set of mutated path branches involved in executing the mutated test case, and acquire the historical global path branch set, wherein the historical global path branch set is obtained by executing historical test cases; a first deletion module, used to delete the mutated test case when the execution result indicates an execution error; a fifth determination module, used to determine the mutated test case as the target test case when the execution result indicates normal execution, and there are mutated path branches in the mutated path branch set that are not in the historical global path branch set; a first monitoring module, used to monitor the path coverage change rate of the mutated path branch set when the execution result indicates normal execution, and all mutated path branches in the mutated path branch set are in the historical global path branch set, wherein the path coverage change rate is the path change value between the mutated test case and the previous mutated test case, and the execution time of the previous mutated test case is earlier than the execution time of the mutated test case; and a first generation module, used to determine whether the path coverage change rate is less than a preset change threshold, obtain a judgment result, and generate the target test case based on the judgment result.

[0093] The test case generation device described above may also include a processor and a memory. The parsing unit 40, determining unit 41, searching unit 42, mutation unit 43, generation unit 44, etc., are all stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0094] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, each mutation test case is executed. The execution result of each mutation test case is obtained, and based on the execution result, the target test case is generated.

[0095] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0096] It should be noted that the parsing unit 40, determining unit 41, searching unit 42, mutation unit 43, and generating unit 44 mentioned above correspond to steps S201 to S205 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0097] Example 3

[0098] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0099] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0100] In this embodiment, the computer terminal described above can execute the program code of the following steps in the test case generation method: determining initial test cases and parsing the initial test cases to obtain an abstract syntax tree, wherein the abstract syntax tree includes at least: multiple first nodes and database objects associated with the first nodes, and each first node has a corresponding first node identifier; based on the taint marking method, identifying multiple target path branches involved in the execution of the initial test cases, and determining the path type of each target path branch, and determining the structural data that each target path branch depends on when executing, wherein the structural data includes at least: multiple second nodes, each second node has a corresponding second node identifier; for each second node identifier, searching for a first node identifier that is the same as the second node identifier among multiple first node identifiers, and determining the first node corresponding to the first node identifier as the target first node, and calculating the node activity level of each target first node and the object activity level of each database object based on the path type; mutating the target first node based on the node activity level and the object activity level to obtain mutated nodes, and generating mutated test cases based on the mutated nodes; executing each mutated test case, obtaining the execution result of each mutated test case, and generating target test cases based on the execution result.

[0101] Optionally, the computer terminal described above can execute the program code for the following steps in the test case generation method: for each target path branch, determine whether a target path branch exists among multiple path branches, wherein the multiple path branches are obtained by executing historical initial test cases; if a target path branch exists among multiple path branches, determine the path type of the target path branch as a covered path branch; if a target path branch does not exist among multiple path branches, determine the path type of the target path branch as an uncovered path branch.

[0102] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the test case generation method: For each target first node, determine the target path branch where the second node corresponding to the target first node is located; if the path type of the target path branch is an uncovered path branch, calculate the first hotspot value of the target first node based on the initial hotspot value and the first preset value; calculate the second hotspot value of the database object based on the initial hotspot value and the second preset value; if the path type of the target path branch is an covered path branch, calculate the third hotspot value of the target first node based on the initial hotspot value and the third preset value; calculate the fourth hotspot value of the database object based on the initial hotspot value and the third preset value, wherein the first preset value is greater than the second preset value, and the second preset value is greater than the third preset value; determine the node activity level based on all first hotspot values ​​and all third hotspot values, and determine the object activity level based on all second hotspot values ​​and all fourth hotspot values.

[0103] Optionally, the aforementioned computer terminal may execute program code for the following steps in the test case generation method: determining the maximum value among all first hotspot values ​​and all third hotspot values; normalizing the hotspot value of each target first node based on the maximum value to obtain a normalized node hotspot value; and determining the node activity level based on the normalized node hotspot value.

[0104] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the test case generation method: when the normalized node hotspot value is greater than a first preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as a first activity level; when the normalized node hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as a second activity level; when the normalized node hotspot value is less than or equal to the second preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as a third activity level, wherein the first preset hotspot threshold is greater than the second preset hotspot threshold, the first activity level is greater than the second activity level, and the second activity level is greater than the third activity level.

[0105] Optionally, the aforementioned computer terminal may execute program code for the following steps in the test case generation method: determining the maximum value among all second hotspot values ​​and all fourth hotspot values; normalizing the hotspot value of each database object based on the maximum value to obtain a normalized object hotspot value; and determining the object activity level based on the normalized object hotspot value.

[0106] Optionally, the aforementioned computer terminal may execute the program code for the following steps in the test case generation method: when the normalized object hotspot value is greater than a first preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the first activity level; when the normalized object hotspot value is less than or equal to the first preset hotspot threshold and greater than a second preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the second activity level; when the normalized object hotspot value is less than or equal to the second preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the third activity level.

[0107] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the test case generation method: obtaining the set of mutated path branches involved in executing the mutated test case, and obtaining the historical global path branch set, wherein the historical global path branch set is obtained by executing historical test cases; deleting the mutated test case if the execution result indicates an execution error; determining the mutated test case as the target test case if the execution result indicates normal execution, and there are mutated path branches in the mutated path branch set that are not in the historical global path branch set; monitoring the path coverage change rate of the mutated path branch set if the execution result indicates normal execution, and all mutated path branches in the mutated path branch set are in the historical global path branch set, wherein the path coverage change rate is the path change value between the mutated test case and the previous mutated test case, and the execution time of the previous mutated test case is earlier than the execution time of the mutated test case; determining whether the path coverage change rate is less than a preset change threshold, obtaining the determination result, and generating the target test case based on the determination result.

[0108] Optionally, Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0109] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the test case generation method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned test case generation method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0110] The processor can access the information and application programs stored in the memory via the transmission device to execute the steps described above in the method for generating the test cases.

[0111] This application provides a scheme for generating test cases. By identifying active areas of SQL syntax nodes and database objects based on taint analysis, it differentiates the hotspot values ​​of covered and uncovered branches, and uses maximum value normalization and multi-level threshold determination to classify nodes and objects into first to third activity levels. Thus, during the mutation phase, it prioritizes targeted mutation of key syntax structures and data objects with high activity levels. After execution, it dynamically selects seeds based on whether new branch coverage is generated and the coverage change rate. This achieves collaborative optimization of fuzz testing and symbolic execution, effectively reducing the resource waste caused by a large number of invalid random mutations, improving the effectiveness and path coverage of test cases, and thus solving the technical problem in related technologies where a large number of invalid test cases are generated, leading to inefficient testing.

[0112] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0113] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0114] Example 4

[0115] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the test case generation method provided in Embodiment 1.

[0116] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0117] This application also provides a computer program product, which, when executed on a data processing device, is adapted to perform the steps of a test case generation method.

[0118] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0119] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0121] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0122] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0123] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0124] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for generating test cases, characterized in that, include: Initial test cases are determined and parsed to obtain an abstract syntax tree, wherein the abstract syntax tree includes at least: multiple first nodes and database objects associated with the first nodes, and each first node has a corresponding first node identifier; Based on the taint marking method, multiple target path branches involved in the execution of the initial test case are identified, and the path type of each target path branch is determined. The structural data on which each target path branch depends during execution is also determined, wherein the structural data includes at least: multiple second nodes, each second node corresponding to a second node identifier; For each second node identifier, find the first node identifier that is the same as the second node identifier among the plurality of first node identifiers, and determine the first node corresponding to the first node identifier as the target first node. Based on the path type, calculate the node activity level of each target first node and the object activity level of each database object. Based on the node activity level and the object activity level, the target first node is mutated to obtain a mutated node, and mutated test cases are generated based on the mutated node. Each of the mutation test cases is executed, the execution result of each mutation test case is obtained, and the target test case is generated based on the execution result.

2. The test case generation method according to claim 1, characterized in that, The path type includes at least: covered path branches and uncovered path branches. The step of determining the path type of each target path branch includes: For each target path branch, determine whether the target path branch exists among multiple path branches, wherein the multiple path branches are obtained by executing historical initial test cases; If the target path branch exists among the plurality of path branches, the path type of the target path branch is determined to be the covering path branch; If the target path branch does not exist among the multiple path branches, the path type of the target path branch is determined to be the uncovered path branch.

3. The test case generation method according to claim 1, characterized in that, The steps for calculating the node activity level of each target first node and the object activity level of each database object based on the path type include: For each target first node, determine the target path branch where the second node corresponding to the target first node is located; If the path type of the target path branch is an uncovered path branch, calculate the first hotspot value of the target first node based on the initial hotspot value and the first preset value. Based on the initial hotspot value and the second preset value, calculate the second hotspot value of the database object; If the path type of the target path branch is an overlay path branch, the third hotspot value of the target first node is calculated based on the initial hotspot value and the third preset value. Based on the initial hotspot value and the third preset value, the fourth hotspot value of the database object is calculated, wherein the first preset value is greater than the second preset value, and the second preset value is greater than the third preset value; The node activity level is determined based on all the first hotspot values ​​and all the third hotspot values, and the object activity level is determined based on all the second hotspot values ​​and all the fourth hotspot values.

4. The test case generation method according to claim 3, characterized in that, The step of determining the node activity level based on all the first hotspot values ​​and all the third hotspot values ​​includes: Determine the maximum value among all the first hotspot values ​​and all the third hotspot values; Based on the maximum value, the hotspot value of each target first node is normalized to obtain the normalized node hotspot value. The node activity level is determined based on the normalized node hotspot value.

5. The test case generation method according to claim 4, characterized in that, The step of determining the node activity level based on the normalized node hotspot value includes: If the normalized node hotspot value is greater than the first preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the first activity level. If the normalized node hotspot value is less than or equal to the first preset hotspot threshold and greater than the second preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the second activity level. When the normalized node hotspot value is less than or equal to the second preset hotspot threshold, the node activity level of the target first node corresponding to the normalized node hotspot value is determined as the third activity level, wherein the first preset hotspot threshold is greater than the second preset hotspot threshold, the first activity level is greater than the second activity level, and the second activity level is greater than the third activity level.

6. The test case generation method according to claim 3, characterized in that, The step of determining the activity level of the object based on all the second hotspot values ​​and all the fourth hotspot values ​​includes: Determine the maximum value among all the second hotspot values ​​and all the fourth hotspot values; Based on the maximum value, the hotspot value of each database object is normalized to obtain the normalized object hotspot value; The activity level of the object is determined based on the normalized object hotspot value.

7. The test case generation method according to claim 6, characterized in that, The step of determining the activity level of an object based on the normalized object hotspot value includes: If the normalized object hotspot value is greater than the first preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the first activity level; If the normalized object hotspot value is less than or equal to the first preset hotspot threshold and greater than the second preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the second activity level. If the normalized object hotspot value is less than or equal to the second preset hotspot threshold, the object activity level of the database object corresponding to the normalized object hotspot value is determined as the third activity level.

8. The method for generating test cases according to claim 1, characterized in that, Based on the execution results, the steps for generating target test cases include: Obtain the set of mutation path branches involved in executing the mutation test cases, and obtain the set of historical global path branches, wherein the set of historical global path branches is obtained by executing historical test cases; If the execution result indicates an execution error, delete the mutated test case; If the execution result indicates that the execution is normal, and there is a mutated path branch in the mutated path branch set that is not in the historical global path branch set, then the mutated test case is determined as the target test case. If the execution result indicates that the execution is normal, and all the mutated path branches in the mutated path branch set are in the historical global path branch set, monitor the path coverage change rate of the mutated path branch set, wherein the path coverage change rate is the path change value between the mutated test case and the previous mutated test case, and the execution time of the previous mutated test case is earlier than the execution time of the mutated test case. Determine whether the path coverage change rate is less than a preset change threshold, obtain the determination result, and generate the target test case based on the determination result.

9. A test case generation device, characterized in that, include: A parsing unit is used to determine initial test cases and parse the initial test cases to obtain an abstract syntax tree, wherein the abstract syntax tree includes at least: multiple first nodes and database objects associated with the first nodes, and the first nodes have corresponding first node identifiers; The determining unit is used to identify multiple target path branches involved in the execution of the initial test case based on the taint marking method, and to determine the path type of each target path branch and the structural data that each target path branch depends on when it is executed, wherein the structural data includes at least: multiple second nodes, each second node corresponding to a second node identifier; The search unit is configured to, for each second node identifier, search among the plurality of first node identifiers for a first node identifier that is the same as the second node identifier, determine the first node corresponding to the first node identifier as the target first node, and calculate the node activity level of each target first node and the object activity level of each database object based on the path type; The mutation unit is used to mutate the target first node based on the node activity level and the object activity level to obtain mutated nodes, and generate mutation test cases based on the mutated nodes. The generation unit is used to execute each of the mutation test cases, obtain the execution result of each of the mutation test cases, and generate the target test case based on the execution result.

10. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the test case generation method according to any one of claims 1 to 8.

11. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the test case generation method according to any one of claims 1 to 8.

Images