Data generation device, data generation method, and program

Abstract

To provide a data generation device, a data generation method, and a program that enable fuzzing data which is more likely to cause an abnormality to be generated by a limited number of times.SOLUTION: A data generation device according to the present disclosure includes: a rule information storage unit that stores rule information in which numeric values to be used as data are ranked; a data generation unit that generates data in accordance with the rule information read out from the rule information storage unit; and a rule information update unit that updates the rule information stored in the rule information storage unit. The rule information update unit changes the ranking of the numeric values based on a result of a test using the data, and updates the rule information in accordance with the changed ranking of the numeric values.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to a data generation device, a data generation method, and a program. [Background technology]

[0002] In order to check for unknown vulnerabilities in software, there is a testing technique called fuzzing, in which data containing values ​​that would never normally be entered into the software is input and the behavior of the software at that time is monitored to check for any defects that could lead to vulnerabilities.

[0003] Fuzz testing is a black box test that uses a brute force approach to input data; however, in reality, exhausting all possible combinations of input data would require a huge amount of testing effort, so it is necessary to generate fuzz data that can efficiently find vulnerabilities with a limited amount of testing effort. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 5906855 Summary of the Invention [Problem to be solved by the invention]

[0005] On the other hand, Patent Document 1 shows a method that can reduce the enormous number of test steps by first rewriting all data to abnormal values ​​and then gradually reverting it to the original value while testing. However, with the method of Patent Document 1, even if an abnormality is found in the test target, there are too many alterations to normal data, so it takes time to identify the cause, and there is no effect from reducing the number of tests.

[0006] In view of the above-mentioned problems, an object of the present invention is to provide a data generation device, a data generation method, and a program capable of generating data that is more likely to cause an abnormality with a limited number of attempts. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems and achieve the objective, the data generation device of the present disclosure includes a rule information storage unit that stores rule information that ranks numerical values ​​to be used as data, a data generation unit that generates data in accordance with the rule information read from the rule information storage unit, and a rule information update unit that updates the rule information stored in the rule information storage unit, and the rule information update unit changes the ranking of the numerical values ​​based on the results of a test using the data, and updates the rule information according to the changed ranking of the numerical values.

[0008] In order to solve the above-mentioned problems and achieve the objective, the data generation method disclosed herein includes the steps of storing rule information that ranks numerical values ​​to be used as data in a rule information storage unit, generating data in accordance with the rule information read from the rule information storage unit, and updating the rule information stored in the rule information storage unit, wherein in the step of updating the rule information, the ranking of the numerical values ​​is changed based on the results of a test using the data, and the rule information is updated based on the changed ranking of the numerical values.

[0009] In order to solve the above-mentioned problems and achieve the objective, the program disclosed herein causes a computer to execute the steps of storing rule information that ranks numerical values ​​to be used as data in a rule information storage unit, generating data in accordance with the rule information read from the rule information storage unit, and updating the rule information stored in the rule information storage unit, and in the step of updating the rule information, the ranking of the numerical values ​​is changed based on the results of a test using the data, and the rule information is updated based on the changed ranking of the numerical values. Effect of the Invention

[0010] According to the present invention, it is possible to provide a data generation device, a data generation method, and a program capable of generating data in which an abnormality is more likely to occur with a limited number of attempts. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram for explaining an overview of a fuzz test according to the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating an example of the configuration of a test system according to the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating an example of a configuration of a data generating device according to the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of numeric rule information according to the present disclosure. [Diagram 5] FIG. 5 is a diagram illustrating an example of enumeration type rule information according to the present disclosure. [Figure 6] FIG. 6 is a diagram illustrating an example of character string type rule information according to the present disclosure. [Figure 7] FIG. 7 is a diagram illustrating an example of flag-type rule information according to the present disclosure. [Figure 8] FIG. 8 is a flowchart showing a flow of processing of the data generating device according to the present disclosure. [Figure 9] FIG. 9 is a flowchart showing a flow of processing of the data generating device according to the present disclosure. [Figure 10] FIG. 10 is a flowchart showing a flow of processing of the data generating device according to the present disclosure. [Figure 11] FIG. 11 is a flowchart showing a flow of processing of the data generating device according to the present disclosure. [Figure 12] FIG. 12 is a diagram showing an example of a data format of normal data of an inspection target device according to the present disclosure. [Figure 13] FIG. 13 is a diagram showing an example of evaluation values ​​of candidate values ​​set in data section 1 according to the present disclosure. [Figure 14]FIG. 14 is a diagram showing an example of evaluation values ​​of candidate values ​​set in data section 2 according to the present disclosure. [Figure 15] FIG. 15 is a diagram showing an example of evaluation values ​​of candidate values ​​set in data section 3 according to the present disclosure. [Figure 16] FIG. 16 is a diagram showing an example of evaluation values ​​of candidate values ​​set in data section 4 according to the present disclosure. [Figure 17] FIG. 17 is a diagram showing an example of evaluation values ​​of candidate values ​​set in data section 5 according to the present disclosure. [Figure 18] FIG. 18 is a diagram showing an example of evaluation values ​​of candidate values ​​set in data section 6 according to the present disclosure. [Figure 19] FIG. 19 is a diagram showing an example of evaluation values ​​of candidate values ​​set in data section 7 according to the present disclosure. [Figure 20] FIG. 20 is a diagram showing an example of evaluation values ​​of candidate values ​​set in data section 8 according to the present disclosure. [Figure 21] FIG. 21 is a diagram showing a first example of the evaluation values ​​of selected data values ​​from the fuzzing data according to the present disclosure and the sum of the evaluation values ​​of combinations thereof. [Figure 22] FIG. 22 is a diagram showing a second example of the evaluation values ​​of selected data values ​​from the fuzzing data according to the present disclosure and the sum of the evaluation values ​​of combinations thereof. [Figure 23] FIG. 23 is a flowchart showing a flow of processing by the rule information update unit of the data generating device according to the present disclosure. [Figure 24] FIG. 24 is a diagram illustrating a configuration example of an inspection target device according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Note that the present disclosure is not limited to the embodiments described below.

[0013] (Overview of fuzz testing) First, an overview of the fuzzing test according to the present disclosure will be described with reference to Fig. 1. Fig. 1 is a diagram for explaining the overview of the fuzzing test according to the present disclosure. As shown in Fig. 1, the fuzzing test is a test in which a data generating device 100 generates a plurality of fuzzing data in response to an operation by a user U, transmits the generated fuzzing data to an inspection target device 200, inputs the generated fuzzing data to the inspection target device 200, executes various processes in the inspection target device 200 based on the input fuzzing data, and monitors whether or not an abnormal operation occurs in the inspection target device 200 at that time.

[0014] Fuzzing testing is a testing method for checking unknown vulnerabilities in the system or software being evaluated by inputting data with values ​​that would not normally be input to the system or software being evaluated and monitoring the behavior of the software at that time to check for defects that could lead to vulnerabilities.Fuzzing data is data that includes illegal data, unexpected data, and random data that is not normally anticipated in the standards that the tested device complies with, and is data that may cause the tested device to malfunction.

[0015] 1, in a test at the development stage of a product equipped with software, a user U such as a developer generates fuzzing data using a data generating device 100, inputs the generated fuzzing data to a test target device 200A or a test target device 200B, and observes the behavior of the test target device 200A or the test target device 200B. If an abnormal operation is detected in the fuzzing test, countermeasures such as software modification or circuit design change are implemented.

[0016] (Test system configuration) Next, a configuration example of a test system 1 according to the present disclosure will be described with reference to Fig. 2. Fig. 2 is a diagram showing a configuration example of a test system according to the present disclosure. As shown in Fig. 2, the test system 1 according to the present disclosure includes a data generating device 100, a test target device 200, and a network N. Below, these components will be briefly described in order.

[0017] The data generating device 100 is an information processing device that performs a fuzzing test by generating fuzzing data that is likely to cause a problem in the test target device 200 and transmitting the generated fuzzing data to the test target device 200. Note that in the fuzzing test, in order to check whether the test target device 200 operates normally, data is generated in which part or all of the regular data is modified, and such data is used as fuzzing data.

[0018] The test target device 200 is an information processing device that is the target of a fuzzing test. The test target device 200 may be an information processing device in which software for implementing various applications is implemented, and may be, for example, a music player, a wireless communication terminal, a car navigation system, a car audio device, headphones, a drive recorder, a video camera, or the like.

[0019] The network N connects the data generating device 100 and the inspection target device 200 to each other and exchanges information. If the network N is wired, it may be realized by, for example, a Universal Serial Bus (USB), a Serial Digital Interface (SDI), or a High-Definition Multimedia Interface (HDMI) (registered trademark). If it is wireless, it may be realized by a wireless Local Area Network (LAN) defined in IEEE802.11.

[0020] (Configuration of data generation device) Next, a configuration example of a data generating device according to the present disclosure will be described with reference to Fig. 3. Fig. 3 is a diagram showing a configuration example of a data generating device according to the present disclosure. As shown in Fig. 3, a data generating device 100 according to the present disclosure includes a communication unit 110, a storage unit 120, a control unit 130, an input unit 140, and a display unit 150. The configuration of these units will be described in order below.

[0021] The communication unit 110 is responsible for transmitting and receiving various information and the like between an external device in a wired or wireless manner. In the case of a wired communication, the communication unit 110 may include an interface such as a USB terminal, an SDI terminal, or an HDMI (registered trademark) terminal. In the case of a wireless communication, the communication unit 110 may be realized by a wireless LAN defined by IEEE802.11, Bluetooth (registered trademark), Wi-Fi (registered trademark), or the like.

[0022] The storage unit 120 is a storage device that stores various types of information. The storage unit 120 includes a main storage device and an auxiliary storage device. The main storage device may be realized by a semiconductor memory element such as a random access memory (RAM), a read only memory (ROM), or a flash memory. The auxiliary storage device may be realized by a hard disk or a solid state drive (SSD), for example.

[0023] As shown in FIG. 3, the storage unit 120 includes a rule information storage unit 121 and a data section setting storage unit 122.

[0024] The rule information storage unit 121 stores rule information that ranks a plurality of numerical values ​​used as fuzzing data. The rule information storage unit 121 stores rule information determined according to data type. The rule information may set the same rank for all values ​​as the initial value before the fuzzing test is performed, or may set the rank based on known vulnerabilities in advance. Furthermore, rule information for the same data type may be treated as one piece of rule information, or rule information may be set for each data section even for the same data type. The rule information is rule information for assigning an evaluation value to data.

[0025] The data type is set based on the standard of the input data of the inspection target device 200, and is one of the following data types: numeric type, enumeration type, string type, and flag type. Details of these data types will be described later.

[0026] In the rule information, a ranking is set for each one or more pieces of data (numeric values ​​used as fuzzing data). Hereinafter, the one or more pieces of data for which a ranking is set will be referred to as a data value. In the rule information, the more times an abnormality occurs in the test target device 200 when that data value is used (the number of times the data value occurs), the higher the ranking is assigned.

[0027] In the rule information, the rank and the evaluation value are associated with each other, and the higher the rank, the higher the evaluation value is assigned. However, the same evaluation value may be assigned to different ranks in at least some of the ranks. The data value group may be set arbitrarily, and may be classified, for example, into a data value group that is a normal value and a data value group that is an abnormal value. For example, the data value group that is a normal value may be separated into a plurality of data value groups, and may be classified, for example, into the maximum value, minimum value, median value, and other values ​​within the normal value. For example, the data value group that is an abnormal value may be separated into a plurality of data value groups, and may be classified, for example, into the maximum value, minimum value, median value, and other values ​​within the abnormal value (outside the normal value). A normal value is a value that conforms to the standard in that data type and that data section, and an abnormal value is a value that does not conform to the standard.

[0028] Examples of rule information determined according to the above-mentioned data types will be described with reference to Fig. 4 to Fig. 7. Fig. 4 is a diagram showing an example of numerical rule information according to the present disclosure. As shown in Fig. 4, the numerical rule information is determined by the items "rank", "evaluation value", "data value", and "number of occurrences of data value".

[0029] "Ranking" indicates the ranking of the data value among all the data values ​​indicated by "data value", and a data value with a higher "number of times a data value occurs" is ranked higher. "Evaluation value" is the evaluation value of the data value indicated by "data value" as fuzzing data, and may be determined according to the ranking of the data value, or may be determined arbitrarily. "Data value" is the value of data according to the data type. "Number of times a data value occurs" indicates the number of times an abnormality occurred when the data indicated by "data value" was generated as fuzzing data and input into the test target device 200.

[0030] In FIG. 4, for example, an example is shown in which the evaluation value of data ranked "1" is stored as a data value of "4", which is the "maximum value outside the normal range", and the number of occurrences of the data value is stored as "39".

[0031] Note that the numerical rule information shown in FIG. 4 is merely an example, and is not limited to this, and any numerical rule information may be defined and stored.

[0032] Next, the enumeration type rule information will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the enumeration type rule information according to the present disclosure. As shown in Fig. 5, the enumeration type rule information is defined by the items "rank", "evaluation value", "data value", and "number of occurrences of data value". These are the same as the items of the numerical value type rule information described above, and therefore description thereof will be omitted.

[0033] FIG. 5 shows an example in which the evaluation value of data with a rank of "1" is stored as a data value of "4", which is the "median within normal values", and the number of occurrences of the data value is stored as "47".

[0034] Note that the enumeration type rule information shown in FIG. 5 is merely an example, and is not limited to this, and any enumeration type rule information may be defined and stored.

[0035] Next, character string type rule information will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of character string type rule information according to the present disclosure. As shown in Fig. 6, character string type rule information is defined by items such as "rank", "evaluation value", "data value", and "number of occurrences of data value". These are the same as the items of the numerical value type rule information described above, and therefore description thereof will be omitted.

[0036] In FIG. 6, for example, an example is shown in which the evaluation value of data with a rank of "1" is "4", the data value is "a code representing control (=normal value)", and the number of occurrences of the data value is stored as "72".

[0037] Note that the character string type rule information shown in FIG. 6 is merely an example, and is not limited to this, and any character string type rule information may be defined and stored.

[0038] Next, flag-type rule information will be described with reference to Fig. 7. Fig. 7 is a diagram showing an example of flag-type rule information according to the present disclosure. As shown in Fig. 7, flag-type rule information is defined by items such as "rank", "evaluation value", "data value", and "number of occurrences of data value". These are the same as the items of the flag-type rule information described above, and therefore description thereof will be omitted.

[0039] In FIG. 7, for example, an example is shown in which the evaluation value of data with a rank of "1" is "4", the data value is "a bit inversion of a normal value (=outside the normal value)", and the number of occurrences of the data value is stored as "43".

[0040] Note that the flag-type rule information shown in FIG. 7 is merely an example, and is not limited to this, and any flag-type rule information may be defined and stored.

[0041] The data interval setting storage unit 122 stores information about the data intervals set by the data interval setting unit 132. The information about the data intervals set by the data interval setting unit 132 will be described later in the description of the processing of the data interval setting unit 132.

[0042] Next, returning to Fig. 3, the control unit 130 will be described. The control unit 130 is a controller that executes various arithmetic processes and processes that realize functions. The control unit 130 is realized by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like, executing various programs stored in the storage unit 120 using a RAM as a working area. The control unit 130 may also be realized by an integrated circuit, such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0043] As shown in FIG. 3, the control unit 130 includes a normal data acquisition unit 131, a data interval setting unit 132, a data type setting unit 133, a rule information acquisition unit 134, a data generation unit 135, a data transmission unit 136, a monitoring data receiving unit 137, and a rule information update unit 138.

[0044] The control unit 130 realizes these functions and executes these processes by reading and executing a program (software) from the storage unit 120. Note that these functions of the control unit 130 may be realized by electronic circuits. The control unit 130 may execute these processes by one CPU, or may be provided with multiple CPUs and execute these processes in parallel by the multiple CPUs. Below, these configurations will be explained in order.

[0045] (Fuzz testing process) First, the flow of the fuzz test process realized by the control unit 130 will be described with reference to Fig. 8. Fig. 8 to Fig. 11 are flowcharts showing the flow of the process of the data generating device according to the present disclosure. The fuzz test will be described along the flow shown in Fig. 8.

[0046] First, the data generating device 100 acquires normal data (step S101). Next, the data generating device 100 executes a data section setting process (step S102). Next, the data generating device 100 executes a data type setting process (step S103). Next, the data generating device 100 executes a rule information acquisition process (step S104). Next, the data generating device 100 executes a data generation process (step S105). Next, the data generating device 100 executes a data transmission process (step S106). Next, the data generating device 100 executes a test target device alive monitoring data reception process (step S107). Next, the data generating device 100 executes a rule information update process (step S108).

[0047] The processes from step S101 to step S108 are respectively realized by normal data acquisition unit 131, data section setting unit 132, data type setting unit 133, rule information acquisition unit 134, data generation unit 135, data transmission unit 136, monitoring data reception unit 137, and rule information update unit 138. The processes of these components will be specifically described below.

[0048] (Regular data acquisition process) The normal data acquiring unit 131 acquires normal data that is the basis of fuzzing data. The normal data is the original input data of the inspection target device 200. The normal data is a data group (a chunk of data) in which a plurality of data are arranged, for example, a data group in which binary data are arranged. The normal data acquiring unit 131 may acquire normal data from an external device via the communication unit 110, or may acquire normal data by selecting from normal data stored in advance in a normal data storage unit (not shown) provided in the storage unit 120. Here, data that conforms to the original input format of the inspection target device 200 is regarded as normal data, and an example of such data is shown in FIG. 12. FIG. 12 is a diagram showing an example of the data format of normal data of the inspection target device according to the present disclosure.

[0049] As shown in FIG. 12, the fields of the data format include information relating to the following items: “ID,” “format type,” “codec,” “bit rate,” “sampling frequency,” “copyright information,” “song title information data length,” “song title information,” and “payload.”

[0050] "ID" is an identifier used to identify the entire data, and is a fixed value of 0x01. "Format type" indicates the type of data stored in the payload, with 0x1 being audio data, 0x2 being video data, and 0x3 being a reserved number. The following items take the data format according to this format type, and the example in Figure 9 shows the case where 0x01 audio data has been selected. "Codec" indicates the compression encoding method for the audio data stored in the payload, with 0x1 being MP3 (MPEG-1 Audio Layer-3), 0x2 being AAC (Advanced Audio Coding), and 0x3 being linear PCM (Pulse Code Modulation).

[0051] "Bit rate" indicates the amount of audio data per unit time, with 0x0 being 1.5Mbps and selectable only when the codec is LPCM (Linear PCM), 0x1 being 128kbps and selectable only when the codec is MP3 or AAC, and 0x2 being 320kbps and selectable only when the codec is MP3. "Sampling frequency" indicates the frequency at which the audio signal is sampled, with 0x1 being 44100Hz and selectable regardless of whether the codec is MP3, AAC, or Linear PCM, and 0x2 being 48000Hz and set only when the codec is Linear PCM. "Copyright information" is information regarding the copyright of the audio data stored in the payload, with the least significant bit of the 4-bit bit string being 0 indicating no copyright, and 1 indicating copyright, and also with the most significant bit being 0 indicating that the audio data stored in the payload is a copy, and 1 indicating that it is original data.

[0052] "Song title information data length" indicates the length in bytes of the song title information field, which is explained below, and is set within the range of 0 to 63. "Song title information" is an area where the data length is variable with the value indicated in song title information data length, and stores character string data of the song title information. Here, the character string data conforms to ASCII code. The above is the header information, followed by the "payload", where the main music data is stored. Note that since the header information is the subject of fuzz testing, detailed explanation of the payload will be omitted.

[0053] (Data section setting process) The data interval setting unit 132 sets a data interval based on the acquired regular data. The data interval setting unit 132 divides the multiple data arranged in the regular data into one or multiple data, and sets the divided interval as a data interval. In other words, a data interval can be said to be information indicating the number of bits of data and the position of that data among the multiple data arranged in the regular data. The data interval setting unit 132 determines whether there is a data interval for which a data interval number (position of data) and a data interval length (number of bits of data) have not been set among all the data included in the regular data, and if there is an unset interval, sets a data number and a data interval length to that interval.

[0054] The process of the data interval setting unit 132 will be described with reference to FIG. 9. First, the data interval number i is set to 1 (step S201). Next, the data interval setting unit 132 judges whether or not there is an interval in which the data interval number and data interval length are not set (step S202). If there is an interval in which the data interval number and data interval length are not set (step S202: Yes), the data interval setting unit 132 sets a data interval i in the unset interval, obtains the interval length li corresponding to the data interval i, and records the interval number i and the interval length li (step S203). Next, the data interval setting unit 132 adds 1 to the data interval number i (step S204). Next, the data interval setting unit 132 returns to step S201 and executes the subsequent processes.

[0055] If there is no unset section in step S202 (step S202: No), the data section setting unit 132 ends the process.

[0056] For example, based on standard information of normal data, the data section number and the number of bits indicating the length of that data section are set as follows, starting from the beginning of the data. ID: Section number = 1, Data length = 8 bits Format type: Section number = 2, Data length = 4 bits Codec: Section number = 3, Data length = 4 bits Bit rate: Section number = 4, Data length = 4 bits Sampling frequency: section number = 5, data length = 4 bits Copyright information: Section number = 6, Data length = 4 bits Song title information data length: Section number = 7, data length = 8 bits Song title information: Section number = 8, data length = 8 x N bits (where N is the value of the song title information data length)

[0057] The data interval setting unit 132 accepts an input for setting a data interval from the user via the input unit 140 and sets the data interval. That is, the data interval setting unit 132 accepts an input of an interval length li (value of the number of bits) corresponding to the data interval i from the user via the input unit 140. At that time, a screen for confirming the input contents or a GUI (Graphical User Interface) may be displayed on the display unit 150, and the user inputs this information using the mouse or keyboard of the input unit 140. However, the present invention is not limited to this, and the data interval setting unit 132 may automatically set the data interval based on the standard information of the regular data.

[0058] The set interval is data interval information including the interval number and its data length, but the interval number is not necessarily required, and the data length may be represented by the number of consecutive fixed-length bits, and the intervals may be represented in ascending order from the beginning. In this way, any information that uniquely determines the number of intervals from the beginning and the data length in bits may be used.

[0059] Furthermore, the data interval setting unit 132 stores information representing the intervals thus set (information about the data interval) in the data interval setting storage unit 122. Note that, in each data interval, within the range from the minimum value to the maximum value represented by the number of bits of the data interval, the range that normal data can take is set as a normal value or a value within the normal value, and the rest is set as an abnormal value or a value outside the normal value.

[0060] (Data type setting process) The data type setting unit 133 sets a data type indicating the type of value that the data can take for all the data intervals set by the data interval setting unit 132 .

[0061] The processing of the data type setting unit 133 will be described with reference to Fig. 10. First, the data type setting unit 133 sets the data section number i to 1, assuming that i = 1 (step S301). Next, the data type setting unit 133 acquires the data type corresponding to the data section i and records the data type (step S302). Next, the data type setting unit 133 adds 1 to the data section number i (step S303). Next, the data type setting unit 133 determines whether the data section number i is greater than the total number of data sections I (step S304). If the data section number i is greater than the total number of data sections I (step S304: Yes), the data type setting unit 133 ends the processing.

[0062] In step S304, if the data section number i is equal to or smaller than the total number of data sections I (step S304: No), the data type setting unit 133 returns to step S302 and executes the subsequent processes.

[0063] Here, a detailed description will be given of the types of data types set by the data type setting unit 133. As described above, the data type is information that is set based on the standard of the input data of the inspection target device 200, and any one of the numeric type, enumeration type, string type, and flag type is set.

[0064] The numeric type is a data type that is set when the normal data in the corresponding data section can take a numeric value such as an integer. The enumeration type is a data type that is set when the normal data in the corresponding data section is not necessarily a numeric value, and each option is assigned a numeric value in a format that can be expressed in the data section in order to uniquely select a specific option from multiple options in the corresponding data section, where the normal data is not necessarily a numeric value. The string type is a data type that is set when the normal data in the corresponding data section is data consisting of character strings such as ASCII code or UTF-8. The flag type is set when the normal data in the corresponding data section is composed of bits that indicate one of two exclusive states, such as whether a specific function is enabled or disabled, or whether it is present or not, depending on whether each bit is 0 or 1.

[0065] For example, in the case of the above-mentioned normal data, data type setting unit 133 sets the data type as follows, and stores it in storage unit 120 as information indicating the data type of the specified section number. ID: interval number = 1, enumeration type Format type: Section number = 2, Enumeration type Codec:IntervalNumber=3, Enumeration bitrate:interval number=4, enumeration Sampling frequency: interval number = 5, enumeration type Copyright information: section number = 6, flag type Song title information data length: Section number = 7, Numeric type Song title information: Section number = 8, String type

[0066] The data type setting unit 133 accepts an input for setting a data type from the user via the input unit 140 and sets the data type. That is, the data type setting unit 133 accepts an input of a data type corresponding to the data section i from the user via the input unit 140. At that time, a screen for confirming the input contents or a GUI (Graphical User Interface) may be displayed on the display unit 150, and the user inputs this information using the mouse or keyboard of the input unit 140. However, the present invention is not limited to this, and the data type setting unit 133 may automatically set the data type based on the standard information of the regular data.

[0067] The set type is data type information including the interval number and its data type, but the interval number is not necessarily required, and the data type may be used as information and the types may be expressed in ascending order from the beginning. In this way, any information that uniquely determines the type of data type for any interval from the beginning may be sufficient.

[0068] Furthermore, data type setting unit 133 stores information indicating the type thus set (information about the data type) in data type setting storage unit 123.

[0069] (Rule information setting process) The rule information acquisition unit 134 acquires rule information for each data type from the rule information storage unit 121. As described above, the rule information includes, for each data type, data values ​​that the data type can take, a ranking (ranking information) associated with the data value, and evaluation value information associated with the ranking information. The data values ​​are classified, for example, into normal values ​​and values ​​other than normal values ​​(abnormal values). The ranking is determined by the number of occurrences of the data value. The update of the number of occurrences and rankings will be described in the processing of the rule information update unit 138 described later.

[0070] For example, rule information acquisition unit 134 acquires data section information of section number 1 set by data section setting unit 132 from data section setting storage unit 122, and then acquires the data type of data section 1 set by data type setting unit 133 from data type setting storage unit 123. Next, rule information corresponding to the acquired data type is acquired from rule information storage unit 121, and if it has not been acquired yet, rule information corresponding to the enumeration type, which is the data type of section number 1, is acquired from rule information storage unit 121. Also, if rule information of the enumeration type has already been acquired, the acquisition process is not performed and the process moves to the next process. In the next process, it is determined whether or not a data section with the next section number exists, and if a data section with the next section number exists, the same process as the data section with section number 1 described above is performed, and if a data section with the next section number does not exist, the process ends.

[0071] (Data setting process) The data generation unit 135 generates fuzzing data according to the rule information. In this embodiment, the data generation unit 135 assigns an evaluation value to a range of values ​​that can be obtained by the number of bits of each data section according to the rule information of the data type of each data section, and selects a value from each data section according to the evaluation value to generate fuzzing data.

[0072] The process of the data generating unit 135 will be described with reference to FIG. 11. First, the data generating unit 135 executes reading of normal data (step S401). Next, the data generating unit 135 sets the data interval number i to 1 by setting i=1 (step S402). Next, the data generating unit 135 calculates the range of possible values ​​from the interval length of the data interval i (step S403). Next, the data generating unit 135 sets evaluation values ​​to all possible values ​​based on the rule information of the data type of the data interval i (step S404). Next, the data generating unit 135 adds 1 to the data interval number i by setting i=i+1 (step S405). Next, the data generating unit 135 determines whether the data interval number i is greater than the total number of data intervals I (step S406). If the data interval number i is greater than the total number of data intervals I (step S406: Yes), the data generating unit 135 ends the process.

[0073] It should be noted that in step S406, if the data section number i is smaller than the total number of data sections I (step S406: No), the data generator 135 returns to step S403 and executes the subsequent processes.

[0074] For example, in the case of the normal data described above, the range of values ​​that can be taken in each data section is as follows: ID: 0x00-0xFF (0 to 255) Format type: 0x0-0xF (0 to 15) Codec: 0x0-0xF (0 to 15) Bitrate: 0x0-0xF (0 to 15) Sampling frequency: 0x0-0xF (0 to 15) Copyright information: 0x0-0xF (0 to 15) Song title information data length: 0x00-0xFF (0 to 255) Song title information: 0x00-0xFF (0 to 255) In response to this, an evaluation value for each candidate value is set based on rule information corresponding to the data type of each data section, as in the example described below.

[0075] The data generating unit 135 extracts data values ​​corresponding to candidate values ​​of a data section from the rule information. Then, the data generating unit 135 sets an evaluation value associated with the extracted data value in the rule information (an evaluation value associated with the rank of the extracted data value) as an evaluation value of the candidate value of the data section. The data generating unit 135 repeats the same process for each data section and each candidate value, and sets an evaluation value for each candidate value.

[0076] An example of the evaluation value of the candidate value set for the ID of data section 1 will be described with reference to FIG. 13. FIG. 13 is a diagram showing an example of the evaluation value of the candidate value set for data section 1 according to the present disclosure. First, since the ID of data section 1 is an enumeration type, an evaluation value is set to a value that this data section length can take based on the rule information of the enumeration type. In data section 1, since only 0x01 is a normal value, 0x00 and values ​​from 0x02 to 0xFF are outside the normal value. First, for the normal value 0x01, it is set as the median value within the normal values ​​of the rule information, and an evaluation value of 4, ranked 1, is set (in the case of data section 1, since only 0x01 is a normal value, an evaluation value of the median within the normal values ​​is set).

[0077] If the rule information provides a separate rule for when there is only one normal value, that evaluation value is set. Alternatively, if there is only one normal value and an evaluation value of either the minimum value, maximum value, or median is set, that evaluation value is set. Next, among values ​​outside the normal values, 0xFE, which is the bit inversion of the normal value 0x01, is set to an evaluation value of 3, and the other values ​​0x00, 0x02 to 0xFD, and 0xFF are set to an evaluation value of 2.

[0078] An example of the evaluation values ​​of the candidate values ​​set for the format type, codec, bit rate, and sampling frequency of data intervals 2 to 5 will be described with reference to Figs. 14 to 17, respectively. Fig. 14 is a diagram showing an example of the evaluation values ​​of the candidate values ​​set for data interval 2 according to the present disclosure. Fig. 15 is a diagram showing an example of the evaluation values ​​of the candidate values ​​set for data interval 3 according to the present disclosure. Fig. 16 is a diagram showing an example of the evaluation values ​​of the candidate values ​​set for data interval 4 according to the present disclosure. Fig. 17 is a diagram showing an example of the evaluation values ​​of the candidate values ​​set for data interval 5 according to the present disclosure. As with data interval 1, the data types of the format type, codec, bit rate, and sampling frequency of data intervals 2 to 5 are enumerated types, so that the evaluation values ​​shown in Figs. 14 to 17 are set, respectively.

[0079] Next, an example of the evaluation value of the candidate value set in the copyright information of the data section 6 will be described with reference to FIG. 18. FIG. 18 is a diagram showing an example of the evaluation value of the candidate value set in the data section 6 according to the present disclosure. Since the copyright information of the data section 6 is a flag type, the evaluation value is set to a value that this data section length can take based on the flag type rule information. The possible values ​​in the data section 6 are 0x0 to 0xF, of which 0x0, 0x1, 0x8, and 0x9 are values ​​within the normal value range, and other values ​​are values ​​outside the normal value range. According to the rule information, 0x0 is set to an evaluation value of 1 as a normal value indicating that the function is disabled, and 0x1, 0x8, and 0x9 are set to an evaluation value of 3 as normal values ​​indicating that the function is enabled. In addition, the values ​​0x6, 0x7, 0xE, and 0xF obtained by bit-inverting the normal values ​​are set to an evaluation value of 4, and the other values ​​0x2 to 0x5 and 0x9 to 0xD are set to an evaluation value of 2.

[0080] Next, an example of the evaluation value of the candidate value set in the song title information data length of the data section 7 will be described with reference to FIG. 19. FIG. 19 is a diagram showing an example of the evaluation value of the candidate value set in the data section 7 according to the present disclosure. Since the song title information data length of the data section 7 is a numeric type, an evaluation value is set to a value that this data section length can take based on the rule information of the numeric type. The possible values ​​in the data section 7 are 0x00 to 0xFF, of which 0x00 to 0x3F are normal values, and the other values ​​from 0x40 to 0xFF are out of the normal values. Among the values ​​0x00 to 0x3F within the normal values ​​according to the rule information, the minimum value 0x00 is set to an evaluation value of 1, the maximum value 0x3F is set to an evaluation value of 2, and the median values ​​0x1F and 0x20 are set to an evaluation value of 1. In addition, the other values ​​within the normal values ​​0x01 to 0x1E and 0x21 to 0x3E are set to an evaluation value of 1. Next, for the out-of-normal values ​​between 0x40 and 0xFF, the minimum out-of-normal value 0x40 is assigned an evaluation value of 3, the maximum out-of-normal value 0xFF is assigned an evaluation value of 4, and the median out-of-normal values ​​0x9F and 0xA0 are assigned an evaluation value of 1. Additionally, the out-of-normal values ​​between 0x41 and 0x9E, and between 0xA1 and 0xFE are assigned an evaluation value of 1.

[0081] Next, an example of the evaluation value of the candidate value set for the character string type of data section 8 will be described with reference to FIG. 20. FIG. 20 is a diagram showing an example of the evaluation value of the candidate value set for data section 8 according to the present disclosure. Since data section 8 is a character string type, the evaluation value is set to the possible values ​​of the data section length per character, 0x00 to 0xFF, based on the rule information of the character string type. First, among the normal values ​​from 0x00 to 0x7E, the evaluation value 4 is set to the values ​​from 0x00 to 0x1F, which are codes representing control. Next, the evaluation value 2 is set to the values ​​from 0x20 to 0x7E, which are codes representing letters, numbers, and symbols. And finally, the evaluation value 3 is set to the values ​​from 0x80 to 0xFF, which are values ​​other than the normal values.

[0082] After setting the evaluation value for the candidate value of each data section, the data generation unit 135 next selects one arbitrary data value in each data section and sums up the evaluation values ​​of the data values ​​for all data sections. The data generation unit 135 generates fuzzing data to be used in the fuzzing test based on the sum of the evaluation values ​​in all data sections. An example of the result of summing up the evaluation values ​​of the selected data values ​​for all data sections will be described with reference to FIG. 21 and FIG. 22. FIG. 21 is a diagram showing a first example of the evaluation value of the selected data value in the fuzzing data according to the present disclosure and the sum of the evaluation values ​​of the combination thereof. FIG. 22 is a diagram showing a second example of the evaluation value of the selected data value in the fuzzing data according to the present disclosure and the sum of the evaluation values ​​of the combination thereof. That is, as in the first example shown in FIG. 21 and the second example shown in FIG. 22, when the data values ​​of each data section are the data values ​​shown in FIG. 21 and FIG. 22, respectively, the sum of the respective evaluation values ​​is 26 in the first example and 18 in the second example. In this way, the data generation unit 135 calculates the sum for all combinations of data values, and finally generates the combination of data values ​​with the largest sum as fuzzing data. In addition, when generating multiple fuzzing data, the data generation unit 135 generates the required number of fuzzing data in descending order from the combination of data values ​​with the largest sum.

[0083] However, in an actual fuzzing test, when it is desired to save the trouble of calculating the sum of all combinations of data values, for data values ​​for which a range of possible values ​​is set in a data interval, the calculation may be performed by fixing the data value to any one of the possible ranges. Also, in order to avoid selecting only a specific data value, it is possible to select a combination of data values ​​whose sum is closest to an arbitrary sum, rather than a combination of data values ​​whose sum is large, or to limit the number of data intervals for which rank 1 is selected. Also, when generating multiple fuzzing data, it is possible to prevent a data value that has been selected once from being selected.

[0084] (Data transmission process) The data transmission unit 136 transmits the generated fuzzing data to the inspection target device 200. The data transmission unit 136 transmits the fuzzing data via the communication unit 110 by a communication means such as USB, Bluetooth (registered trademark), or Wi-Fi (registered trademark) that corresponds to the inspection target device 200. That is, the data transmission unit 136 may use the communication unit 110 that complies with the communication means of the inspection target device 200.

[0085] (Receiving and processing alive monitoring data for the device under test) The inspection target device 200 executes a fuzz test using the fuzzing data acquired from the data transmission unit 136. That is, the inspection target device 200 executes a process to be monitored using the fuzzing data as input data. The inspection target device 200 outputs information indicating the result of the process as monitoring data. The monitoring data receiving unit 137 receives the monitoring data from the inspection target device 200. Here, after processing the fuzzing data received from the data transmission unit 136, the inspection target device 200 outputs whether the process has been completed normally or not. The monitoring data receiving unit 137 receives from the inspection target device 200 the processing result of either normal completion or abnormal completion.

[0086] The transmission and reception of the processing result between the monitoring data receiving unit 137 and the inspection target device 200 may be performed via the network N, or a dedicated interface for data transmission and reception may be used. In particular, when the processing of the fuzzing data of the inspection target device 200 ends normally, the interface used for transmitting and receiving the fuzzing data may be used. Furthermore, the monitoring data receiving unit 137 stores in advance an approximate processing time until the inspection target device 200 normally completes the processing, and when an abnormality occurs in the inspection target device 200 and it is not possible to output an indication that the processing has not been normally completed, it is determined that a processing result of abnormal termination has been received as a timeout.

[0087] (Rule information update process) The rule information update unit 138 changes the ranking of the multiple numerical values ​​(each data value) used as fuzzing data in the rule information based on the result of the fuzzing test. More specifically, when the result of the fuzzing test is an abnormal response, the rule information update unit 138 raises the ranking of the data value corresponding to the numerical value of the fuzzing data used in the fuzzing test, and when the result of the fuzzing test is a normal response, the rule information update unit 138 lowers the ranking of the data value corresponding to the numerical value of the fuzzing data used in the fuzzing test. Furthermore, the rule information update unit 138 increases the number of times an abnormality has occurred (the number of times an abnormal response of a data value has occurred) associated with the data value corresponding to the numerical value included in the fuzzing data used in the abnormally terminated process in the rule information. In this way, by increasing the number of times an abnormality has occurred for the abnormally terminated data value, if the number of times an abnormality has occurred for that data value exceeds the number of times an abnormality has occurred for other data values, the rule information update unit 138 changes the ranking of the data value based on a comparison of the number of times an abnormal response has occurred. Note that an abnormal response is a response that has abnormally terminated after the inspection target device 200 processes the fuzzing data. Moreover, a normal response is a response that ends normally after the test target device 200 processes the fuzzing data.

[0088] Such processing by the rule information update unit 138 will be described with reference to FIG. 23. FIG. 23 is a flowchart showing the flow of processing by the rule information update unit of the data generating device according to the present disclosure. Processing by the rule information update unit will be described along the flow shown in FIG. 23. First, the rule information update unit 138 judges whether the monitoring data receiving unit 137 has received a processing result of abnormal termination (step S501). If the monitoring data receiving unit 137 has received a processing result of abnormal termination (step S501: Yes), the rule information update unit 138 sets the data section i to 1, i=1 (step S502). Next, the rule information update unit 138 acquires the numerical value Vi of the data section i of the transmitted fuzzing data (step S503). Next, the rule information update unit 138 acquires the rule information Ri of the data section i of the transmitted fuzzing data (step S504). Next, the rule information update unit 138 sets the rank j to 1, i=1 (step S505).

[0089] Next, the rule information update unit 138 determines whether Vi is a data value of rank j (step S506). If Vi is a data value of rank j in step S506 (step S506: Yes), the rule information update unit 138 increments the number of occurrences of the jth rank by +1 (step S508). Next, the rule information update unit 138 determines whether j-1<1 (step S509). If j-1<1 in step S509 (step S509: Yes), the rule information update unit 138 records the updated rule information (step S513).

[0090] In step S501, if the monitoring data receiving unit 137 does not receive a processing result indicating an abnormal end (step S501: No), the rule information updating unit 138 ends the process.

[0091] In step S506, if Vi is not the data value of rank j (step S506: No), the rule information update unit 138 sets j=j+1 (step S507). Next, the rule information update unit 138 returns to step S505 and executes the subsequent processes.

[0092] In step S509, when j - 1 < 1 is not true (step S509: No), the rule information update unit 138 determines whether the occurrence count of the data value at the (j - 1)-th position of Ri is less than the occurrence count of the data value at the j-th position (step S510). In step S510, when the occurrence count of the data value at the (j - 1)-th position of Ri is less than the occurrence count of the data value at the j-th position (step S510: Yes), the rule information update unit 138 swaps the (j - 1)-th and j-th positions of Ri (step S511). Next, the rule information update unit 138 sets j = j - 1 (step S512). Next, the rule information update unit 138 returns to step S509 and executes the subsequent processing.

[0093] Note that in step S510, when the occurrence count of the data value at the (j - 1)-th position of Ri is not less than the occurrence count of the data value at the j-th position (step S510: No), the rule information update unit 138 proceeds to step S513 and executes the subsequent processing.

[0094] Specifically, when the monitoring data reception unit 137 receives an abnormal termination, the rule information update unit 138 acquires the numerical value of the fading data transmitted in data section 1 from the data transmission unit 136. Also, the data type setting unit 133 provides the data type of data section 1, and further, the rule information storage unit 121 provides the rule information of the data type of data section 1. Next, it is determined, in descending order from the 1st position of the rule information, which position of the data value the value of data section 1 of the transmitted fading data corresponds to. Then, when the corresponding rank is found, the occurrence count of that rank is incremented by 1. Next, the rank is updated according to the changed occurrence count. Although the rank may not be changed depending on the occurrence count, at least when the rank is changed, the rule information update unit 138 stores the new rule information with the changed rank in the rule information storage unit 121.

[0095] In the above example, the rule information update unit 138 performs a process of updating the rule information only when the test ends abnormally, but when the test ends normally, for example, a process of lowering the ranking of the values ​​used in each data section at that time may be performed. That is, when the result of the fuzzing test is an abnormal response, the rule information update unit 138 may raise the ranking of the numerical value of the fuzzing data used in the fuzzing test based on the number of occurrences of the abnormal response, and when the result of the fuzzing test is a normal response, the rule information update unit 138 may lower the ranking of the numerical value of the fuzzing data used in the fuzzing test based on the number of occurrences of the normal response.

[0096] Furthermore, the rule information update unit 138 may determine the rank of the numerical value of the fuzzing data based on the number of times the numerical value of the fuzzing data is used (the number of times the data value is adopted as fuzzing data), and may raise the rank of the numerical value of the fuzzing data if the number of times the numerical value of the fuzzing data is used is less than a predetermined threshold. Here, the predetermined threshold may be set arbitrarily, and may be determined, for example, according to the time required for the inspection target device 200 to process the fuzzing data. Note that the number of times used means the number of times the numerical value of the fuzzing data is input to the inspection target device 200 as fuzzing data.

[0097] The input unit 140 accepts various operations from the user. For example, the input unit 140 may include a keyboard and a mouse and accept various operations from the user. In addition, when the display unit 150 is a touch panel, the touch panel may be used as the input unit 140, and various operations from the user may be accepted through the touch panel. Note that the touch panel may be of various types, such as a resistive film type, a capacitive type, a surface acoustic wave type, an infrared type, or an electromagnetic induction type.

[0098] The display unit 150 displays various types of information. For example, the display unit 150 may display a GUI for accepting operations related to various processes. The display unit 150 may be realized by a liquid crystal display, an organic EL (Electro Luminescence) display, a micro LED (Light Emitting Diode) display, or the like. Furthermore, the display unit 150 may be a touch panel as described above.

[0099] (Configuration of the device to be inspected) Next, a configuration example of the inspection target device 200 according to the present disclosure will be described with reference to Fig. 24. Fig. 24 is a diagram showing a configuration example of the inspection target device according to the present disclosure. As shown in Fig. 24, the inspection target device 200 according to the present disclosure includes a communication unit 210, a storage unit 220, and a control unit 230. Below, these configurations will be described in order.

[0100] The communication unit 210 is responsible for transmitting and receiving various information between external devices via wired or wireless communication. In the case of wired communication, it may be equipped with an interface such as a USB terminal, an SDI terminal, or an HDMI (registered trademark) terminal. In the case of wireless communication, it may be realized by a wireless LAN defined by IEEE802.11, Bluetooth (registered trademark), Wi-Fi (registered trademark), or the like.

[0101] The storage unit 220 is a storage device that stores various types of information. The storage unit 220 includes a main storage device and an auxiliary storage device. The main storage device may be realized by a semiconductor memory element such as a RAM, a ROM, or a flash memory. The auxiliary storage device may be realized by a hard disk, an SSD, or the like.

[0102] The control unit 230 is a controller that executes various arithmetic processes and processes that realize functions. The control unit 230 is realized by a CPU, an MPU, or the like executing various programs stored in the storage unit 120 using the RAM as a working area. The control unit 130 may also be realized by an integrated circuit such as an ASIC or an FPGA.

[0103] As shown in FIG. 24, the control unit 230 includes a data acquisition unit 231, a process execution unit 232, an abnormality detection unit 233, and an abnormality notification unit 234.

[0104] The control unit 230 realizes these functions and executes these processes by reading and executing a program (software) from the storage unit 220. Note that these functions of the control unit 230 may be realized by electronic circuits. The control unit 230 may execute these processes by one CPU, or may be provided with multiple CPUs and execute these processes in parallel by the multiple CPUs. Below, these configurations will be explained in order.

[0105] The data acquisition unit 231 acquires fuzzing data. That is, the data acquisition unit 231 acquires the fuzzing data by receiving the fuzzing data transmitted from the data transmission unit 136 of the data generation device 100 via the communication unit 210. Upon acquiring the fuzzing data, the data acquisition unit 231 passes the acquired fuzzing data to the process execution unit 232.

[0106] The process execution unit 232 executes various processes using the fuzzing data. For example, the process execution unit 232 executes processes such as music playback, video playback, and route search in a car navigation system.

[0107] The anomaly detection unit 233 detects anomalies that occur when various processes using fuzzing data are executed. For example, the anomaly detection unit 233 detects that an abnormal end has occurred or an abnormal response has been shown during the execution of various processes using fuzzing data.

[0108] When the anomaly detection unit 233 detects an anomaly during execution of processing of fuzzing data, the anomaly notification unit 234 notifies the data generating device 100 that an anomaly has occurred. Specifically, the anomaly notification unit 234 notifies the data generating device 100 that an anomaly has occurred by distinguishing between an abnormal end and an abnormal response. The anomaly notification unit 234 transmits the anomaly occurrence via the communication unit 210 by a communication means such as USB, Bluetooth (registered trademark), or Wi-Fi (registered trademark) that corresponds to the data generating device 100. That is, the anomaly notification unit 234 may use the communication unit 210 that complies with the communication means of the data generating device 100.

[0109] (Effects of the data generation device) As described above, the data generation device 100 generates fuzzing data, performs testing, updates the rule information based on the results, and then generates fuzzing data based on the rule information and performs further fuzz testing using the fuzzing data. By repeating this process multiple times, it becomes possible to gradually generate fuzzing data that is more likely to cause problems in the test target device 200.

[0110] In addition, setting an evaluation value based on the ranking and generating fuzzing data using that evaluation value avoids testing using fuzzing data that is based on abnormalities of a specific value that have frequently occurred in a specific section in the past, and that will only produce abnormal responses of that specific value from the next time onwards, making it possible to perform a fuzz test that fulfills its original role as a black box test.

[0111] Furthermore, by selecting not only the data combination with the highest summed evaluation value, but also multiple combinations of data with the highest summed values ​​in descending order, or by limiting the number of data intervals from which to select the data that ranks first, or by limiting the data combination that is closest to an arbitrary summed value, it becomes possible to conduct fuzz testing that is more likely to cause problems while still fulfilling its role as a black box, rather than simply using fuzz data to detect abnormal responses of specific values ​​only.

[0112] (Composition and Effects) Data generating device 100 according to the present disclosure includes a rule information storage unit 121 that stores rule information that ranks numerical values ​​to be used as data, a data generating unit 135 that generates data according to the rule information read from the rule information storage unit 121, and a rule information updating unit 138 that updates the rule information stored in the rule information storage unit 121, and rule information updating unit 138 changes the ranking of the numerical values ​​based on the results of the test and stores the changed ranking of the numerical values ​​in the rule information storage unit 121.

[0113] According to this configuration, fuzzing data is generated based on rule information that ranks the numerical values ​​used in the fuzzing data, a fuzzing test is executed, and the rule information can be updated by changing the rank of the numerical values ​​used in the fuzzing data based on the results of the fuzzing test. Therefore, by repeatedly executing multiple fuzzing tests, it becomes possible to generate fuzzing data that is more likely to cause problems in the inspection target device 200. Therefore, it is possible to provide a data generation device 100 that can generate fuzzing data that is more likely to cause anomalies with a limited number of attempts.

[0114] If the test result is an abnormal response, the rule information update unit 138 of the data generating device 100 according to the present disclosure raises the rank of the numerical value used in the test based on the number of times that the abnormal response occurred, and if the test result is a normal response, lowers the rank of the numerical value used in the test based on the number of times that the normal response occurred.

[0115] According to this configuration, based on the results of the fuzzing test, the fuzzing data used in the fuzzing test can be ranked higher in the case of an abnormal response and lowered in the case of a normal response, thereby generating fuzzing data that is more likely to cause an abnormal response. Therefore, it is possible to provide a data generation device 100 that can generate fuzzing data that is more likely to cause an abnormality with a limited number of tries.

[0116] The rule information update unit 138 of the data generating apparatus 100 according to the present disclosure further determines the rank of the numerical values ​​based on the number of times the numerical values ​​are used, and raises the rank of the numerical values ​​if the number of times the numerical values ​​are used is less than a predetermined threshold.

[0117] According to this configuration, when the number of times the numerical value of the fuzzing data is used is less than a predetermined threshold, the ranking of the numerical value of the fuzzing data can be raised. Therefore, it is possible to encourage the generation of numerical values ​​of fuzzing data that are not used often, and to encourage the generation of fuzzing data that is more likely to cause anomalies from among the numerical values ​​that are not used.

[0118] The data generation method according to the present disclosure includes the steps of storing rule information that ranks numerical values ​​to be used as data in the rule information storage unit 121, generating data in accordance with the rule information read from the rule information storage unit, and updating the rule information stored in the rule information storage unit 121, and in the step of updating the rule information, the ranking of the numerical values ​​is changed based on the results of the test, and the changed ranking of the numerical values ​​is stored in the rule information storage unit 121.

[0119] According to this configuration, fuzzing data is generated based on rule information that ranks the possible values ​​of the fuzzing data, a fuzzing test is executed, and the rule information can be updated by changing the ranking of the possible values ​​of the fuzzing data based on the results of the fuzzing test. Therefore, by repeatedly executing multiple fuzzing tests, it becomes possible to generate fuzzing data that is more likely to cause problems in the inspection target device 200. Therefore, it is possible to provide a data generation method that can generate fuzzing data that is more likely to cause an abnormality in a limited number of times.

[0120] The program of the present disclosure causes a computer to execute the steps of storing rule information that ranks numerical values ​​to be used as data in the rule information storage unit 121, generating data according to the rule information read from the rule information storage unit 121, and updating the rule information stored in the rule information storage unit 121, and in the step of updating the rule information, the ranking of the numerical values ​​is changed based on the results of the test, and the changed ranking of the numerical values ​​is stored in the rule information storage unit 121.

[0121] According to this configuration, fuzzing data is generated based on rule information that ranks the possible values ​​of the fuzzing data, a fuzzing test is executed, and the rule information can be updated by changing the ranking of the possible values ​​of the fuzzing data based on the results of the fuzzing test. Therefore, by repeatedly executing multiple fuzzing tests, it becomes possible to gradually generate fuzzing data that is more likely to cause problems in the inspection target device 200. Therefore, it is possible to provide a program that can generate fuzzing data that is more likely to cause an abnormality in a limited number of times.

[0122] Although the embodiment of the present invention has been described above, the embodiment is not limited to the contents of this embodiment. The above-mentioned components include those that a person skilled in the art can easily imagine, those that are substantially the same, and those that are within the so-called equivalent range. Furthermore, the above-mentioned components can be appropriately combined. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the gist of the above-mentioned embodiment. [Explanation of symbols]

[0123] 1 Test System 100 Data generating device 110 Communications Department 120 Storage section 121 Rule information storage unit 122 Data section setting memory unit 130 Control section 131 Regular Data Acquisition Department 132 Data section setting section 133 Data Type Setting Section 134 Rule information acquisition unit 135 Data Generation Division 136 Data transmission unit 137 Monitoring data receiver 138 Rule Information Update Department 140 Input section 150 Display section 200 Equipment to be inspected 210 Communications Department 220 Storage section 230 Control Unit 231 Data Acquisition Department 232 Processing Execution Unit 233 Anomaly Detection Unit 234 Abnormality notification section N Network

Claims

1. a rule information storage unit that stores rule information that ranks the numerical values ​​used as data; a data generating unit that generates data in accordance with the rule information read from the rule information storage unit; a rule information update unit that updates the rule information stored in the rule information storage unit, the rule information update unit changes the ranking of the numerical values ​​based on a result of a test using the data, and updates the rule information according to the changed ranking of the numerical values. Data generation device.

2. The rule information update unit, If the test result is an abnormal response, increase the rank of the value used in the test based on the number of occurrences of the abnormal response; If the test result is a normal response, lower the ranking of the value used in the test based on the number of normal responses that occurred; The data generating device according to claim 1 .

3. The rule information update unit further determining a rank for the values ​​based on the number of times the values ​​were used in the data used in the test; 3. The data generating device according to claim 1 or 2.

4. storing rule information in which the numerical values ​​used as data are ranked in a rule information storage unit; generating data in accordance with the rule information read from the rule information storage unit; updating the rule information stored in the rule information storage unit; In the step of updating the rule information, the ranking of the numerical values ​​is changed based on a result of a test using the data, and the rule information is updated based on the changed ranking of the numerical values. Data generation method.

5. On the computer, storing rule information in which the numerical values ​​used as data are ranked in a rule information storage unit; generating data in accordance with the rule information read from the rule information storage unit; updating the rule information stored in the rule information storage unit; Run the command, In the step of updating the rule information, the ranking of the numerical values ​​is changed based on a result of a test using the data, and the rule information is updated based on the changed ranking of the numerical values. program.

Images