Data generation device, data generation method, and program

Abstract

To evaluate problems efficiently with a limited number of data.SOLUTION: The data generator includes: a data section setting unit for dividing input data as the source of data into more than one data section; a candidate value determination unit for determining the candidate value of the data from a data value which can be acquired in the data sections; a candidate value evaluation setting unit for setting a first evaluation value of a problem evaluation in the candidate value of the data; and a data generation unit for generating data on the basis of the first evaluation value set in the candidate value of the data. The data generation unit selects a candidate value on the basis of the first evaluation value of a plurality of candidate values set in each of the data sections and generates data.SELECTED DRAWING: Figure 8

Description

Technical Field

[0001] The present disclosure relates to a data generation device, a data generation method, and a program.

Background Art

[0002] To inspect unknown vulnerabilities in software, there is a test method called fuzzing. The test method called fuzzing is a method of inputting data having values that are not originally input to the software and monitoring the behavior of the software at that time to check for defects that may lead to vulnerabilities.

[0003] Patent Document 1 discloses setting fuzz data (fuzzing data) for each address of binary values included in a file.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] In Patent Document 1, all values ​​other than the canonical value that should be set for each address are set as fuzzing data. For example, if 256 different values ​​can be set for a single address, then 255 values ​​other than the single canonical value become fuzzing data. Therefore, in the method of setting fuzzing data disclosed in Patent Document 1, the number of fuzzing data increases as the number of values ​​that can be set for a single address increases, which leads to a problem of increased load on fuzzing tests. Also, if the number of addresses increases, the number of values ​​that should be set as fuzzing data increases by 255 each time, which leads to a problem of increased load on fuzzing tests. For this reason, there is a need to generate fuzzing data that can efficiently find vulnerabilities with a limited amount of data.

[0006] However, if the designer of the fuzzing test intentionally generates fuzzing data, while the likelihood of discovering pre-anticipated defects increases, there is a risk of deviating from the original purpose of fuzzing, which is to discover unknown vulnerabilities. Similarly, while it is possible to generate fuzzing data mechanically using the method described in Patent Document 1, it becomes difficult to discover defects caused by data other than specific addresses.

[0007] This disclosure is made in view of the above, and aims to provide a data generation device, a data generation method, and a program that can generate data for efficiently performing defect evaluation with a limited number of data points. [Means for solving the problem]

[0008] The data generation device of the present disclosure is a data generation device for generating data used in fuzzing tests, comprising: a data interval setting unit that divides input data which is the source of the data into a plurality of data intervals; a candidate value determination unit that determines candidate values ​​for the data from data values ​​that can be obtained in the data intervals; a candidate value evaluation setting unit that sets a first evaluation value for defect evaluation for the candidate values ​​of the data; and a data generation unit that generates data based on the first evaluation value set for the candidate values ​​of the data, wherein the data generation unit selects candidate values ​​based on the first evaluation values ​​of a plurality of candidate values ​​set in each of the plurality of data intervals and generates them as the data.

[0009] The data generation method disclosed herein is a data generation method performed by a data generation device that generates data used for fuzzing testing, and comprises: a data interval setting process that divides the input data that is the source of the data into a plurality of data intervals; a candidate value determination process that determines candidate values ​​for the data from data values ​​that can be obtained in the data intervals; a candidate value evaluation setting process that sets a first evaluation value for defect evaluation for the candidate values ​​of the data; and a data generation process that generates data based on the first evaluation value set for the candidate values ​​of the data, wherein the data generation process selects candidate values ​​based on the first evaluation values ​​of a plurality of candidate values ​​set in each of the plurality of data intervals and generates them as the data.

[0010] The program of this disclosure is a program to be executed by a data generation device that generates data to be used for fuzzing testing, and it is configured to execute: a data interval setting process that divides the input data that is the source of the data into a plurality of data intervals; a candidate value determination process that determines candidate values ​​for the data from the data values ​​that can be obtained in the data intervals; a candidate value evaluation setting process that sets a first evaluation value for defect evaluation for the candidate values ​​of the data; and a data generation process that generates data based on the first evaluation value set for the candidate values ​​of the data, wherein the data generation process selects candidate values ​​based on the first evaluation values ​​of a plurality of candidate values ​​set in each of the plurality of data intervals and generates them as the data. [Effects of the Invention]

[0011] According to this disclosure, it is possible to generate data for efficiently performing defect evaluation with a limited amount of data. [Brief explanation of the drawing]

[0012] [Figure 1] Figure 1 is a block diagram showing the device configuration of the fuzzing data generation apparatus according to this embodiment. [Figure 2] Figure 2 is a block diagram illustrating the functionality of the fuzzing data generation device according to this embodiment. [Figure 3] Figure 3 shows an example of input data. [Figure 4] Figure 4 shows an example of a first evaluation value for candidate values. [Figure 5] Figure 5 shows an example of the second evaluation value and the calculated evaluation value. [Figure 6] Figure 6 shows an example of the second evaluation value and the calculated evaluation value. [Figure 7] Figure 7 shows an example of a calculated evaluation value in an interval combination pattern. [Figure 8] Figure 8 is a flowchart of the fuzzing data generation method according to this embodiment. [Figure 9] Figure 9 is a flowchart of the data interval setting process. [Figure 10] Figure 10 is a flowchart of the data type setting process. [Figure 11] Figure 11 is a flowchart of the candidate value determination process. [Figure 12] Figure 12 is a flowchart of the candidate value evaluation and setting process. [Figure 13] Figure 13 is a flowchart of the combination generation process. [Figure 14] Figure 14 is an explanatory diagram of the interval combination patterns generated by the combination generation process. [Figure 15]FIG. 15 is a flowchart of the combination evaluation setting process. [Figure 16] FIG. 16 is a flowchart of the fading data generation process. [Figure 17] FIG. 17 is a flowchart regarding the output process of the fading data. [Figure 18] FIG. 18 is a diagram showing an example of the first evaluation value and the second evaluation value. [Figure 19] FIG. 19 is a diagram showing an example of the first evaluation value and the second evaluation value. [Figure 20] FIG. 20 is a diagram showing an example of the calculated evaluation value in the interval combination pattern. [Embodiments for Carrying Out the Invention]

[0013] Hereinafter, embodiments of the communication terminal according to the present invention will be described in detail based on the drawings. Note that the present invention is not limited by this embodiment.

[0014] [This Embodiment] FIG. 1 is a block diagram showing the device configuration of the fading data generation device according to this embodiment. FIG. 2 is a block diagram functionally showing the fading data generation device according to this embodiment. FIG. 3 is a diagram showing an example of input data. FIG. 4 is a diagram showing an example of the first evaluation value of candidate values. FIGS. 5 and 6 are diagrams showing examples of the second evaluation value and the calculated evaluation value. FIG. 7 is a diagram showing an example of the calculated evaluation value in the interval combination pattern.

[0015] (Fading Data Generation Device) The fading data generation device (data generation device) 1 of this embodiment is, for example, a computer device. Note that the fading data generation device 1 may be an information processing system composed of a group of computer devices. That is, the hardware configuration of the fading data generation device 1 is not particularly limited.

[0016] The fuzzing data generator 1 is a device that generates fuzzing data to be input to the equipment under test that is the subject of fuzzing testing. Fuzzing testing is a testing method that checks for unknown vulnerabilities in a system or software under evaluation by inputting data with values ​​that would not normally be input to the system or software under evaluation and monitoring the behavior of the software at that time to confirm whether there are any defects that could lead to vulnerabilities. Fuzzing data is invalid data, unexpected data, and random data that are not normally expected in the standards to which the equipment under test conforms, and is abnormal data that may cause the equipment under test to malfunction. The fuzzing data generator 1 may be installed in the same device as the equipment under test.

[0017] Referring to Figure 1, the configuration of the fuzzing data generation device 1 will be described. The fuzzing data generation device 1 includes a UI (User Interface) 5, a storage unit 7, and a control unit 8.

[0018] The User Interface (UI) 5 accepts user input and outputs information to the user. Examples of UI 5 include input devices such as keyboards, display units such as LCD panels and OLED panels, speakers, and microphones. The UI 5 inputs information received from the user to the control unit 8. Furthermore, the UI 5 outputs data received from the control unit 8 to the user.

[0019] The memory unit 7 stores various types of information. The memory unit 22 is a storage device such as a semiconductor memory element, such as RAM (Random Access Memory), ROM (Read Only Memory), or Flash Memory. The memory unit 7 may also be an external storage device connected wirelessly or via a wired connection. The memory unit 7 stores various types of information, including a program P for generating fuzzing data, information about the data format of the input data, evaluation values ​​corresponding to data types included in the data format information pre-entered by the user, evaluation values ​​corresponding to data type combinations, and data interval information generated by the data interval setting unit 11.

[0020] The control unit 8 controls the operation of each part of the fuzzing data generation device 1. The control unit 8 is, for example, an integrated circuit such as a CPU (Central Processing Unit). The control unit 8 realizes the functions shown in Figure 2 by executing the program P stored in the memory unit 7.

[0021] Next, referring to Figure 2, the functions realized by the control unit 8 of the fuzzing data generation device 1 executing program P will be described. The fuzzing data generation device 1 includes a data interval setting unit 11, a data type setting unit 12, a candidate value determination unit 13, a combination generation unit 14, a fuzzing data generation unit (data generation unit) 15, a candidate value evaluation setting unit 16, and a combination evaluation setting unit 17. The data interval setting unit 11, the data type setting unit 12, the candidate value determination unit 13, the combination generation unit 14, the fuzzing data generation unit 15, the candidate value evaluation setting unit 16, and the combination evaluation setting unit 17 may be software or modules whose processing is executed when the control unit 8 executes program P. Alternatively, the data interval setting unit 11, the data type setting unit 12, the candidate value determination unit 13, the combination generation unit 14, the fuzzing data generation unit 15, the candidate value evaluation setting unit 16, and the combination evaluation setting unit 17 may be hardware such as circuits or chips. The fuzzing data generation device 1 generates fuzzing data based on the input data. Before describing the various parts of the fuzzing data generation device 1, we will now explain the input data and the fuzzing data.

[0022] Input data is the data that is input to the device under test. The input data is in a data format that conforms to the standards that the device under test complies with, such as Bluetooth®, Wi-Fi®, and USB (Universal Serial Bus). On the other hand, fuzzing data is data used to confirm whether the device under test is operating abnormally. Fuzzing data is data obtained by randomizing or modifying the data values ​​included in the above input data.

[0023] Input data includes various types of information, such as an ID or header information containing a unique value to identify the data, information indicating the data type, and information indicating the data length. The various types of information included in the input data are composed of bit sequences of a predetermined bit length, and the data consisting of these consecutive bit sequences is the input data.

[0024] Here, we will explain the input data shown in Figure 3 as an example of input data. The data shown in Figure 3 is music video data. In Figure 3, input data conforming to the data format of the equipment under test is considered normal, legitimate data. The legitimate data includes various information such as ID, format type, codec, bitrate, sampling frequency, copyright information, song title information data length, song title information, and payload.

[0025] The ID is a data value used to identify the entire data set. The ID has 8 bits, is assigned the data interval number "1", and is of an enumerated type. Here, a data interval is a section of data obtained by dividing the input data into bit sequences of a predetermined bit length for each piece of information contained in the input data or for each data interval number. The ID has a fixed data value of 0x01. Note that the data value indicated by "0x" is a hexadecimal value.

[0026] The format type indicates the type of data stored in the payload. The format type has 4 bits, is assigned the data interval number "2", and is an enumerated data type. For the format type, 0x1 indicates audio data, 0x2 indicates video data, and 0x3 indicates a reserved number. Subsequent information will follow this format type, and the example shown in Figure 9 illustrates the case where audio data (0x1) is selected.

[0027] The codec represents the compression encoding method for the audio data stored in the payload. The codec has 4 bits, is assigned the data interval number "3", and is an enumerated data type. The codec is defined as MP3 if the data value is 0x1, AAC (registered trademark) if it is 0x2, and Linear PCM (LPCM) if it is 0x3.

[0028] Bitrate represents the amount of audio data per unit time. The bitrate has 4 bits, is assigned the data interval number "4", and is an enumerated data type. The bitrate can only be selected when the data value is 0x0 (1.5 Mbps) and the codec is LPCM, when it is 0x1 (128 kbps) and the codec is MP3 or AAC, or when it is 0x2 (320 kbps) and the codec is MP3.

[0029] The sampling frequency represents the frequency at which an audio signal is sampled. The sampling frequency has 4 bits, is assigned the data interval number "5", and is of an enumerated type. The sampling frequency can be selected regardless of whether the data value is 0x1 (44100Hz) and the codec is MP3, AAC, or LPCM, or it can be set to 0x2 (48000Hz) and the codec is LPCM.

[0030] Copyright information is information regarding the copyright of the audio data stored in the payload. The copyright information is 4 bits long, assigned the data interval number "6", and is of the flag type. The copyright information is a 4-bit data value, and if the least significant bit of the bit string is 0b, it indicates no copyright; if it is 1b, it indicates copyright. Furthermore, if the most significant bit of the copyright information is 0b, it indicates that the audio data stored in the payload is a copy; if it is 1b, it indicates that it is the original data. Note that "0b" and "1b" are binary values, where 0b is the binary value 0 and 1b is the binary value 1.

[0031] The song title data length is information that represents the data length of the next song title information. The song title data length has 8 bits, is assigned the data interval number "7", and is of numeric type. The song title data length is set as a numerical value within the range of 0 to 63.

[0032] The song title information is a variable-length area of ​​data specified by the song title information data length, and stores the string data of the song title. The song title information has 8 × N (number of characters) bits, is assigned the data interval number "8", and is of string type. The song title information is set as a string using ASCII code as the data value.

[0033] The above information constitutes the header information, and the main music and video data is stored in the payload. In this embodiment, the header information is subject to fuzzing testing, while the payload is not. Therefore, details regarding the payload are omitted. As shown in Figure 3, information regarding the data format of the input data is predetermined and stored in the storage unit 7.

[0034] The data interval setting unit 11 divides the input data into multiple data intervals. Specifically, the data interval setting unit 11 determines whether there are any data intervals among all the input data for which a data interval number (also simply called a data interval) and data interval length (number of bits) have not been set. If there are any unset intervals, the data interval number and data interval length are set for those intervals. The data interval number and the number of bits indicating the length of the data interval set for the input data are as shown in Figure 3, and the data interval number and data interval length are set sequentially from the beginning of the input data. Note that the data intervals are set by the user via the UI 5. When data intervals are set, the data interval setting unit 11 generates information as data interval information, which associates the data interval number and the data interval length. The data interval information thus generated is stored in the storage unit 7.

[0035] Furthermore, data interval information does not necessarily require a data interval number; it may be defined as a data length of a consecutive fixed number of bits, with the data intervals represented in ascending order from the beginning. Therefore, data interval information only needs to uniquely determine which data interval it is from the beginning and what its data length is in bits.

[0036] The data type setting unit 12 sets a data type for each of the set data intervals. Specifically, the data type setting unit 12 sets a data type that indicates the types of values ​​that the data value can take for all data intervals set by the data interval setting unit 11. The data type is information used to set evaluation values ​​for candidate values ​​in the candidate value evaluation setting unit 16, which will be described later. Examples of data types that can be set for data intervals include numeric types, enumeration types, string types, and flag types.

[0037] A numeric type is a data type set when the input data set in a data interval can take the form of a numerical value such as an integer. Specifically, a numeric type is a number that can be represented as an integer or floating-point number according to the data format, and may also be a value that represents a quantity such as length, size, or setting value.

[0038] An enumeration type is a data type used when input data set in a data interval is assigned a numerical value in a format that can be represented within that data interval, in order to uniquely select a specific option from among multiple choices that are not necessarily numerical. Specifically, an enumeration type may be a value that indicates one setting from among multiple options for a setting item or type.

[0039] The string type is a data type set when the input data within a data interval consists of a string such as ASCII (American Standard Code for Information Interchange) code or UTF (UCS Transformation Format or Unicode Transformation Format)-8. Specifically, the string type may also be a value that represents a character or string as defined in a character set.

[0040] A flag type is a data type composed of bits that indicate one of two mutually exclusive states, such as whether a particular function is enabled or disabled, depending on whether each bit of the input data within the data interval is 0 or 1. Specifically, a flag type may be a bit sequence where each bit is assigned the ON / OFF status of a setting or the presence or absence of a function, and 0 / 1 represents those states (such as ON / OFF or presence / absence).

[0041] In the example shown in Figure 3, the data types are set as follows: ID is an enumeration type, format type is an enumeration type, codec is an enumeration type, bitrate is an enumeration type, sampling frequency is an enumeration type, copyright information is a flag type, song title information data length is a numeric type, and song title information is a string type.

[0042] The candidate value determination unit 13 determines candidate values ​​for fuzzing data to be set in the data interval. Specifically, the candidate value determination unit 13 uses the data values ​​of normal input data (regular data) that can be taken in the data interval as candidate values ​​for fuzzing data, based on the data type. Next, the candidate value determination unit 13 determines the range of possible data values ​​from the bit length of the data interval and also uses the data values ​​of abnormal input data that cannot be taken by regular data as candidate values ​​for fuzzing data. In other words, the candidate value determination unit 13 treats all data values ​​that can be taken in the data interval as candidate values ​​for fuzzing data. To put it another way, candidate values ​​are all data values ​​that can be handled based on the data type set in the data interval.

[0043] In the example shown in Figure 3, based on the number of bits set for each data section, candidate fuzzing data values ​​are selected from data values ​​such as: ID: "0x00-0xFF (0-255)", format type: "0x0-0xF (0-15)", codec: "0x0-0xF (0-15)", bitrate: "0x0-0xF (0-15)", sampling frequency: "0x0-0xF (0-15)", copyright information: "0x0-0xF (0-15)", song title information data length: "0x00-0xFF (0-255)", and song title information: "0x00-0xFF (0-255) × N".

[0044] The candidate value evaluation setting unit 16 sets a first evaluation value for the defect evaluation for the candidate values ​​of the fuzzing data. Defect evaluation is an evaluation that determines the likelihood of defects occurring in the system or software being evaluated. Specifically, the candidate value evaluation setting unit 16 selects the evaluation method for each candidate value and sets the first evaluation value depending on the data type of each data interval. The first evaluation value is a numerical value set based on the data type of the data interval of the candidate value, indicating the degree of likelihood of defects occurring based on the evaluation that determines the likelihood of defects occurring in the system or software being evaluated. Now, referring to Figure 4, the first evaluation values ​​corresponding to the data types shown in Figure 3 will be explained. Figure 4 is an example of a first evaluation value corresponding to a data type, which is stored in the storage unit 7 in advance.

[0045] For numerical data types, for example, in data interval number 7, the first evaluation value is set to 0 for the minimum value "0x00", maximum value "0x3F", and median "0x1F, 0x20" within the range of possible normal values, and to -1 for the other normal values ​​"0x01-0x1E, 0x21-0x3E". Within the range of abnormal values ​​"0x40-0xFF", the first evaluation value is set to +2 for the minimum value "0x40", maximum value "0xFF", and median "0x9F, 0xA0", and to +1 for the other abnormal values ​​"0x41-0x9E, 0xA1-0xFE".

[0046] For example, in the enumeration type, data interval number 1, the first evaluation value for the normal data value "0x01" is set to -1, the first evaluation value for the candidate value "0xFE", which consists of a bit sequence obtained by bit-inverting the normal data value, is set to +2, and the first evaluation value for all other candidate values ​​"0x00, 0x02-0xFD, 0xFF" is set to +1.

[0047] For string types, for example, data interval number 8, in the character code used, characters and numbers such as "0x30-0x39 (characters "0" to "9")" have a first evaluation value of -1, control characters such as "0x00-0x1F", spaces "0x20", and symbols such as "0x21-0x2F" have a first evaluation value of 0, and values ​​that do not exist in the character code, such as "0x80-0xFF", have a first evaluation value of +1.

[0048] For flag types, for example, in data interval number 6, the bit sequence "0x0" (the least significant bit is 0b, the most significant bit is 0b, and the other bits are 0b) that represents the function being enabled or disabled has a first evaluation value of -1; the bit sequence "0x1, 0x8, 0x9" (at least one of the least significant or most significant bits is 1b, and the other bits are 0b) that represents the function being enabled or disabled has a first evaluation value of 0; the bit inverted bit sequence "0x06, 0x07, 0xE" (the bit inverted bit sequence of "0x1, 0x8, 0x9") that represents any function being enabled has a first evaluation value of +2; and the other bit sequences "0x2-0x5, 0xA-0xD, 0xF" have a first evaluation value of +1.

[0049] Furthermore, the first evaluation value should be set to a higher number for candidate values ​​that are more likely to cause problems in the system or software being evaluated. For example, depending on the format of the input data, in a data section where positive integer values ​​are normal data, setting the most significant bit to 1 results in a bit sequence representing a negative integer. If the system being evaluated does not correctly handle the positive and negative signs of integers, problems may occur in the system being evaluated. Therefore, it is advisable to set a higher first evaluation value for data where the most significant bit is 1.

[0050] In the example shown in Figure 3, the first evaluation value of the candidate value for each data interval is set to the value shown in Figure 4 by the candidate value evaluation setting unit 16 in accordance with the above.

[0051] The combination generation unit 14 generates interval combination patterns by combining one or more data intervals and stores the information. An interval combination pattern is a combination of data intervals in which one or more data intervals are selected so that the data intervals to be combined do not overlap, and the data intervals are combined in a way that is one or more and less than or equal to the total number of data intervals. Specifically, the combination generation unit 14 selects one or more data intervals so that the data intervals to be combined do not overlap, generates an interval combination pattern, and stores it. The number of data intervals combined in an interval combination pattern is one or more and less than or equal to the total number of data intervals. In the example shown in Figure 3, the total number of data intervals used for combination is 8, so the total number of data interval combinations is 2 to the power of 8 minus 1, or 255.

[0052] Here are some examples of interval combination patterns. Note that Ca represents a combination of only data interval a, and Cab represents a combination of data interval a and data interval b. If the number of data intervals to be combined increases, the letter following C will increase.

[0053] If the number of data intervals to be combined is 1, there are 8C1 = 8 possible interval combinations. In other words, the possible interval combinations are C1 = data interval 1, C2 = data interval 2, C3 = data interval 3, C4 = data interval 4, C5 = data interval 5, C6 = data interval 6, C7 = data interval 7, and C8 = data interval 8.

[0054] If the number of data intervals to be combined is 2, the number of interval combination patterns is 8C2 = 28. That is, as interval combination patterns, C12 = data interval 1 and data interval 2, C13 = data interval 1 and data interval 3, C14 = data interval 1 and data interval 4, C15 = data interval 1 and data interval 5, C16 = data interval 1 and data interval 6, C17 = data interval 1 and data interval 7, C18 = data interval 1 and data interval 8, C23 = data interval 2 and data interval 3, C24 = data interval 2 and data interval 4, C25 = data interval 2 and data interval 5, C26 = data interval 2 and data interval 6, C27 = data interval 2 and data interval 7, C28 = data interval 2 and data interval 8, C34 = data interval 3 and Data interval 4, C35 = data interval 3 and data interval 5, C36 = data interval 3 and data interval 6, C37 = data interval 3 and data interval 7, C38 = data interval 3 and data interval 8, C45 = data interval 4 and data interval 5, C46 = data interval 4 and data interval 6, C47 = data interval 4 and data interval 7, C48 = data interval 4 and data interval 8, C56 = data interval 5 and data interval 6, C57 = data interval 5 and data interval 7, C58 = data interval 5 and data interval 8, C67 = data interval 6 and data interval 7, C68 = data interval 6 and data interval 8, C78 = data interval 7 and data interval 8.

[0055] Similarly, when there are 3 data intervals to combine, the number of interval combination patterns is 8C3 = 56. When there are 4 data intervals to combine, the number of interval combination patterns is 8C4 = 70. When there are 5 data intervals to combine, the number of interval combination patterns is 8C5 = 56. When there are 6 data intervals to combine, the number of interval combination patterns is 8C6 = 28. When there are 7 data intervals to combine, the number of interval combination patterns is 8C7 = 8. When there are 8 data intervals to combine, the number of interval combination patterns is 8C8 = 1. Adding these together, as shown above, the total number of combinations is 255.

[0056] Furthermore, when storing combinations of data intervals as information, it is possible to store them using only numbers and symbols by using the data interval numbers, such as C12=1:2 or Cabcd=a:b:c:d.

[0057] The combination evaluation setting unit 17 sets a second evaluation value for the defect evaluation in the interval combination pattern. The second evaluation value is a numerical value set based on the dependency relationship of each data interval in the interval combination pattern, indicating the degree of likelihood of a defect occurring in the system or software being evaluated, based on an evaluation that determines the likelihood of a defect occurring. Specifically, the combination evaluation setting unit 17 sets the second evaluation value according to the dependency relationship of the combined data intervals.

[0058] In this embodiment, for example, the value of the song title information data length in data section number 7 and the song title information in data section number 8, whose length is determined by that value, are dependent on each other. A dependency also exists between the codec value in data section number 3 and the bitrate of data section number 4 and the sampling frequency of data section number 5, whose selectable values ​​are determined by that value. In data sections with such dependencies, if an abnormal value, i.e., fuzzing data, is set in one of them, even if the other data section contains normal data, it becomes abnormal data that does not conform to the format of the input data. Therefore, since this is equivalent to setting fuzzing data in both data sections, the second evaluation value may be set lower than other combinations when a combination includes data sections with such dependencies. Accordingly, the combination evaluation setting unit 17 may set the second evaluation value to 0 for combinations that include both data section number 7 and data section number 8, to +1 for combinations that include all of data section number 3, data section number 4, and data section number 5, and to +2 for all other combinations.

[0059] Furthermore, the combination evaluation setting unit 17 may subtract 1 from the second evaluation value of combinations that include four or more data intervals. This is because, in fuzzing tests, inputting abnormal values ​​in all data intervals can cause more problems in the system or software being tested, while inputting abnormal values ​​in all data intervals makes it difficult to identify the cause of the problem. To reflect this in the evaluation value, the unit may lower the second evaluation value of combinations that include more data intervals and raise the second evaluation value of combinations that include fewer data intervals.

[0060] The fuzzing data generation unit 15 extracts predetermined candidate values ​​from the candidate values ​​of the fuzzing data and generates input data that corresponds to the extracted candidate values ​​as fuzzing data. Specifically, for all interval combination patterns, the fuzzing data generation unit 15 calculates a calculated evaluation value based on the first evaluation value of the candidate values ​​of the data intervals included and the second evaluation value of the interval combination pattern. The calculated evaluation value is the sum of the first evaluation value of the candidate values ​​of the data intervals included in the interval combination pattern and the second evaluation value of the interval combination pattern. Note that the calculated evaluation value is not particularly limited to the summed evaluation value, and may be calculated by any calculation method as long as it is an evaluation value calculated based on the first evaluation value and the second evaluation value. Then, the fuzzing data generation unit 15 sums the first evaluation value and the second evaluation value, and generates and outputs the input data with the highest calculated evaluation value from the summed calculated evaluation value as fuzzing data. Furthermore, the fuzzing data may consist of multiple data points, and by pre-setting the number of data points to be output via UI5 or similar, the fuzzing data may be output in the order of the highest calculated evaluation values.

[0061] In the examples shown in Figures 5 to 7, when the interval combination pattern is C12 (a combination of data interval number 1 and data interval number 2), the second evaluation value of the interval combination pattern is +2, and the subtraction when there are many combinations is 0. Therefore, each candidate value in interval combination pattern C12 is the calculated evaluation value shown in Figures 5 and 6. In the example shown in Figure 7, the highest calculated evaluation value is obtained when data interval number 1 is 0xFE and data interval number 2 is one of 0xC, 0xD, or 0xE. Similarly, calculated evaluation values ​​can be obtained for other interval combination patterns.

[0062] In this embodiment, an example is shown in which the input data with the highest calculated evaluation value is output as fuzzing data. However, input data with a low calculated evaluation value may also be output as fuzzing data. In other words, as long as fuzzing data is generated based on the calculated evaluation value, it may be generated based on any predetermined condition. As described above, by setting the first and second evaluation values ​​according to the data type of each data interval and the dependency relationship of the combination of data intervals, it becomes possible to generate fuzzing data for more efficient testing from among a large amount of fuzzing data.

[0063] (Fuzzing data generation method) Next, with reference to Figures 8 to 17, the fuzzing data generation method (data generation method) performed by the fuzzing data generation device 1 will be described. Figure 8 is a flowchart of the fuzzing data generation method according to this embodiment. Figure 9 is a flowchart of the data interval setting process. Figure 10 is a flowchart of the data type setting process. Figure 11 is a flowchart of the candidate value determination process. Figure 12 is a flowchart of the candidate value evaluation setting process. Figure 13 is a flowchart of the combination generation process. Figure 14 is an explanatory diagram of the interval combination pattern generated by the combination generation process. Figure 15 is a flowchart of the combination evaluation setting process. Figure 16 is a flowchart of the fuzzing data generation process. Figure 17 is a flowchart related to the fuzzing data output process. In the fuzzing data generation method, fuzzing data is generated by each part shown in Figure 2 performing various processes in accordance with the processing flow shown in Figure 8.

[0064] As shown in Figure 8, in the fuzzing data generation method, first, the data interval setting unit 11 executes a data interval setting process S1 to set data intervals for the input data. After the execution of the data interval setting process S1, the data type setting unit 12 executes a data type setting process S2 to set data types for the data intervals set by the data interval setting unit 11. After the execution of the data type setting process S2, the candidate value determination unit 13 executes a candidate value determination process S3 to determine candidate values ​​for fuzzing data to be set in the data intervals based on the data types set by the data type setting unit 12. After the execution of the candidate value determination process S3, the candidate value evaluation setting unit 16 executes a candidate value evaluation setting process S4 to set first evaluation values ​​for the candidate values ​​of fuzzing data determined by the candidate value determination unit 13 based on the data types of the data intervals of the candidate values. After the execution of the candidate value evaluation setting process S4, the combination generation unit 14 executes a combination generation process S5 to generate interval combination patterns by combining one or more data intervals set by the data interval setting unit 11. After the combination generation process S5 is executed, the combination evaluation setting unit 17 executes a combination evaluation setting process S6 to set a second evaluation value for the interval combination pattern generated by the combination generation unit 14. After the combination evaluation setting process S6 is executed, the fuzzing data generation unit 15 executes a fuzzing data generation process S7 to generate fuzzing data by extracting predetermined candidate values ​​from candidate values ​​of fuzzing data based on the first evaluation value and the second evaluation value. After the fuzzing data generation process S7 is executed, the series of processes related to the fuzzing data generation method is completed.

[0065] Next, with reference to Figure 9, the data interval setting process S1 will be explained. In the data interval setting process S1, the data interval setting unit 11 sets the data interval i to an initial value of 1 (i=1) (step S11). After executing step S11, the data interval setting unit 11 determines whether or not there are any unset data intervals in the input data (step S12). If the data interval setting unit 11 determines that there are unset intervals (step S12: Yes), it sets the data interval i in the unset interval (step S13). Specifically, the data interval setting unit 11 sets the data interval number i and data interval length l of the first unset interval.i The following settings are configured. For example, the data interval setting unit 11 sets the data interval number of the data interval to which the ID is set to be data interval number 1, and sets the data interval length to 8 bits.

[0066] Next, after step S13 is executed, the data interval setting unit 11 updates the data interval i by adding 1 to it (i = i + 1) (step S14). After step S14 is executed, the data interval setting unit 11 proceeds back to step S12 and repeats steps S12 through S14 until there are no unset intervals left.

[0067] On the other hand, if the data interval setting unit 11 determines in step S12 that there are no unset intervals (step S12: No), it terminates the data interval setting process S1, assuming that all data interval numbers and data interval lengths have been set.

[0068] Next, the data type setting process S2 will be explained with reference to Figure 10. In the data type setting process S2, the data type setting unit 12 sets the data interval i to its initial value of 1 (i=1) (step S21). After executing step S21, the data type setting unit 12 sets a data type for the data interval i (step S22). For example, the data type setting unit 12 sets an enumerated type as the data type to be set for data interval number 1.

[0069] Next, after step S22 is executed, the data type setting unit 12 updates the data interval i by adding 1 to it (i = i + 1) (step S23). After step S23 is executed, the data type setting unit 12 determines whether the value of data interval i exceeds the total number of data intervals I (step S24). If the data type setting unit 12 determines that the value of data interval i does not exceed the total number of data intervals I (step S24: No), it proceeds back to step S22 and repeatedly executes steps S22 to S24 until the value of data interval i exceeds the total number of data intervals I.

[0070] On the other hand, if the data type setting unit 12 determines in step S24 that the value of data interval i exceeds the total number of data intervals I (step S24: Yes), it terminates the data type setting process S2, assuming that data types have already been set for all data interval numbers.

[0071] Next, the candidate value determination process S3 will be explained with reference to Figure 11. In the candidate value determination process S3, the candidate value determination unit 13 reads normal data (step S31). As described above, normal data is normal input data that can be taken within a data interval. The candidate value determination unit 13 may read multiple normal data for the same data interval, for example, with different values ​​set for ID, etc. Reading normal data includes the candidate value determination unit 13 acquiring multiple normal data.

[0072] After step S31 is executed, the candidate value determination unit 13 sets the data interval i to its initial value of 1 (i=1) (step S32). After step S32 is executed, the candidate value determination unit 13 sets normal data as candidate values ​​for the data interval i (step S33). Specifically, the candidate value determination unit 13 sets normal data according to the data type set in the data interval i as candidate values. After step S33 is executed, the candidate value determination unit 13 calculates the range of data values ​​that can be taken from the data interval length of the data interval based on the data type (step S34). After step S34 is executed, the candidate value determination unit 13 sets values ​​other than the normal data range (data values ​​of abnormal input data) from the range of values ​​that the data interval i can take within the calculated range of data values ​​as candidate values ​​for fuzzing data (step S35). As a result, the candidate value determination unit 13 treats all data values ​​that can be taken in the data interval as candidate values ​​for fuzzing data.

[0073] After step S35 is executed, the candidate value determination unit 13 updates the data interval i by adding 1 to it (i = i + 1) (step S36). After step S36 is executed, the candidate value determination unit 13 determines whether the value of data interval i exceeds the total number of data intervals I (step S37). If the candidate value determination unit 13 determines that the value of data interval i does not exceed the total number of data intervals I (step S37: No), it proceeds back to step S33 and repeatedly executes steps S33 to S37 until the value of data interval i exceeds the total number of data intervals I.

[0074] On the other hand, if the candidate value determination unit 13 determines in step S37 that the value of data interval i exceeds the total number of data intervals I (step S37: Yes), it terminates the candidate value determination process S3, assuming that candidate values ​​for fuzzing data have already been set for all data interval numbers.

[0075] Next, the candidate value evaluation setting process S4 will be explained with reference to Figure 12. In the candidate value evaluation setting process S4, the candidate value evaluation setting unit 16 sets the data interval i to an initial value of 1 (i=1) (step S41). After executing step S41, the candidate value evaluation setting unit 16 determines whether the data interval i is of a numeric type or not (step S42). If the candidate value evaluation setting unit 16 determines that the data interval i is of a numeric type (step S42: Yes), it sets the first evaluation value corresponding to the numeric type as the candidate value of the fuzzing data (step S43). In step S43, the candidate value evaluation setting unit 16 sets the first evaluation value based on the data of the first evaluation value corresponding to the data type shown in Figure 4, which is stored in the storage unit 7 beforehand. After executing step S43, the candidate value evaluation setting unit 16 proceeds to step S44, which will be described later.

[0076] In step S42, if the candidate value evaluation setting unit 16 determines that the data interval i is not of a numeric type (step S42: No), it determines whether the data interval i is of an enumerated type (step S46). If the candidate value evaluation setting unit 16 determines that the data interval i is of an enumerated type (step S46: Yes), it sets the first evaluation value corresponding to the enumerated type as the candidate value of the fuzzing data (step S47). In step S47, as in step S43, the candidate value evaluation setting unit 16 sets the first evaluation value based on the data shown in Figure 4. After executing step S47, the candidate value evaluation setting unit 16 proceeds to step S44, which will be described later.

[0077] In step S46, if the candidate value evaluation setting unit 16 determines that the data interval i is not an enumerated type (step S46: No), it determines whether the data interval i is of string type (step S48). If the candidate value evaluation setting unit 16 determines that the data interval i is of string type (step S48: Yes), it sets the first evaluation value corresponding to the string type as the candidate value of the fuzzing data (step S49). In step S49, as in step S43, the candidate value evaluation setting unit 16 sets the first evaluation value based on the data shown in Figure 4. After executing step S49, the candidate value evaluation setting unit 16 proceeds to step S44, which will be described later.

[0078] In step S48, if the candidate value evaluation setting unit 16 determines that the data interval i is not of string type (step S48: No), it determines that the data interval i is of flag type (not of any other data type) and sets the first evaluation value corresponding to the flag type as the candidate value of the fuzzing data (step S50). In step S50, as in step S43, the candidate value evaluation setting unit 16 sets the first evaluation value based on the data shown in Figure 4. After executing step S50, the candidate value evaluation setting unit 16 proceeds to step S44, which will be described later.

[0079] After executing steps S43, S47, S49, and S50, the candidate value evaluation setting unit 16 updates the data interval i by adding 1 to it (i = i + 1) (step S44). After executing step S44, the candidate value evaluation setting unit 16 determines whether the value of data interval i exceeds the total number of data intervals I (step S45). If the candidate value evaluation setting unit 16 determines that the value of data interval i does not exceed the total number of data intervals I (step S45: No), it proceeds back to step S42 and repeatedly executes steps S42 to S45 until the value of data interval i exceeds the total number of data intervals I.

[0080] On the other hand, if the candidate value evaluation setting unit 16 determines in step S45 that the value of data interval i exceeds the total number of data intervals I (step S45: Yes), it terminates the candidate value evaluation setting process S4, assuming that the first evaluation value has already been set for the candidate values ​​of the fuzzing data for all data interval numbers.

[0081] Next, the combination generation process S5 will be explained with reference to Figure 13. In the combination generation process S5, the combination generation unit 14 sets initial values ​​(step S51). Specifically, in step S51, the combination generation unit 14 sets the interval combination pattern i, where D is the total number of data intervals, to an initial value of 1 (i=1). That is, i is the number of the data interval combination pattern. Also in step S51, the combination generation unit 14 sets the bit sequence mask position j, which is used to determine whether or not to select a data interval d for each interval combination pattern i, to an initial value of 0 (j=0). Furthermore, in step S51, the combination generation unit 14 sets the data interval d to be combined to an initial value of 1 (d=1).

[0082] After executing step S51, the combination generation unit 14 determines whether the value obtained by ANDing the interval combination pattern i and the value obtained by shifting 1 to the left by the bit string mask position j (i&(1<<j)) is 1 (step S52). When the combination generation unit 14 determines that it is 1 (step S52: Yes) in step S52, it selects the data interval d as the combination of the data intervals of the interval combination pattern i (step S53). For example, when i = 1 and j = 0, the combination generation unit 14 obtains C1, which is the combination of only the data interval 1 as the combination of the data intervals when the interval combination pattern is 1, as the interval combination pattern with i = 1. On the other hand, when the combination generation unit 14 determines that it is not 1 (step S52: No) in step S52, it proceeds to step S54 without executing step S53.

[0083] After executing step S53, the combination generation unit 14 updates the bit string mask position j by adding 1 to the bit string mask position j (let j = j + 1), and updates the data interval d by adding 1 to the data interval d (let d = d + 1) (step S54). After executing step S54, the combination generation unit 14 determines whether the value of the data interval d exceeds the total number of data intervals D (step S55). When the combination generation unit 14 determines that the value of the data interval d does not exceed the total number of data intervals D (step S55: No), it proceeds to step S52 again and repeats steps S52 to S55 until the value of the data interval d exceeds the total number of data intervals D.

[0084] On the other hand, if the combination generation unit 14 determines in step S55 that the value of data interval d exceeds the total number of data intervals D (step S55: Yes), it increases the number of interval combination patterns by adding 1 to the interval combination pattern i (i = i + 1), sets the bit string mask position j to its initial value of 0 (j = 0), and sets the data interval d to be combined to its initial value of 1 (d = 1) (step S56). After executing step S56, the combination generation unit 14 determines whether the number of interval combination patterns i is 2 to the power of D (2^D) or greater (step S57). If the combination generation unit 14 determines that the number of interval combination patterns i is 2 to the power of D or greater (step S57), it considers that all combinations have been generated and terminates the combination generation process S5. On the other hand, if the combination generation unit 14 determines that the interval combination pattern i is not greater than or equal to 2 to the power of D (i.e., less than 2 to the power of D) (step S57: No), it proceeds back to step S52 and repeatedly executes steps S52 to S57 until the interval combination pattern i becomes greater than or equal to 2 to the power of D.

[0085] Here, with reference to Figure 14, we will explain the interval combination pattern i generated by the combination generation process S5. Figure 14 shows the case where the total number of data intervals is 3, and there are 7 (2^3-1) possible interval combination patterns i. In the case shown in Figure 14, the bit string corresponds to (data interval 3, data interval 2, data interval 1), and binary values ​​are set at the positions in the bit string corresponding to the data intervals. The data intervals whose binary value is 1 are the data intervals that are combined in interval combination pattern i.

[0086] Therefore, the interval combination pattern i for the bit string (1,1,1) is C123, which is a combination of data interval 3, data interval 2, and data interval 1. The interval combination pattern i for the bit string (1,1,0) is C23, which is a combination of data interval 3 and data interval 2. The interval combination pattern i for the bit string (1,0,1) is C13, which is a combination of data interval 3 and data interval 1. The interval combination pattern i for the bit string (1,0,0) is C3, which is only data interval 3. The interval combination pattern i for the bit string (0,1,1) is C12, which is a combination of data interval 2 and data interval 1. The interval combination pattern i for the bit string (0,1,0) is C2, which is only data interval 2. The interval combination pattern i for the bit string (0,0,1) is C1, which is only data interval 1. The interval combination pattern i for the bit string (0,0,0) is not set as an interval combination pattern i because none of the data intervals are set.

[0087] Next, the combination evaluation setting process S6 will be described with reference to Figure 15. In the combination evaluation setting process S6, the combination evaluation setting unit 17 accepts input of data interval dependencies (step S61). Data interval dependencies are input, for example, via UI5. Accepting input of data interval dependencies includes the combination evaluation setting unit 17 acquiring data regarding data interval dependencies.

[0088] After step S61 is executed, the combination evaluation setting unit 17 sets the interval combination pattern i to its initial value of 1 (i=1) (step S62). After step S62 is executed, the combination evaluation setting unit 17 determines whether or not the data intervals to be combined in the interval combination pattern i include dependencies (step S63). If the combination evaluation setting unit 17 determines that the data intervals to be combined include dependencies (step S63: Yes), it sets the second evaluation value of the combination that includes dependencies in the data intervals to the interval combination pattern i (step S64). On the other hand, if the combination evaluation setting unit 17 determines that the data intervals to be combined do not include dependencies (step S63: No), it sets the second evaluation value of the combination that does not include dependencies in the data intervals to the interval combination pattern i (step S67).

[0089] After step S64 or step S67 is executed, the combination evaluation setting unit 17 updates the interval combination pattern i by adding 1 to it (i = i + 1) (step S65). After step S65 is executed, the combination evaluation setting unit 17 determines whether the value of interval combination pattern i exceeds the total number of interval combination patterns C (step S66). If the combination evaluation setting unit 17 determines that the value of interval combination pattern i does not exceed the total number of interval combination patterns C (step S66: No), it proceeds back to step S63 and repeatedly executes steps S63 to S66 until the value of interval combination pattern i exceeds the total number of interval combination patterns C.

[0090] On the other hand, if the combination evaluation setting unit 17 determines in step S66 that the value of interval combination pattern i exceeds the total number of interval combination patterns C (step S66: Yes), it sets a second evaluation value for all interval combination patterns and terminates the combination evaluation setting process S6.

[0091] Next, the fuzzing data generation process S7 will be explained with reference to Figure 16. In the fuzzing data generation process S7, the fuzzing data generation unit 15 sets the interval combination pattern i to an initial value of 1 (i=1) (step S71). After executing step S71, the fuzzing data generation unit 15 calculates a calculated evaluation value by summing the first evaluation value and the second evaluation value corresponding to the candidate fuzzing data values ​​in the data interval of the interval combination pattern i (as shown in Figure 7) (step S72).

[0092] After step S72 is executed, the fuzzing data generation unit 15 updates the interval combination pattern i by adding 1 to it (i = i + 1) (step S73). After step S73 is executed, the fuzzing data generation unit 15 determines whether the value of interval combination pattern i exceeds the total number of interval combination patterns C (step S74). If the fuzzing data generation unit 15 determines that the value of interval combination pattern i does not exceed the total number of interval combination patterns C (step S74: No), it proceeds back to step S72 and repeatedly executes steps S72 to S74 until the value of interval combination pattern i exceeds the total number of interval combination patterns C.

[0093] On the other hand, if the fuzzing data generation unit 15 determines in step S74 that the value of interval combination pattern i exceeds the total number of interval combination patterns C (step S74: Yes), it outputs the candidate value with the highest calculated evaluation value as fuzzing data (step S75) and terminates the fuzzing data generation process S7.

[0094] Here, with reference to Figure 17, the output processing of fuzzing data in step S75 will be explained in detail. Figure 17 is a flowchart relating to the output processing of fuzzing data. The fuzzing data generation unit 15 sets the interval combination pattern i to its initial value of 1 (i=1) (step S81). After executing step S81, the fuzzing data generation unit 15 sets the calculated evaluation value corresponding to interval combination pattern i (i=1) as the maximum evaluation value, which is the highest calculated evaluation value (step S82). In step S82, the calculated evaluation value corresponding to the interval combination pattern i that was deemed to have a high calculated evaluation value in step S85, which will be described later, is reset as the maximum evaluation value, which is the highest calculated evaluation value.

[0095] After step S82 is executed, the fuzzing data generation unit 15 updates the interval combination pattern i by adding 1 to it (i = i + 1) (step S83). After step S83 is executed, the fuzzing data generation unit 15 determines whether the value of the interval combination pattern i exceeds the total number of interval combination patterns C (step S84). If the fuzzing data generation unit 15 determines that the value of the interval combination pattern i does not exceed the total number of interval combination patterns C (step S84: No), it determines whether the maximum evaluation value set in step S82 is smaller than the calculated evaluation value corresponding to the updated interval combination pattern i in step S83 (step S85). If the fuzzing data generation unit 15 determines that the maximum evaluation value is smaller than the calculated evaluation value corresponding to the updated interval combination pattern i (step S85: Yes), it proceeds to step S82 and resets the calculated evaluation value corresponding to the updated interval combination pattern i as the maximum evaluation value. On the other hand, if the fuzzing data generation unit 15 determines that the maximum evaluation value is not smaller than the calculated evaluation value corresponding to the updated interval combination pattern i (step S85: No), it proceeds to step S83 and updates the interval combination pattern i. Then, the fuzzing data generation unit 15 repeatedly executes steps S82 to S85 until the value of the interval combination pattern i exceeds the total number of interval combination patterns C.

[0096] In step S84, if the fuzzing data generation unit 15 determines that the value of interval combination pattern i exceeds the total number of interval combination patterns C (step S84: Yes), it outputs a candidate value corresponding to the interval combination pattern i set as the maximum evaluation value as fuzzing data (step S86), and terminates the fuzzing data output process.

[0097] In this embodiment, the first evaluation value and the second evaluation value were added together, but the second evaluation value may be omitted and only the first evaluation value may be used to output the fuzzing data. Alternatively, the fuzzing data may be output using a calculated value obtained by a predetermined calculation formula based on the first evaluation value and the second evaluation value.

[0098] Here, with reference to Figures 18 to 20, an example of a calculated evaluation value calculated by a predetermined formula will be explained. Figures 18 and 19 show examples of the first and second evaluation values. Figure 20 shows an example of a calculated evaluation value in a combination pattern of intervals. In the examples shown in Figures 18 and 19, the combination pattern of intervals is C12 (a combination of data interval number 1 and data interval number 2), and the first and second evaluation values ​​are as shown in Figure 18 for data interval number 1 and as shown in Figure 19 for data interval number 2. Here, the calculated evaluation value is calculated by the formula shown in equation (1) below.

[0099] Calculated evaluation value = (C1's first evaluation value) + (C2's first evaluation value) -(Second evaluation value of C1) × (Second evaluation value of C2) ... (1)

[0100] For each candidate value in interval combination pattern C12, the calculated evaluation value calculated based on equation (1) is as shown in Figure 20. In the example shown in Figure 20, the highest calculated evaluation value is obtained when data interval number 1 is 0x01 and data interval number 2 is one of 0xC, 0xD, or 0xE, and when data interval number 1 is 0xFE and data interval number 2 is one of 0x1, 0x2, or 0x3. Similarly, calculated evaluation values ​​can be obtained for other interval combination patterns.

[0101] As described above, according to this embodiment, fuzzing data can be generated by setting a first evaluation value as a candidate value for the fuzzing data. Therefore, in this embodiment, fuzzing data for performing fuzzing tests can be efficiently generated with a limited number of data points.

[0102] Furthermore, according to this embodiment, a first evaluation value can be set according to the data type of each data interval. Therefore, in this embodiment, fuzzing data that takes data types into consideration can be generated.

[0103] Furthermore, according to this embodiment, a second evaluation value can be set according to the interval combination pattern to generate fuzzing data. Therefore, in this embodiment, fuzzing data that takes into account the dependencies between data intervals can be generated.

[0104] Furthermore, according to this embodiment, a second evaluation value can be set in the interval combination pattern according to the dependency relationship of the data interval combination. Therefore, in this embodiment, fuzzing data that takes into account the dependency relationship of the data interval combination can be generated. [Explanation of Symbols]

[0105] 1. Fuzzing data generation device 5 UI 7 Memory section 8 Control Unit 11. Data interval setting section 12. Data type setting section 13 Candidate Value Determination Unit 14 Combination generation unit 15. Fuzzing Data Generation Unit 16 Candidate Value Evaluation Setting Unit 17 Combination Evaluation Setting Unit

Claims

1. A data generation device for generating data used in fuzzing tests, A data interval setting unit divides the input data that forms the basis of the data into multiple data intervals, A candidate value determination unit determines candidate values ​​for the data from the data values ​​obtainable in the aforementioned data interval, A candidate value evaluation setting unit sets a first evaluation value for defect evaluation in the candidate values ​​of the aforementioned data, The system includes a data generation unit that generates data based on the first evaluation value set as the candidate value of the aforementioned data, The data generation unit, A data generation device that selects candidate values ​​based on a first evaluation value of a plurality of candidate values ​​set in each of the plurality of data intervals, and generates them as data.

2. The system further includes a data type setting unit that sets data types for each of the multiple data intervals, The candidate value determination unit is: From the data values ​​obtainable according to the data type set in the data interval, the candidate values ​​of the data are determined. The candidate value evaluation setting unit is: The data generation device according to claim 1, wherein the first evaluation value based on the data type is set to the candidate value of the data.

3. A combination generation unit that generates interval combination patterns by combining one or more of the aforementioned data intervals, The aforementioned interval combination pattern further includes a combination evaluation setting unit for setting a second evaluation value for defect evaluation, The data generation unit, A data generation device according to claim 1 or 2, which calculates a calculated evaluation value based on a first evaluation value of a plurality of candidate values ​​set in each data interval that is a combination of the interval combination pattern and a second evaluation value of the interval combination pattern, and selects the candidate values ​​based on the calculated calculated evaluation value to generate the data.

4. The aforementioned combination evaluation setting unit is: The data generation device according to claim 3, which sets a second evaluation value based on the dependency relationships between the data intervals to be combined.

5. In a data generation method performed by a data generation device that generates data used for fuzzing tests, A data interval setting process that divides the input data that forms the basis of the aforementioned data into multiple data intervals, A candidate value determination process that determines candidate values ​​for the data from the data values ​​obtainable in the aforementioned data interval, A candidate value evaluation setting process is performed to set a first evaluation value for defect evaluation in the candidate values ​​of the aforementioned data, A data generation process is performed to generate data based on the first evaluation value set as the candidate value of the aforementioned data, In the aforementioned data generation process, A data generation method that selects candidate values ​​based on a first evaluation value of a plurality of candidate values ​​set in each of the plurality of data intervals, and generates them as data.

6. In a program to be executed by a data generation device that generates data used for fuzzing tests, A data interval setting process that divides the input data that forms the basis of the aforementioned data into multiple data intervals, A candidate value determination process that determines candidate values ​​for the data from the data values ​​obtainable in the aforementioned data interval, A candidate value evaluation setting process is performed to set a first evaluation value for defect evaluation in the candidate values ​​of the aforementioned data, A data generation process is performed to generate data based on the first evaluation value set as the candidate value of the aforementioned data. In the aforementioned data generation process, A program that selects candidate values ​​based on a first evaluation value of a plurality of candidate values ​​set in each of the plurality of data intervals, and generates them as data.

Images