Inspection device, inspection method, and inspection program

Abstract

To provide an inspection device, an inspection method, and an inspection program in which an automatically generated input value of a program is automatically inspected in executing the program.SOLUTION: An inspection device 1 includes: an extraction part 11 for extracting a definition character string from a program to be executed; a type discrimination part 12 for discriminating a type on the basis of a value of the definition character string; an input part 13 for providing a user interface for receiving an input value rewriting the definition character string; an inspection part 14 for applying prescribed inspection according to a type to an input value; a dictionary generation part 15 for generating a dictionary file in which a definition character string is associated with an input value having passed the inspection; and an execution part 16 for rewriting and executing a program based on the dictionary file.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a technique for inspecting software.

Background Art

[0002] In recent years, a technique called generative AI that automatically generates various contents such as text, images, audio, and videos based on learned data has been utilized (see, for example, Non-Patent Document 1). Also, in the software development field, the feature of AI that allows for the development and utilization of a large number of software in a short period of time may be exploited to automatically generate programs. Furthermore, means for automating software testing have also been provided (see, for example, Non-Patent Document 2).

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Non-Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, when developing a program using AI, it is necessary to query the AI using natural language to generate the program. At this time, since it is difficult to describe security requirements in natural language, there may be cases where a vulnerable program is generated as a result.

[0005] An object of the present invention is to provide an inspection device, an inspection method, and an inspection program that can execute while automatically inspecting input values of an automatically generated program.

Means for Solving the Problems

[0006] The inspection device according to the present invention comprises: an extraction unit that extracts a definition string from a program to be executed; a type determination unit that determines the type based on the value of the definition string; an input unit that provides a user interface for receiving input values ​​to rewrite the definition string; an inspection unit that performs a predetermined check on the input values ​​according to the type; a dictionary generation unit that generates a dictionary file associating the definition string with the input values ​​that have passed the check; and an execution unit that rewrites and executes the program based on the dictionary file.

[0007] The extraction unit may extract the definition string using i18n software, and the dictionary generation unit may generate a dictionary file that the i18n software references.

[0008] The aforementioned program may be one that is automatically generated by AI in response to an input question.

[0009] The input unit may accept the input value through a user interface of a type corresponding to the type.

[0010] The dictionary generation unit may associate all combinations of the input values ​​for the definition strings extracted by the extraction unit with identifiers and register them in the dictionary file.

[0011] When the execution unit receives a selection instruction for any of the identifiers registered in the dictionary file, it may execute the program using the combination of input values ​​associated with the selected identifier.

[0012] The inspection method according to the present invention includes an extraction step of extracting a definition string from a program to be executed; a type determination step of determining the type based on the value of the definition string; an input step of providing a user interface for receiving input values ​​to rewrite the definition string; an inspection step of performing a predetermined check on the input value according to the type; a dictionary generation step of generating a dictionary file that associates the definition string with the input values ​​that have passed the check; and an execution step of rewriting and executing the program based on the dictionary file.

[0013] The inspection program according to the present invention is for causing a computer to function as the inspection device. [Effects of the Invention]

[0014] According to the present invention, the input values ​​of an automatically generated program can be automatically checked and executed. [Brief explanation of the drawing]

[0015] [Figure 1] This is a block diagram showing the functional configuration of the inspection device in the embodiment. [Figure 2] This is a flowchart showing the flow of the inspection method in the embodiment. [Figure 3] This figure illustrates an automatically generated program in an embodiment. [Modes for carrying out the invention]

[0016] An example of an embodiment of the present invention will be described below. The inspection device of this embodiment automatically inserts a program that checks input values ​​to a program automatically generated from natural language using learning technology such as AI, thereby preventing invalid input and safely executing the automatically generated program.

[0017] Figure 1 is a block diagram showing the functional configuration of the inspection device 1 in this embodiment. The inspection device 1 is an information processing device that includes various input / output interfaces and the like, in addition to the control unit 10 and the storage unit 20. The control unit 10 is a part that controls the entire inspection device 1. By appropriately reading and executing various programs stored in the storage unit 20, it realizes each function in the present embodiment. The control unit 10 may be a CPU.

[0018] The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the inspection device 1, and may be a ROM, RAM, flash memory, hard disk drive (HDD), or the like.

[0019] Specifically, the control unit 10 functions as an extraction unit 11, a type discrimination unit 12, an input unit 13, an inspection unit 14, a dictionary generation unit 15, and an execution unit 16 by executing software (inspection program) stored in the storage unit 20.

[0020] When the extraction unit 11 receives a question sentence input from the user and automatically generates a program by a predetermined generation AI, or when a separately automatically generated program is input, it extracts definition strings from this program using i18n (internationalization support) software. The definition string is a string temporarily placed by the AI (such as a temporary file name), and needs to be replaced with an input value during program execution.

[0021] Here, for example, the i18n software is provided such as "Python Standard Library > Internationalization > gettext - Internationalization service for multi - language support, Internet <https: / / docs.python.org / ja / 3 / library / gettext.html>", and is a library for replacing multiple languages with each other using a dictionary file. Note that the extraction unit 11 may be composed of software having a similar function, not limited to the i18n software only.

[0022] The type determination unit 12 determines the type of file, string, number, URL, etc., based on the value of the definition string extracted by the extraction unit 11. For example, if the string contains "file" and has an extension, such as "file1.txt", the type determination unit 12 identifies the file format from the extension and determines that it is a file path of that file format. Also, if the string is in URL format, such as "http: / / example.com / ", the type determination unit 12 determines that this string is a URL.

[0023] The input unit 13 provides a user interface (such as a file selection dialog or a list of character encoding candidates) according to the type of input value used to rewrite the definition string included in the program.

[0024] The inspection unit 14 performs a predetermined inspection on the input value received by the input unit 13, according to the type determined by the type determination unit 12. The content of the checks on the input values ​​may be the same as those typically performed in existing software, as exemplified below.

[0025] [For files] • Is the file path in the correct format? Does the file path contain a path traversal ".."? Does the file path contain an executable file? • Is the file path length normal (e.g., 1kbyte or less)? Does the file exist at the specified path? • Is the file format (image, CSV, text, etc.) indicated by the file name correct?

[0026] [If it's a string] • Does the string contain special characters such as escape characters? • Is the string length normal (e.g., 1TB or less)?

[0027] [For numerical values] Is the value numerically correct (does not contain any characters other than 0-9, etc.)?

[0028] [If using a URL] Is the URL in the correct format? • Does the URL contain any special characters such as escape characters? • Does the URL point to a dangerous site such as a phishing site?

[0029] The dictionary generation unit 15 generates a dictionary file for i18n software that associates definition strings with input values ​​that have passed the check.

[0030] The execution unit 16 rewrites and executes the program based on the dictionary file generated by the dictionary generation unit 15.

[0031] Figure 2 is a flowchart showing the flow of the inspection method in this embodiment. Furthermore, it is assumed that a natural language input string (question text) A is received from the user via a predetermined interface, and that program B is pre-generated using AI from this natural language input string.

[0032] In step S1, the extraction unit 11 uses i18n software to extract the definition string C from program B. In step S2, the type determination unit 12 determines the type based on the value of the definition string C.

[0033] In step S3, the input unit 13 displays a user interface (UI) of a type appropriate to the user, prompting the user to input a value to replace the definition string C, and sequentially accepts input values ​​for each of the definition strings. In step S4, the inspection unit 14 checks each input value received in step S3 to ensure it conforms to the type determined in step S2. For example, if it is a file path for an image file, the input value must be a valid file path string (it must not contain path traversals, special characters, program execution instructions, etc.).

[0034] In step S5, the dictionary generation unit 15 generates a dictionary file D, which is referenced by i18n software, that is, a dictionary file for replacing definition strings in the program with other languages, by associating input values ​​with definition strings. The language indicated by dictionary file D can be any language E.

[0035] In step S6, the execution unit 16 uses the dictionary file D generated in step S5 and specifies language E to convert the definition string into an input value, and then executes program B. Note that dictionary file D may contain multiple combinations of input values ​​associated with multiple languages ​​(identifiers). In this case, the execution unit 16 receives a selection instruction for one of the registered identifiers, converts the definition string to the corresponding combination, and executes program B.

[0036] Figure 3 illustrates a program automatically generated by AI in this embodiment. Here, values ​​whose input method is not specified in the query (input string A), such as ['file1.zip', 'file2.zip', 'file3.zip'], are hardcoded into the automatically generated program.

[0037] The definition string extracted from this program is: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} .TXT utf-8 {ip}: {count} file1.zip no2.zip b3.zip These types are then, \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}→String .txt → string utf-8 → Character encoding {ip}: {count} → string file1.zip → File file2.zip → File file3.zip → file The input values ​​are checked based on this classification.

[0038] This avoids problems such as processing unintended files by providing a string like ". / .. / .. / path / traversal" in the filename, or outputting the entire file by leaving the string empty.

[0039] According to this embodiment, the inspection device 1 utilizes the feature that the program automatically generated by AI includes external input values ​​as defined strings within the program, and uses i18n software, which is originally intended to translate screen display strings written in the program into other languages, as an input means for external input values. In other words, the inspection device 1 determines the type of input value based on the value of the definition string in the program, performs an inspection of the input value according to the type, and then uses a dictionary file that associates the definition string with the input value to replace the definition string with the input value and execute the program. This allows the inspection device 1 to automatically inspect the input values ​​of the automatically generated program while executing the program without modifying it.

[0040] Therefore, users of the inspection device 1 can use the program generated by the AI ​​without making any changes, and the inspection of input values ​​that are unlikely to be added as requirements when generating the program can be automatically added. Unlike traditional program development environments, AI-based program development may lack sufficient foundational knowledge of program development. In such cases, basic security considerations may be neglected, ultimately increasing the risks associated with using programs developed with AI. On the other hand, applying traditional software code reviews and other inspections to such programs would negate the full potential of AI's ability to develop a large number of software programs in a short time. According to this embodiment, a certain level of security can be automatically imparted to programs generated using AI, thus reducing the number of security and other testing items and enabling rapid deployment, thereby facilitating the efficient implementation of programs. Furthermore, by using a dictionary file as input values, external input values ​​can be saved in a general-purpose format and reused.

[0041] Furthermore, this will enable the efficient and safe implementation of, for example, AI-powered automated generation programs, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs): "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0042] Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above. Furthermore, the effects described in the embodiments described above are merely a list of the most preferred effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0043] The inspection method performed by inspection device 1 is implemented by software. When implemented by software, the programs constituting this software are installed on an information processing device (computer). These programs may be distributed to users by being recorded on removable media such as a CD-ROM, or by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of Symbols]

[0044] 1. Inspection device 10 Control Unit 11 Extraction part 12 Type discrimination section 13 Input section 14. Inspection Department 15. Dictionary Generation Unit 16. Execution Unit 20 Memory section

Claims

1. An extraction unit that extracts a definition string temporarily placed by the AI ​​from among the programs to be executed that are automatically generated by the AI ​​in response to a natural language question, A type determination unit that determines the type based on the value of the definition string, An input unit that provides a user interface for receiving input values ​​to rewrite the aforementioned definition string, An inspection unit that performs a predetermined inspection according to the type on the input value, A dictionary generation unit generates a dictionary file that associates the definition string with the input value that passed the inspection, An inspection device comprising: an execution unit that rewrites and executes the program based on the dictionary file.

2. The extraction unit extracts the definition string using i18n software, The inspection apparatus according to claim 1, wherein the dictionary generation unit generates a dictionary file that is referenced by the i18n software.

3. The inspection apparatus according to claim 1 or claim 2, wherein the input unit receives the input value through a user interface of a type corresponding to the type.

4. The inspection device according to claim 1 or 2, wherein the dictionary generation unit associates all combinations of the input values ​​for the definition strings extracted by the extraction unit with identifiers and registers them in the dictionary file.

5. The inspection device according to claim 4, wherein the execution unit, upon receiving a selection instruction for any of the identifiers registered in the dictionary file, executes the program using the combination of input values ​​associated with the selected identifier.

6. An extraction step of extracting a definition string that has been temporarily placed by the AI ​​from among the programs to be executed that are automatically generated by the AI ​​in response to a natural language question, A type determination step that determines the type based on the value of the definition string, An input step that provides a user interface for accepting input values ​​to rewrite the aforementioned definition string, An inspection step in which a predetermined check is performed on the input value according to the type, A dictionary generation step that generates a dictionary file that associates the definition string with the input value that passed the inspection, An execution step in which a computer rewrites and executes the program based on the dictionary file; and a testing method in which a computer performs this execution step.

7. An inspection program for causing a computer to function as the inspection device described in claim 1 or claim 2.

Images