WO2023224013A1

WO2023224013A1 - Test pattern generation device and test pattern generation program

Info

Publication number: WO2023224013A1
Application number: PCT/JP2023/018167
Authority: WO
Inventors: 友一樫山
Original assignee: オン・デマンド・ワン株式会社
Priority date: 2022-05-17
Filing date: 2023-05-15
Publication date: 2023-11-23

Abstract

[Problem] To generate a suitable test pattern. [Solution] This test pattern generation device 1 generates a test pattern TP for a vulnerability test which tests the vulnerability of image display information. The test pattern generation device 1 comprises: a screen display information acquisition unit 10 which acquires screen display information about a target screen W including a plurality of predetermined display areas DA in which predetermined displaying is performed and a plurality of input areas IA to which input values IV can be input; and a test pattern generation unit 11 which analyzes the screen display information acquired by the screen display information acquisition unit 10 and generates a test pattern TP in which the input values IV, which should be input to the plurality of input areas IA in order to test the vulnerability of the screen display information, are designated. The test pattern generation unit 11 respectively acquires variable names FN set to the plurality of input areas IA and designates, according to the variable name FN set to the input areas IA, the input values IV that should be respectively input to the plurality of input areas IA.

Description

Test pattern generation device and test pattern generation program

The present disclosure relates to a test pattern generation device and a test pattern generation program.

It is widely practiced to allow arbitrary input values to be input into a predetermined area (text box, etc.) on a screen displayed on a display or the like. It is desirable that such screens be designed to avoid high vulnerabilities such as errors caused by input values. Therefore, when designing a screen, a vulnerability test is performed to test the vulnerability of screen display information written in HTML (Hypertext Markup Language) or the like. For example, Patent Document 1 discloses a device that modifies a request generated from a transition scenario that aggregates screen transition routes according to predetermined conditions, and determines the degree of vulnerability according to the content of the response to the request. There is.

Patent No. 6942277

By the way, in a vulnerability test, it is confirmed whether or not an error occurs by inputting various input values into areas on the screen where input values can be input. A set of input values input in this way is called a test pattern. Here, if the input values included in the test pattern are not set appropriately, for example because they do not match the input format of the input area, there is a risk that the vulnerability test cannot be continued due to format mismatch (format error). There is. Specifically, if there is a format mismatch in even one of the multiple input items, the vulnerability test may not be able to be continued. Therefore, it is desirable to appropriately set the test pattern.

Therefore, a test pattern generation device and a test pattern generation program according to the present disclosure aim to generate appropriate test patterns.

A test pattern generation device (1) according to one aspect of the present disclosure is a test pattern generation device (1) that generates a test pattern (TP) for a vulnerability test to test the vulnerability of screen display information, Screen display information for acquiring screen display information of a target screen (W) that includes multiple default display areas (DA) with default displays and multiple input areas (IA) where input values (IV) can be entered. The screen display information acquired by the acquisition unit (10) and the screen display information acquisition unit (10) is analyzed and input into a plurality of input areas (IA) in order to test the vulnerability of the screen display information. a test pattern generation section (11) that generates a test pattern (TP) specifying an input value (IV), the test pattern generation section (11) being set in each of a plurality of input areas (IA); The input value (IV) to be input to each of multiple input areas (IA) is specified according to the variable name (FN) set in the input area (IA). do.

A test pattern generation program (P) according to one aspect of the present disclosure causes a computer (C) to execute a test pattern generation process to generate a test pattern (TP) for a vulnerability test for testing the vulnerability of screen display information. A test pattern generation program (P) that causes a computer (C) to display a plurality of default display areas (DA) in which default displays are displayed and a plurality of input areas (IA) in which input values (IV) can be entered. ) and a screen display information acquisition unit (10) that acquires the screen display information of the target screen (W), which analyzes the screen display information acquired by the screen display information acquisition unit (10), and A test pattern generation unit (11) that generates a test pattern (TP) specifying input values (IV) to be input to a plurality of input areas (IA) in order to test vulnerabilities; The generation unit (11) acquires the variable name (FN) set in each of the plurality of input areas (IA), and generates an input value (IV) to be input to each of the plurality of input areas (IA). Specify according to the variable name (FN) set in the input area (IA).

According to at least one of these test pattern generation device (1) and test pattern generation program (P), screen display information of a target screen (W) including a default display area (DA) and a plurality of input areas (IA). By analyzing the above, a test pattern (TP) is generated that specifies input values (IV) to be input into a plurality of input areas (IA) in a vulnerability test of the screen display information. Specifically, the variable name (FN) set in each of a plurality of input areas (IA) is obtained, and the input value (IV) is determined according to the variable name (FN) set in the input area (IA). is specified. In this way, it is possible to specify a suitable input value (IV) by referring to the variable name (FN), so that an appropriate test pattern (TP) can be generated.

In the test pattern generation device (1) according to one aspect of the present disclosure, the test pattern generation unit (11) creates a label name (LN) in each of the plurality of input areas (IA) based on the default display area (DA). and specify the input value (IV) to be input into each of multiple input areas (IA) according to the variable name (FN) and label name (LN) set in the input area (IA). You may. According to this, a more suitable input value (IV) can be specified by referring to the label name (LN) set for each of a plurality of input areas (IA) based on the default display area (DA). Become.

In the test pattern generation device (1) according to one aspect of the present disclosure, the test pattern generation unit (11) includes a default display displayed at a position closest to each of the plurality of input areas (IA) on the target screen (W). A label name (LN) may be set in the input area (IA) based on the area (DA). According to this, it becomes easy to set an appropriate label name (LN) for each of the plurality of input areas (IA).

A test pattern generation device (1) according to an aspect of the present disclosure generates a vulnerability test based on a test result of a vulnerability test performed using a test pattern (TP) generated by a test pattern generation unit (11). The test pattern generation unit (11) includes a format conformance determination unit (14) that determines whether the pattern (TP) conforms to a format for testing the vulnerability of screen display information. (14), if it is determined that the test pattern (TP) does not conform to the format for testing the vulnerability of screen display information, a new label name (LN) is added to each of the multiple input areas (IA). ), and set the input value (IV) to be input in each of the multiple input areas (IA) to the variable name (FN) and the variable name (FN) set in the input area (IA). It may be newly designated according to the modified label name (MLN). According to this, even if the label name (LN) set for multiple input areas (IA) is not appropriate, another label name (LN) can be set and vulnerability testing can be continued. Can be done.

In the test pattern generation device (1) according to one aspect of the present disclosure, the test pattern generation unit (11) includes a default display displayed at a position closest to each of the plurality of input areas (IA) on the target screen (W). When a label name (LN) is set in the input area (IA) based on the area (DA), the test pattern (TP) is used by the format conformance determination unit (14) to test the vulnerability of the screen display information. When it is determined that the format does not conform to the format, the relevant A modified label name (MLN) may be set in the input area (IA). According to this, it becomes easy to set an appropriate label name (LN) for each of multiple input areas (IA), and even if the label name (LN) is not appropriate, another relatively appropriate label name (LN) can be set. This makes it easier to set a label name (LN).

A test pattern generation device (1) according to an aspect of the present disclosure generates a vulnerability test based on a test result of a vulnerability test performed using a test pattern (TP) generated by a test pattern generation unit (11). The test pattern generation unit (11) includes a format conformance determination unit (14) that determines whether the pattern (TP) conforms to a format for testing the vulnerability of screen display information. Input values to be input into each of the plurality of input areas (IA) when it is determined that the test pattern (TP) does not conform to the format for testing the vulnerability of screen display information according to (14) As (IV), the input value (IV) input from the user terminal (2) may be newly specified. According to this, even if the label name (LN) set in multiple input areas (IA) is not appropriate, the user can manually specify another appropriate label name (LN). Vulnerability testing can continue.

In the test pattern generation device (1) according to one aspect of the present disclosure, the test pattern generation unit (11) generates a variable name (FN) and a label name (LN) set in each of the plurality of input areas (IA). The screen display information acquisition unit (10) adds new information to the trained model in which the neural network has been trained to estimate input values (IV) to be input to each of the plurality of input areas (IA). By inputting the variable name (FN) and label name (LN) related to the acquired screen display information as input data, multiple input values (IV) can be output as new output data corresponding to the input data. may be specified as input values (IV) to be input to each of the input areas (IA). According to this, a more suitable input value (IV) can be specified using machine learning.

In the test pattern generation device (1) according to one aspect of the present disclosure, the test pattern generation unit (11) determines whether the input value (IV) to be input to each of the plurality of input areas (IA) is a date. If it is determined that the input value (IV) to be input into each of the plurality of input areas (IA) is a date, a description of the date display included in the default display area (DA). The format may be determined and the date represented by the description format may be designated as the input value (IV). According to this, it is possible to specify a more suitable date input value (IV) by taking advantage of the fact that the date display format is likely to be common within the same target screen (W). .

In the test pattern generation device (1) according to one aspect of the present disclosure, a vulnerability test is performed on a specific input area (SIA) that is a test target among a plurality of input areas (IA) included in a target screen (W); This is a test executed by inputting an input value (IV) to each of the remaining input areas (RIA) other than the specific input area (SIA), and the test pattern generation unit (11) is a screen display information acquisition unit. The screen display information obtained in (10) may be analyzed to generate a test pattern (TP) specifying the input value (IV) to be input to the residual input area (RIA). According to this, it becomes possible to specify a suitable input value (IV) for the input area (IA) other than the test target among the plurality of input areas (IA).

In the test pattern generation device (1) according to one aspect of the present disclosure, the test pattern generation unit (11) analyzes the screen display information acquired by the screen display information acquisition unit (10), and ) A test pattern (TP) may be generated in which a test target input value, which is an input value (IV) to be input into the test pattern (IV), is specified. According to this, it becomes possible to input a suitable input value (IV) into the specific input area (SIA) that is the test target.

Note that the above reference numerals in parentheses indicate the reference numerals of constituent elements in the embodiments to be described later as an example of the present disclosure, and do not limit the present disclosure to the aspects of the embodiments.

In this way, the test pattern generation device and test pattern generation program according to the present disclosure can generate appropriate test patterns.

FIG. 1 is a block diagram showing the functional configuration of a test pattern generation device according to this embodiment. FIG. 2 is a diagram showing an example of the target screen. FIG. 3 is a diagram showing an example of variable names, label names, and test patterns corresponding to the target screen. FIG. 4 is a diagram showing an example of variable names, label names, and test patterns when corrected label names are set for some of the label names. FIG. 5 is a flowchart of test pattern generation processing executed by the test pattern generation device. FIG. 6 is a block diagram showing the module configuration of the test pattern generation program.

Hereinafter, exemplary embodiments will be described with reference to the drawings. Note that the same or corresponding parts in each figure are given the same reference numerals, and redundant explanation will be omitted.

[overall structure]
FIG. 1 is a block diagram showing the functional configuration of a test pattern generation device 1 according to this embodiment. FIG. 2 is a diagram showing an example of the target screen W. FIG. 3 is a diagram showing an example of a variable name FN, a label name LN, and a test pattern TP corresponding to the target screen W. The test pattern generation device 1 shown in FIGS. 1 to 3 is a vulnerability test for testing the vulnerability of the screen display information of the target screen W when designing the target screen W, which is a screen to be displayed on a display or the like. This is a device that generates an appropriate test pattern TP.

Here, the "target screen W" is a screen that can be displayed on a display or the like by a user, such as the general public or a specific customer. The target screen W may be a page on a website, or may be a data file as a document that can be exchanged over a network or the like. Although the type and purpose of the target screen W are not particularly limited, in FIG. 2, a fictitious application form (equipment use application form) used within a company is illustrated as a simple example of the target screen W. The target screen W shown in Figure 2 displays the name of the equipment manager, as well as the applicant's name and date of birth, in order to apply to the equipment manager for the use of the equipment for which the application is being made (equipment in the head office hall). This is a screen for inputting , contact information, and base name. The "user" is a person who actually uses the target screen W, and may be a person different from the person (user) who designs or develops the target screen W. Here, the user is an applicant who attempts to apply to the equipment manager for use of the equipment in the head office hall.

"Screen display information" is information that specifies the contents of the target screen W in detail. The screen display information may be written in any format. Here, it is assumed that the target screen W is written in HTML as an example. The screen display information is recorded on, for example, a web server, and may be downloaded from the web server as needed. By being described as screen display information, the target screen W includes a plurality of default display areas DA and a plurality of input areas IA.

The "default display area DA" is an area where a default display is displayed. In other words, the default display area DA is an area that cannot be rewritten by the user or an area that is not expected to be rewritten by the user. In Figure 2, the default display area DA includes "Application form for equipment use", "Lord", "Name", "Date of birth", "Contact information", "Base name", and "Application for use of the following equipment". ” and “Facilities in the head office hall (equipment to be put into service on January 1, 2020)” are shown as examples.

On the other hand, the "input area IA" is an area where an input value IV can be input. In other words, the input area IA is an area for input by the user. "Input value IV" is information input into the input area IA, and for example, if the input area IA is a text box or a drop-down list, it may be a character string, or if the input area IA is a radio button. Alternatively, in the case of a check box or the like, it may be checked or not. In Figure 2, the input area IA is ``Text box immediately before ``Mr.'''', ``Text box immediately after ``Name'''', ``Text box immediately after ``Date of birth'', and ``Contact information''. The display areas of "Text box immediately after 'base name'" and "Text box immediately after 'base name'" are illustrated.

A variable name FN is set in each input area IA. The variable name FN is a character string linked to each input area IA in the screen display information, and may be composed of words related to the contents of each input area IA. In Fig. 3, the variable names FN associated with each input area IA are "Equipment Manager" associated with "Text box immediately before 'Name'" and "Text box immediately after 'Name'". "Applicant" linked to "Applicant", "Date of birth" linked to "Text box immediately after 'Date of birth'", "Telephone number" linked to "Text box immediately after 'Contact information'" ``number'' and ``work location'' linked to the ``text box immediately after ``base name.'''' are shown as examples.

"Vulnerability test" is a test that examines the vulnerability of screen display information. "Vulnerability" here refers to an error (an event in which processing on the target screen W cannot be continued) due to the contents of the input value IV entered into the input area IA on the target screen W. This means the extent to which this may occur. Such an error may typically be an event that occurs when an unexpected input value IV is input into the input area IA. Note that the "error" here means that the target screen W does not function properly due to vulnerability in the screen display information, and is different from "format incompatibility (format error)" described later.

In the vulnerability test, each of the plurality of input areas IA is classified into a specific input area SIA or a residual input area RIA. The "specific input area SIA" means the input area IA that is the test target among the plurality of input areas IA included in the target screen W. The "remaining input area RIA" means an input area IA other than the specific input area SIA among the plurality of input areas IA included in the target screen W. That is, the vulnerability test is a test executed by inputting the input value IV to each of the specific input area SIA and the remaining input area RIA. In the vulnerability test, all or part of a plurality of input areas IA are sequentially set one item at a time to the specific input area SIA. In FIG. 2, first, "the text box immediately before 'Todo'" is set to the specific input area SIA, and input areas IA other than "the text box immediately before 'Todo'" are set to the remaining input area RIA. . After this, when "the text box immediately after 'Name'" is set in the specific input area SIA, input areas IA other than "the text box immediately after 'Name'" (the text box that was previously set in the specific input area SIA) "including the text box immediately before 'dono'") is set in the remaining input area RIA. Thereafter, each input area IA is sequentially set as the specific input area SIA, and the other input areas IA are set as the remaining input area RIA. As a result, even if an error occurs in the vulnerability test, it becomes clear to which input area IA the error is caused.

"Test pattern TP" is a set of input values IV specifying input values IV to be input into each input area IA in order to test the vulnerability of screen display information in a vulnerability test. The test pattern TP may be a set of input values IV specifying at least the input values IV to be input to the remaining input area RIA. Alternatively, the test pattern TP may be a set of input values IV specifying input values IV to be input to each of the specific input area SIA and the remaining input area RIA.

The physical configuration of the test pattern generation device 1 will be explained. The test pattern generation device 1 is physically configured as a computer C (server) that can communicate with the user terminal 2 and the like via a network by wire or wirelessly. The test pattern generation device 1 includes a control calculation device, a storage device, and an input/output device. The control arithmetic device is configured as a controller such as a CPU (Central Processing Unit), and performs arithmetic processing and controls a storage device and an input/output device. The storage device includes, for example, a main storage device and an auxiliary storage device. The main storage device is composed of, for example, RAM (Random Access Memory). Further, the auxiliary storage device is constituted by, for example, a ROM (Read Only Memory). The input/output device includes, for example, an input device that receives data from the outside and sends it to the storage device, and an output device that outputs the calculation result calculated by the control calculation device and stored in the storage device to the outside. There is.

The test pattern generation device 1 executes a predetermined process by, for example, loading a program stored in a ROM into a RAM, and executing the program loaded into the RAM by a CPU. Here, the test pattern generation device 1 loads a test pattern generation program P stored in the ROM into the RAM, and executes the test pattern generation program P read into the RAM by the CPU, thereby performing the test pattern generation process described below. Execute. Note that the test pattern generation device 1 may physically have a configuration different from the configuration described above.

The user terminal 2 can create and edit screen display information for the target screen W. The user terminal 2 displays the created and edited target screen W on a browser. Further, the user terminal 2 cooperates with the test pattern generation device 1 using the extension function of the browser to execute a vulnerability test of the screen display information of the target screen W. When executing a vulnerability test, the user terminal 2 sends screen display information to the test pattern generation device 1, sends a test pattern request to the test pattern generation device 1, and executes a test according to the sent test pattern request. The pattern TP is received from the test pattern generation device 1, and the test result of the vulnerability test is transmitted to the test pattern generation device 1. The "test pattern request" is a request to transmit a test pattern TP corresponding to screen display information for which vulnerability is to be tested. The test pattern request may be a request to transmit a test pattern TP according to screen display information that has already been transmitted from the user terminal 2 to the test pattern generation device 1. The user terminal 2 may be a notebook computer, a desktop computer, a tablet, a smartphone, or the like operated by the user, and here it is assumed that the user terminal 2 is a notebook computer.

Next, the functional configuration of the test pattern generation device 1 will be explained. Functionally, the test pattern generation device 1 includes a screen display information acquisition section 10, a test pattern generation section 11, a test pattern transmission section 12, a test result reception section 13, a format conformance determination section 14, a vulnerability determination section 15, and a result notification information generation section 16.

The screen display information acquisition unit 10 acquires screen display information of the target screen W including the default display area DA and input area IA. The screen display information acquisition unit 10 may acquire the screen display information from the user terminal 2, for example, or may acquire the image display information from an external server or the like that receives the screen display information from the user terminal 2. In addition, if the test pattern generation device 1 itself is equipped with a function capable of creating and editing screen display information, the screen display information acquisition unit 10 also displays the screen display information created and edited by the test pattern generation device 1 itself. Information may also be obtained.

The test pattern generation unit 11 analyzes the screen display information acquired by the screen display information acquisition unit 10, and generates input values IV to be input into the plurality of input areas IA in order to test the vulnerability of the screen display information. A test pattern TP that specifies is generated. For example, the test pattern generation unit 11 may analyze the screen display information acquired by the screen display information acquisition unit 10 and generate a test pattern TP specifying the input value IV to be input into the remaining input area RIA. Often, a test pattern TP may be generated specifying input values IV to be input to each of the specific input area SIA and the remaining input area RIA. The test pattern generation unit 11 may generate the test pattern TP when the screen display information acquisition unit 10 acquires the screen display information, and the test pattern generation unit 11 may generate the test pattern TP when the screen display information acquisition unit 10 acquires the screen display information. The test pattern TP may be generated when a predetermined condition is met (for example, an explicit instruction is given).

The test pattern generation unit 11 analyzes the screen display information acquired by the screen display information acquisition unit 10, and generates a test pattern TP specifying the test target input value, which is the input value IV to be input into the specific input area SIA. May be generated. More specifically, the test pattern generation unit 11 may generate a test pattern TP specifying only the input value IV (input value to be tested) to be input to the specific input area SIA as the input value IV; A test pattern TP may be generated that specifies both the input value IV (test target input value) to be input to the input area SIA and the input value IV to be input to the remaining input area RIA. Further, the test pattern generation unit 11 may generate a test pattern TP specifying only the input value IV to be input into the remaining input area RIA as the input value IV.

FIG. 4 is a diagram showing an example of variable names FN, label names LN, and test patterns TP when corrected label names MLN are set for some of the label names LN. A specific method for generating the test pattern TP by the test pattern generation section 11 will be described with reference to FIGS. 2 to 4.

As described above, variable names FN are set in each input area IA of the target screen W. In other words, the variable name FN corresponding to the input area IA is defined in the screen display information. The test pattern generation unit 11 acquires the variable name FN set in each input area IA. Specifically, the test pattern generation unit 11 analyzes the contents of the screen display information written in HTML and obtains the variable name FN set in each input area IA.

Furthermore, the test pattern generation unit 11 sets a label name LN in each input area IA based on the default display area DA of the target screen W. "Label name LN" expresses the content of the input value IV to be input into each input area IA. The label name LN is given to each input area IA by the test pattern generation unit 11 according to a predetermined algorithm. That is, the label name LN corresponding to each input area IA is not defined in the screen display information.

The test pattern generation unit 11 sets a label name LN for each input area IA on the target screen W based on the default display area DA displayed at the closest position from each input area IA. The "nearest position" refers to each input area IA (specifically, the center of each input area IA, or an arbitrary point on the outer periphery of each input area IA, etc.) when the target screen W is displayed on the display. ) means that the straight line distance on the display is the shortest. In FIGS. 2 and 3, in the input area IA of "the text box immediately before 'Tono'", the label name LN is "Tono" because the default display area DA displayed at the closest position is "Tono". It is set. In the input area IA of the "text box immediately after 'Name'", the label name LN is set to "Name" because the default display area DA displayed at the closest position is "Name". In the input area IA of "Text box immediately after 'Date of Birth'", the label name LN is set to 'Date of Birth' because the default display area DA displayed at the closest position is 'Date of Birth'. has been done. In the input area IA of "Text box immediately after 'Contact'", the label name LN is set to 'Contact' because the default display area DA displayed at the closest position is 'Contact'. . In the input area IA of "Text box immediately after 'base name'", the label name LN is "(abbreviation not allowed)" because the default display area DA displayed at the closest position is "(abbreviation not allowed)". It is set.

The test pattern generation unit 11 modifies the already set label name LN and sets a modified label name MLN. "Modified label name MLN" is a label name LN newly set in the input area IA in which a label name LN has already been set. As will be described later, when the format conformance determination section 14 determines that the test pattern TP does not conform to the format for testing the vulnerability of screen display information, the test pattern generation section 11 generates a Set the modified label name MLN. At this time, the test pattern generation unit 11 may set the corrected label name MLN to all of the plurality of input areas IA included in the target screen W, or may set the corrected label name MLN to some of them. When setting the corrected label name MLN in some of the plurality of input areas IA, it can be arbitrarily determined in which input area IA the corrected label name MLN is set. For example, as will be described later, the corrected label name MLN may be set in the input area IA for which format incompatibility has been pointed out by the format compatibility determination unit 14.

For example, when the test pattern generation unit 11 sets a label name LN to the input area IA based on the default display area DA displayed at the closest position from each input area IA on the target screen W, The format conformance determination unit 14 determined that the test pattern TP does not conform to the format for testing the vulnerability of screen display information (in other words, it does not conform to the format to be input into the input area IA). Sometimes, the modified label name MLN may be set in the input area IA based on the default display area DA displayed at the second closest position from each input area IA on the target screen W. Here, as a result of executing a vulnerability test based on the label name LN shown in Fig. 3, if a format mismatch (described later) occurs and the vulnerability test cannot be continued, as shown in Fig. 4. A modified label name MLN is set in . In other words, in FIG. 3, in the input area IA of the "text box immediately after 'base name'", the label name LN is It is set as "(abbreviation not allowed)". On the other hand, in Figure 4, in the input area IA of the "text box immediately after 'base name'", the modified label is The name MLN is set as "base name".

The test pattern generation unit 11 specifies the input value IV to be input to each input area IA. At least, the test pattern generation unit 11 specifies the input value IV to be input to each input area IA according to the variable name FN set in the input area IA. "Specify according to the variable name FN" may mean specifying the variable name FN as it is as the input value IV, or specifying a predetermined modification to the variable name FN as the input value IV. Alternatively, a predetermined character string or the like linked to the variable name FN may be specified as the input value IV.

In addition, when a label name LN is set in each input area IA, the test pattern generation unit 11 converts the input value IV to be input into each input area IA into the variable name set in the input area IA. It may be specified according to FN and label name LN. In this case, various settings can be made as to what input value IV is specified from the variable name FN and label name LN. In FIG. 3, the input values IV specified for each input area IA are "Ichiro Tanaka" specified for "the text box immediately before 'dono'" and "text box immediately after 'name'". "Hanako Suzuki" specified for "April 1, 1990" specified for "Text box immediately after 'Date of birth'", "Text box immediately after 'Contact information'" Examples include "050-000-000" specified for "base name" and "Tokyo" specified for "text box immediately after 'base name'". In addition, here, the variable name FN for "the text box immediately after 'base name'" is "work location" and the label name LN is "(abbreviation not allowed)", so the base name (head office, Kyushu office, etc.) was not detected, and as a result, "Tokyo" was entered by mistake (in this explanation, "Head Office", "Kyushu Office", etc. should be entered here). (This assumes that the format is non-conforming.)

When the modified label name MLN is set in at least one of the input areas IA, the test pattern generation unit 11 sets the input value IV to be input in each input area IA to the input value IV set in the input area IA. It may be newly designated according to the variable name FN and modified label name MLN. Even in this case, various settings can be made as to what input value IV is specified from the variable name FN and label name LN. In FIG. 4, the corrected label name MLN of "head office" is specified for the "text box immediately after 'base name'". Here, unlike in Figure 3, the label name LN for "text box immediately after 'base name'" has been corrected to "base name", so the base name (head office, Kyushu office, etc.) should be entered. , and as a result, "Headquarters" is correctly entered.

For example, the test pattern generation unit 11 may specify the input value IV to be input to each input area IA using machine learning such as deep learning (so-called AI (Artificial Intelligence)). As an example, a neural network can be used that includes an input layer into which input data is input, an output layer which outputs output data, and an intermediate layer arranged between the input layer and the output layer. In this case, the test pattern generation unit 11 estimates the input value IV to be input to each of the plurality of input areas IA from the variable name FN and label name LN (corrected label name MLN) set in each input area IA. The variable name FN and label name LN (corrected label name MLN) related to the screen display information newly acquired by the screen display information acquisition unit 10 are input data to the trained model in which the learning for the neural network has been performed for the neural network. The input value IV to be output as new output data corresponding to the input data may be specified as the input value IV to be input to each input area IA.

The test pattern generation unit 11 determines whether the input value IV to be input into each input area IA is a date (for example, year, month, day, etc.). Based on the variable name FN and label name LN (corrected label name MLN) set in each input area IA, the test pattern generation unit 11 determines whether the input value IV to be input to the input area IA is based on the date (for example, year, month, day, etc.).

When it is determined that the input value IV to be input into each input area IA is a date, the test pattern generation unit 11 determines the description format of the date display included in the default display area DA, and The date represented by the format is designated as the input value IV. "Description format" is the pattern of how dates are written, such as the order in which "year, month, and day" are written, whether or not to insert slashes or dots between these "year, month, and day," The format includes whether or not to include the year. The test pattern generation unit 11 analyzes the screen display information of the default display area DA included in the target screen W, and extracts the date display included in the target screen W. Here, as shown in Figure 2, "January 1, 2020" is displayed as part of the default display area DA for "Facilities in the head office hall (equipment that started service on January 1, 2020)". The date display is extracted. In addition, in FIG. 2, since the input value IV to be input into the input area IA of "the text box immediately after 'date of birth'" is a date, the test pattern generation unit 11 inputs it into the input area IA. The date is set to ``April 1, 1990,'' which matches the writing format of ``January 1, 2020.''

The test pattern transmitter 12 receives a test pattern request from the user terminal 2. The “test pattern request” is a request to transmit the test pattern TP generated by the test pattern generation unit 11 to the user terminal 2.

The test pattern transmitter 12 transmits the test pattern TP to the user terminal 2. For example, upon receiving a test pattern request from the user terminal 2, the test pattern transmitter 12 may transmit the test pattern TP to the user terminal 2. Alternatively, the test pattern transmitter 12 may transmit the test pattern TP to the user terminal 2 in response to an event other than reception of a test pattern request.

The test result receiving unit 13 receives test results from the user terminal 2. The “test result” is the result of a vulnerability test executed on the user terminal 2. Specifically, the test result is a result of a vulnerability test executed on the user terminal 2 using the test pattern TP transmitted to the user terminal 2 by the test pattern transmitting unit 12. The test results determine whether the test pattern TP conforms to the format for testing the vulnerability of screen display information, and whether the test pattern TP conforms to the format for testing the vulnerability of screen display information. If so, information regarding whether or not the image display information of the target screen W has vulnerability may be included.

The format compatibility determination unit 14 determines whether the test pattern TP tests the vulnerability of the screen display information based on the test result of the vulnerability test performed using the test pattern TP generated by the test pattern generation unit 11. Determine whether it conforms to the format. If the test result indicates that the input value IV input to any input area IA does not conform to the appropriate format, the format conformance determination unit 14 determines that the test pattern TP is the screen display information. It may be determined that the format does not conform to the format for testing vulnerabilities (format incompatibility). On the other hand, if the test result shows that the input values IV input to all the input areas IA conform to the appropriate format, the format conformance determination unit 14 determines that the test pattern TP is the screen display information. may be determined to conform to the format for testing vulnerabilities (format conformance). As an example, if the input value IV of "Tokyo" is entered in the input area IA of the "text box immediately after 'base name'", "Tokyo" is not the "base name". Therefore, the format compatibility determining unit 14 determines that at least the input area IA of "the text box immediately after 'base name'" is format incompatible.

The vulnerability determination unit 15 determines the presence or absence of vulnerability in the screen display information when the test pattern TP conforms to the format for testing the vulnerability of the screen display information. The vulnerability determination unit 15 may determine the presence or absence of vulnerability in the screen display information based on the test results of the vulnerability test performed using the test pattern TP generated by the test pattern generation unit 11. . The vulnerability presence/absence determining unit 15 may determine that there is no vulnerability in the screen display information when the test result is “no vulnerability” in the vulnerability test executed on the user terminal 2 (vulnerability None judgment). On the other hand, the vulnerability presence/absence determination unit 15 may determine that the screen display information is vulnerable if the vulnerability test executed on the user terminal 2 shows that the test result is "vulnerable" ( (Judgment of vulnerability).

The result notification information generation unit 16 generates result notification information that notifies the user terminal 2 of the determination results by the format compatibility determination unit 14 and the vulnerability presence determination unit 15. The result notification information generation unit 16 may transmit the generated result notification information to the user terminal 2. For example, the result notification information generation unit 16 may transmit the generated result notification information to the user terminal 2 immediately, or may transmit the generated result notification information to the user terminal 2 upon receiving a command to transmit from the user terminal 2. It's okay.

[Test pattern generation process]
FIG. 5 is a flowchart of the test pattern generation process executed by the test pattern generation device 1. The test pattern generation process shown in FIG. 5 is a process of generating a test pattern TP for a vulnerability test to test the vulnerability of screen display information. The test pattern generation process is started by the computer C executing a test pattern generation program P, which will be described later.

In step S10, the user terminal 2 acquires screen display information of the target screen W including the default display area DA and input area IA. After that, the test pattern generation process moves to step S12.

In step S12, the user terminal 2 transmits screen display information to the test pattern generation device 1. That is, the screen display information acquisition unit 10 of the test pattern generation device 1 acquires screen display information of the target screen W including the default display area DA and the input area IA from the user terminal 2. After that, the test pattern generation process moves to step S14.

In step S14, the test pattern generation unit 11 of the test pattern generation device 1 analyzes the screen display information acquired by the screen display information acquisition unit 10. At this time, the test pattern generation unit 11 acquires the variable name FN set in each input area IA. In subsequent step S16, the test pattern generation unit 11 sets a label name LN in each input area IA based on the default display area DA of the target screen W. Thereafter, the test pattern generation process moves to step S18.

In step S18, the test pattern generation unit 11 of the test pattern generation device 1 generates a test pattern TP specifying the input value IV according to the variable name FN and label name LN set in each input area IA. The test pattern generation unit 11 may generate a test pattern TP specifying an input value IV to be input to the residual input area RIA, and an input value to be input to each of the specific input area SIA and the residual input area RIA. A test pattern TP specifying the IV may be generated. After that, the test pattern generation process moves to step S20.

In step S20, the test pattern transmitter 12 of the test pattern generation device 1 receives a test pattern request from the user terminal 2. In subsequent step S22, the test pattern transmitter 12 transmits the test pattern TP to the user terminal 2. Thereafter, the test pattern generation process moves to step S24.

In step S24, the user terminal 2 uses the test pattern TP received from the test pattern generation device 1 to execute a vulnerability test of the screen display information of the target screen W using the extension function of the browser. The user terminal 2 generates test results of the vulnerability test. In the following step S26, the user terminal 2 transmits the test result to the test pattern generation device 1, and in response, the test result reception unit 13 of the test pattern generation device 1 receives the test result from the user terminal 2. After that, the test pattern generation process moves to step S28.

In step S28, the format compatibility determination unit 14 of the test pattern generation device 1 determines whether the test pattern TP is correct based on the test result of the vulnerability test performed using the test pattern TP generated by the test pattern generation unit 11. Determine whether the screen display information conforms to the format for testing vulnerability. If the test result indicates that the input value IV input to any input area IA does not conform to the appropriate format, the format conformance determination unit 14 determines that the test pattern TP is the screen display information. Determine that it does not conform to the format for testing vulnerabilities (format non-conformance). On the other hand, if the test result shows that the input values IV input to all the input areas IA conform to the appropriate format, the format conformance determination unit 14 determines that the test pattern TP is the screen display information. It is determined that the format conforms to the format for testing vulnerabilities (format conformance). If the format compatibility determination unit 14 determines that the format is incompatible (step S28: NO), the test pattern generation process moves to step S30. On the other hand, if the format compatibility determination unit 14 determines that the format is compatible (step S28: YES), the test pattern generation process moves to step S32.

In step S30, the test pattern generation unit 11 of the test pattern generation device 1 modifies the already set label name LN and sets a modified label name MLN. The test pattern generation unit 11 may set the corrected label name MLN in all of the plurality of input areas IA included in the target screen W, or may set the corrected label name MLN in some of them. Thereafter, the test pattern generation process moves to step S18, and steps S18 and subsequent steps are repeated using the corrected label name MLN.

In step S32, the vulnerability presence/absence determination unit 15 of the test pattern generation device 1 determines the test result of the vulnerability test performed using the test pattern TP generated by the test pattern generation unit 11. Based on this, it is determined whether there is any vulnerability in the screen display information. The vulnerability presence/absence determination unit 15 determines that there is no vulnerability in the screen display information when the test result is "no vulnerability" in the vulnerability test executed on the user terminal 2 (no vulnerability determination). . On the other hand, the vulnerability determination unit 15 determines that the screen display information is vulnerable if the test result is "vulnerable" in the vulnerability test executed on the user terminal 2 (vulnerable judgement). If the vulnerability presence determination unit 15 determines that there is no vulnerability (step S32: YES), the test pattern generation process moves to step S34. On the other hand, if the vulnerability determination unit 15 determines that there is a vulnerability (step S32: NO), the test pattern generation process moves to step S36.

In step S34, the result notification information generation unit 16 of the test pattern generation device 1 generates result notification information that notifies the user terminal 2 that the determination result by the vulnerability presence/absence determination unit 15 is a determination that there is no vulnerability. On the other hand, in step S36, the result notification information generation unit 16 of the test pattern generation device 1 generates result notification information that notifies the user terminal 2 that the determination result by the vulnerability presence determination unit 15 is a vulnerability determination. do. With the above steps, the test pattern generation process ends.

[Test pattern generation program]
A test pattern generation program P for causing the computer C to function as the test pattern generation device 1 will be explained. FIG. 6 is a block diagram showing the module configuration of the test pattern generation program P. The test pattern generation program P shown in FIG. 6 is a program that causes the computer C to execute a test pattern generation process for generating a test pattern TP for a vulnerability test for testing the vulnerability of screen display information.

The test pattern generation program P includes a main module MM, a screen display information acquisition module M10, a test pattern generation module M11, a test pattern transmission module M12, a test result reception module M13, a format conformance determination module M14, a vulnerability determination module M15, and It is equipped with a result notification information generation module M16. The main module MM is a part that controls the computer C in an integrated manner. Each of the screen display information acquisition module M10, test pattern generation module M11, test pattern transmission module M12, test result reception module M13, format conformance determination module M14, vulnerability presence determination module M15, and result notification information generation module M16 is executed. The functions realized by this are the screen display information acquisition unit 10, the test pattern generation unit 11, the test pattern transmission unit 12, the test result reception unit 13, the format conformance determination unit 14, the vulnerability determination unit 15, and the result notification information. The functions are the same as those of the generation unit 16. Note that the test pattern generation program P does not need to include at least one module other than the main module MM, the screen display information acquisition module M10, and the test pattern generation module M11.

[Action and effect]
As explained above, the test pattern generation device 1 is a test pattern generation device 1 that generates test patterns TP for a vulnerability test for testing the vulnerability of screen display information, and includes a plurality of predetermined displayed patterns. A screen display information acquisition unit 10 that acquires screen display information of a target screen W including a default display area DA and a plurality of input areas IA in which input values IV can be input; a test pattern generation unit 11 that analyzes screen display information and generates a test pattern TP specifying input values IV to be input to a plurality of input areas IA in order to test the vulnerability of the screen display information; In preparation, the test pattern generation unit 11 acquires the variable name FN set in each of the plurality of input areas IA, and sets the input value IV to be input to each of the plurality of input areas IA in the input area IA. Specify according to the specified variable name FN.

The test pattern generation program P is a test pattern generation program P that causes the computer C to execute a test pattern generation process for generating a test pattern TP for a vulnerability test for testing the vulnerability of screen display information. , a screen display information acquisition unit 10 that acquires screen display information of a target screen W including a plurality of default display areas DA in which default displays are displayed and a plurality of input areas IA in which input values IV can be input; Analyzes the screen display information acquired by the information acquisition unit 10, and generates a test pattern TP specifying input values IV to be input into a plurality of input areas IA in order to test the vulnerability of the screen display information. The test pattern generation unit 11 acquires the variable name FN set in each of the plurality of input areas IA, and acquires the input value to be input to each of the plurality of input areas IA. IV is specified according to the variable name FN set in the input area IA.

According to at least one of the test pattern generation device 1 and the test pattern generation program P, by analyzing the screen display information of the target screen W including the default display area DA and the plurality of input areas IA, the vulnerability of the screen display information is determined. A test pattern TP is generated that specifies input values IV to be input to a plurality of input areas IA in the performance test. Specifically, the variable name FN set in each of the plurality of input areas IA is acquired, and the input value IV is specified according to the variable name FN set in the input area IA. In this way, it is possible to specify a suitable input value IV by referring to the variable name FN, so that an appropriate test pattern TP can be generated.

In the test pattern generation device 1, the test pattern generation unit 11 sets a label name LN to each of the plurality of input areas IA based on the default display area DA, and inputs the input to be input to each of the plurality of input areas IA. The value IV is specified according to the variable name FN and label name LN set in the input area IA. According to this, a more suitable input value IV can be specified by referring to the label name LN set to each of the plurality of input areas IA based on the default display area DA.

In the test pattern generation device 1, the test pattern generation unit 11 assigns a label name LN to the input area IA based on the default display area DA displayed at the closest position from each of the input areas IA on the target screen W. Set. According to this, it becomes easy to set appropriate label names LN for each of the plurality of input areas IA.

The test pattern generation device 1 uses the test pattern TP to test the vulnerability of screen display information based on the test result of the vulnerability test performed using the test pattern TP generated by the test pattern generation unit 11. The test pattern generating section 11 includes a format conformance determining section 14 that determines whether the test pattern TP conforms to the format of the screen display information. If it is determined that they do not conform, a corrected label name MLN, which is a new label name LN, is set in each of the plurality of input areas IA, and an input value IV to be input in each of the plurality of input areas IA is set. , is newly designated according to the variable name FN and modified label name MLN set in the input area IA. According to this, even if the label names LN set in the plurality of input areas IA are not appropriate, it is possible to set another label name LN and continue the vulnerability test.

In the test pattern generation device 1, the test pattern generation unit 11 assigns a label name LN to the input area IA based on the default display area DA displayed at the closest position from each of the input areas IA on the target screen W. In this case, when the format conformance determination unit 14 determines that the test pattern TP does not conform to the format for testing the vulnerability of screen display information, each of the plurality of input areas IA on the target screen W A modified label name MLN is set in the input area IA based on the default display area DA displayed at the second closest position. According to this, it becomes easier to set an appropriate label name LN for each of the plurality of input areas IA, and even if the label name LN is not appropriate, another relatively appropriate label name LN is set. It becomes easier.

In the test pattern generation device 1, the test pattern generation unit 11 estimates an input value IV to be input to each of the plurality of input areas IA from the variable name FN and label name LN set in each of the plurality of input areas IA. By inputting the variable name FN and label name LN related to the screen display information newly acquired by the screen display information acquisition unit 10 as input data to the trained model in which the neural network has been trained to , the input value IV to be output as new output data corresponding to the input data is designated as the input value IV to be input to each of the plurality of input areas IA. According to this, it becomes possible to specify a more suitable input value IV using machine learning.

In the test pattern generation device 1, the test pattern generation unit 11 determines whether the input value IV to be input to each of the plurality of input areas IA is a date, and determines whether the input value IV to be input to each of the plurality of input areas IA is a date. If it is determined that the input value IV to be input is a date, the format of the date display included in the default display area DA is determined, and the date represented by the format is specified as the input value IV. . According to this, it is possible to specify a more suitable date input value IV by utilizing the fact that there is a high possibility that the description format of date display is common within the same target screen W.

In the test pattern generation device 1, the vulnerability test is performed on each of the specific input area SIA that is the test target and the remaining input area RIA other than the specific input area SIA among the plurality of input areas IA included in the target screen W. This is a test that is executed by inputting an input value IV, and the test pattern generation unit 11 analyzes the screen display information acquired by the screen display information acquisition unit 10 to determine the input that should be input into the remaining input area RIA. A test pattern TP with a specified value IV is generated. According to this, it becomes possible to specify a suitable input value IV for the input area IA other than the test target among the plurality of input areas IA.

In the test pattern generation device 1, the test pattern generation unit 11 analyzes the screen display information acquired by the screen display information acquisition unit 10, and generates a test target input value which is the input value IV to be input into the specific input area SIA. A test pattern TP that specifies is generated. According to this, it becomes possible to input a suitable input value IV to the specific input area SIA that is the test target.

[Deformed form]
The embodiments described above can be implemented in various forms with changes or improvements based on the knowledge of those skilled in the art.

For example, in the embodiment described above, the target screen W shown in FIG. 2 is an example, and the test pattern generation device 1 is also applicable to a target screen W in a completely different form from this target screen W.

In the test pattern generation device 1 described above, the test pattern generation unit 11 also assigns a label name LN to the input area IA based on the default display area DA displayed at the position closest to each input area IA on the target screen W. Set. However, the test pattern generation unit 11 is displayed in the same row as each input area IA on the target screen W (at the same height in the vertical direction as each input area IA on the target screen W, that is, in a horizontal position). The label name LN may be set in the input area IA based on the default display area DA. In other words, the test pattern generation unit 11 selects a default display area that is displayed in the same row as each input area IA on the target screen W, rather than a default display area DA that is displayed in the closest position from each input area IA on the target screen W. Priority may be given to DA.

In addition, in the above-described test pattern generation device 1, when the format conformance determining unit 14 determines that the format is non-conforming in step S28 of the test pattern generation process (step S28: NO), the test pattern generating unit 11 corrects the pattern in step S30. The label name MLN is set, and then the test pattern TP is generated again using the modified label name MLN. However, instead of automatically regenerating the test pattern TP in this way (or in addition to automatically regenerating the test pattern TP in this way), the test pattern generation device 1 uses manual input from the user. Corrections may also be made (manually).

That is, the test pattern generation device 1 uses the test pattern TP to test the vulnerability of the screen display information based on the test result of the vulnerability test performed using the test pattern TP generated by the test pattern generation unit 11. The test pattern generating section 11 includes a format conformance determining section 14 that determines whether the test pattern TP conforms to a format for testing the vulnerability of screen display information. If it is determined that the input value IV does not conform to the format, the input value IV input from the user terminal 2 may be newly designated as the input value IV to be input to each of the plurality of input areas IA. According to this, even if the label name LN set in multiple input areas IA is not appropriate, the vulnerability test can be continued by specifying another appropriate label name LN by manual input by the user. be able to.

Claims

A test pattern generation device that generates a test pattern for a vulnerability test to test the vulnerability of screen display information,
a screen display information acquisition unit that acquires the screen display information of a target screen including a plurality of default display areas in which default displays are displayed and a plurality of input areas in which input values can be input;
The test specifies the input values to be input into the plurality of input areas in order to analyze the screen display information acquired by the screen display information acquisition unit and test the vulnerability of the screen display information. A test pattern generation unit that generates a pattern,
The test pattern generation unit includes:
Obtain the variable name set in each of the plurality of input areas,
A test pattern generation device that specifies the input value to be input to each of the plurality of input areas according to the variable name set in the input area.
The test pattern generation unit includes:
setting a label name for each of the plurality of input areas based on the default display area;
The test pattern generation device according to claim 1, wherein the input value to be input into each of the plurality of input areas is specified according to the variable name and the label name set in the input area.
The test pattern generation unit sets the label name to the input area based on the default display area that is displayed at a position closest to each of the plurality of input areas on the target screen. test pattern generator.
Based on the test result of the vulnerability test performed using the test pattern generated by the test pattern generation unit, the test pattern conforms to the format for testing the vulnerability of the screen display information. a format compatibility determination unit that determines whether the
The test pattern generation unit includes:
If the format conformance determination unit determines that the test pattern does not conform to the format for testing the vulnerability of the screen display information, a new label name is displayed in each of the plurality of input areas. Set a certain correction label name,
The test pattern generation device according to claim 2, wherein the input value to be input to each of the plurality of input areas is newly specified according to the variable name and the modified label name set in the input area. .
The test pattern generation unit may set the label name to the input area based on the default display area that is displayed at a position closest to each of the plurality of input areas on the target screen. when the determination unit determines that the test pattern does not conform to the format for testing the vulnerability of the screen display information, the second closest position from each of the plurality of input areas on the target screen; The test pattern generation device according to claim 4, wherein the modified label name is set in the input area based on the default display area displayed in the input area.
Based on the test result of the vulnerability test performed using the test pattern generated by the test pattern generation unit, the test pattern conforms to the format for testing the vulnerability of the screen display information. a format compatibility determination unit that determines whether the
The test pattern generation unit is configured to generate data in each of the plurality of input areas when the format conformance determination unit determines that the test pattern does not conform to the format for testing the vulnerability of the screen display information. The test pattern generation device according to claim 1, wherein the input value input from a user terminal is newly specified as the input value to be input to the test pattern generation device.
The test pattern generation unit uses a neural network for learning to estimate the input value to be input to each of the plurality of input areas from the variable name and the label name set to each of the plurality of input areas. By inputting, as input data, the variable name and the label name related to the screen display information newly acquired by the screen display information acquisition unit into the trained model that has been trained, the input data can be handled. 3. The test pattern generation device according to claim 2, wherein the input value to be output as new output data is specified as the input value to be input to each of the plurality of input areas.
The test pattern generation unit includes:
determining whether the input value to be input into each of the plurality of input areas is a date;
If it is determined that the input value to be input into each of the plurality of input areas is a date, the format of the date display included in the default display area is determined, and the date is expressed in the format. The test pattern generation device according to claim 1, wherein a date specified as the input value is specified as the input value.
The vulnerability test is performed by inputting the input value into each of the specific input area to be tested and the remaining input area other than the specific input area among the plurality of input areas included in the target screen. is a test that is executed,
The test pattern generation unit analyzes the screen display information acquired by the screen display information acquisition unit and generates the test pattern specifying the input value to be input into the remaining input area. 9. The test pattern generation device according to any one of 1 to 8.
The test pattern generation unit analyzes the screen display information acquired by the screen display information acquisition unit and generates the test pattern specifying a test target input value that is the input value to be input to the specific input area. The test pattern generation device according to claim 9, which generates a test pattern.
A test pattern generation program that causes a computer to execute a test pattern generation process that generates a test pattern for a vulnerability test to test the vulnerability of screen display information,
The computer,
a screen display information acquisition unit that acquires the screen display information of a target screen including a plurality of default display areas in which default displays are displayed and a plurality of input areas in which input values can be input;
The test specifies the input values to be input into the plurality of input areas in order to analyze the screen display information acquired by the screen display information acquisition unit and test the vulnerability of the screen display information. Functions as a test pattern generation section that generates a pattern,
The test pattern generation unit includes:
Obtain the variable name set in each of the plurality of input areas,
A test pattern generation program that specifies the input value to be input to each of the plurality of input areas according to the variable name set in the input area.