Exploring Effective Data for Surrogate Training Towards Black-box Attack