SQL injection attack detection system supporting multiple database types

Abstract

The invention relates to an SQL injection attack detecting system which supports multiple types of databases, which comprises a data acquisition module, a data preprocessing module, SQL injection attack detecting modules, an SQL injection alarming module and a classification transferring module. The system may comprise a plurality of the SQL injection attack detecting modules, and each of the SQL injection attack detecting modules respectively creates SQL injection attack detecting grammar rules based on the expanded SQL grammar of the data base types which are related with the SQL injection attack detecting modules, each of the SQL injection attack detecting modules is bound with the destination address of a certain Web application server, thereby the SQL injection attack detection of all to-be detected objects which have the same determination address is realized. The system fully considers the differences of the SQL grammar of various types of the databases, classifies the to-be detected objects according to the destination address of the Web application server, and detects the objects by the SQL injection attack detecting module which supports the SQL grammar expansion of the specific types of the databases, and greatly reduces the under-reporting problems in the SQL injection attack detecting modules.

Description

technical field [0001] The invention relates to the technical field of network security detection, in particular to an SQL injection attack detection system that supports multiple database types and can be used for intrusion detection and defense products. Background technique [0002] SQL (Structure Query Language, Structured Query Language) injection attack means that the attacker uses the SQL injection vulnerability in the existing application program to inject malicious SQL commands into the background database engine for execution, so as to steal data or even control the database server security incidents. The root cause of the SQL injection vulnerability is that the application uses user input data to construct dynamic SQL statements, and does not perform security checks and filters on user input data. SQL injection vulnerabilities are common in web applications that use the HTTP protocol (Hypertext Transfer Protocol, Hypertext Transfer Protocol) to implement communic...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to overcome the existing SQL injection attack detection method based on the standard SQL99 syntax specification in the actual application process due to the differences in the SQL syntax of various types of relational databases. To solve the problem of underreporting, a SQL injection attack detection system supporting multiple database types is proposed. The SQL injection attack detection system fully considers the SQL syntax differences of various types of databases when defining the SQL injection attack detection syntax rules, which greatly reduces the False negative rate of existing SQL injection attack detection systems

Images