SQL injection attack detection system suitable for high speed LAN environment

Abstract

SQL injection attack detection system adapting to high speed LAN environment comprises data acquisition module, data pretreatment module, filter module for object to be detected, SQL injection attack detection module and SQL injection alarming module. The data acquisition module acquires network data pack related with HTTP service from protected network; data pretreatment module resolves operation and establishes object to be detected and transmits to the filter module for object to be detected based on TCP stream reassembly and HTTp protocol; the filter module for object to be detected matches URL of every object to be detected according to filtering rule sequence established, and performs designated processing action of matched filtering rule. The Web object type of HTTP request is divided into static Web type and dynamic Web type; static Web type HTTP requests during real time SQL injection attack detection is filtered out, which largely relieves processing pressure for SQL injection attack detection module, reduces rate of false alarm.

Description

technical field [0001] The invention relates to the technical field of network security detection, in particular to a SQL injection attack detection system suitable for a high-speed local area network environment. Background technique [0002] SQL (Structure Query Language, Structured Query Language) injection attack means that the attacker uses the SQL injection vulnerability in the existing application program to inject malicious SQL commands into the background database engine for execution, so as to steal data or even control the database server. Purpose. The root cause of the SQL injection vulnerability is that the application uses user input data to construct dynamic SQL statements, and does not perform security checks and filters on user input data. SQL injection vulnerabilities are common in web applications that use the HTTP protocol (Hypertext Transfer Protocol, Hypertext Transfer Protocol) to implement communication between the client and the server. [0003] SQ...

AI Technical Summary

Problems solved by technology

This SQL injection attack detection method using traditional intrusion detection system attack signatures has the following problems: SQL injection attack signatures are difficult to accurately extract, resulting in a very high false positive rate; SQL injection attack signatures are easy to be deceived, resulting in a very high false negative rate high

In a typical SQL injection attack detection network application environment, an intrusion detection / prevention system capable of SQL injection attack detection needs to perform SQL injection attack detection on all HTTP requests entering the protected network, but in a high-speed LAN environment , the HTTP traffic entering the protected network is relatively large, which will bring greater processing pressure to the SQL injection attack detection system

Images