Detection method for injection attack of database and system

Abstract

The invention discloses a detection method for the injection attack of a database and a system, detecting the access activities of a database in real time. The method comprises the following steps of: solely leaning through the history access record of the database and establishing an access activity pattern library of the database; receiving the real-time access of the database, judging whether the real-time access is injection attack or not according to the access activity pattern library and acquiring a judging result; and responding the real-time access according to the judging result and the preset response mode. Compared with the prior art, the invention can automatically recognize normal database access and injection attack and blocks the injection attack so as to protect the safety of a database server.

Description

technical field [0001] The invention relates to the field of information security, in particular to a database injection attack detection method and system. Background technique [0002] With the development of the Internet, the client / server (B / S) model has been more and more widely used. In the B / S mode, data interaction between the user and the background database server often occurs, that is, the user enters and submits data through a form on the web page of the client, and the application program of the server constructs an SQL statement based on the data submitted by the user and submits it to the database. The server processes and returns the processing result to the user. When developing applications in the B / S mode, many developers neglect to judge the legality of user input data, which makes the application security risks. The attacker can submit a piece of database query code, and steal some data he wants to know according to the result returned by the program. ...

AI Technical Summary

Problems solved by technology

However, from the perspective of database access behavior itself, whether it is the normal access of the user or the injection attack of the attacker, it is presented as submitting and running SQL statements to the database server, which leads to the fact that although the network security audit product can record the access information of the user to the database , but the audit product itself cannot distinguish whether the access behavior represented by a database access record is a normal access or a malicious injection attack

In this way, when an attacker implements an injection attack, the audit product can only record the behavior of the attacker, and cannot detect and block the attack in time, and can only identify the attack through post-mortem analysis.

In addition, the attacker's access records are submerged in a large number of access records, and security managers can only identify them through experience, which brings great inconvenience to post-event analysis

Images