Method and system for analyzing and matching SQLs (Structured Query Languages)

Abstract

The invention discloses a method and a system for analyzing and matching SQLs (Structured Query Languages), which is used for effectively analyzing and matching SQL sentences. The method comprises the following steps of: establishing an incidence relation library among a database table, a database and the fields of the database table; establishing a matching rule set according to the incidence relation library; establishing a basic syntax analyzing rule library according to SQL sentences defined by the SQL / 99 standard; establishing an extended syntax analyzing rule library according to SQL sentences realized by main-trend database manufacturers; carrying out syntax analysis to the inputted SQL sentences according to the basic syntax analyzing rule library and the extended syntax analyzing rule library to obtain user concerning information; establishing an operational character set and establishing matching algorithms for operational characters in the operational character set; and selecting the matching algorithms according to the matching rule set and the operational character set and then matching the user concerning information and the matching rule set to obtain matching results. The invention can be widely applied to product for network intrusion detection, network intrusion prevention, database audit and the like.

Description

Technical field [0001] The present invention relates to network security protection technology, in particular to a method and system for SQL analysis and matching. Background technique [0002] Network intrusion detection systems and network intrusion prevention systems are important ways and means to protect network security. They are usually deployed at the entrance of key networks or at the entrance of network borders to monitor and capture the network data flow in and out of the network in real time and conduct intelligent comprehensive analysis. Real-time network intrusion behavior and real-time block or alarm and other response measures. [0003] Auditing products are also a very important method and means in network security protection. Auditing products are also deployed inside key networks or at the entrance of network borders, bypass monitoring the real-time data flow in the network and perform intelligent comprehensive analysis to monitor the network. Whether the system...

AI Technical Summary

Problems solved by technology

[0007] (1) It generally stays at the level of obtaining SQL statements from the user's network environment, and does not perform in-depth grammatical analysis on them, resulting in a low success rate of matching SQL statements with definition rules that users care about;

[0008] (2) It is easy to cause serious events such as false positives or missed negatives

[0010] (1) The parsing degree of the SQL statement as mentioned above is not enough;

[0011] (2) The matching algorithm is too simple, and a simple string matching method is generally used to match the entire result

[0012] To sum up, in view of the low level of SQL statement parsing and SQL rule matching at present, it is necessary to propose a technology with better SQL statement parsing and rule matching effects to solve the above technical problems

Images