Method and device for detecting SQL (Structured Query Language) injection attack

Abstract

The invention discloses a method for detecting an SQL (Structured Query Language) injection attack. The method comprises the following steps of: detecting whether a user sends universal resource locator (URL) request messages of a prescribed number of times, which carry SQL injection keywords and are used for requesting to access a related website with the same access attribute information in prescribed time duration or not; if so, affirming that the user is carrying out an SQL injection attack on the website at the moment; and if not, affirming that the user does not carry out the SQL injection attack on the website. The embodiment of the invention also discloses an SQL injection attack detection device. The method and the device for detecting the SQL injection attack provided by the embodiment of the invention effectively overcome the defects of the traditional SQL detection mechanisms on the basis of the behavioral characteristics of the SQL injection attack of malicious personnel and solve the problem of high false alarm rate in the traditional SQL injection attack detection method.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a SQL injection attack detection method and a device thereof. Background technique [0002] With the gradual development of the Internet, there are more and more network sites providing various services, which provide great convenience to people's daily life. However, also with the development of the Internet and the advancement of computer technology, there are more and more types of attacks against website systems, and more and more frequent. Among them, the SQL injection attack has gradually become one of the most frequent attack methods encountered by the website system. Through the SQL injection attack, the content of the web page can be tampered with and the highest data management authority of the website system may be obtained, which brings serious harm to the website system. Due to the frequent occurrence of SQL injection incidents, it not only damages the ...

AI Technical Summary

Problems solved by technology

In practice, the access requests provided by users who normally visit the website may occasionally contain SQL injection keywords, so users who visit the website normally may be mistakenly identified as attacking users and their legitimate access to the website may be blocked, resulting in erroneous Therefore, this SQL injection attack detection method, which is identified as a SQL injection attack whenever a SQL injection keyword appears, will inevitably lead to a high false positive rate in the SQL injection attack detection process of the existing website protection method

In addition, instead of blocking access in time to malicious users who are conducting SQL injection attacks, SQL injection keyword matching processing is performed on each access request, which also makes this SQL injection attack detection method a large amount of calculation and efficient. very low

Images