Method for detecting SQL (structured query language) injection vulnerability

Abstract

The invention relates to a method for detecting SQL (structured query language) injection vulnerability, comprising the following steps: 1, capturing user input data; 2, generating harmless input; 3, carrying out SQL lexical analysis and syntactic analysis to generate SQL syntax trees, wherein the SQL syntax trees comprise a syntax tree based on user input word strings and a syntax tree based on harmless word strings; 4, comparing the two SQL syntax trees, and if the two SQL syntax trees are same, considering a group of testing word strings to pass a test; and 5, responding the result, if a user attempting to carry out SQL injection is found out, blocking an HTTP (hyper text transport protocol) package, and otherwise, releasing the HTTP package. In the method, analyzed objects are input by the user directly or indirectly, thus maximally restoring the real intentions of the user and reducing the rate of false alarm; and meanwhile, based on the analysis of the SQL syntax trees, the SQL injection can be blocked fundamentally, thereby improving the accuracy rate of the detection.

Description

technical field [0001] The invention relates to a detection method aimed at SQL injection threats that can be used for web protection and intrusion detection, and belongs to the field of network information security. Background technique [0002] The relationship between the database and the WEB has become more and more close, and the web is convenient and fast, and the characteristics of a wide range of user groups make B / S development more popular year by year. It can be said that the web has greatly expanded the user group of the database, making it really affect the personal lifestyle. But while the web brings these advantages to the database, it also brings many hidden dangers to the database. Among them, the most harmful and the most attack methods, the most difficult to prevent is the SQL injection (SQL Injection) attack. [0003] In the common front-end language of WEB applications, such as ASP.NET, PHP or JSP, a typical SQL statement for processing login can be wr...

AI Technical Summary

Problems solved by technology

Generally, only enterprise-level applications are used. Although it can be made more secure by paying a lot of extra cost, it still cannot completely prevent SQL injection attacks fundamentally.

[0016] Generally speaking, because of the concealment and diversity of its attacks, and some keywords are often used by ordinary users, the difficulty in detecting SQL injection is that it is difficult to ensure that there are no missed reports and good reports.

Images