Method and apparatus for detecting structured query language injection attack

Abstract

The invention discloses a method and an apparatus for detecting structured query language (SQL) injection attack. The method and the apparatus for detecting the SQL injection attack are used for improving the detection efficiency of the SQL injection attack and reducing the false and missing alarm rate. The method for detecting the SQL injection attack comprises the steps: acquiring a to-be-detected SQL statement, analyzing the to-be-detected SQL statement to obtain morphologies and a morphology sequence contained in the to-be-detected SQL statement, and transforming the to-be-detected SQL statement into a to-be-detected character string according to a corresponding relation between each morphology and a specified character or a specified character string as well as the morphologies and the morphology sequence contained in the to-be-detected SQL statement; matching the to-be-detected character string with the character string in a character string library corresponding to a prestored SQL injection (SQLI) statement; and determining that the SQL injection attack exists when the to-be-detected character string is matched with any character string in the character string library corresponding to the prestored SQLI statement.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for detecting a structured query language SQL injection attack. Background technique [0002] Structured Query Language (SQL) injection is a technique that is often used to compromise a website. By inserting SQL commands into a web page (Web) form to submit or input a domain name or a query string for a page request, the server is finally tricked into executing malicious SQL commands. [0003] The principle of the SQL injection attack detection technology in the prior art is as follows: maintain a regular feature library of the SQL injection attack statement, which includes the SQL injection statement and the regular expression of the SQL injection statement; Extract the SQL statement to be detected in the hypertext transfer protocol (HyperTextTransferProtocol, HTTP) request uniform resource locator (UniformResourceLocator, URL), and carry out regula...

AI Technical Summary

Problems solved by technology

[0004] The key to SQL injection attack detection technology in the prior art is to maintain a reasonable regular feature library of SQL injection attack statements. On the one hand, due to the variability of SQL injection attacks, the regular feature library coverage of SQL injection statements cannot be absolutely comprehensive , when the SQL statement to be detected is regularly matched with the statements in the SQL injection statement feature library, the rate of false positives and false negatives is high; on the other hand, as the coverage of the SQL injection statement regular feature library is increasing, the When the SQL statement to be detected is regularly matched with the SQL injection statement regular feature library, it will take a lot of time, resulting in very low detection efficiency. This is a well-known shortcoming of regular matching

[0005] To sum up, in the prior art, when the SQL statement to be detected is regularly matched with the SQL injection statement regular feature library, the detection efficiency is low, and the rate of false positives and false negatives is high

Images