Machine learning-based SQL injection detection method, and database security system

Abstract

The invention discloses a machine learning-based SQL injection detection method, and a database security system, and belongs to the technical field of network security. The machine learning-based SQLinjection detection method comprises the steps of extracting parameters from HTTP requests, generating a grammar tree of a sample through lexical analysis and grammatical analysis, extracting featuresof the grammar tree and a URL, and performing training by adopting a machine learning algorithm of a support vector machine; and deploying a trained classification model between a Web service and a client, classifying the HTTP requests in a production environment, when it is judged that the HTTP requests comprise SQL injection attacks, giving a warning and blocking the requests, and finally storing the requests in an SQL injection attack sample library. According to the method, the dependency on background information is low, so that the HTTP requests received by the Web service only need tobe obtained; the deployment difficulty is low, so that the classification model can be deployed between a Web server and the client to serve as a flow filter; the method has high accuracy; the methodhas a continuous learning capability; and the method has high expansibility.

Description

technical field [0001] The invention belongs to the technical field of data network security, and in particular relates to a machine learning-based SQL injection detection method and a database security system. Background technique [0002] At present, the existing technologies commonly used in the industry are as follows: SQL is the abbreviation of Structured Query Language (Structured Query Language), which is a language for operating databases. SQL injection refers to inserting specific SQL commands into HTTP requests to trick the server into executing malicious SQL commands, thereby stealing, tampering or maliciously deleting data. Traditionally, the prevention of SQL injection is mainly carried out in two stages. The first is protection at the stage of writing Web service source code. Developers follow the empirical guidelines for preventing SQL injection when writing source code, and use methods such as "check parameter format", "filter special characters", and "bind...

AI Technical Summary

Problems solved by technology

Requires extensive manual analysis and is prone to missed detection

[0003] In summary, the problems in the prior art are: Need to obtain the source code of the Web service, or need to spend a lot of manual analysis to build a matching model of legal or illegal SQL

If the false positive rate of the system is too high, then its judgment result cannot be used as the basis for filtering SQL requests, otherwise normal HTTP requests are likely to be intercepted, affecting the normal operation of Web services

Images