A SQL injection attack detection method and system

Abstract

An SQL injection attack detecting method and system are provided, comprising building phase of SQL injection attack detecting knowledge base and detecting phase for real-time SQL injection attack. The build of SQL injection attack detecting knowledge base comprises collection of SQL injection attack sample for sorts of scenes, classification of SQL injection ways, and build of SQL injection attack detecting grammar rules aiming at sorts of SQL injection ways; the detecting phase for real-time SQL injection attack comprises extraction and decoding of user inputting data in HTTP request message and matching of the SQL injection attack detecting grammar rules and so on. This invention defines the SQL injection attack detecting grammar rules by using SQL grammar instead of defining the SQL injection attack detecting grammar rules based on the traditional attack characteristic. The invention overcomes shortcomings of uneasy extraction and inclined fraud of the attach characteristic sign of the SQL injection attack incident, which significantly reduces rate of wrong report and rate of missing report while invading the detecting system for detecting SQL injection attack.

Description

technical field [0001] The invention relates to the technical field of network security detection, in particular to a SQL injection attack detection method and system that can be used for intrusion detection and defense products. Background technique [0002] SQL (Structure Query Language, Structured Query Language) is a kind of query, insert, update and delete data, generate, modify and delete database objects, provide database security mechanism, database integrity and data protection control, and is a general data-oriented database Handles language specifications. SQL injection attacks refer to the fact that attackers use existing applications that do not strictly check and filter user input data to inject malicious SQL commands into the background database engine for execution, so as to steal data or even control the database server. The root cause of the SQL injection vulnerability is that the application uses user input data to construct dynamic SQL statements, and do...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to overcome the shortcomings of the existing SQL injection attack detection method due to inaccurate extraction of attack feature signatures and easy spoofing of attack feature signatures, and to provide a SQL injection attack detection method and system based on SQL injection attack detection syntax rules

Images