Database SQL infusion protecting method based on self-learning

Abstract

The invention discloses a database SQL infusion protecting method based on self-learning, comprising a learning phase and a filtering phase. The learning phase works in safe environment. At the moment, all SQL sentences are legitimate SQL sentences generated by an application system. A knowledge model (knowledge base) of the legitimate SQL sentences can be constituted by analyzing the sentences as well as analyzing and summarizing the characteristics of the sentences on the basis of sentence analysis results. The filtering phase works in real environment. At the moment, all SQL sentences are assumed to be possibly illegitimate SQL sentences. The sentences undergo pattern matching with the knowledge base established in the safe environment. If the matching is successful, the sentences are legitimate SQL sentences, otherwise, the sentences are illegitimate SQL sentences. The database SQL infusion protecting method has the advantage that an SQL infusion protecting system based on learning the legitimate SQL sentences can greatly reduce the false report rate and missing report rate which are caused by traditional SQL infusion protection, and the defending capability of the whole system can be improved.

Description

technical field [0001] The invention relates to a database SQL injection protection method, in particular to a database SQL injection protection method based on self-learning. Background technique [0002] With the development of the Internet, the development of commercial dynamic websites based on B / S mode is more and more favored by major companies. There are also more and more application programmers. But the uneven level of programmers and the immaturity of security defense technology have brought many unsafe factors to the application system. Most web application systems need to interact with users, receive data from users and process it. If an attacker intentionally enters maliciously constructed data, the malicious code contained in these data will be blocked by the system or Other clients execute, thereby causing damage to the server or client, which is the so-called SQL injection. [0003] Since SOL injection is accessed from a normal WWW port, and it looks no di...

AI Technical Summary

Problems solved by technology

Moreover, SQL injection methods are varied, and new attack methods appear almost every day. There are considerable defects in filtering based on known features, and the false positive rate of pure feature filtering is very high. For example, some prominent SQL injection statements contain 1=1 feature, if all the SQL statements containing the 1=1 feature are judged to be illegal during the feature inspection process, a large number of legal SQL statements will be blocked, and the injection attack method with the same effect as 1=1 is 2=2 , (1)=(1), abs(1)=abs(1), etc. may be missed

Images