Sql (Structured query language) injection detection method and device

Abstract

The invention provides an sql (Structured query language) injection detection method and device, and belongs to the technical field of network security. The method comprises the following steps: extracting http (hypertext transport protocol) parameters from an http request; combining each http parameter with each predefined dynamic sql template into an sql sentence; performing grammatical analysis on each sql sentence respectively, determining that the http parameter does not lead to an sql injection attack if the sql sentence is inconsistent with an sql grammatical rule, and outputting a marked character string which corresponds to the sql sentence if the sql sentence is consistent with an sql grammatical rule; matching the marked character string with a marked character string set having an sql injection attach characteristic, and determining that the http request is an sql injection attack if matching is successful. According to the method and the device, the execution efficiency of sql injection detection can be increased, and the false alarm rate of sql injection detection is lowered.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a SQL injection detection method and device. Background technique [0002] Hackers often use sql (structure query language, structured query language) injection vulnerabilities to perform various illegal database operations when invading websites, such as stealing sensitive information and obtaining system management permissions. Traditional WAF (Web Application Firewall, Web Application Firewall) usually uses regular expressions for SQL injection matching when filtering SQL injection attacks, or directly searches SQL syntax keywords. [0003] When using regular expressions for matching or directly searching for sql syntax keywords, it is often necessary to match the entire data submitted by the user before intercepting, which will lead to relatively low execution efficiency. [0004] In addition, because regular expressions do not have the ability to analyze context, w...

AI Technical Summary

Problems solved by technology

[0005] It can be seen that the existing sql injection detection method not only has poor execution efficiency, but also easil

Images