SQL statement detection method and system

Abstract

Embodiments of the invention provide an SQL statement detection method and system, and aims at rapidly and efficiently detecting and defensing database security holes. The method comprises the following steps of: extracting feature information of each statement from to-be-detected structured query language SQL statements by an analysis module; loading a configuration file by a safety regulation plugin, matching the feature information according to corresponding safety regulations in the configuration file, and determining safety regulation IDs of the successfully matched safety regulations according to the matching result, wherein the safety regulations correspond to at least one safety regulation ID; and carrying out statistics on the successfully matched safety regulation IDs by a strategy matching module and executing preset safety strategies corresponding to the safety regulation IDs.

Description

technical field [0001] The invention relates to the field of data security, in particular to a SQL statement detection method and system. Background technique [0002] As a very important storage tool, databases often store a large amount of valuable or sensitive information, including financial, intellectual property, corporate data, etc. Network hackers will use various channels to obtain what they want information. Therefore, ensuring database security becomes particularly important. There are many means for network hackers to obtain information, such as SQL injection, which will take advantage of the loopholes in website construction to construct some special SQL statements to obtain information illegally. [0003] Each dangerous behavior corresponds to a SQL feature. In the prior art, dangerous behaviors are identified by identifying SQL features. For example, select * from a into outfile "D: / test.txt", the data in data table a can be exported to "D: / test.txt", caus...

AI Technical Summary

Problems solved by technology

For each dangerous statement, construct a detection rule, that is, a security rule, to detect and identify SQL statements that are the same as or similar to the dangerous statement, and run different security rules in sequence to analyze and identify each SQL statement separately. When the development of the plug-in is completed, its detection function is solidified. It can only detect SQL statements that are the same as or similar to the preset dangerous statements, and its detection range cannot be expanded. In addition, when there are many security rule plug-ins that need to be run, each security rule Plug-ins need to parse and identify all SQL statements, repeated parsing of SQL statements will make the detection efficiency low

Images