SQL injection audit or protection method and device based on database protocol

Abstract

The invention provides an SQL injection audit or protection method and device base on a database protocol, and relates to the technical field of information safety. The method comprises the steps that data packages sent by a database server according to the preset database protocol are acquired, wherein the data packages respond to request information of a client; the data packages are analyzed according to a data format of the preset database protocol to determine a response result of the database server to the request information; based on the response result, a dangerous access interface accessing the database server caused by SQL injection is determined so that access requests accessing the dangerous access interface can be prevented. By means of the method, the technical problem that the false positive rate is high in traditional audit and protection methods of SQL injection is alleviated.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a database protocol-based SQL injection audit or protection method and device. Background technique [0002] The so-called SQL (Structured Query Language) injection, a relatively common situation is to insert SQL statements in the Web form, SQL injection is often used to attack the server to achieve the purpose of stealing information or controlling the system. [0003] Regarding the auditing technology of SQL injection, according to whether the auditing process requires the execution of the application program, there are mainly two types: the first type is static code auditing, which mainly realizes the loop traversal analysis of the entire code by scanning the function list to achieve the discovery of SQL The purpose of injection; the second type is dynamic code auditing, which mainly detects SQL injection by monitoring whether the transmission process of user inpu...

AI Technical Summary

Problems solved by technology

[0004] The above SQL injection audit technologies have the following problems: (1) The list of suspicious risk points scanned by the static code audit technology is often very large, requiring a lot of manual analysis, and the false positive rate is very high

(2) Dynamic code audit technology Because the user's input variables are processed by various logics, although the final result is not abnormal even though the dangerous function is passed, there will be many false positives

(3) In the method of using regular expressions for regular matching, in order to ensure that the normal regular business is not affected, the regular expression structure will be looser, so it is easy for intruders to bypass the regular matching of regular expressions. Therefore, there is also a high false positive rate

[0005] Aiming at the technical problem of high false positive rate in the above-mentioned traditional SQL injection auditing and protection methods, there is no effective solution in the prior art

Images