SQL injection attack detection method based on machine learning

Abstract

The invention discloses an SQL injection attack detection method based on machine learning. The method comprises the following steps of 1, acquiring annotation data, and cleaning and preprocessing original request data; 2, feature extraction bring carried out on different parts of the request data, and extracted features comprising the weight of a frequent item set; the frequent items being obtained by mining a frequent item set in the SQL injection data through an FP-growth algorithm; 3, splicing the feature vectors obtained in the step 2 to obtain the feature vector of the whole data; 4, establishing an SVM detection model; inputting the feature vector of the whole data into an SVM detection model for training; and 5, inputting the feature vector of the to-be-detected request data into the trained SVM detection model, and judging whether the to-be-detected request data is SQL injection attack data or not with the assistance of the white list. The SQL injection attack can be effectively and quickly detected, malicious attacks can be defended, and system security can be protected.

Description

technical field [0001] The invention relates to a network security big data analysis technology. More specifically, the present invention relates to a method for detecting SQL injection attacks based on machine learning. Background technique [0002] In the current "5G" era, the network has long been integrated into people's daily lives, and the amount of cloud data is showing explosive growth. At the same time, everyone is surrounded by numbers, and network security has naturally become a hot topic. Every browser, app, and even the user used by the user will be stored in the database by major companies in the form of data. Whether it is an individual user or an enterprise, where there is data, there is a danger of being invaded. Criminals often use loopholes in programs to carry out network attacks, and the consequences of network attacks are usually very serious, such as stealing or abusing data information, causing server paralysis or even stealing money. In recent year...

AI Technical Summary

Problems solved by technology

Criminals often use loopholes in the program to carry out network attacks, and the consequences of network attacks are usually very serious, such as stealing or abusing data information, causing server paralysis or even stealing money, etc.

In recent years, research on SQL injection detection has occasionally appeared, such as machine learning detection technology based on TF-IDF, but the feature vectors extracted by TF-IDF often have very large data dimensions, even reaching thousands of dimensions, which not only consumes resources, but also And the speed is slow; and the detection method based on deep learning, due to the complexity of the network structure, the calculation amount will be extremely large, which will also make the running speed very slow

Images