SQL injection attack detection method and device

Abstract

The invention provides a structured query language (SQL) injection attack detection method and device. The method comprises the following steps: obtaining a prediction value of a first neural network model, wherein the prediction value is a probability that training samples are SQL injection attacks; obtaining a first training sample set, wherein the first training sample set comprises multiple first training samples, and the probability of the multiple first training samples for SQL injection attacks is larger than a first preset threshold value; obtaining a second training sample set, wherein the second training sample set comprises multiple second training samples, and the multiple second training samples are training samples which are manually marked in the first training sample set as SQL injection attacks; taking the second training sample set as input of the first neural network model, and performing incremental training on parameters of the first neural network model to obtain a second neural network model. According to the technical scheme, the detection accuracy of SQL injection attacks can be improved, and the missing report rate and the false report rate are reduced.

Description

technical field [0001] The present application relates to the field of Web security, and more specifically, relates to a method, device and computing device for detecting SQL injection attacks of structured query statements. Background technique [0002] Structured query language (structured query language, SQL) injection attack is one of the common methods used by hackers to attack databases. SQL injection vulnerabilities can affect any website or web application that uses an SQL database. Criminals may use it to gain unauthorized access to users' sensitive data: customer information, personal data, trade secrets, intellectual property, etc. SQL injection attacks are one of the oldest, most popular, and most dangerous web page (Web) application vulnerabilities. [0003] In a related technical solution, a keyword-based detection method and a rule-based method are used to detect whether SQL keywords and special symbols are included, thereby detecting SQL injection attacks. ...

AI Technical Summary

Problems solved by technology

This detection technique relies heavily on the experience of security experts, so it is very poor at identifying unknown attack types

For new data, this detection method needs to retrain the model after merging the new data with the old training data. As the training data set becomes larger and larger, model training requires more and more time and will cause huge pressure on memory.

Images