A SQL injection alarm processing method and device

Abstract

The present invention provides a SQL injection alarm processing method and device, the method comprising: according to the SQL injection alarm and attack behavior verification rules, obtaining the attack behavior verification result of the SQL injection alarm; wherein, the attack behavior verification rule is a predetermined If it is known that the attack behavior verification result is that there is an attack behavior, then according to the attack result verification rule corresponding to the attack behavior type included in the attack behavior verification result and the SQL injection alarm, the verification of the SQL injection alarm is obtained As a result, the verification result includes a verification basis; wherein, the attack result verification rule is preset. The device is used to perform the above method. The SQL injection alarm processing method and device provided by the embodiments of the present invention improve the efficiency of tracing the source of the SQL injection alarm.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a SQL injection alarm processing method and device. Background technique [0002] SQL injection is one of the more common network attack methods. It can be passed into web applications by constructing special inputs as parameters, and most of these inputs are some combinations in SQL syntax. By executing SQL statements, the attackers can execute the desired operations. The main reason is that the program does not carefully filter the data entered by the user, resulting in illegal data intrusion into the system. [0003] At present, most network security products mainly focus on the alarm logs of security devices in the detection, analysis and source tracing of SQL injection alarms, and most of the SQL injection alarm data lacks contextual correlation, and data association is basically based on a single product perspective, such as Security products on the host side cond...

AI Technical Summary

Problems solved by technology

[0003] At present, most network security products mainly focus on the alarm logs of security devices in the detection, analysis and source tracing of SQL injection alarms, and most of the SQL injection alarm data lacks contextual correlation, and data association is basically based on a single product perspective, such as Security products on the host side conduct analysis and traceability around their own data, and security products on the network side also conduct analysis and traceability around their own traffic. There are blind spots in analysis, detection and traceability among different security products.

Images