SQL (Structured Query Language) attack false alarm elimination method

Abstract

The invention provides an SQL (Structured Query Language) attack false alarm elimination method, which comprises the following steps of: logging in network security equipment to extract alarm information, screening alarms related to WEB service SQL injection attacks from the alarm information, and forming an SQL injection alarm list S; and for each alarm in the SQL injection alarm list S, downloading a data packet related to the alarm, and extracting feature information: based on the extracted feature information, carrying out false alarm analysis and judgment on each alarm to obtain a comprehensive judgment score, calculating a final score according to the comprehensive judgment score and the output of the machine learning model, and sending the final score to the server. And comparing the final score with a dynamic threshold value Threshold, and judging whether a false alarm exists or not. Through the SQL attack false alarm elimination method provided by the invention, the problem caused by SQL attack false alarm in related technologies is solved, the elimination method is faster, the accuracy is higher, and the SQL attack false alarm problem can be more effectively solved.

Description

Technical Field

[0001] The invention relates to the field of network security, and in particular to a method for eliminating SQL attack false positives. Background Art

[0002] With the rapid development of information technology and the deepening of data dependence, the security of database systems, as core components supporting modern applications and business operations, has received increasing attention. SQL (Structured Query Language) injection attacks are a common database security threat. By injecting malicious code into SQL queries, they can bypass the security control of applications and illegally access, manipulate or destroy data in the database. In order to prevent such attacks, many organizations and enterprises have deployed various SQL injection detection systems and firewalls to protect the integrity and confidentiality of the database.

[0003] Network security monitoring duty is one of the key links to ensure the security of information systems. The monitoring duty personnel are responsible for real-time monitoring, analysis and response to network security events. In terms of SQL injection attack protection, the work of monitoring duty includes the use of tools such as firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS) to detect potential attack activities. However, these security tools often face a significant problem in actual application - false positives. False positives refer to the security monitoring system mistakenly identifying legitimate operations or normal query behaviors as attack activities. Summary of the invention

[0004] In order to improve the accuracy of SQL injection attack detection and reduce false alarms, the present invention proposes a SQL attack false alarm elimination method, which combines the knowledge of network security experts, reduces the occurrence of false alarms by screening and analyzing, optimizing detection rules and features, and can provide more accurate attack identification capabilities during network security monitoring duty, improve the overall security and response efficiency of the system, and ensure business continuity and data security.

[0005] A method for eliminating SQL attack false positives includes the following steps:

[0006] Log in to the network security device to extract alarm information, filter out alarms related to WEB service SQL injection attacks from the alarm information, and form an SQL injection alarm list S;

[0007] For each alarm in the SQL injection alarm list S, download the data packet related to the alarm and extract the characteristic information:

[0008] Based on the extracted feature information, each alarm is analyzed and judged for false alarms to obtain a comprehensive judgment score. Total for:

[0009]

[0010] Among them, φ i , j and k is the comprehensive coefficient, F i , G j and H k represents different feature information, context and adaptive scoring function, λ is the weight of machine learning model, Adaptive ( N c , H p ) represents an adaptive adjustment function based on network context and historical patterns;

[0011] Score based on comprehensive judgment Total The output score of the machine learning model ML The final score Final_Score is calculated and compared with the dynamic threshold Threshold to determine whether it is a false alarm.

[0012] Furthermore, the characteristic information includes: source IP address IP_src, request string Req_str, business system account information Sys_info, timestamp T s , response time T r , request size Req_size, request frequency Req_freq, access region IP_region, target URL Target_url, number of request parameters Param_count, network context Net_ctx, historical alarm pattern Hist_pattern, request method type Req_method, user agent User_agent, TLS / SSL status TLS_status, request delay Latency, connection stability Conn_stability, proxy service usage Proxy_usage.

[0013] Furthermore, based on the extracted feature information, each alarm is analyzed and judged for false alarms to obtain a comprehensive judgment score. Total , where the feature information score calculation formula is as follows:

[0014] F1=log(Rieq_size+1)+log(Param_count+1)+Sim(Req_str,P_sqli)

[0015] F2=Entropy(Req_str)·Complexity(Req_str)

[0016]

[0017] F4=Anom(T r )·log(Sys_info+1)

[0018] F5=Latency_Impact(Latency)

[0019] The context score calculation formula is as follows:

[0020]

[0021] G2=Net(Net c tx)·Req_method_Score(Req m ethod)

[0022] G3=UA_Risk(U ser a gent)

[0023]

[0024] The adaptive scoring calculation formula is as follows:

[0025]

[0026] Furthermore, the score is based on the comprehensive judgment. Total The output score of the machine learning model ML Calculate the final score Final_Score, including:

[0027] Final_Score=α×Score Total +(1-α)×Score ML

[0028] Among them, α is an adjustable balance coefficient, which is used to control the influence ratio of the rule algorithm and the machine learning model; Score ML It is a score calculated by a machine learning model. Alerts are analyzed and scored based on the trained machine learning model to capture patterns or features that may be missed by the rule algorithm.

[0029] Furthermore, the final score Final_Score is compared with the dynamic threshold Threshold to determine whether it is a false alarm, specifically: if Final_Score is greater than or equal to Threshold, the alarm is considered to be a real attack behavior, and the security system or personnel need to take corresponding measures; if Final_Score is less than Threshold, the alarm is considered to be a false alarm.

[0030] Furthermore, after the false alarm is eliminated, the corresponding security response actions are immediately triggered, including blocking the attack source, issuing security alerts, and updating firewall rules.

[0031] Furthermore, the dynamic adaptive adjustment method of the dynamic adjustment threshold Threshold is:

[0032]

[0033] Among them, γ and η are dynamic adjustment parameters, n is the number of alarms, Adaptive(N c , H p ) is the adaptive adjustment function.

[0034] Furthermore, the method also includes tracing the source of the alarm, by comparing the Trace_Score with a preset threshold or with historical data, to determine whether the alarm is a false alarm or an abnormal alarm that requires further attention; the higher the Trace_Score, the more likely the alarm is related to real attack behavior, requiring more attention from security personnel, and a comprehensive analysis and judgment is performed based on the following expression:

[0035]

[0036] Among them, β l and κ q is the weighting coefficient of traceability analysis, p and r represent the number of traceability components and behavioral patterns respectively, Trace_Component is the traceability component, and Behavioral_Pattern is the information related to behavioral pattern analysis.

[0037] The present invention has the following advantages:

[0038] c. Significantly reduce false alarm rate: By integrating multi-dimensional feature information scoring, combining complex scoring functions and adaptive adjustment mechanisms, the present invention effectively reduces the false alarm rate. The system can more accurately distinguish normal traffic from malicious attack traffic, reduce unnecessary alarms, and improve the efficiency of security incident response.

[0039] 2. Improve the ability to detect complex attack patterns: Introduce deep learning algorithms and pattern recognition technology, optimize the feature information scoring system, so that the system can effectively detect and respond to complex SQL injection attack patterns. The ability to identify variant attacks has been significantly improved.

[0040] 3. Optimize the feature information scoring system: This invention introduces more feature dimensions and complex scoring functions into the feature information scoring system, overcoming the limitation of traditional methods that rely on only a small number of features. By comprehensively evaluating various feature information, the accuracy of detecting SQL injection attacks is improved.

[0041] 4. Dynamic threshold adjustment: With the dynamic threshold adjustment mechanism, the system can automatically adjust the threshold according to the changes in real-time data and network environment. This flexible adjustment capability enables the system to adapt to different network environments and attack intensities, improving the accuracy and flexibility of detection.

[0042] 5. Enhanced adaptive context filtering capability: Adaptive context filtering technology is introduced to automatically adjust filtering rules according to the actual conditions of different network environments. This technology improves the efficiency of false alarm elimination and makes the system perform better in various network environments.

[0043] 6. Adaptability to various network environments: The method of the present invention has good adaptability and can be implemented in various network architectures such as virtualized environments, cloud computing platforms, distributed systems, edge computing devices, etc. It can be flexibly adjusted according to the specific network environment requirements to meet the needs of various application scenarios.

[0044] 7. Real-time response and security protection: In addition to eliminating false alarms, the present invention also has a real-time response mechanism that can immediately trigger corresponding security response actions after a false alarm is discovered, such as blocking the attack source, issuing security alerts, updating firewall rules, etc. This mechanism enhances the security protection capability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The present invention is a flowchart of a method for eliminating SQL attack false positives. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] like Figure 1 As shown, an embodiment of the present invention provides a method for eliminating SQL attack false positives, comprising the following steps:

[0048] (1) Log in to the network security device to view the alarm information, filter out the alarms related to the WEB service SQL injection attack from the alarm information, and form a SQL injection alarm list S;

[0049] (2) For each alarm in the SQL injection alarm list S, download the data packet related to the alarm and extract the characteristic information, which includes: source IP address IP_src, request string Req_str, business system account information Sys_info, timestamp T s , response time T r , request size Req_size, request frequency Req_freq, access region IP_region, target URL Target_url, request parameter number Param_count, network context Net_ctx, historical alarm pattern Hist_pattern, request method type Req_method, user agent User_agent, TLS / SSL status TLS_status, request delay Latency, connection stability Conn_stability, proxy service usage Proxy_usage;

[0050] (3) Based on the extracted feature information, each alarm is analyzed and judged for false alarms to obtain a comprehensive judgment score. Total for:

[0051]

[0052] Among them, φ i , j and k is the comprehensive coefficient, F i , G j and H k represents different feature information, contextual scoring and adaptive scoring functions, λ is the weight of the machine learning model, Adaptive(N c , H p ) represents an adaptive adjustment function based on network context and historical patterns. The specific calculation is as follows:

[0053] Feature Information Rating:

[0054] F1=log(Req_size+1)+log(Param_count+1)+Sim(Req_str,P_sqli)

[0055] F2=Entropy(Req_str)·Complexity(Req_str)

[0056]

[0057] F4=Anom(T r )·log(Sys_info+1)

[0058] F5=Latency_Impact(Latency)

[0059] Contextual Scoring:

[0060]

[0061] Adaptive Scoring:

[0062]

[0063] (4) Score based on comprehensive judgment Total The output score of the machine learning model ML The final score Final_Score is calculated and compared with the dynamic threshold Threshold to determine whether it is a false alarm.

[0064] Final_Score is a final score for comprehensive judgment. The calculated Final_Score is compared with a preset dynamic threshold Threshold. If Final_Score is greater than or equal to Threshold, it is considered that the alarm may be a real attack behavior, and the security system or personnel need to take corresponding measures, such as further analysis, blocking the attack source, and issuing an alarm. If Final_Score is less than Threshold, it is considered that the alarm is likely to be a false alarm. The calculation formula for the final score Final_Score is as follows:

[0065] Final_Score=α×Score Total +(1α)×Score ML

[0066] Among them, α is an adjustable balance coefficient, which is used to control the influence ratio of the rule algorithm and the machine learning model. Totol It is a score calculated based on a rule-based algorithm, taking into account the extracted feature information and context information, and using a specific scoring function (such as F i ,,G j , H k ) Calculate the score of the alarm, Score ML It is a score calculated by a machine learning model. Alerts are analyzed and scored based on the trained machine learning model. It is mainly used to capture patterns or features that may be missed by the rule algorithm.

[0067] The scoring function F of the feature information i , Context scoring function G j and the adaptive scoring function H kThrough optimization based on historical data, deep learning algorithms, pattern recognition algorithms, regression analysis, etc., the detection capability of complex SQL injection attacks is improved.

[0068] The method adopts a dynamic learning mechanism to continuously update the feature scoring model and automatically adjust the weight parameter φ based on real-time data and historical alarm patterns. i , j ,,ξ k , and balance coefficient α to adapt to different network environments and threat modes.

[0069] The adaptive adjustment process of false alarm elimination includes:

[0070] Dynamically adjust the threshold:

[0071]

[0072] Among them, γ and η are dynamic adjustment parameters, n is the number of alarms, Adaptive(N c , Hp ) is the adaptive adjustment function.

[0073] The method also includes tracing the source of the alarm and performing comprehensive analysis and judgment based on the following expression:

[0074]

[0075] Among them, β l and κ q is the weighting coefficient of traceability analysis, p and r represent the number of traceability components and behavior patterns, respectively.

[0076] The scoring model further improves the ability to accurately identify SQL injection attacks by introducing new pattern matching algorithms, such as multidimensional vector analysis, time series segmentation, and cross-domain feature clustering.

[0077] The method introduces adaptive context filtering technology in the alarm processing process to intelligently screen alarms in different network environments to improve the efficiency and accuracy of false alarm elimination.

[0078] The method can be implemented in a variety of network architectures, including but not limited to virtualized environments, cloud computing platforms, distributed systems, etc., and can be flexibly adjusted according to specific environmental requirements.

[0079] The method has a real-time response mechanism to attack behaviors while eliminating false alarms, and can immediately trigger corresponding security response actions after the false alarms are eliminated, such as blocking the attack source, issuing security alarms, updating firewall rules, etc.

[0080] The SQL attack false alarm elimination method provided by the present invention solves the problems caused by SQL attack false alarms in the related art, provides a new method for eliminating SQL attacks, has a faster elimination method and a higher accuracy rate, and can more effectively solve the SQL attack false alarm problem. The solution can be used as an efficient and practical SQL attack false alarm elimination method for network security monitoring duty.

[0081] The technical effect of the present invention is described below through experiments:

[0082] Experimental setup

[0083] 1. Dataset:

[0084] Network environment:

[0085] Virtualized environment: simulates an internal corporate network.

[0086] Cloud computing platform: Simulates an external service provider network.

[0087] Distributed systems: Simulate application environments across multiple data centers.

[0088] Data source: A total of 15,000 alarm records were collected from the above environment, including 2,000 actual SQL injection attacks and 13,000 normal traffic. Feature information: source IP address, request string, target URL, timestamp, TLS / SSL status, user agent, etc.

[0089] 2. Experimental group methods:

[0090] Feature information score (F i ,): including request string entropy value, target URL historical access frequency, number of request parameters, etc.

[0091] Context score (G j ): Including user agent risk score, connection stability score, access region score, etc.

[0092] Adaptive scoring (H k ): Includes source IP address risk score, time pattern score, cross-validation score, etc.

[0093] Dynamic threshold adjustment (Threshold): Adjusted based on real-time data and historical patterns.

[0094] Adaptive context filtering: Automatically adjust parameters according to different network environments.

[0095] 3. Control group method: fixed threshold and traditional feature matching: false positive elimination based on static rules and simple feature matching.

[0096] 4. Experimental steps: The data set is divided into a training set (70%) and a test set (30%). The experimental group and the control group train the model in different network environments and apply it to the test set. The false alarm rate, true attack rate, false alarm elimination accuracy, processing time and other indicators of each alarm are recorded.

[0097] Experimental Results

[0098] 1. Virtualization environment:

[0099] Experimental group: Feature information scoring, request string entropy value (Entropy): average entropy value = 3.5, false alarm rate reduced by 30%. Target URL historical access frequency (Hist(Target_url)): average access frequency = 6 times / week, false alarm rate reduced by 25%. Context scoring: User agent risk score (UA_Risk): average risk score = 0.75, accuracy increased to 87%. Connection stability score (Conn_Stability): average stability score = 0.85, accuracy increased to 82%. Adaptive scoring: Source IP address risk score (IP_Risk): average risk score = 0.65, false alarm rate reduced by 20%. Time pattern (Time_Pattern): average time pattern score = 0.55, accuracy increased to 88%.

[0100] Dynamic threshold adjustment, adjusted threshold (`Threshold`): average threshold = 0.45, accuracy increased to 85%. Adaptive context filtering: processing efficiency increased by 25%, false alarm elimination efficiency increased to 90%.

[0101] Control group: fixed threshold and simple feature matching, request string entropy value (Entropy): average entropy value = 3.2, false alarm rate did not decrease significantly. Target URL historical access frequency (Hist(Target_url)): average access frequency = 5 times / week, false alarm rate decreased by 15%. Fixed feature score: User agent risk score (UA_Risk): average risk score = 0.7, accuracy rate 75%. Connection stability score (Conn_Stability): average stability score = 0.8, accuracy rate 70%.

[0102] Fixed threshold: Average threshold = 0.5, accuracy rate is 72%. Traditional filtering technology: Processing efficiency is improved by 10%, and false alarm elimination efficiency is 80%.

[0103] 2. Cloud computing platform:

[0104] Experimental group: Feature information scoring, request string entropy value (Entropy): average entropy value = 3.8, false alarm rate reduced by 35%. Target URL historical access frequency (Hist(Target_url)): average access frequency = 7 times / week, false alarm rate reduced by 30%. Context scoring: User agent risk score (UA_Risk): average risk score = 0.8, accuracy increased to 89%. Connection stability score (Conn_Stability): average stability score = 0.9, accuracy increased to 85%. Adaptive scoring: Source IP address risk score (IP_Risk): average risk score = 0.7, false alarm rate reduced by 25%. Time pattern (Time_Pattern): average time pattern score = 0.6, accuracy increased to 90%.

[0105] Dynamic threshold adjustment, adjusted threshold (`Threshold`): average threshold = 0.5, accuracy increased to 87%. Adaptive context filtering: processing efficiency increased by 30%, false alarm elimination efficiency increased to 93%.

[0106] Control group: fixed threshold and simple feature matching, request string entropy (Entropy): average entropy = 3.4, false alarm rate did not decrease significantly. Target URL historical access frequency (Hist(Target_url)): average access frequency = 6 times / week, false alarm rate decreased by 20%. Fixed feature score, user agent risk score (UA_Risk): average risk score = 0.75, accuracy rate 77%. Connection stability score (Conn_Stability): average stability score = 0.85, accuracy rate 72%.

[0107] Static threshold, fixed threshold: average threshold = 0.55, accuracy rate is 74%. Traditional filtering technology: processing efficiency is improved by 12%, and false alarm elimination efficiency is 82%.

[0108] 3. Distributed Systems:

[0109] Experimental group: Feature information scoring, request string entropy (Entropy): average entropy = 4.0, false positive rate reduced by 40%. Target URL historical access frequency (Hist(Target_url)): average access frequency = 8 times / week, false positive rate reduced by 35%. Context scoring, user agent risk score (UA_Risk): average risk score = 0.85, accuracy increased to 91%. Connection stability score (Conn_Stability): average stability score = 0.95, accuracy increased to 90%.

[0110] Adaptive scoring, source IP address risk score (IP_Risk): average risk score = 0.75, the false alarm rate is reduced by 30%. Time pattern (Time_Pattern): average time pattern score = 0.65, the accuracy rate is increased to 92%.

[0111] Dynamic threshold adjustment, adjusted threshold (Threshold): average threshold = 0.55, accuracy increased to 89%. Adaptive context filtering, processing efficiency increased by 35%, false alarm elimination efficiency increased to 95%.

[0112] Control group: fixed threshold and simple feature matching, request string entropy (Entropy): average entropy = 3.8, false alarm rate did not decrease significantly. Target URL historical access frequency (Hist(Target_url)): average access frequency = 7 times / week, false alarm rate decreased by 25%. Fixed feature scoring, user agent risk score (UA_Risk): average risk score = 0.8, accuracy rate 80%. Connection stability score (Conn_Stability): average stability score = 0.9, accuracy rate 75%.

[0113] Static threshold, fixed threshold: average threshold = 0.6, accuracy rate is 77%. Traditional filtering technology. Processing efficiency is improved by 15%, and false alarm elimination efficiency is 85%.

[0114] According to the experimental results, the present invention has the following innovations and beneficial effects:

[0115] 1. Multi-dimensional feature information scoring system: In the prior art, SQL attack detection systems usually rely on a small amount of feature information (such as source IP address, request string, etc.) for scoring, which leads to a single detection result and cannot fully evaluate the authenticity of the alarm. The present invention innovatively introduces a multi-dimensional feature information scoring system, covering multiple features such as request frequency, connection stability, user agent, TLS / SSL status, etc. Through the comprehensive scoring of these multi-dimensional features, the system can more accurately identify complex SQL injection attacks, significantly improve detection accuracy, and reduce false alarm rates.

[0116] 2. Complex scoring function and adaptive adjustment mechanism: Traditional SQL attack detection methods mostly rely on static scoring functions and fixed thresholds, which are difficult to adapt to the ever-changing attack patterns and network environments. The present invention introduces complex scoring functions in feature information scoring, such as using polynomials, logarithms, entropy values, etc. for feature analysis. At the same time, an adaptive adjustment mechanism is adopted to automatically adjust the weight parameters of the scoring function according to real-time data and historical patterns. This innovative scoring and adjustment method allows the system to dynamically respond to different attack patterns and network environment changes, improving the flexibility and accuracy of detection.

[0117] 3. Dynamic threshold adjustment mechanism: In the prior art, SQL attack detection systems usually use static thresholds to determine the authenticity of attacks. This approach often performs poorly when facing attacks of different intensities and network environments, and is prone to false positives or false negatives. The present invention innovatively introduces a dynamic threshold adjustment mechanism, and the system can adaptively adjust the threshold based on the number of alarms, network context, and historical data. This mechanism enables the system to maintain efficient detection capabilities in various complex network environments, reducing the possibility of false positives and false negatives.

[0118] 4. Adaptive context filtering technology: In the prior art, SQL attack detection systems usually lack flexibility in alarm screening in different network environments and cannot effectively filter alarms according to specific network environments and application scenarios. The present invention introduces adaptive context filtering technology, and the system can automatically adjust the alarm screening rules according to changes in the network environment. For example, for different scenarios such as virtualized environments and cloud computing platforms, the system can adaptively filter out low-priority alarm information, significantly improving the efficiency of false alarm elimination and the applicability of the system.

[0119] 5. Support for multiple network architectures and flexible adjustment capabilities: Traditional SQL attack detection systems mostly operate under a single network architecture and lack good adaptability to different types of network environments (such as virtualization, distribution, cloud computing, etc.). The present invention innovatively designs a false alarm elimination method that can adapt to multiple network architectures and has flexible adjustment capabilities. Whether in a virtualized environment or in a distributed system, the present invention can operate effectively and automatically adjust the feature information scoring system and threshold settings according to specific environmental requirements, ensuring efficient detection capabilities under different network architectures.

[0120] 6. Real-time response mechanism and security protection improvement: Existing SQL attack detection systems usually lack subsequent security response actions after false alarms are eliminated, and cannot prevent subsequent potential attacks in a timely manner. After the false alarms are eliminated, the present invention innovatively introduces a real-time response mechanism, which can immediately trigger security response actions, such as blocking the attack source, updating firewall rules, etc. This mechanism greatly improves the security protection capability of the system, so that the system can not only efficiently eliminate false alarms, but also respond to potential threats in the first place, enhancing the overall network security.

[0121] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for eliminating SQL attack false positives, characterized in that: The following steps are involved: Log in to the network security device to extract alarm information, filter out alarms related to WEB service SQL injection attacks from the alarm information, and form an SQL injection alarm list S; For each alarm in the SQL injection alarm list S, download the data packet related to the alarm and extract the characteristic information: Based on the extracted feature information, each alarm is analyzed and judged for false alarms to obtain a comprehensive judgment score. Total for: Among them, φ i , j and k is the comprehensive coefficient, F i , G j and H k represents different feature information, context and adaptive scoring function, λ is the weight of the machine learning model, Adaptive(N c , H p ) represents an adaptive adjustment function based on network context and historical patterns; Score based on comprehensive judgment Total The output score of the machine learning model ML The final score Final_Score is calculated and compared with the dynamic threshold Threshold to determine whether it is a false alarm.

2. The method for eliminating SQL attack false positives according to claim 1, characterized in that: The characteristic information includes: source IP address IP_src, request string Req_str, business system account information Sys_info, timestamp T s , response time T r , request size Req_size, request frequency Req_freq, access region IP_region, target URL Target_url, number of request parameters Param_count, network context Net_ctx, historical alarm pattern Hist_pattern, request method type Req_method, user agent User_agent, TLS / SSL status TLS_status, request delay Latency, connection stability Conn_stability, proxy service usage Proxy_usage.

3. The method for eliminating SQL attack false positives according to claim 2, characterized in that: Based on the extracted feature information, each alarm is analyzed and judged for false alarms to obtain a comprehensive judgment score. Total , The characteristic information score calculation formula is as follows: F1=log(Req_size+1)+log(Param_count+1)+Sim(Req_str,P_sqli) F2=Entropy(Req_str)·Complexity(Req_str) F4=Anom(T r )·log(Sys_info+1) F5=Latency_Impact(Latency) The context score calculation formula is as follows: G2=Net(Net c tx)·Req_method_Score(Req m ethod): G3=UA_Risk(User a gent) The adaptive scoring calculation formula is as follows:

4. The method for eliminating SQL attack false positives according to claim 1, characterized in that: The score is based on comprehensive judgment. Total The output score of the machine learning model ML Calculate the final score Final_Score, including: Final_Score=α×Score Total +(1-a)×Score ML Among them, α is an adjustable balance coefficient, which is used to control the influence ratio of the rule algorithm and the machine learning model; Score ML It is a score calculated by a machine learning model. Alerts are analyzed and scored based on the trained machine learning model to capture patterns or features that may be missed by the rule algorithm.

5. The method for eliminating SQL attack false positives according to claim 1 or 4, characterized in that: The final score Final_Score is compared with the dynamic threshold Threshold to determine whether it is a false alarm. Specifically, if Final_Score is greater than or equal to Threshold, the alarm is considered to be a real attack behavior and the security system or personnel need to take corresponding measures; if Final_Score is less than Threshold, the alarm is considered to be a false alarm.

6. The method for eliminating SQL attack false positives according to claim 5, characterized in that: After the false alarm is eliminated, the corresponding security response actions are immediately triggered, including blocking the attack source, issuing security alerts, and updating firewall rules.

7. The method for eliminating SQL attack false positives according to claim 1 or 4, characterized in that: The dynamic adaptive adjustment method of the dynamic adjustment threshold Threshold is: Among them, γ and η are dynamic adjustment parameters, n is the number of alarms, Adaptive(N c , H p ) is the adaptive adjustment function.

8. The method for eliminating SQL attack false positives according to claim 1, characterized in that: The method also includes tracing the source of the alarm, by comparing the Trace_Score with a preset threshold or with historical data to determine whether the alarm is a false alarm or an abnormal alarm that requires further attention; the higher the Trace_Score, the more likely the alarm is related to real attack behavior, requiring more attention from security personnel, and a comprehensive analysis and judgment is performed based on the following expression: Among them, β l and κ q is the weighting coefficient of traceability analysis, p and r represent the number of traceability components and behavioral patterns respectively, Trace_Component is the traceability component, and Behavioral_Pattern is the information related to behavioral pattern analysis.

Images