Method for discovering SQL (Structured Query Language) injection attack behavior based on chaotic parting dimension

Abstract

The invention discloses a method for discovering SQL injection attack behaviors based on chaotic parting dimensions, and the method specifically comprises the steps: S1, data collection and feature extraction: obtaining HTTP request data, including SQL query data; extracting the characteristics of the SQL injection attack, wherein the characteristics comprise special characters, SQL keywords and potential malicious structures; s2, calculating a parting dimension; s3, setting a classification dimension threshold value, and if the classification dimension of the selected SQL statement is higher than the threshold value, judging that the SQL statement is an SQL injection attack; and S4, performing anomaly detection and response. The invention mainly relates to the technical field of network security, chaos theory and typing analysis. According to the method, the data is analyzed by using the typing dimension in the chaos theory, the accuracy and efficiency of attack detection are further improved, and nonlinear characteristics and complexity in an attack mode can be revealed, so that the method has advantages in coping with complex attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, chaos theory and classification analysis, and mainly relates to a method for discovering SQL injection attack behavior based on chaos classification dimension. BACKGROUND

[0002] The present application mainly relates to the field of network security, chaos theory and classification analysis. In the field of network security, this method is used for detecting and defending against SQL injection attacks in web applications, belonging to the field of attack detection and defense. By using the classification dimension in chaos theory to analyze data, the accuracy and efficiency of attack detection are further improved, and the non-linear characteristics and complexity in attack patterns can be revealed, which makes this method have an advantage in dealing with complex attacks.

[0003] With the widespread development of the Internet and web applications, network security problems are becoming increasingly serious, and SQL injection attacks, as one of the most common web application security threats, have become a global focus of network security protection. SQL injection attacks manipulate databases to perform unauthorized operations by maliciously constructing SQL statements, causing serious security risks to enterprises and users.

[0004] The method used in the prior art is as follows:

[0005] (1) Signature-based detection method: By predefining attack patterns or rules, the SQL statements in web requests are matched to identify potential SQL injection attacks. Common firewalls and intrusion detection systems use this method to detect attacks by matching common malicious SQL statements or keywords.

[0006] Advantages: Can quickly identify known attack patterns and has fast processing speed.

[0007] Disadvantages: For unknown or variant SQL injection attacks, it relies on rule updates and is prone to missed detection and false positives. Attackers can bypass this rule-based detection system by varying or obfuscating SQL injection code.

[0008] (2) Behavior analysis-based detection method: By monitoring network traffic and database behavior, abnormal patterns are identified. For example, machine learning techniques are used to analyze network traffic features to detect potential SQL injection attacks.

[0009] Advantages: Through behavior analysis, unknown attack methods can be identified, and new attacks can be adapted to some extent.

[0010] Disadvantages: Requires a large amount of training data and has high computational complexity, with poor real-time performance. SUMMARY

[0011] In view of the problems and shortcomings of the existing technology, this invention aims to provide a method for detecting SQL injection attacks based on the chaotic fractal dimension, thereby solving the aforementioned problems. The technology of this invention is closely related to existing SQL injection attack protection technologies based on anomaly detection. Current mainstream technologies include feature-matching detection methods (such as regular expressions or SQL query syntax matching) and machine learning-based detection methods. However, these methods typically rely on predefined rules or large amounts of labeled data and have poor adaptability to unknown or variant attacks. The chaotic fractal dimension-based method of this invention, by analyzing the complexity of network traffic, can identify potential nonlinear attack behaviors, avoiding the limitations of traditional methods and better addressing complex and ever-changing attack patterns.

[0012] According to a first aspect of the present invention, a method for detecting SQL injection attacks based on chaotic fractal dimension is proposed, the specific steps of which include:

[0013] S1. Data collection and feature extraction, including: acquiring HTTP request data, including SQL query data; extracting features of SQL injection attacks, including: special characters, SQL keywords, and potential malicious structures;

[0014] S2. Calculate the fractal dimensions, including:

[0015] S2.1 Data preprocessing: Clean and preprocess the HTTP request data to remove noise and identify the SQL query portion in the request data;

[0016] S2.2 Data Transformation: Transform the SQL query into a mathematical model;

[0017] S2.3. Using the mathematical model as a high-dimensional dataset, the number of partitions of the high-dimensional dataset is calculated using the box counting method, and the fractal dimension is further calculated using the number of partitions and the partitioned sub-datasets.

[0018] S3. Set a fractal dimension threshold. If the fractal dimension of the selected SQL statement is higher than the threshold, the SQL statement is determined to be an SQL injection attack.

[0019] S4. Anomaly detection and response, including:

[0020] S4.1 Traffic Classification: Calculate the classification dimension of all request data and divide the request data into normal traffic and abnormal traffic;

[0021] S4.2 Real-time monitoring: Perform real-time traffic monitoring in the network environment, analyze request data in real time using the aforementioned calculation fractal dimension method, and immediately mark the request data as a potential SQL injection attack if an abnormal fractal dimension is detected.

[0022] S4.3 If an SQL injection attack is detected, the response mechanism will be immediately triggered to block the corresponding IP address.

[0023] Furthermore, the extraction of SQL injection attack characteristics also includes using time delay analysis to extract request data with abnormally long response times.

[0024] Furthermore, the data preprocessing in step S2.1 specifically includes: identifying the SQL query portion in the request data, wherein the query portion includes the URL address, parameters, and form input portion; collecting the traffic logs of the web server, including normal requests and SQL injection requests, and extracting the SQL query portion of each request.

[0025] Furthermore, the mathematical model is specifically represented by converting characters or bytes in the SQL query statement into ASCII values.

[0026] Furthermore, the specific formula for calculating the number of partitions in the high-dimensional dataset using the box counting method is as follows:

[0027]

[0028] Where N(∈) represents the number of boxes required to cover the data points with scale ∈, ∈ represents the scale of the box, and C represents the dynamically adjusted parameter.

[0029] Furthermore, the specific formula for calculating the fractal dimension is as follows:

[0030]

[0031] Where D represents the fractal dimension, N(∈) represents the number of boxes required to cover the data points with scale ∈, and ∈ represents the scale of the box.

[0032] Furthermore, the setting of the fractal dimension threshold also includes dynamically adjusting the threshold of the fractal dimension using a sliding window method.

[0033] Furthermore, after setting the fractal dimension threshold, an anomaly detection model is trained based on deep learning autoencoders and isolated forests, combined with normal traffic samples. If new traffic data deviates from the normal traffic pattern, the traffic data is marked as an anomaly.

[0034] According to a second aspect of the present invention, a computer program product is provided, on which one or more computer programs are stored, which, when executed by a computer processor, implement the method described above.

[0035] The above-described one or more technical solutions in the embodiments of this application have at least one of the following technical effects:

[0036] (1) Improve the accuracy of SQL injection attack detection

[0037] By employing a chaotic fractal dimensional analysis method, the complex patterns and abnormal behaviors of SQL injection attacks can be identified more accurately. Compared to traditional rule-based or signature-based detection methods, this invention significantly improves detection accuracy and effectively reduces false positives and false negatives.

[0038] (2) Enhance the ability to identify new and variant attacks.

[0039] Chaos theory possesses powerful nonlinear and complex characteristics, enabling it to adapt to the diversity and ever-changing trends of SQL injection attack methods. Therefore, this invention can better address new and variant SQL injection attacks, especially covert attacks that traditional detection methods cannot identify.

[0040] (3) Reduce reliance on large amounts of labeled data

[0041] Traditional SQL injection attack detection methods, especially machine learning-based methods, typically require large amounts of labeled data for training. This invention, however, utilizes chaotic fractal dimensionality analysis to reduce reliance on labeled data and achieve adaptive detection. This allows for effective detection and defense against SQL injection attacks even in situations where data is scarce or labeling is difficult.

[0042] (4) Reduce computing resource consumption and support real-time detection

[0043] Fractal dimension calculation in chaos theory is relatively efficient, enabling complex pattern recognition and attack detection with relatively low computational resource consumption. Therefore, this invention supports real-time detection in high-traffic network environments, avoiding performance bottlenecks caused by excessive computational complexity.

[0044] (5) Improve the ability to detect complex variant attacks.

[0045] SQL injection attacks take many forms, and attackers often bypass traditional signature detection methods by altering the structure or encoding of SQL statements. This method can extract potential attack patterns from the non-linear dynamics of data without relying on predefined rules or signatures. It can effectively deal with attack variants and has higher adaptability and accuracy for unidentified SQL injection attack types. Attached Figure Description

[0046] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Elements in the drawings are not necessarily to scale. The same reference numerals refer to corresponding similar parts.

[0047] Figure 1 A flowchart illustrating a method for detecting SQL injection attacks based on chaotic fractal dimensions according to an embodiment of the present invention is shown.

[0048] Figure 2 This is a schematic diagram of the structure of a computer system suitable for implementing the electronic devices of the present application embodiments. Detailed Implementation

[0049] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0050] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0051] Figure 1 A flowchart illustrating a method for detecting SQL injection attacks based on chaotic fractal dimensions according to an embodiment of the present invention is shown, as follows: Figure 1 As shown:

[0052] S1. Data collection and feature extraction;

[0053] SQL injection attacks manifest as malicious SQL statements that differ in structure or content from normal HTTP request data (such as GET / POST requests, request headers, URL parameters, etc.). This method utilizes a chaotic fractal dimension for detection and requires data to be obtained from network traffic.

[0054] Network traffic obtained from the network may appear random and disordered, but this is caused by the complex behavior of deterministic systems, which is consistent with chaos theory. Therefore, by using the chaos fractal dimension to model network traffic or database behavior, we can discover the nonlinear, complex and hidden characteristics in the behavior.

[0055] Network traffic data: Obtain HTTP request data, such as those involving SQL queries.

[0056] SQL query characteristics: Extract common characteristics in SQL injection attacks, such as special characters (e.g., single quotes ', double quotes ", semicolons;, comment symbols --, etc.), SQL keywords (e.g., SELECT, UNION, DROP, INSERT, etc.), and potential malicious structures (e.g., logical operators, subqueries, etc.).

[0057] S2, Calculate the fractal dimension;

[0058] The calculation of fractal dimension involves the following four steps:

[0059] Step 1: Data Preprocessing: Clean and preprocess the network traffic to remove noise and identify the SQL query parts in the request, especially the URL, parameters and form input parts.

[0060] For example, collect web server traffic logs, including both normal and attack (SQL injection) requests. For each request, extract the SQL query portion (such as URL parameters, form data, etc.).

[0061] Normal request: SELECT * FROM users WHERE id = 1

[0062] SQL injection request: SELECT * FROM users WHERE id=1 OR 1=1

[0063] Step 2: Data Conversion: Transform the SQL query input (or the entire HTTP request) into a mathematical model (character set or byte stream). In this embodiment, the characters or bytes in these SQL queries are converted into numerical representations (such as ASCII values).

[0064] Normal query: SELECT * FROM users WHERE id=1 → [83,69,76,69,67,84,...]

[0065] SQL injection query: SELECT * FROM users WHERE id=1 OR 1=1 → [83,69,76,69,67,84,...]

[0066] Step 3: Calculation using the box counting method:

[0067]

[0068] Where N(∈) represents the number of boxes required to cover the data points with scale ∈, ∈ represents the scale of the box, and C represents the dynamically adjusted parameter.

[0069] The processed data is considered as a high-dimensional dataset.

[0070] The data is covered using "boxes" of different sizes, and the number of data points contained in each box is calculated. As the box size decreases, the number of boxes required to completely cover the dataset is recorded.

[0071] For each request, treat them as a high-dimensional dataset. Cover these data points using box counting. Choose different box sizes, ranging from large boxes (covering the entire dataset) to very small boxes (covering finer structures).

[0072] In this embodiment, box counting is performed on the character set of a certain request:

[0073] For ∈ = 10: 20 boxes need to be covered, N(10) = 20;

[0074] For ∈=5: 40 boxes need to be covered, N(5)=40;

[0075] For ∈=1: 100 boxes need to be covered, N(1)=100;

[0076] By calculating N(∈) at each scale, the fractal dimension is further calculated using a formula.

[0077] Step 4: Calculate the fractal dimension:

[0078]

[0079] Where D represents the fractal dimension, ∈ represents the size of the box, and N(∈) represents the number of boxes required to cover the data points at scale ∈.

[0080] Calculate lnN(∈) and ln∈ for each scale:

[0081] lnN(10)=ln20;

[0082] lnN(5)=ln40;

[0083] lnN(1) = ln100;

[0084] The formula for data complexity is:

[0085]

[0086] In this embodiment, if ∈1=10 and ∈2=5:

[0087]

[0088] When ∈1=5 and ∈2=1:

[0089]

[0090] In summary, D(10,5)≈1 and D(5,1)≈0.57, thus revealing the complexity of the fractal dimension D.

[0091] S3. Set the threshold for the fractal dimension;

[0092] Normal traffic typically follows simple and regular patterns, with a low fractal dimension D value. However, SQL injection attacks, due to complex and irregular inputs, usually have a higher fractal dimension D value. The fractal dimension D value can be used to determine if an SQL injection attack is occurring. A suitable threshold can be set using a sliding window, and the presence of an SQL injection attack can be determined by checking if the fractal dimension D of the request exceeds that threshold.

[0093] In data streams or time series, sliding windows help us continuously calculate the fractal dimensions of data within a fixed-size window, and set thresholds based on changes in these fractal dimensions to determine whether anomalies have occurred. Specifically, this also includes:

[0094] 1) Set the parameters for the sliding window;

[0095] Window size w: Determines the size of the sliding window. The window size can be fixed or dynamically adjusted as needed. Typically, w represents the number of data points in the time series or the length of the time period.

[0096] Step size s: The step size at which the sliding window moves each time, usually 1 or adjustable as needed.

[0097] 2) Calculate the fractal dimension in each sliding window;

[0098] For the data within each window, the fractal dimension D is calculated using box counting.

[0099] Calculate the number of boxes N(∈) for different box sizes ∈ in the dataset in the window.

[0100] Calculate the fractal dimension and fractal dimension complexity for each window using the box counting formula.

[0101] 3) Set dynamic thresholds;

[0102] After calculating the fractal dimension of each sliding window, the threshold can be set using the following methods:

[0103] Mean-weighted threshold: Calculate the average fractal dimension D of all windows. avg And the standard deviation σ, then set the threshold to D. avg +kσ (k is a constant). If the fractal dimension of a window exceeds this threshold, it is considered abnormal.

[0104] Quantile threshold: Calculate the distribution of fractal dimensions across all windows. You can set a percentile (e.g., 95%) and use this percentile as the threshold. If the fractal dimension of a window exceeds this percentile, it is considered an anomaly.

[0105] Adaptive Threshold: Set an adaptive threshold based on the changing trend of the fractal dimension of each sliding window. For example, set a threshold variation range and adjust the current threshold according to the rate of change of historical windows.

[0106] 4) Anomaly detection

[0107] When the fractal dimension of a sliding window exceeds a set threshold, it can be determined that the data within that time period has a significant change in complexity, which may be a sign of anomaly or attack.

[0108] Furthermore, the selected model is trained and dynamically updated based on the aforementioned thresholds:

[0109] Training phase: Using historical data or sample traffic, calculate the subdivision dimension of normal traffic and attack traffic. Based on deep learning autoencoders and isolated forest methods, train an anomaly detection model using normal traffic samples. If new traffic data deviates from the normal traffic pattern, the traffic data is marked as an anomaly.

[0110] Dynamic updates: In practical applications, since the manifestations of SQL injection attacks may change constantly, a dynamic update approach can be adopted to continuously adjust the thresholds to adapt to new attack patterns.

[0111] S4. Anomaly Detection and Response;

[0112] Traffic classification: By calculating the fractal dimension of all incoming requests, requests are divided into normal traffic and abnormal traffic (i.e., SQL injection attacks).

[0113] Real-time monitoring: Perform real-time traffic monitoring in the network environment, and analyze requests in real time using the above-mentioned fractal dimension method. When an anomaly in the fractal dimension is detected (above a set threshold), immediately mark the request as a potential SQL injection attack.

[0114] Defense mechanism: Once an SQL injection attack is detected, the response mechanism will be immediately triggered to block the IP address.

[0115] Example Analysis:

[0116] The following experiments were conducted to compare the fractal dimensions of normal requests and SQL injection requests:

[0117] For a normal request (such as a simple SQL query), the fractal dimension D ≈ 0.6.

[0118] SQL injection requests (such as queries with complex conditions) yielded the following result: Fractal dimension D ≈ 1.2;

[0119] (1) Dataset preparation: Collect a set of normal requests (such as standard database queries) and a set of known SQL injection attacks (generated by common SQL injection testing tools or known attack scripts).

[0120] (2) Fractal dimension calculation: Extract the SQL query part for each request and use box counting to calculate the fractal dimension and complexity.

[0121] (3) Analysis results: The experiment shows that the fractal dimension of normal requests is relatively low, indicating that their query structure is relatively simple and has strong regularity. When an SQL injection attack occurs, the fractal dimension is higher, indicating that its query structure is more complex and unpredictable, and may contain multiple subqueries, logical operators, etc.

[0122] (4) Threshold setting:

[0123] Based on the calculated fractal dimension, a reasonable threshold is set as D = 0.8. When the fractal dimension of a request exceeds this threshold, the request is considered to be potentially an SQL injection attack.

[0124] The experimental data are shown in Table 1:

[0125] Table 1 Experimental Data

[0126]

[0127]

[0128] By analyzing the fractal dimensions of normal requests and SQL injection requests, it can be seen that SQL injection requests typically exhibit a higher fractal dimension, indicating a more complex structure. Normal requests, on the other hand, maintain a lower fractal dimension (usually below 0.8), conforming to a simple and regular query structure. This method can effectively distinguish whether a request has been subjected to an SQL injection attack.

[0129] In summary, the core technical point of this invention lies in:

[0130] (1) Chaotic fractal dimensional analysis method

[0131] The core technology of this invention lies in utilizing the fractal dimension analysis method from chaos theory to detect SQL injection attacks. Chaos theory, through the analysis of dynamic system behavior, can reveal abnormal patterns in network traffic, particularly effectively identifying the complexity and nonlinear characteristics of SQL injection attacks.

[0132] (2) Adaptive recognition capability of attack patterns

[0133] Chaotic fractal dimensional analysis can effectively identify new and variant SQL injection attacks. The innovation lies in its adaptability; it does not rely on a fixed rule base or signature database and can automatically adjust the identification mode based on dynamic characteristics of network traffic.

[0134] (3) Improve detection accuracy and reduce false alarm rate

[0135] The technical solution of this invention effectively improves detection accuracy through in-depth analysis of SQL injection attack traffic. Compared with traditional rule-based or signature-based detection methods, this invention significantly improves accuracy and effectively reduces false positives and false negatives.

[0136] The technical effects and applications of this invention are as follows:

[0137] (1) Application of Chaotic Fractal Dimensional Analysis in SQL Injection Attack Detection

[0138] This invention relates to a unique application method of chaotic fractal dimension analysis in the field of SQL injection attack detection, including how to analyze network traffic, identify abnormal patterns, and determine whether they are attack behaviors.

[0139] (2) Adaptive detection algorithm

[0140] The adaptive detection algorithm is designed to automatically adapt to different types of SQL injection attacks, especially when attack methods are constantly changing and evolving. Combined with the sliding window method, it can maintain high detection accuracy.

[0141] (3) Real-time detection mechanism with low resource consumption

[0142] This method enables a real-time detection mechanism with low computational resource consumption, especially in high-concurrency, high-traffic network environments, ensuring that detection does not affect the overall performance of the system.

[0143] The following is for reference. Figure 2 It shows a schematic diagram of the structure of a computer system 200 suitable for implementing electronic devices according to embodiments of the present application. Figure 2 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0144] like Figure 2As shown, the computer system 200 includes a central processing unit (CPU) 201, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 202 or programs loaded from storage section 208 into random access memory (RAM) 203. The RAM 203 also stores various programs and data required for the operation of the system 200. The CPU 201, ROM 202, and RAM 203 are interconnected via a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.

[0145] The following components are connected to I / O interface 205: an input section 206 including a keyboard, mouse, etc.; an output section 207 including a liquid crystal display (LCD) and speakers, etc.; a storage section 208 including a hard disk, etc.; and a communication section 209 including a network interface card such as a LAN card and a modem, etc. The communication section 209 performs communication processing via a network such as the Internet. A drive 210 is also connected to I / O interface 205 as needed. A removable medium 211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 210 as needed so that computer programs read from it can be installed into storage section 208 as needed.

[0146] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 209, and / or installed from removable medium 211. When the computer program is executed by central processing unit (CPU) 201, it performs the functions defined in the methods of this application. It should be noted that the computer-readable storage medium of this application can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0147] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0148] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0149] The modules described in the embodiments of this application can be implemented in software or in hardware.

[0150] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: S1, collect data and extract features, including: acquiring HTTP request data, including SQL query data; extracting features of SQL injection attacks, including: special characters, SQL keywords, and potential malicious structures; S2, calculate the fractal dimension; S3, set a fractal dimension threshold, and if the fractal dimension of a selected SQL statement is higher than the threshold, determine that the SQL statement is an SQL injection attack; S4, detect and respond to anomalies.

[0151] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for detecting SQL injection attacks based on chaotic fractal dimension, characterized in that, Includes the following steps: S1. Data collection and feature extraction, including: acquiring HTTP request data, including SQL query data; extracting features of SQL injection attacks, including: special characters, SQL keywords, and potential malicious structures; S2. Calculate the fractal dimensions, including: S2.1 Data preprocessing: Clean and preprocess the HTTP request data to remove noise and identify the SQL query portion in the request data; S2.2 Data Transformation: Transform the SQL query into a mathematical model; S2.

3. Using the mathematical model as a high-dimensional dataset, the number of partitions of the high-dimensional dataset is calculated using the box counting method, and the fractal dimension is further calculated using the number of partitions and the partitioned sub-datasets. S3. Set a fractal dimension threshold. If the fractal dimension of the selected SQL statement is higher than the threshold, the SQL statement is determined to be an SQL injection attack. S4. Anomaly detection and response, including: S4.1 Traffic Classification: Calculate the classification dimension of all request data and divide the request data into normal traffic and abnormal traffic; S4.2 Real-time monitoring: Perform real-time traffic monitoring in the network environment, analyze request data in real time using the aforementioned calculation fractal dimension method, and immediately mark the request data as a potential SQL injection attack if an abnormal fractal dimension is detected. S4.3 If an SQL injection attack is detected, the response mechanism will be immediately triggered to block the corresponding IP address.

2. The method according to claim 1, characterized in that, The extraction of SQL injection attack characteristics also includes using time delay analysis to extract request data with abnormally long response times.

3. The method according to claim 1, characterized in that, The data preprocessing in step S2.1 further includes: identifying the SQL query portion in the request data, wherein the query portion includes the URL address, parameters and form input portion; collecting the traffic logs of the web server, including normal requests and SQL injection requests, and extracting the SQL query portion of each request.

4. The method according to claim 1, characterized in that, The mathematical model is specifically represented by converting characters or bytes in an SQL query statement into ASCII values.

5. The method according to claim 1, characterized in that, The specific formula for calculating the number of partitions in the high-dimensional dataset using the box counting method is as follows: Where N(∈) represents the number of boxes required to cover the data points with scale ∈, ∈ represents the scale of the box, and C represents the dynamically adjusted parameter.

6. The method according to claim 1, characterized in that, The specific formula for calculating the fractal dimension is as follows: Where D represents the fractal dimension, N(∈) represents the number of boxes required to cover the data points with scale ∈, and ∈ represents the scale of the box.

7. The method according to claim 1, characterized in that, The setting of the fractal dimension threshold also includes dynamically adjusting the fractal dimension threshold using a sliding window method.

8. The method according to claim 1 or 7, characterized in that, After setting the threshold for the classification dimension, an anomaly detection model is trained based on the deep learning autoencoder and isolated forest method, combined with normal traffic samples. If new traffic data deviates from the normal traffic pattern, the traffic data is marked as an anomaly.

9. A computer program product, characterized in that, It stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-8.

10. A computing system, characterized in that, It includes a processor and a memory, the processor being configured to perform the method as described in any one of claims 1-8.

Images