SQL (Structured Query Language) injection response method for industrial sensitive data

Abstract

The embodiment of the invention relates to the field of data processing, and provides an industrial sensitive data-oriented SQL injection response method, which comprises the following steps of: performing feature extraction on an SQL command uploaded by a client to obtain a first feature information set; calculating reasoning score information of an SQL command uploaded by a client according to first feature information in the first feature information set to obtain target score information; generating an injection response scheme corresponding to the SQL command uploaded by the client according to a preset score information threshold and the target score information to obtain a target response scheme; responding to an SQL command uploaded by the client according to the target response scheme to obtain a response result; the accuracy of performing injection response on the SQL uploaded by the client is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a SQL injection response method for industrial sensitive data. BACKGROUND

[0002] With the continuous acceleration of industrial intelligentization and digitization process, a large amount of sensitive data involved in industrial control systems is accelerating the migration to the cloud, and databases undertake the core data storage and interaction tasks among them. These data usually include device running state, control instruction, process flow parameter and production core index, the integrity and secrecy of which are directly related to the safe and stable operation of industrial systems. Once the sensitive data is illegally tampered with, leaked or called, it is likely to cause serious production accidents and economic losses. Therefore, to protect the security of sensitive data in industrial databases has become one of the core goals of industrial information security protection.

[0003] In order to protect the security of sensitive data in industrial databases, it is necessary to identify SQL injection attacks in industrial control systems, especially for database operation requests involving sensitive data, so as to ensure the safe and stable operation of industrial systems.

[0004] In the prior art, static detection or dynamic detection of SQL commands uploaded by clients is usually carried out based on SQL writing rules. However, the static detection based on SQL writing rules only has good detection effect on SQL commands with standard format, but the form of SQL command is various and the data structure is complex, which leads to insufficient accuracy of the static detection based on SQL writing rules when responding to SQL commands with non-uniform format and complex structure. The dynamic detection based on SQL writing rules can analyze the actual execution path of SQL command to identify SQL commands with attack variants, but the response speed of the dynamic detection based on SQL writing rules is slow, which is difficult to adapt to high-frequency requests in industrial scenarios, resulting in low accuracy when responding to SQL commands uploaded by clients. SUMMARY

[0005] The SQL injection response method for industrial sensitive data provided by the embodiments of the present application can improve the accuracy when responding to SQL commands uploaded by clients.

[0006] The first aspect of the embodiments of the present application provides a SQL injection response method for industrial sensitive data, which comprises: characteristic extraction of SQL commands uploaded by clients to obtain a first feature information set; According to the first feature information in the first feature information set, the inference score information of the SQL command uploaded by the client is calculated to obtain target score information; According to the preset score information threshold and the target score information, the injection response scheme corresponding to the SQL command uploaded by the client is generated to obtain a target response scheme; According to the target response scheme, the SQL command uploaded by the client is responded to obtain a response result.

[0007] In this example, by extracting features of the SQL command uploaded by the client, a first feature information set is obtained. According to the first feature information in the first feature information set, the inference score information of the SQL command uploaded by the client is calculated to obtain target score information. According to the preset score information threshold and the target score information, the injection response scheme corresponding to the SQL command uploaded by the client is generated to obtain a target response scheme. According to the target response scheme, the SQL command uploaded by the client is responded to obtain a response result, which improves the accuracy when responding to the SQL command uploaded by the client.

[0008] In one possible implementation, a method for extracting features of a SQL command uploaded by a client to obtain a first feature information set includes: standardizing the SQL command uploaded by the client to obtain a first SQL command; vectorizing the first SQL command to obtain a second SQL command; extracting features of the second SQL command to obtain a first feature information set.

[0009] In one possible implementation, a method for extracting features of the second SQL command to obtain a first feature information set includes: extracting term frequency features of the second SQL command to obtain a first sub-feature information set; extracting global rarity features of the second SQL command to obtain a second sub-feature information set; extracting local phrase structure features of the second SQL command to obtain a third sub-feature information set; determining the first sub-feature information in the first sub-feature information set, the second sub-feature information in the second sub-feature information set, and the third sub-feature information in the third sub-feature information set as elements in the first feature information set to obtain a first feature information set.

[0010] In one possible implementation, a method for calculating inference score information of a SQL command uploaded by a client according to first feature information in a first feature information set, to obtain target score information, includes: calculating, according to the first feature information in the first feature information set, adaptability score information corresponding to each classifier in a preset independent gating network respectively, to obtain a first score information set; selecting, according to the first score information in the first score information set, K classifiers in the preset independent gating network, to obtain an active classifier set; calculating, for each active classifier in the active classifier set, normalization weight information corresponding to the active classifier, to obtain a first weight information set; calculating, according to the first weight information in the first weight information set, a sparse weight vector corresponding to the preset independent gating network, to obtain second weight information; calculating, according to the second weight information, inference score information of the SQL command uploaded by the client, to obtain the target score information.

[0011] In one possible implementation, a method for generating an injection response scheme corresponding to the SQL command uploaded by the client according to a preset score information threshold and the target score information, to obtain a target response scheme, includes: judging whether the target score information is less than the preset score information threshold, to obtain a judgment result; generating, according to the judgment result, an injection response scheme corresponding to the SQL command uploaded by the client, to obtain the target response scheme. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort.

[0013] Figure 1 A network architecture schematic diagram of a SQL injection response method for industrial sensitive data is provided for the embodiments of the present application; Figure 2 A flowchart schematic diagram of a SQL injection response method for industrial sensitive data is provided for the embodiments of the present application; Figure 3 A structure schematic diagram of a preset independent gating network is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0014] With reference to the drawings and the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments of the present application, all the other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of the present application.

[0015] The terms "first", "second", etc. in the specification and claims of the present application and the above drawings are used to distinguish different objects, rather than to describe a specific sequence. In addition, the terms "comprise" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally further include steps or units not listed, or can optionally further include other steps or units inherent to the process, method, product or device.

[0016] In the present application, the phrase "embodiment" means that the specific features, structures or characteristics described in conjunction with the embodiment can be included in at least one embodiment of the present application. The phrase appears at various places in the specification does not necessarily refer to the same embodiment, nor is it mutually exclusive or alternative to other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in the present application can be combined with other embodiments.

[0017] Please refer to Figure 1 , Figure 1The application provides a network architecture diagram of an SQL injection response method for industrial sensitive data. The SQL injection response system for industrial sensitive data is arranged in a security intermediate layer between an industrial access layer and an industrial data layer, and includes a pseudo-label generation submodule, a real-time discrimination submodule, and an interception uploading module. The real-time discrimination submodule is used to receive SQL commands input by clients such as industrial tablets, operation panels, handheld terminals, actuators, and malicious clients controlled by hackers in the industrial access layer, and to determine whether the received SQL commands have injection risks. If the SQL commands received by the real-time discrimination submodule do not have injection risks, the SQL commands can be determined as normal SQL commands. The real-time discrimination submodule injects the SQL commands determined as not having injection risks into an industrial database of the industrial data layer, and performs operation on the SQL commands. If the SQL commands received by the real-time discrimination submodule have injection risks, the SQL commands can be determined as malicious SQL injection commands. The real-time discrimination submodule uploads the SQL commands determined as having injection risks to the interception uploading module, so as to prevent the SQL commands having injection risks from flowing into the industrial database of the industrial data layer. The interception uploading module uploads the SQL commands having injection risks to a blockchain, so as to ensure the non-tamperability and traceability of the SQL commands having injection risks. The pseudo-label generation submodule is used to add pseudo-label information to the SQL commands discriminated by the real-time discrimination submodule. The pseudo-label generation submodule adds the SQL commands with pseudo-labels to a training data set, and inputs the SQL commands with pseudo-labels to the real-time discrimination submodule again. Thus, the training data in the training data set can be used to train the real-time discrimination submodule, so as to improve the discrimination accuracy of the real-time discrimination submodule.

[0018] In order to better understand the method for responding to SQL injection for industrial sensitive data provided by the embodiments of the present application, the method for responding to SQL injection for industrial sensitive data in the prior art will be briefly introduced first. In the prior art, the SQL command uploaded by the client is usually detected statically or dynamically based on the writing rules of SQL. However, the static detection scheme based on the writing rules of SQL only has good detection effect on the SQL command with standard format, but the SQL command has various forms and complex data structure, which results in that the static detection scheme based on the writing rules of SQL is not accurate enough when responding to the injection of the SQL command with non-uniform format and complex structure. The dynamic detection method based on the writing rules of SQL can analyze the actual execution path of the SQL command to identify the SQL command of attack variant, but the response speed of the dynamic detection method based on the writing rules of SQL is slow, which is difficult to adapt to the high-frequency request in the industrial scene, so that the accuracy of responding to the injection of the SQL command uploaded by the client is low.

[0019] To solve the above technical problems, the embodiments of the present application provide a method for responding to SQL injection for industrial sensitive data. The method includes the following steps: extracting features of the SQL command uploaded by the client to obtain a first feature information set, generating an injection response scheme corresponding to the SQL command uploaded by the client according to the first feature information in the first feature information set to obtain a target response scheme, and responding to the SQL command uploaded by the client using the target response scheme to obtain a response result, thereby improving the accuracy of responding to the injection of the SQL command uploaded by the client.

[0020] Please refer to Figure 2 , Figure 2 The embodiments of the present application provide a flowchart of a method for responding to SQL injection for industrial sensitive data. As shown in Figure 2 the method includes the following steps: 101. Extracting features of the SQL command uploaded by the client to obtain a first feature information set.

[0021] In the method, the first SQL command can be obtained by standardizing the SQL command uploaded by the client, and the SQL command uploaded by the client is converted into a data format that can be directly used by a mathematical model by vectorizing the first SQL command to obtain a second SQL command. The first feature information set is obtained by using a preset feature extraction module to respectively extract term frequency features, global rarity features and local phrase structure features of the second SQL model.

[0022] 102. Calculate the inference score information of the SQL command uploaded by the client according to the first feature information in the first feature information set, and obtain target score information.

[0023] Specifically, the first feature information in the first feature information set can be input into a preset independent gating network model, K classifiers with the highest scores can be selected as classifier experts according to the adaptability score information between each classifier in the preset independent gating network model and the first feature information in the first feature information set, and an active classifier set is obtained; the sparse weight vector corresponding to all classifiers in the preset independent gating network is determined according to the active classifier in the active classifier set, and second weight information is obtained; the first feature information in the first feature information set is inferred according to the second weight information, so as to realize the inference of the SQL command uploaded by the client, and obtain the target score information.

[0024] 103. Generate the injection response scheme corresponding to the SQL command uploaded by the client according to the preset score information threshold and the target score information, and obtain the target response scheme.

[0025] Specifically, the size relationship between the target score information and the preset score information threshold can be determined to determine whether the preset release process is used as the injection response scheme corresponding to the SQL command uploaded by the client or the preset interception process is used as the injection response scheme corresponding to the SQL command uploaded by the client, and the target response scheme is obtained.

[0026] 104. Respond to the SQL command uploaded by the client according to the target response scheme, and obtain a response result.

[0027] The release process or the interception process can be executed on the SQL command uploaded by the client according to the content of the target response scheme, so as to complete the response to the SQL command uploaded by the client, and obtain the response result. The response result can be, for example, "the SQL command uploaded by the client has been released and executed in the database" or "the SQL command uploaded by the client has been intercepted and written into the blockchain network". The specific content of the above response result is only for illustration and does not limit the specific content of the response result.

[0028] In particular, the SQL command uploaded by the client can also be independently inferred by a preset Distill BERT model to obtain pseudo-label information; the pseudo-label information is used for pseudo-label processing of the SQL command uploaded by the client, pseudo-labels are added to the SQL command uploaded by the client, and a third SQL command is obtained; confidence information corresponding to the pseudo-label information of the third SQL command is calculated to obtain first confidence information; the first confidence information is modified by introducing a small perturbation term to obtain second confidence information; it is judged whether the second confidence information is less than or equal to a preset confidence threshold; if the second confidence is less than or equal to the preset confidence threshold, the third SQL command is stored in a unified format, and the third SQL command is added to a preset training data set to obtain a first training data set; if the second confidence is greater than the preset confidence threshold, the third SQL command is stored in a unified format, but the third SQL command is not added to the preset training data set. The data in the preset training data set is used for optimizing and training the classifier in the preset independent gate network model.

[0029] In particular, the pseudo-label information corresponding to the third SQL command can be calculated by the following formula to obtain the first confidence information: In the formula, max represents the maximum value operation; when the SQL command uploaded by the client contains multiple instructions, the maximum operation is performed; when the SQL command uploaded by the client contains only one instruction, the maximum operation is not performed. represents the first confidence information. represents the maximum value operation; when the SQL command uploaded by the client contains multiple instructions, the maximum operation is performed; when the SQL command uploaded by the client contains only one instruction, the maximum operation is not performed. represents the normalization operation. represents the third SQL command.

[0030] In a specific embodiment, the SQL command uploaded by the client "SELECT * FROM device_status WHERE device_id = 123;" is classified and inferred by a preset Distill BERT model to obtain pseudo-label information "normal", and "normal" indicates that the SQL command uploaded by the client is a normal SQL command; the pseudo-label information is used for pseudo-label processing of the SQL command uploaded by the client, and the third SQL command obtained is "message": "SELECT * FROM device_status WHERE device_id = 123;","tag^BERT": "normal" The first confidence score corresponding to the pseudo-label information "normal" is calculated to be P max= 0.95; by introducing a small perturbation term ε = 0.01 and a preset confidence threshold γ = 0.5, the first confidence score corresponding to the pseudo-label information "normal" is modified, and the second confidence score P max - ε = 0.95 - 0.01 = 0.94 > 0.5, indicating that the SQL command "SELECT * FROM device_status WHERE device_id = 123;" uploaded by the client is a valid sample, and the third SQL command can be stored in a unified format and added to the preset training data set. The storage format of the third SQL command is as follows: { "message": "SELECT * FROM device_status WHERE device_id = 123;", "tag^BERT": "normal" } In this example, by extracting features from the SQL command uploaded by the client, a first feature information set is obtained, the inference score information of the SQL command uploaded by the client is calculated according to the first feature information in the first feature information set, target score information is obtained, the injection response scheme corresponding to the SQL command uploaded by the client is generated according to the preset score information threshold and the target score information, the target response scheme is obtained, the SQL command uploaded by the client is responded according to the target response scheme, and the response result is obtained, which improves the accuracy when responding to the SQL command uploaded by the client.

[0031] In one possible implementation, a method for extracting features from a SQL command uploaded by a client to obtain a first feature information set includes: A1, standardizing the SQL command uploaded by the client to obtain a first SQL command; A2, vectorizing the first SQL command to obtain a second SQL command; A3, extracting features from the second SQL command to obtain a first feature information set.

[0032] Because different users have different writing habits when writing SQL commands, the generated SQL commands may not be consistent in format, which may further result in unclear structure of the generated SQL commands, and seriously affect the accuracy of subsequent feature extraction of the SQL command uploaded by the client. Therefore, before extracting features from the SQL command uploaded by the client, the SQL command uploaded by the client needs to be standardized, thereby improving the accuracy of feature extraction of the SQL command uploaded by the client.

[0033] Specifically, the first sub-SQL command can be obtained by converting the SQL command uploaded by the client into all lower case format; the second sub-SQL command can be obtained by deleting redundant spaces and comment characters in the first sub-SQL command using a general redundancy removal method; and the first SQL command can be obtained by checking whether special symbols in the second sub-SQL command are used abnormally using a general special symbol checking method and deleting the special symbols used abnormally in the second sub-SQL command.

[0034] In a specific example, a user issues a SQL command "SELECT * FROM device_status WHERE device_id = 123; @@ / / query the device status of the device with device ID 123" through a client, converts "SELECT * FROM device_status WHERE device_id = 123; @@ / / query the device status of the device with device ID 123" into all lower case format, and obtains the first sub-SQL command "select * from device_status where device_id = 123; @@ / / query the device status of the device with device ID 123". The second sub-SQL command "select * from device_status where device_id = 123; @@ " is obtained by deleting redundant spaces and comment characters in the first sub-SQL command. The general special symbol checking method is used to check whether "@" in the second sub-SQL command is used abnormally after ";" in the second sub-SQL command, and therefore, "@" in the second sub-SQL command has no actual meaning. The first SQL command "select * from device_status where device_id = 123;" is obtained by deleting "@" in the second sub-SQL command.

[0035] Since a neural network is usually used to extract features of a SQL command when the SQL command is extracted, the neural network cannot directly process text type data, and therefore, the data format of the first SQL command needs to be converted into a data format that can be directly processed by the neural network before the first SQL command is extracted.

[0036] After the first SQL command is obtained, the first SQL command can be processed by a general vectorization processing method to perform vector encoding processing, convert the data format of the first SQL command from a text format into a numerical format, and obtain a second SQL command.

[0037] After obtaining the second SQL command, the first feature information set can be obtained by extracting the term frequency feature, global rarity feature and local phrase structure feature of the second SQL command.

[0038] In one possible implementation, a method for extracting features of the second SQL command to obtain the first feature information set comprises: B1, extracting the term frequency feature of the second SQL command to obtain a first sub-feature information set; B2, extracting the global rarity feature of the second SQL command to obtain a second sub-feature information set; B3, extracting the local phrase structure feature of the second SQL command to obtain a third sub-feature information set; B4, determining the first sub-feature information in the first sub-feature information set, the second sub-feature information in the second sub-feature information set and the third sub-feature information in the third sub-feature information set as elements in the first feature information set to obtain the first feature information set.

[0039] The first sub-feature information can be obtained by inputting the second SQL command into a preset BoC (Bag of Concepts) model, which can extract the key operators, function names, table names and field names in the second SQL command, and perform structured modeling processing on the extracted key operators, function names, table names and field names, etc.

[0040] The term frequency feature of the second SQL command can be extracted to obtain the first sub-feature information by the following formula: In the formula, tf (w) represents any one of the key operators, function names, table names and field names in the second SQL command; represents the second SQL command; represents TensorFlow processing; represents the first sub-feature information in the first sub-feature information set, which can be understood as the frequency of occurrence in the second SQL command.

[0041] ​​While obtaining the first set of sub-feature information, the second SQL command can be input into a preset TF-IDF (Term Frequency-Inverse Document Frequency) model. The preset TF-IDF model can calculate the rarity of key operators, function names, table names, and field names in the second SQL command within the preset SQL command set, thereby obtaining the second set of sub-feature information. Specifically, the second SQL command can be subjected to global sparse feature extraction using the method shown in the following formula to obtain the second sub-feature information set: In the formula This represents any one of the key operators, function names, table names, and field names in the second SQL command; This indicates the second SQL command; This indicates TensorFlow processing; express The total number of words in the Chinese dictionary; express middle Number of times it appears; Indicates inverse document frequency calculation; This represents a predefined set of SQL commands, which can be understood as a document consisting of all SQL commands. express The total number of SQL commands in the command; express Includes The number of SQL commands corresponding to; This represents the second sub-feature information in the set of second sub-feature information.

[0042] After obtaining the second sub-feature information set, the second SQL command can be processed by n-grams to extract continuous sub-sequences from the second SQL command, thus obtaining the second sub-SQL command set. The second sub-SQL commands in the second sub-SQL command set are then input into a preset TF-IDF model. The preset TF-IDF model can calculate the rarity of each second sub-SQL command in the preset SQL command set based on the preset SQL command set, thus obtaining the third sub-feature information set.

[0043] Specifically, the second SQL command can be subjected to local phrase structure feature extraction using the method shown in the following formula to obtain the third sub-feature information set: the formula denotes a second sub-SQL command in the second sub-SQL command set; denotes a second SQL command; denotes total number of n-grams sequences obtained after n-gram processing of all SQL commands in the formula; denotes the number of times the second sub-SQL command in the second sub-SQL command set appears in the second SQL command; denotes a preset SQL command set, which can be understood as a document composed of all SQL commands; denotes TensorFlow processing; denotes inverse document frequency calculation; denotes total number of SQL commands in the formula; denotes the number of SQL commands in the formula corresponding to; denotes third sub-feature information in the third sub-feature information set.

[0044] After obtaining the first sub-feature information set, the second sub-feature information set, and the third sub-feature information set, the first feature information set can be obtained by determining the first sub-feature information in the first sub-feature information set, the second sub-feature information in the second sub-feature information set, and the third sub-feature information in the third sub-feature information set as elements in the first feature information set.

[0045] In this example, the first sub-feature information set, the second sub-feature information set, and the third sub-feature information set are obtained by respectively extracting the term frequency feature, the global rarity feature, and the local phrase structure feature corresponding to the second SQL command. This realizes sufficient extraction of feature information of the second SQL command from different aspects, improves the accuracy of feature extraction of the second SQL command, and further improves the accuracy of response to the SQL command uploaded by the client.

[0046] In one possible implementation, a method for calculating inference score information of a SQL command uploaded by a client according to first feature information in a first feature information set to obtain target score information, comprising: C1, calculating the adaptability score information corresponding to each classifier in a preset independent gating network according to the first feature information in the first feature information set to obtain a first score information set; C2, selecting K classifiers in the preset independent gating network according to the first score information in the first score information set to obtain an active classifier set; C3, calculate the normalized weight information corresponding to each active classifier in the set of active classifiers, to obtain a first weight information set; C4, calculate the sparse weight vector corresponding to the preset independent gating network according to the first weight information in the first weight information set, to obtain second weight information; C5, calculate the inference score information of the SQL command uploaded by the client according to the second weight information and the first feature information in the first feature information set, to obtain target score information.

[0047] Since the parameters of each classifier in the preset independent gating network are different, the data feature preferences corresponding to each classifier are different. Therefore, before inferring the SQL command uploaded by the client, the classifier with the highest adaptability score needs to be selected as a classifier expert in the independent gating network, and the corresponding first feature information is inferred using the classifier expert, so as to improve the accuracy when inferring the SQL command uploaded by the client.

[0048] Please refer to Figure 3 , Figure 3 The embodiment of the present application provides a structure diagram of the preset independent gating network. As shown in Figure 3 , the preset independent gating network can input the first feature information in the first feature information set into a full connection layer for linear transformation processing, to obtain a second feature information set; the second feature information in the second feature information set is activated using a ReLu activation function for activation processing, to introduce non-linear features for the second feature information in the second feature information set to obtain a first score information set, and K classifiers are selected as TOP K experts, i.e. active classifiers, in the preset independent gating network according to the first score information in the first score information set, to obtain a set of active classifiers; the inference score information of the SQL command uploaded by the client is calculated for the first feature information in the first feature information set by calculating the weight information corresponding to each active classifier in the set of active classifiers, to obtain target score information.

[0049] Specifically, the first feature information in the first feature information set can be input into the full connection layer in the preset independent gating network for linear transformation processing, to obtain a second feature information set; the second feature information in the second feature information set is activated using a ReLu activation function for activation processing, to calculate the adaptability score information corresponding to each classifier in the preset independent gating network when the first feature information set is linearly transformed, to obtain a first score information set.

[0050] The first score information in the first score information set can be understood as the adaptability score information corresponding to the linear transformation of the jth classifier in the preset independent gating network on the ith first feature information in the first feature information set. In the formula, Wj represents the linear transformation weight matrix corresponding to the linear transformation of the classifier on the first feature information in the first feature information set, and The first score information in the first score information set can be understood as the adaptability score information corresponding to the linear transformation of the jth classifier in the preset independent gating network on the ith first feature information in the first feature information set. The activation function is used for activation processing. The activation function is used for activation processing. In the formula, Wj represents the linear transformation weight matrix corresponding to the linear transformation of the classifier on the first feature information in the first feature information set, and B represents the vector dimension corresponding to the first feature information in the first feature information set, and C represents the output dimension corresponding to the first score information, which can be determined by user input or system default. The first score information in the first score information set can be understood as the adaptability score information corresponding to the linear transformation of the jth classifier in the preset independent gating network on the ith first feature information in the first feature information set. The first score information in the first score information set can be understood as the adaptability score information corresponding to the linear transformation of the jth classifier in the preset independent gating network on the ith first feature information in the first feature information set.

[0051] After obtaining the first score information set, K first score information with the largest value can be selected from the first score information set to obtain a target score information set. The classifier corresponding to each target score information in the target score information set is determined as an active classifier to obtain an active classifier set. The active classifier set can be represented as K represents the number of active classifiers in the active classifier set, which can be determined by user input or system default.

[0052] After obtaining the active classifier set, the Softmax normalization processing can be performed on each target score information in the target score information set to calculate the normalization weight information corresponding to each active classifier in the active classifier set, and the first normalization weight information is obtained.

[0053] The first weight information set can be obtained by calculating the normalization weight information corresponding to each active classifier in the active classifier set by the method shown in the following formula: In the formula, Wj represents the linear transformation weight matrix corresponding to the linear transformation of the classifier on the first feature information in the first feature information set, and The first weight information in the first weight information set can be understood as the first weight information corresponding to the ith active classifier in the active classifier set. denotes target score information corresponding to the i th active classifier in the active classifier set; denotes an exponential function, wherein e denotes a natural constant.

[0054] After obtaining the first weight information set, the classifier sequence can be obtained by processing the classifier numbers in the preset independent gating network and performing sorting processing according to the numerical values of the classifier numbers corresponding to the classifiers. It is judged in turn whether the classifiers in the classifier sequence belong to the active classifiers in the active classifier set, and the normalized weight information corresponding to each classifier in the preset independent gating network is generated according to the judgment result to obtain the second sub-weight information set. The dilution weight vector corresponding to the preset independent gating network is constructed using a general vector construction method according to the second sub-weight information in the second sub-weight information set, and the second weight information is obtained.

[0055] Specifically, the sparse weight vector corresponding to the preset independent gating network can be calculated according to the first weight information in the first weight information set by the method shown in the following formula to obtain the second weight information: In the formula, w i denotes the i th element in the second weight information, which can be understood as the weight information corresponding to the i th classifier in the preset independent gating network. If the i th classifier in the classifier sequence is an active classifier, the first weight information corresponding to the classifier in the first weight information set is determined as the i th element in the second weight information. If the i th classifier in the classifier sequence does not belong to the active classifier, the i th element in the second weight information is determined as 0.

[0056] After obtaining the second weight information, the inference score of the SQL command uploaded by the client can be calculated by weighted summation of the second weight information and the first score information in the first score information set, so as to obtain the target score information.

[0057] Specifically, the inference score information of the SQL command uploaded by the client can be calculated according to the second weight information and the first feature information in the first feature information set by the method shown in the following formula to obtain the target score information: In the formula, s denotes the target score information. w i denotes the i th element in the second weight information. ​​represents the first score information corresponding to the i-th classifier in the first score information set; K represents the number of active classifiers in the active classifier set.

[0058] In one specific embodiment, the preset independent gating network includes 15 classifiers, the first feature information in the first feature information set is input into the preset independent gating network, the adaptability score information corresponding to each classifier in the preset independent gating network is calculated, and the obtained first score information set is “0.1, 0.3, 0.15, 0.3, 0.1, 0.1, 0.5, 0.2, 0.35, 0.15, 0.2, 0.15, 0.2, 0.05, 0.1”; the five highest first score information in the first score information set is selected, the obtained target score information set is “0.3, 0.3, 0.5, 0.2, 0.35”, the classifier corresponding to each target score information in the target score information set is obtained, and the obtained active classifier set is “SVM_1, NB_4, SVM_3, XGB_2, NB_2”; the normalization weight corresponding to each active classifier in the active classifier set is calculated, and the obtained first weight information set is “0.25, 0.2, 0.2, 0.15, 0.2”; the 15 classifiers in the preset independent gating network are numbered, it is found that the number corresponding to SVM_1 in the active classifier set is 2, the number corresponding to NB_4 is 4, the number corresponding to SVM_3 is 7, the number corresponding to XGB_2 is 8, and the number corresponding to NB_2 is 9, then the obtained second weight information “[0, 0.25, 0, 0.2, 0, 0, 0.2, 0.15, 0.2, 0, 0, 0, 0, 0, 0]” is obtained; then the target score information is Output(x) = (0.1*0) + (0.3*0.25) + (0.15*0) + (0.3*0.2) + (0.1*0) + (0.1*0) + (0.5*0.2) + (0.2*0.15) + (0.35*0.2) + (0.15*0) + (0.2*0) + (0.15*0) + (0.2*0) + (0.05*0) + (0.1*0) = 0.335.

[0059] In the example, by selecting a classifier in the preset independent gating network model that is adapted to the first feature information in the first feature information set, a set of active classifiers is obtained; by generating a sparse weight vector corresponding to the preset independent gating network model according to the normalized weight information corresponding to each active classifier in the set of active classifiers, second weight information is obtained; and by using the preset independent gating network according to the second weight information to infer the first feature information in the first feature information set, inference processing of the SQL command uploaded by the client is realized, a target score is obtained, thereby improving the accuracy of the target score, and further improving the accuracy when responding to the SQL injection uploaded by the client.

[0060] In one possible implementation, a method for generating an injection response scheme corresponding to the SQL command uploaded by the client according to preset score information threshold and target score information, obtaining a target response scheme, includes: D1, determining whether the target score information is less than the preset score information threshold, obtaining a determination result; D2, generating an injection response scheme corresponding to the SQL command uploaded by the client according to the determination result, obtaining a target response scheme.

[0061] Specifically, the determination result can be obtained by determining whether the numerical value of the target score information is less than the numerical value corresponding to the preset score information threshold. The determination result can be, for example, "the target score information is less than the preset score information threshold" or "the target score information is greater than or equal to the preset score information threshold". The specific content of the above determination result is only used for illustration and does not limit the content of the determination result.

[0062] After obtaining the judgment result, if the judgment result indicates that the target score information is less than the preset score information threshold, it is indicated that the SQL command uploaded by the client is a normal SQL command, and a preset release process is determined as an injection response scheme corresponding to the SQL command uploaded by the client, to obtain a target response scheme; wherein the preset release process can be injecting the SQL command uploaded by the client into the database, and executing the SQL command uploaded by the client in the database. If the judgment result indicates that the target score information is greater than or equal to the preset score information threshold, it is indicated that the SQL command uploaded by the client is an abnormal SQL command, and a preset interception process is determined as an injection response scheme corresponding to the SQL command uploaded by the client, to obtain a target response scheme; wherein the preset interception process can be blocking the data transmission path of uploading the SQL command uploaded by the client to the database, so that the SQL command uploaded by the client cannot be transmitted to the database, and collecting metadata corresponding to the SQL command uploaded by the client to obtain first metadata; standardizing and packaging the target metadata to obtain second metadata; performing hash encryption processing on the second metadata by using a preset hash encryption protection command to obtain third metadata; adding a digital signature and a timestamp to the third metadata by using a general digital signature method to obtain fourth metadata; and writing the fourth metadata into a block chain network by using a block chain node broadcast and consensus mechanism.

[0063] In one specific embodiment, if the preset score information threshold is 0.5, the target score information is 0.335 according to steps C1-C5, and 0.335 is less than 0.5, therefore, the judgment result is "the target score information is less than the preset score information threshold", it is indicated that the SQL command uploaded by the client is a normal SQL command, and the preset release process is determined as an injection response scheme corresponding to the SQL command uploaded by the client, to obtain a target response scheme; if the preset score information threshold is 0.3, the target score information is 0.335 according to steps C1-C5, and 0.335 is greater than 0.3, therefore, the judgment result is "the target score information is greater than or equal to the preset score information threshold", it is indicated that the SQL command uploaded by the client is an abnormal SQL command, and the preset interception process is determined as an injection response scheme corresponding to the SQL command uploaded by the client, to obtain a target response scheme.

[0064] In this example, the size relationship between the target score information and the preset score information threshold is determined to determine the processing flow of the SQL command uploaded by the client, to obtain a target response scheme, thereby improving the accuracy of the target response scheme, and further improving the accuracy when responding to the SQL command uploaded by the client.

Claims

1. A method for responding to SQL injection attacks targeting sensitive industrial data, characterized in that, The method includes: Feature extraction is performed on the SQL commands uploaded by the client to obtain the first set of feature information; The inference score information of the SQL command uploaded by the client is calculated based on the first feature information in the first feature information set to obtain the target score information; Based on the preset scoring information threshold and the target scoring information, an injection response scheme corresponding to the SQL command uploaded by the client is generated, and the target response scheme is obtained; The system responds to the SQL commands uploaded by the client according to the target response scheme, and obtains the response result.

2. The SQL injection response method for sensitive industrial data according to claim 1, characterized in that, The first feature information set is obtained by extracting features from the SQL commands uploaded by the client, including: The SQL commands uploaded by the client are standardized to obtain the first SQL command; The first SQL command is vectorized to obtain the second SQL command; Feature extraction is performed on the second SQL command to obtain the first feature information set.

3. The SQL injection response method for sensitive industrial data according to claim 2, characterized in that, The step of extracting features from the second SQL command to obtain a first set of feature information includes: The term frequency features of the second SQL command are extracted to obtain the first sub-feature information set; Global sparse feature extraction is performed on the second SQL command to obtain the second sub-feature information set; Local phrase structure features are extracted from the second SQL command to obtain a third set of sub-feature information; The first sub-feature information in the first sub-feature information set, the second sub-feature information in the second sub-feature information set, and the third sub-feature information in the third sub-feature information set are determined as elements in the first feature information set, thus obtaining the first feature information set.

4. The SQL injection response method for sensitive industrial data according to claim 3, characterized in that, The step of calculating the inference score information of the SQL command uploaded by the client based on the first feature information in the first feature information set to obtain the target score information includes: Based on the first feature information in the first feature information set, calculate the adaptability score information corresponding to each classifier in the preset independent gating network to obtain the first score information set; Based on the first score information in the first score information set, select K classifiers in the preset independent gating network to obtain the active classifier set; Calculate the normalized weight information corresponding to each active classifier in the set of active classifiers to obtain the first weight information set; The second weight information is obtained by calculating the sparse weight vector corresponding to the preset independent gated network based on the first weight information in the first weight information set. The inference score information of the SQL command uploaded by the client is calculated based on the second weight information and the first feature information in the first feature information set to obtain the target score information.

5. The SQL injection response method for sensitive industrial data according to claim 4, characterized in that, The step of generating an injection response scheme corresponding to the SQL command uploaded by the client based on a preset scoring information threshold and target scoring information, and obtaining the target response scheme, includes: Determine whether the target score information is less than a preset score information threshold to obtain the determination result; Based on the judgment result, an injection response scheme corresponding to the SQL command uploaded by the client is generated, and the target response scheme is obtained.

Images