A sql injection sentence transformation method based on context-free grammar

Abstract

The application discloses a SQL injection sentence transformation method based on context-free grammar. When network security attack and defense research is carried out, a large number of semantic equivalent transformations of SQL injection sentences need to be generated. The application is based on an improved context-free grammar and combined with a semantic matching method, can generate theoretically infinite equivalent replacements according to a single SQL injection sentence, and the semantic equivalence is that the functionality and maliciousness of the SQL injection sentence are retained. The application uses a semantic-based mode to match the generated entry, processes the SQL injection sentence in a more fine-grained manner, and avoids the damage of a regular matching method to the functionality of the SQL injection sentence.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a SQL injection statement transformation method based on context-free grammar. BACKGROUND

[0002] With the continuous evolution and global deployment of the Internet, network services play an increasingly important role in social infrastructure in daily life. On the other hand, they are also facing global threats from different places, different scales and through different ways. Common web threats include SQL injection, cross-site scripting, cross-site request forgery, distributed denial of service, etc. SQL (Structured Query Language) injection is one of the most common and most threatening attack methods. Attackers exploit security vulnerabilities by querying databases through SQL, thereby directly accessing unauthorized information, creating or modifying new user permissions or manipulating sensitive information in other ways.

[0003] SQL injection statements, as the most core content in exploiting SQL injection vulnerabilities, play a role in triggering vulnerabilities, stealing data, tampering with content, etc. From the perspective of security research, whether attacking or defending against SQL injection, equivalent transformation of its injection statements is indispensable. Traditional methods mainly focus on regular matching-based replacement, which cannot guarantee functionality and maliciousness, i.e., the modified SQL injection may not trigger normally. Performing semantic-based equivalent replacement can promote attack and defense research, such as optimization of SQL injection interception by firewalls, etc. SUMMARY

[0004] The application aims to overcome the deficiencies of the prior art and provides a SQL injection statement transformation method based on context-free grammar.

[0005] The application aims to overcome the deficiencies of the prior art and provides a SQL injection statement transformation method based on context-free grammar.

[0006] (1) Construct a context-free grammar rule set G, including four parts: a non-terminal symbol set V, a terminal symbol set Σ, a start variable set S, and a production set R, i.e., G=(V,Σ,S,R).

[0007] (1.1) Construct the non-terminal symbol set V to expand the generation range of the SQL injection statement, representing the intermediate state, i.e., the potential generation target.

[0008] (1.2) Construct the terminal symbol set Σ to refer to the actual content of the generated, such as generating Boolean expressions, equations, inequalities, etc.

[0009] (1.3) Construct the start variable set S, that is, the entry of the program when the SQL injection statement transformation is performed, such as type of equation, number, letter, etc.

[0010] (1.4) Construct the production set R, R is the relation from V to (V∩Σ) * , * indicates repeating once or more times, and is used for iteratively processing S to generate the final SQL injection statement.

[0011] (2) The SQL injection statement is segmented according to common punctuation marks (such as comma, semicolon, space, etc.), and the segmented contents are inserted into the set D, D={d i |i=1,2,…,N}.

[0012] (3) Each element d i in D is matched with the contents of the variable set S in the context-free grammar rule set G according to semantics (such as equation, number, letter, etc.), and the t item replacement content is generated and inserted into the set M i , that is, |M i =G(d i )|=t, and M={M i |i=1,2,…,N}.

[0013] (4) Each random replacement content in each subset M i in M is taken, and is recombined in the order of i from small to large to obtain the final SQL injection statement transformation result.

[0014] Compared with the prior art, the present application has the following beneficial effects:

[0015] (1) The present application is based on an improved context-free grammar, which can generate theoretically infinite replacements according to a single SQL injection statement, and the semantics are equivalent, that is, the functionality and maliciousness are preserved;

[0016] (2) The present application uses a semantic-based method to match the entry of replacement generation, which processes the SQL injection statement in a more fine-grained manner while avoiding the destruction of its functionality by the regular matching method. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is the flowchart of the SQL injection statement transformation method of the present application. DETAILED DESCRIPTION

[0018] As Figure 1As shown, the application is a SQL injection sentence transformation method based on context-free grammar. By defining the start variable set, the terminal symbol set, the non-terminal symbol set, the production, etc., the context-free grammar is constructed, and then a large number of equivalent transformations are generated for the SQL injection sentence by the context-free grammar, so that the transformation result of the SQL injection sentence is more real, that is, the functionality and maliciousness are retained. Specifically, the following steps are included:

[0019] (1) Construct the context-free grammar rule set G, including the non-terminal symbol set V, the terminal symbol set Σ, the start variable set S, and the production set R, that is, G=(V,Σ,S,R).

[0020] (1.1) Construct the non-terminal symbol set V, which is used to expand the generation range of the SQL injection sentence and represents the intermediate state, that is, the potential generation target.

[0021] (1.2) Construct the terminal symbol set Σ, which refers to the actual content of the generated, such as generating Boolean expressions, equations, inequalities, etc.

[0022] (1.3) Construct the start variable set S, that is, the entry of the program when the SQL injection sentence is transformed, such as type equation, number, letter, etc.

[0023] (1.4) Construct the production set R, R is the relationship from V to (V∩Σ) * , * represents repeating once or more, which is used to iteratively process S to generate the final SQL injection sentence.

[0024] (2) Divide the SQL injection sentence according to common punctuation marks (such as comma, semicolon, space, etc.), and insert the divided content into set D, D={d i |i=1,2,…,N}.

[0025] (3) Match the content of the variable set S in the context-free grammar rule set G according to the semantics (such as equation, number, letter, etc.) for each element d i in D, and generate t items of replacement content inserted into the sub-set M i , that is, M i =G(d i ), and |M i |=|G(d i )|=t, and the set M={M i |i=1,2,…,N}.

[0026] (4) Randomly replace the content in each sub-set M i from the set M, and recombine according to the order of i from small to large to obtain the final SQL injection sentence transformation result.

Claims

1. A method for SQL injection statement transformation based on context-free grammar, characterized in that, The method comprises the following steps: (1) constructing a context-free grammar rule set G, comprising four parts of a non-terminal symbol set V, a terminal symbol set ∑, a start variable set S, and a production set R, i.e. G=(V,∑,S,R); (2) The SQL injection statement is divided according to punctuation marks, and the divided contents are inserted into the set D, D={d i i=1, 2,..., N}. (3) For each element d in D i , match the contents of the variable set S in the semantic context-free grammar rule set G, and generate t items to replace the contents inserted into the set M i , that is, |M i = G(d i )| = t, and M = {M i |i = 1, 2,..., N}; (4) From each subset M i of M, randomly replace one item in each M with another, recombine in order of increasing i, and obtain the final SQL injection statement transformation result.

2. The method of claim 1, wherein the context-free grammar based SQL injection statement transformation method is characterized by, Step (1) comprises: (1.1) constructing the non-terminal symbol set V, used to expand the generation range of the SQL injection statement, representing an intermediate state, i.e. a potential generation target; (1.2) constructing the terminal symbol set ∑, referring to the actual content of the generation, such as generating a Boolean expression, an equation, an inequality, etc.; (1.3) constructing the start variable set S, i.e. the entry of the program when the SQL injection statement is transformed, such as types of equation, number, letter, etc. (1.4) Construct a set of productions R, R is a relation from V to (V∩∑) * , * denotes zero or more repetitions, for iterating over S to generate the final SQL injection statement.

3. The method of claim 1, wherein the context-free grammar based SQL injection statement transformation method is characterized by, In step (2), the punctuation marks include comma, semicolon, space, etc.

4. The method of claim 1, wherein the context-free grammar based SQL injection statement transformation method is characterized by, In step (3), the semantics include equation, number, letter, etc.

Images