SQL attack defense method, device, equipment and readable storage medium

Abstract

The present application relates to the field of software security, and more particularly to a SQL attack defense method, device, equipment and readable storage medium, the method comprises obtaining the query statement of database and the first database information table that the query statement cannot access;The query statement of the database is analyzed, and the second database information table accessed by the query statement is obtained;According to the first database information table and the second data information table, a honeypot database is established, and the abnormal query statement information of the honeypot database is obtained;According to the abnormal query statement information of the honeypot database, the abnormal IP is alarmed and banned, and the result information of the alarm and ban of the abnormal IP is obtained.The present application improves the situation that too many false reports and normal business access are affected in the actual use of the prior art, and the present application obtains the query statement sent to the database from the application itself, thereby avoiding the coding bypass at the application level.

Description

Technical Field

[0001] This invention relates to the field of software security, and more specifically, to a method, apparatus, device, and readable storage medium for defending against SQL attacks. Background Technology

[0002] Existing technologies are largely based on known SQL injection attack characteristics. These characteristics are matched using regular expressions and other techniques, inevitably leading to false positives where legitimate requests are mistaken for malicious activity. Furthermore, attackers can bypass these detection methods through specific encoding methods or characteristics of the SQL statements themselves, thus escaping detection. Additionally, these attack characteristics need constant updating as attack methods evolve to avoid failing to detect new attacks. Current technologies often only fix vulnerabilities after an attack has occurred, which is often ineffective in preventing data loss. Moreover, existing technologies typically rely on existing bug detection methods and are completely incapable of identifying novel bugs. Summary of the Invention

[0003] The purpose of this invention is to provide a method, apparatus, device, and readable storage medium for defending against SQL attacks, thereby improving the aforementioned problems. To achieve the above objective, the technical solution adopted by this invention is as follows:

[0004] On one hand, this application provides a method for defending against SQL attacks. The method includes: obtaining first information, wherein the first information is a database query statement and a first database information table that the query statement cannot access; inputting the first information into a first model for analysis to obtain second information, wherein the first model is a model for querying and analyzing the database query statement of the first information, and the second information is a second database information table accessed by the query statement; sending the second information to a second model for processing to obtain third information, wherein the second model is a model for establishing a honeypot database based on the first database information table and the second database information table, and the third information is information on abnormal query statements that accessed the honeypot database; sending the third information to a third model for processing to obtain fourth information, wherein the third model is a model for alerting and blocking abnormal IPs, and the fourth information is information on the results of alerting and blocking the abnormal IPs.

[0005] Optionally, the step of inputting the first information into the first model for analysis to obtain the second information includes:

[0006] The query statements in the first information are processed centrally to obtain the first sub-information. The first sub-information includes the query time information of the query statement, the query user information of the query statement, the query source information of the query statement, the query second database information of the query statement, and the specific statement information of the query statement. The first sub-information is classified and summarized to obtain the query statement classification information table.

[0007] The interface of the query statement classification information table is queried to obtain the interface information accessed by the query statement classification information table;

[0008] The information of the second database connected to the interface in the interface information is called, and the information of the second database is statistically processed to obtain the second database information table.

[0009] Optionally, sending the second information to the second model for processing to obtain the third information includes:

[0010] The first database information table, which cannot be accessed by the normal statement, is called. The first database information table is compared with the second database information table to obtain a third database information table. The third database information table is a set of information that is the same as the first database information table and the second database information table.

[0011] Establish a honeypot database identical to the one in the third database information table, obtain query statement information that accesses the honeypot database, perform anomaly judgment on the query statement information that accesses the honeypot database, and obtain abnormal query statement information that accesses the honeypot database.

[0012] Optionally, sending the third information to the third model for processing to obtain the fourth information includes:

[0013] Obtain the source IP address information of the query statement that accesses the honeypot database;

[0014] The query statement information that accesses the honeypot database and the source IP address information are marked, and the marked query statement information is sent to the operation and maintenance personnel, indicating that the query statement is an attack statement;

[0015] Call the firewall's API to block all access from the stated source IP address.

[0016] Secondly, embodiments of this application provide a defense device against SQL attacks, the device comprising:

[0017] The first acquisition unit is used to acquire first information, wherein the first information is a database query statement and a first database information table that cannot be accessed by the query statement;

[0018] The first processing unit is used to input the first information into a first model for analysis to obtain second information. The first model is a model that queries and analyzes a database query statement for the first information. The second information is a second database information table accessed by the query statement.

[0019] The second processing unit is used to send the second information to the second model for processing to obtain the third information. The second model is a model for building a honeypot database based on the first database information table and the second data information table. The third information is abnormal query statement information that accessed the honeypot database.

[0020] The third processing unit is used to send the third information to the third model for processing to obtain the fourth information. The third model is a model for alarming and blocking abnormal IPs, and the fourth information is the result information of alarming and blocking the abnormal IPs.

[0021] Optionally, the device includes:

[0022] The first processing subunit is used to centrally process the query statements in the first information to obtain the first sub-information. The first sub-information includes the query time information of the query statement, the query user information of the query statement, the query source information of the query statement, the query second database information of the query statement, and the specific statement information of the query statement. The first sub-information is classified and summarized to obtain a query statement classification information table.

[0023] The second processing subunit is used to perform query processing on the interface of the query statement classification information table to obtain the interface information accessed by the query statement classification information table.

[0024] The third processing subunit is used to call the information of the second database connected to the interface in the interface information, and perform statistical processing on the information of the second database to obtain the second database information table.

[0025] Optionally, the device includes:

[0026] The fourth processing subunit is used to call the first database information table that cannot be accessed by the normal statement, compare the first database information table with the second database information table, and obtain a third database information table. The third database information is a set of information that is the same as the first database information and the second database information.

[0027] The fifth processing subunit is used to establish the same honeypot database as the third database information table, obtain query statement information that accesses the honeypot database, perform anomaly judgment on the query statement information that accesses the honeypot database, and obtain abnormal query statement information that accesses the honeypot database.

[0028] Optionally, the device includes:

[0029] The first acquisition subunit is used to acquire the source IP address information of the query statement information accessing the honeypot database;

[0030] The sixth processing subunit is used to mark the query statement information and the source IP address information that access the honeypot database, and send the marked query statement information to the operation and maintenance personnel to indicate that the query statement is an attack statement;

[0031] The seventh processing subunit is used to call the firewall's API interface to block all access from the source IP address.

[0032] Thirdly, embodiments of this application provide a defense device against SQL attacks, the device comprising a memory and a processor. The memory stores a computer program; the processor executes the computer program to implement the steps of the SQL attack defense method described above.

[0033] Fourthly, embodiments of this application provide a readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described SQL attack defense method.

[0034] The beneficial effects of this invention are as follows:

[0035] 1. This invention improves upon the existing technology in actual use due to too many false alarms and the impact on normal business access. This invention does not directly obtain the request sent to the database from the HTTP request, but directly obtains the query statement sent to the database by the application itself, thereby avoiding application-level code bypass.

[0036] 2. This invention starts directly from the results of the access to determine whether the query statement is an abnormal query. If it is an abnormal query, it is processed directly to prevent it from causing losses.

[0037] 3. This invention also includes a honeypot database to prevent the loss of confidential data. It can also set traps to lure attackers and block attackers' IP addresses while minimizing losses.

[0038] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing embodiments of the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0039] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of a method for defending against SQL attacks as described in an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of the structure of a defense device against SQL attacks as described in an embodiment of the present invention;

[0042] Figure 3 This is a schematic diagram of the structure of a defense device against SQL attacks as described in an embodiment of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0044] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0045] Example 1

[0046] like Figure 1As shown, this embodiment provides a method for defending against SQL attacks, which includes steps S1, S2, S3 and S4.

[0047] Step S1: Obtain first information, which is a database query statement and a first database information table that the query statement cannot access;

[0048] Step S2: Input the first information into the first model for analysis to obtain the second information. The first model is a model that queries and analyzes the database of the first information. The second information is the second database information table accessed by the query statement.

[0049] Step S3: Send the second information to the second model for processing to obtain the third information. The second model is a model for building a honeypot database based on the first database information table and the second data information table. The third information is information on abnormal query statements that accessed the honeypot database.

[0050] Step S4: Send the third information to the third model for processing to obtain the fourth information. The third model is a model for alerting and blocking abnormal IPs, and the fourth information is the result information of the alerting and blocking of the abnormal IPs.

[0051] It is understood that this invention improves upon the existing technology in actual use due to too many false alarms and the impact on normal business access. This invention does not directly obtain the request sent to the database from the HTTP request, but directly obtains the query statement sent to the database by the application itself, thereby avoiding application-level code bypass.

[0052] It is understood that the present invention starts directly from the results of its access to determine whether the query statement is an abnormal query. If it is an abnormal query, it is processed directly to prevent it from causing losses.

[0053] It is understood that this invention also prevents the loss of confidential data by setting up a honeypot database, and can also set traps to lure attackers, and can block attackers' IPs in order to minimize losses.

[0054] In one specific embodiment of this disclosure, step S2 includes steps S21, S22 and S23.

[0055] Step S21: The query statements in the first information are processed centrally to obtain the first sub-information. The first sub-information includes the query time information of the query statement, the query user information of the query statement, the query source information of the query statement, the query second database information of the query statement, and the specific statement information of the query statement. The first sub-information is classified and summarized to obtain the query statement classification information table.

[0056] Step S22: Perform query processing on the interface of the query statement classification information table to obtain the interface information accessed by the query statement classification information table;

[0057] Step S23: Call the information of the second database connected to the interface in the interface information, and perform statistical processing on the information of the second database to obtain the second database information table.

[0058] It is understood that this invention categorizes and summarizes the first sub-information to obtain multiple different types of query statements. Then, it analyzes the query interface to obtain information about the databases connected to different interfaces. Finally, it creates tables by statistically analyzing the different database information. This facilitates the query statements in querying the databases and also facilitates the detection of the query statements to check whether they have performed any operations other than the normal execution of the statement, thus preventing the query statements from stealing information.

[0059] In one specific embodiment of this disclosure, step S3 includes steps S31 and S32.

[0060] Step S31: Call the first database information table that cannot be accessed by the normal statement, compare the first database information table with the second database information table to obtain the third database information table, wherein the third database information is the same set of information as the first database information and the second database information;

[0061] Step S32: Establish a honeypot database identical to the one in the third database information table, obtain query statement information that accesses the honeypot database, perform anomaly judgment on the query statement information that accesses the honeypot database, and obtain abnormal query statement information that accesses the honeypot database.

[0062] It is understood that the present invention obtains information about databases that should not be accessed by comparing the first database table and the second database table, thereby identifying which statements accessed databases that should not be accessed, and then marking these statements as abnormal statements.

[0063] It is understood that this invention establishes a honeypot database for abnormal query statements to be queried, preventing such queries from damaging files, and uses the honeypot database to detect and detect deceptive queries, thereby blocking the IP addresses associated with such queries.

[0064] In one specific embodiment of this disclosure, step S4 includes steps S41, S42 and S43.

[0065] Step S41: Obtain the source IP address information of the query statement information that accesses the honeypot database;

[0066] Step S42: Mark the query statement information and the source IP address information that access the honeypot database, and send the marked query statement information to the operation and maintenance personnel, indicating that the query statement is an attack statement;

[0067] Step S43: Call the firewall's API interface to block all access from the source IP address.

[0068] It is understandable that the above steps involve obtaining the source IP address information of the query statement, and then marking and blocking the source IP address of the query statement information to achieve the effect of defending against SQL statement attacks, thereby preventing the SQL statement from obtaining database information.

[0069] In one specific embodiment of this disclosure, step S4 is followed by steps S5, S6 and S7.

[0070] Step S5: Obtain the first threshold, which is the threshold for the number of times the source IP address has been blocked;

[0071] Step S6: Compare the number of times the source IP address has been blocked with the first threshold. If the number of times the source IP address has been blocked is greater than 0 and less than the first threshold, then add the source IP address to the access red list. All query statements entered by the source IP address in the access red list need to be judged first to determine whether the access is abnormal.

[0072] Step S7: If the number of times the IP address is blocked is greater than the first threshold, the source IP address is added to the access blacklist, and any query statements entered by the source IP address in the access blacklist are not allowed to access.

[0073] It is understandable that the above steps are to establish a blacklist, prioritize the handling of IP addresses that have been attacked, block any abnormal statements they contain, and reduce the possibility of being attacked.

[0074] It is understandable that the red list in the above steps is to prevent IP address blocking due to misjudgment, thereby permanently preventing access, reducing the workload of manual maintenance, and reducing the waste of human and material resources.

[0075] In one specific embodiment of this disclosure, step S4 is followed by steps S8, S9 and S10.

[0076] Step S8: Obtain the attribute information of the abnormal query statement, including SQL keyword information, IP address information, URL information and operation command information;

[0077] Step S9: Analyze and process the attribute information to obtain the access action information of the abnormal query statement, wherein the access action information is the access path of the abnormal query statement;

[0078] Step S10: Sort and number the access paths of the abnormal query statements, and send the sorted access paths of the abnormal query statements to the communication device of the operation and maintenance personnel, and prompt the operation and maintenance personnel to investigate the access paths.

[0079] It is understandable that the above steps sort and number the access paths of the abnormal query statements, and then allow maintenance personnel to investigate all information of the abnormal statements. This not only prevents other attacks, but also provides some understanding of the purpose and source of the attacks, enabling them to prepare for defense.

[0080] Example 2

[0081] like Figure 2 As shown, this embodiment provides a defense device against SQL attacks, which includes a first acquisition unit 701, a first processing unit 702, a second processing unit 703, and a third processing unit 704.

[0082] The first acquisition unit 701 is used to acquire first information, wherein the first information is a query statement of the database and a first database information table that cannot be accessed by the query statement;

[0083] The first processing unit 702 is used to input the first information into a first model for analysis to obtain second information. The first model is a model that queries and analyzes a database query statement for the first information. The second information is a second database information table accessed by the query statement.

[0084] The second processing unit 703 is used to send the second information to the second model for processing to obtain the third information. The second model is a model for building a honeypot database based on the first database information table and the second data information table. The third information is abnormal query statement information that accessed the honeypot database.

[0085] The third processing unit 704 is used to send the third information to the third model for processing to obtain the fourth information. The third model is a model for alarming and blocking abnormal IPs, and the fourth information is the result information of alarming and blocking the abnormal IPs.

[0086] In one specific embodiment of this disclosure, the first processing unit 702 includes a first processing subunit 7021, a second processing subunit 7022, and a third processing subunit 7023.

[0087] The first processing subunit 7021 is used to centrally process the query statements in the first information to obtain the first sub-information. The first sub-information includes the query time information of the query statement, the query user information of the query statement, the query source information of the query statement, the query second database information of the query statement, and the specific statement information of the query statement. The first sub-information is classified and summarized to obtain a query statement classification information table.

[0088] The second processing subunit 7022 is used to perform query processing on the interface of the query statement classification information table to obtain the interface information accessed by the query statement classification information table.

[0089] The third processing subunit 7023 is used to call the information of the second database connected to the interface in the interface information, and perform statistical processing on the information of the second database to obtain the second database information table.

[0090] In one specific embodiment of this disclosure, the second processing unit 703 includes a fourth processing subunit 7031 and a fifth processing subunit 7032.

[0091] The fourth processing subunit 7031 is used to call the first database information table that cannot be accessed by the normal statement, compare the first database information table with the second database information table, and obtain a third database information table. The third database information is a set of information that is the same as the first database information and the second database information.

[0092] The fifth processing subunit 7032 is used to establish the same honeypot database as the third database information table, obtain query statement information that accesses the honeypot database, perform anomaly judgment on the query statement information that accesses the honeypot database, and obtain abnormal query statement information that accesses the honeypot database.

[0093] In one specific embodiment of this disclosure, the third processing unit 704 includes a first acquisition subunit 7041, a sixth processing subunit 7042, and a seventh processing subunit 7043.

[0094] The first acquisition subunit 7041 is used to acquire the source IP address information of the query statement information for accessing the honeypot database;

[0095] The sixth processing subunit 7042 is used to mark the query statement information and the source IP address information that access the honeypot database, and send the marked query statement information to the operation and maintenance personnel to indicate that the query statement is an attack statement;

[0096] The seventh processing subunit 7043 is used to call the firewall's API interface to block all access from the source IP address.

[0097] In one specific embodiment of this disclosure, the third processing unit 704 is followed by a second acquisition unit 705, a first judgment unit 706, and a second judgment unit 707.

[0098] The second acquisition unit 705 is used to acquire a first threshold, wherein the first threshold is a threshold for the number of times the source IP address is blocked.

[0099] The first judgment unit 706 is used to compare the number of times the source IP address has been blocked with the first threshold. If the number of times the source IP address has been blocked is greater than 0 and less than the first threshold, the source IP address is added to the access red list. All query statements entered by the source IP address in the access red list need to be judged first to determine whether the access is abnormal.

[0100] The second judgment unit 707 is used to add the source IP address to the access blacklist if the number of times the IP address is blocked is greater than a first threshold, and query statements entered by the source IP address in the access blacklist are not allowed to access.

[0101] In one specific embodiment of this disclosure, the third processing unit 704 is followed by a third acquisition unit 708, a fourth processing unit 709, and a fifth processing unit 710.

[0102] The third acquisition unit 708 is used to acquire the attribute information of the abnormal query statement, the attribute information including SQL keyword information, IP address information, URL information and operation command information;

[0103] The fourth processing unit 709 is used to analyze and process the attribute information to obtain the access action information of the abnormal query statement, wherein the access action information is the access path of the abnormal query statement.

[0104] The fifth processing unit 710 is used to sort and number the access paths of the abnormal query statements, send the sorted access paths of the abnormal query statements to the communication device of the operation and maintenance personnel, and prompt the operation and maintenance personnel to investigate the access paths.

[0105] It should be noted that the specific manner in which each module performs its operation in the apparatus described in the above embodiments has been described in detail in the embodiments of the method, and will not be elaborated here.

[0106] Example 3

[0107] Corresponding to the above method embodiments, this disclosure also provides a defense device against SQL attacks. The SQL attack defense device described below and the SQL attack defense method described above can be referred to in correspondence.

[0108] Figure 3 This is a block diagram illustrating a defense device 800 against SQL attacks according to an exemplary embodiment. Figure 3 As shown, the SQL attack defense device 800 may include: a processor 801 and a memory 802. The SQL attack defense device 800 may also include one or more of the following: a multimedia component 803, an input / output (I / O) interface 804, and a communication component 805.

[0109] The processor 801 controls the overall operation of the SQL attack defense device 800 to complete all or part of the steps in the SQL attack defense method described above. The memory 802 stores various types of data to support the operation of the SQL attack defense device 800. This data may include, for example, instructions for any application or method operating on the SQL attack defense device 800, as well as application-related data such as contact data, sent and received messages, pictures, audio, video, etc. The memory 802 can be implemented using any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The multimedia component 803 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in the memory 802 or transmitted via the communication component 805. The audio component also includes at least one speaker for outputting audio signals. I / O interface 804 provides an interface between processor 801 and other interface modules, such as a keyboard, mouse, and buttons. These buttons can be virtual or physical. Communication component 805 is used for wired or wireless communication between the SQL attack defense device 800 and other devices. Wireless communication includes Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination thereof. Therefore, the corresponding communication component 805 may include a Wi-Fi module, a Bluetooth module, or an NFC module.

[0110] In an exemplary embodiment, the SQL attack defense device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to execute the SQL attack defense method described above.

[0111] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the SQL attack defense method described above. For example, the computer-readable storage medium may be the memory 802 including the program instructions described above, which may be executed by the processor 801 of the SQL attack defense device 800 to complete the SQL attack defense method described above.

[0112] Example 4

[0113] Corresponding to the above method embodiments, this disclosure also provides a readable storage medium. The readable storage medium described below and the SQL attack defense method described above can be referred to in correspondence.

[0114] A readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the SQL attack defense method described in the above method embodiments.

[0115] Specifically, the readable storage medium can be a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or any other readable storage medium capable of storing program code.

[0116] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0117] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method of defense against SQL attacks, characterized in that, The method comprises the following steps: obtaining first information, wherein the first information is a query statement of a database and a first database information table that cannot be accessed by the query statement; inputting the first information into a first model for analysis to obtain second information, wherein the first model is a model for querying the first information and performing analysis, and the second information is a second database information table accessed by the query statement; sending the second information to a second model for processing to obtain third information, wherein the second model is a model for establishing a honeypot database according to the first database information table and the second database information table, and the third information is abnormal query statement information that accesses the honeypot database; sending the third information to a third model for processing to obtain fourth information, wherein the third model is a model for alarming and blocking an abnormal IP, and the fourth information is result information of the alarming and blocking of the abnormal IP; the sending of the second information to the second model for processing to obtain the third information comprises: calling a first database information table that cannot be accessed by a normal statement, comparing the first database information table with the second database information table to obtain a third database information table, and the third database information is an information set that is the same as the first database information and the second database information; establishing a honeypot database that is the same as the third database information table, obtaining query statement information that accesses the honeypot database, and performing abnormality judgment on the query statement information that accesses the honeypot database to obtain abnormal query statement information that accesses the honeypot database.

2. The method of defending against SQL attacks of claim 1, wherein, the inputting of the first information into the first model for analysis to obtain the second information comprises: performing centralized processing on the query statement in the first information to obtain first sub-information, wherein the first sub-information comprises query time information of the query statement, query user information of the query statement, query source information of the query statement, query second database information of the query statement, and specific statement information of the query statement, and the first sub-information is classified and summarized to obtain a query statement classification information table; performing query processing on an interface of the query statement classification information table to obtain interface information accessed by the query statement classification information table; calling information of a second database connected with the interface in the interface information, and performing statistical processing on the information of the second database to obtain the second database information table.

3. The method of defending against SQL attacks of claim 1, wherein, the sending of the third information to the third model for processing to obtain the fourth information comprises: obtaining source IP address information of the query statement information that accesses the honeypot database; labeling the query statement information that accesses the honeypot database and the source IP address information, and sending the labeled query statement information to an operation and maintenance personnel to prompt that the query statement is an attack statement; calling an API interface of a firewall to prohibit all access behaviors from the source IP address.

4. A device for defense against SQL attacks, characterized in that, The method comprises the following steps: a first obtaining unit is configured to obtain first information, wherein the first information is a query statement of a database and a first database information table that cannot be accessed by the query statement; The first processing unit is configured to input the first information into a first model for analysis to obtain second information, the first model is a query statement for querying a database of the first information and a model for analysis, and the second information is a second database information table accessed by the query statement; The second processing unit is configured to send the second information to a second model for processing to obtain third information, the second model is a model for establishing a honeypot database according to the first database information table and the second database information table, and the third information is abnormal query statement information for accessing the honeypot database; The third processing unit is configured to send the third information to a third model for processing to obtain fourth information, the third model is a model for alarming and banning an abnormal IP, and the fourth information is result information of the alarming and banning of the abnormal IP; The device comprises: The fourth processing subunit is configured to call a first database information table that cannot be accessed by a normal statement, compare the first database information table with the second database information table, and obtain a third database information table, the third database information being an information set same as the first database information and the second database information; The fifth processing subunit is configured to establish a honeypot database same as the third database information table, obtain query statement information for accessing the honeypot database, perform abnormality judgment on the query statement information for accessing the honeypot database, and obtain abnormal query statement information for accessing the honeypot database.

5. The device for defense against SQL attacks according to claim 4, characterized in that, The device comprises: The first processing subunit is configured to centrally process query statements in the first information to obtain first sub-information, the first sub-information including query time information of the query statements, query user information of the query statements, query source information of the query statements, query second database information of the query statements, and specific statement information of the query statements, classify and summarize the first sub-information to obtain a query statement classification information table, and query an interface of the query statement classification information table to obtain interface information accessed by the query statement classification information table. The second processing subunit is configured to query an interface of the query statement classification information table to obtain interface information accessed by the query statement classification information table. The third processing subunit is configured to call information of a second database connected with the interface in the interface information, statistically process the information of the second database to obtain the second database information table.

6. The apparatus for defense against SQL attacks of claim 5, wherein, The device comprises: The first acquisition subunit is configured to acquire source IP address information of query statement information for accessing the honeypot database; The sixth processing subunit is configured to mark the query statement information for accessing the honeypot database and the source IP address information, and send the marked query statement information to an operation and maintenance personnel to prompt that the query statement is an attack statement; The seventh processing subunit is configured to call an API interface of a firewall to prohibit all access behaviors from the source IP address.

7. A device for defense against SQL attacks, characterized in that, The device comprises: A memory is configured to store a computer program; A processor is configured to execute the computer program to implement steps of the SQL attack defense method according to any one of claims 1 to 3.

8. A readable storage medium characterized by: The readable storage medium has a computer program stored thereon, and the computer program, when executed by a processor, implements the steps of the SQL attack defense method according to any one of claims 1 to 3.

Images