Methods, apparatus, equipment, and media for detecting SQL injection attacks based on HTTP traffic.

Abstract

This application relates to the field of network security technology, and provides a method, apparatus, device, and medium for detecting SQL injection attacks based on HTTP traffic. The method includes: acquiring real-time HTTP request traffic corresponding to a target server; extracting parameter information from the payload of the real-time HTTP request traffic to obtain text to be detected; performing data cleaning processing on the text to be detected to obtain updated text to be detected; performing feature extraction processing on the updated text to be detected to obtain a feature vector to be detected; and inputting the feature vector to be detected into a trained SQL injection attack detection model to obtain an SQL injection attack detection result. This application improves the comprehensiveness, accuracy, and efficiency of SQL injection attack detection.

Description

Technical Field

[0001] This application relates to the field of network data security technology, and in particular to a method, apparatus, device and medium for detecting SQL injection attacks based on HTTP traffic. Background Technology

[0002] With the development and popularization of internet technology, more and more services have moved to the network. These services typically use the HTTP protocol. While transmitting interactive data, HTTP traffic can also carry malicious information injected by attackers. HTTP request traffic carries user input data, while HTTP return traffic carries the server's response information. Attackers can inject SQL statements into HTTP request traffic to compromise servers, execute malicious code, or steal data; this is known as SQL injection attack.

[0003] Currently, SQL injection attack detection typically employs rule matching, taint analysis, or a combination of TF-IDF algorithm and supervised machine learning. However, rule matching can only detect known attacks, making SQL injection attack detection incomplete. Taint analysis requires labeling data in the request, resulting in high storage overhead, and labeling necessitates source code instrumentation, altering the source code. In the combination of TF-IDF algorithm and supervised machine learning, TF-IDF cannot capture the relationship between words and context, leading to inaccurate extracted features and inaccurate SQL injection attack detection results. Furthermore, supervised machine learning requires significant investment of manpower and resources for initial labeling, reducing the efficiency of SQL injection attack detection. Summary of the Invention

[0004] In view of the above, this application provides a method, apparatus, device and medium for detecting SQL injection attacks based on HTTP traffic, with the aim of improving the comprehensiveness, accuracy and efficiency of SQL injection attack detection.

[0005] To achieve the above objectives, this application provides a method for detecting SQL injection attacks based on HTTP traffic, wherein the method includes:

[0006] Obtain the real-time HTTP request traffic corresponding to the target server;

[0007] The parameter information in the payload of the real-time HTTP request traffic is extracted to obtain the text to be detected;

[0008] Perform data cleaning processing on the text to be detected to obtain the updated text to be detected;

[0009] Perform feature extraction processing on the updated text to be detected to obtain the feature vector to be detected;

[0010] The feature vector to be detected is input into the trained SQL injection attack detection model to obtain the SQL injection attack detection result.

[0011] Preferably, the method further includes: pre-training an SQL injection attack detection model;

[0012] The pre-trained SQL injection attack detection model includes:

[0013] Obtain the historical HTTP request traffic corresponding to the target server;

[0014] Extract parameter information from the payload of the historical HTTP request traffic to generate data samples;

[0015] Perform data cleaning on the data sample to obtain an updated data sample;

[0016] Perform feature extraction processing on the updated data samples to obtain the target feature vector;

[0017] The target feature vector is input into the SQL injection attack detection model for unsupervised training to obtain the trained SQL injection attack detection model.

[0018] Preferably, the data cleaning process performed on the text to be detected includes:

[0019] Determine whether the request method corresponding to the text to be detected is a preset method. If so, perform a decoding operation on the text to be detected.

[0020] Perform character case normalization processing on the text to be detected;

[0021] Replace the strings in the text to be detected with preset identifiers;

[0022] Perform standardization processing on characters of a preset type in the text to be detected;

[0023] Feature enhancement processing is performed on statements of a preset type in the text to be detected.

[0024] Preferably, the standardization process performed on characters of a preset type in the text to be detected includes:

[0025] Identify non-keywords in the text to be detected;

[0026] Determine the character type of the non-keyword and obtain the standard identifier corresponding to the character type;

[0027] The corresponding non-keywords in the text to be detected are replaced with the standard identifiers.

[0028] Preferably, the preset type of statement is a conditional statement, and the feature enhancement processing performed on the preset type of statement in the text to be detected includes:

[0029] Identify the condition type of the conditional statements in the text to be detected;

[0030] Get the mapping relationship between condition types and condition identifiers;

[0031] Based on the mapping relationship, the conditional statements in the text to be detected are replaced with the corresponding conditional identifiers.

[0032] Preferably, the step of performing feature extraction processing on the updated text to be detected to obtain a feature vector to be detected includes:

[0033] The updated text to be detected is segmented to obtain a word sequence;

[0034] The word sequence is subjected to vector transformation processing to obtain the feature vector to be detected.

[0035] Preferably, the step of performing vector transformation processing on the word sequence to obtain the feature vector to be detected includes:

[0036] The word sequence is input into the input layer of the word vector conversion model, and the initial vector of each word in the word sequence is obtained based on the input weight matrix of the input layer.

[0037] The initial vector is input into the hidden layer of the word vector conversion model to perform the corresponding operation, thereby obtaining the hidden vector of the word sequence;

[0038] The latent vector is input into the output layer of the word vector conversion model, and the detection feature vector of the word sequence is obtained based on the output weight matrix of the output layer.

[0039] Preferably, the step of extracting parameter information from the payload of the real-time HTTP request traffic to obtain the text to be detected includes:

[0040] The parameter information in the URL and the parameter information in the POST header of the real-time HTTP request traffic are extracted to obtain multiple parameter values;

[0041] The multiple parameter values ​​are connected using a connector to obtain the text to be detected.

[0042] To achieve the above objectives, this application also provides an SQL injection attack detection device based on HTTP traffic, wherein the device includes:

[0043] The traffic acquisition module is used to acquire the real-time HTTP request traffic corresponding to the target server;

[0044] The parameter extraction module is used to extract parameter information from the payload of the real-time HTTP request traffic to obtain the text to be detected;

[0045] The data cleaning module is used to perform data cleaning processing on the text to be detected to obtain an updated text to be detected;

[0046] The feature extraction module is used to perform feature extraction processing on the updated text to be detected to obtain the feature vector to be detected;

[0047] The attack detection module is used to input the feature vector to be detected into the trained SQL injection attack detection model to obtain the SQL injection attack detection result.

[0048] To achieve the above objectives, this application also provides an electronic device, wherein the electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores an HTTP traffic-based SQL injection attack detection program executable by the at least one processor, the HTTP traffic-based SQL injection attack detection program being executed by the at least one processor to enable the at least one processor to execute any of the above-described HTTP traffic-based SQL injection attack detection methods.

[0049] To achieve the above objectives, this application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores an HTTP traffic-based SQL injection attack detection program, and when the HTTP traffic-based SQL injection attack detection program is executed by a processor, it implements the steps of any of the above-described HTTP traffic-based SQL injection attack detection methods.

[0050] This application proposes a method, apparatus, device, and medium for detecting SQL injection attacks based on HTTP traffic. First, parameter information is extracted from the payload of real-time HTTP request traffic to generate text to be detected. Data cleaning is then performed on the text to be detected to obtain an updated text. Next, feature extraction is performed on the updated text to obtain a feature vector to be detected. Finally, the feature vector is input into a trained SQL injection attack detection model for SQL injection attack detection. Because data cleaning is performed on the text to be detected, the characters in the sample are standardized, reducing the possibility of missed and false detections and improving detection accuracy. The SQL injection attack detection model is trained using historical HTTP request traffic, which contains various types of SQL injection attacks, ensuring comprehensive SQL injection attack detection. Unsupervised training of the SQL injection attack detection model eliminates the need for significant investment of manpower and resources for annotation in the early stages, reducing costs and improving training efficiency. Attached Figure Description

[0051] Figure 1 A flowchart illustrating the SQL injection attack detection method based on HTTP traffic provided in this application embodiment;

[0052] Figure 2 A schematic diagram illustrating the principle of vector transformation processing using a word vector transformation model provided in this application embodiment;

[0053] Figure 3 A schematic diagram of the structure of the SQL injection attack detection device based on HTTP traffic provided in the embodiments of this application;

[0054] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0055] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0057] This application provides a method for detecting SQL injection attacks based on HTTP traffic. (Refer to...) Figure 1The diagram shown is a flowchart illustrating the SQL injection attack detection method based on HTTP traffic provided in this application embodiment. This method can be executed by an electronic device, which can be implemented by software and / or hardware. The method includes steps S1-S5:

[0058] S1. Obtain the real-time HTTP request traffic corresponding to the target server;

[0059] The target server can be a server (or server cluster) that provides network services to the target enterprise.

[0060] S2. Extract the parameter information from the payload of the real-time HTTP request traffic to obtain the text to be detected;

[0061] The step of extracting parameter information from the payload of the real-time HTTP request traffic to obtain the text to be detected includes the following steps A11-A12:

[0062] A11. Extract the parameter information from the URL and the parameter information from the POST header line of the real-time HTTP request traffic to obtain multiple parameter values;

[0063] HTTP request traffic records all the information an attacker needs to perform an SQL injection attack, making it an ideal target for detection in SQL injection attack tasks. The URL in the HTTP header line and the parameter information in POST requests contain the actual information during network transmission, which is usually called the payload. SQL injection attacks reside in the payload. Other content in the HTTP request traffic is irrelevant information and does not need to be considered.

[0064] Therefore, SQL injection attacks can be detected simply by extracting the URL from the HTTP header line of the HTTP request traffic and the parameter information from the POST request. The parameter information includes request parameters, request methods, etc.

[0065] A12. Connect the multiple parameter values ​​using a connector to obtain the text to be detected.

[0066] In this embodiment, one request corresponds to one HTTP request traffic. The parameter values ​​extracted from each HTTP request traffic are connected together using a connector to obtain the text to be detected corresponding to each HTTP request traffic. The connector can be "&".

[0067] S3. Perform data cleaning processing on the text to be detected to obtain the updated text to be detected;

[0068] Data cleaning is used to standardize the text to be tested, making it easier for subsequent feature extraction.

[0069] The data cleaning process performed on the text to be detected includes the following steps B11-B15:

[0070] B11. Determine whether the request method corresponding to the text to be detected is a preset method. If so, perform a decoding operation on the text to be detected.

[0071] The preset method is the GET method, and the decoding operation includes URL decoding, HTML decoding, and BASE64 decoding.

[0072] As SQL injection attacks continue to evolve, attackers often encode their attacks to bypass intrusion detection systems. Encoding methods include URL encoding, HTML encoding, and BASE64 encoding. Therefore, during decoding, it is necessary to perform corresponding decoding operations based on the encoding type of the text to be detected.

[0073] The following explanation uses URL encoding and decoding as an example. URL parameter strings are constructed using key-value pairs in the form of key=value, separated by '&'. If the key or value contains '=' or '&', it will cause parameter parsing errors. To avoid parameter parsing errors, the HTTP protocol URL-encodes certain special symbols. Spaces, '#', and other characters frequently used in SQL injection attacks are also encoded. Therefore, URL decoding is necessary during the decoding process.

[0074] For example, if the text to be detected, 1, is:

[0075] / index.php? ext[id%3d0+union+select+1%2c2%2cmd5(1)%23]='exp'

[0076] After URL decoding, the text to be detected, 1, is updated to:

[0077] / index.php? ext[id=0union select 1,2,md5(1)#]='exp'

[0078] As can be seen, after URL decoding, the equal sign, comma, and # sign in the original text 1 to be detected were restored.

[0079] B12. Perform character case normalization processing on the text to be detected;

[0080] Changes in the case of characters in HTTP traffic are interpreted as different characters by computers, significantly increasing the dimensionality of lexical features. Secondly, the case of characters in HTTP traffic is meaningless for SQL injection attack detection tasks. Furthermore, some attackers use case-bypassing techniques, such as rewriting `select` as `SELECT`, to evade intrusion detection systems. Therefore, this solution performs case-normalization processing on the characters in the text to be detected during data cleaning, for example, converting all characters to lowercase.

[0081] B13. Replace the string in the text to be detected with a preset identifier;

[0082] In this embodiment, the characters in the preset format are non-ASCII encoded characters, and the preset identifier is unk.

[0083] In SQL, all reserved words and functions are composed of ASCII-encoded characters. To reduce interference from irrelevant information, this solution replaces non-ASCII-encoded strings with preset identifiers.

[0084] The reason why this solution uses replacement processing instead of filtering processing is that filtering processing will cause information loss, which may lead to missed detections, and may also cause unrelated parts of the text to be detected to be connected together, thus causing false alarms.

[0085] B14. Perform standardization processing on the characters of the preset type in the text to be detected;

[0086] The standardization process for characters of a preset type in the text to be detected includes the following steps C11-C13:

[0087] C11. Identify non-keywords in the text to be detected;

[0088] In this embodiment, the non-keywords in the text to be detected are the content entered by the user.

[0089] C12. Determine the character type of the non-keyword and obtain the standard identifier corresponding to the character type;

[0090] The character types of user input include numbers and strings. The standard identifier for numbers is num, and the standard identifier for strings is str.

[0091] C13. Replace the corresponding non-keywords in the text to be detected with the standard identifier.

[0092] User input is meaningless for SQL injection attack detection tasks. Replacing it with standard identifiers corresponding to character types can reduce interference from irrelevant information, reduce the number of character types, and improve detection efficiency.

[0093] For example, if the text to be detected, 2, is:

[0094] / index.php? ext[id=0union select 1,2#]='exp'

[0095] After standardization in this step, it is updated to:

[0096] / index.php? ext[id=num union select num,num#]=str

[0097] B15. Perform feature enhancement processing on the preset type of statements in the text to be detected.

[0098] In this embodiment, the preset type of statement is a conditional statement, and the feature enhancement processing of the preset type of statement in the text to be detected includes the following steps D11-D13:

[0099] D11. Identify the condition type of the conditional statement in the text to be detected;

[0100] In this embodiment, the condition types include equal to, greater than, and less than.

[0101] D12. Obtain the mapping relationship between condition types and condition identifiers;

[0102] In the mapping relationship, each condition type corresponds to a condition identifier. For example, the condition identifier corresponding to the equality type is "equation".

[0103] D13. Based on the mapping relationship, replace the conditional statements in the text to be detected with the corresponding conditional identifiers.

[0104] For example, if the text to be detected, 3, is:

[0105] / index.php? id=0and'123890'='123890'

[0106] After standardization in step B14, it is updated to:

[0107] / index.php? id=num and str=str

[0108] After this feature enhancement process, it is updated to:

[0109] / index.php? id=num and equation

[0110] S4. Perform feature extraction processing on the updated text to be detected to obtain the feature vector to be detected;

[0111] The step of performing feature extraction processing on the updated text to be detected to obtain the feature vector to be detected includes the following steps E11-E12:

[0112] E11. Perform word segmentation on the updated text to be detected to obtain a word sequence;

[0113] The ability to retain important features during word segmentation significantly impacts the accuracy of SQL injection attack detection. To preserve as many SQL injection attack characteristics as possible, this approach retains special symbols such as '#', '-', ' / ** / ', '+', and '@' during word segmentation. These are very brief but crucial features of SQL injection attacks; retaining them further enhances the detection model's ability to detect SQL injection attacks. Therefore, this approach segments the updated text to be detected based on word boundaries and special symbols (including -, / *, +, #, etc.).

[0114] For example, if the updated text to be detected, 2, is:

[0115] / index.php? ext[id=num union select num,num#]=str

[0116] The word sequence obtained after word segmentation is:

[0117] [Index php ext id num union select num num#str]

[0118] E12. Perform vector transformation processing on the word sequence to obtain the feature vector to be detected.

[0119] The process of performing vector transformation on the word sequence to obtain the feature vector to be detected includes the following steps F11-F13:

[0120] F11. Input the word sequence into the input layer of the word vector conversion model, and obtain the initial vector of each word in the word sequence based on the input weight matrix of the input layer;

[0121] like Figure 2The diagram shown illustrates the principle of vector conversion processing using a word vector conversion model according to an embodiment of this application. In this embodiment, the word vector conversion model is a Word2vec model. The network structure of the Word2vec model is a shallow neural network, with two implementation methods: CBOW and Skip-gram. This solution uses the CBOW method for vector conversion: the dimension of the word vector space is defined as V (for example, V can be 100), if the word sequence is [x... 1k ,x 2k ,…,x Ck As can be seen, there are C words in the word sequence, and the input weight matrix of the Word2vec model's input layer is W. V×N Multiply each word in the word sequence by W. V×N Then the output of the input layer is C initial vectors of dimension V.

[0122] F12. Input the initial vector into the hidden layer of the word vector conversion model and perform the corresponding operation to obtain the hidden vector of the word sequence;

[0123] Input C initial vectors of dimension V into the hidden layer of the Word2vec model and perform the corresponding operation: add the C initial vectors together and calculate the average value. The result (hidden vector) is the output of the hidden layer.

[0124] F13. Input the latent vector into the output layer of the word vector conversion model, and obtain the detection feature vector of the word sequence based on the output weight matrix of the output layer.

[0125] The output weight matrix of the output layer of the Word2vec model is W. 1 V×N Multiply the latent vector by W 1 V×N The result obtained (the feature vector to be detected) is the output of the output layer.

[0126] Because the Word2vec model learns the co-occurrence relationships between words in a word sequence and takes into account contextual information, the extracted feature vectors are richer, which can improve the accuracy of SQL injection attack detection.

[0127] S5. Input the feature vector to be detected into the trained SQL injection attack detection model to obtain the SQL injection attack detection result.

[0128] In this embodiment, the method further includes: pre-training an SQL injection attack detection model;

[0129] The pre-trained SQL injection attack detection model includes the following steps G11-G15:

[0130] G11. Obtain the historical HTTP request traffic corresponding to the target server;

[0131] G12. Extract parameter information from the payload of the historical HTTP request traffic to generate data samples;

[0132] G13. Perform data cleaning processing on the data sample to obtain an updated data sample;

[0133] G14. Perform feature extraction processing on the updated data sample to obtain the target feature vector;

[0134] G15. Input the target feature vector into the SQL injection attack detection model for unsupervised training to obtain the trained SQL injection attack detection model.

[0135] The data sample generation process, data cleaning process, and feature extraction process are the same as the text to be detected generation process, data cleaning process, and feature extraction process, and will not be repeated here.

[0136] In this embodiment, the SQL injection attack detection model uses the unsupervised clustering algorithm DBSCAN. DBSCAN is a representative density-based clustering algorithm. Unlike partitioning and hierarchical clustering methods, DBSCAN defines a cluster as the largest set of density-connected points. It can divide regions with sufficiently high density into clusters and can discover clusters of arbitrary shapes in noisy spatial databases without pre-setting the number of cluster centers. Furthermore, it uses unsupervised machine learning algorithms to learn the features of the data, eliminating the need for significant upfront investment in labeling.

[0137] DBSCAN characterizes the density of sample distributions based on a set of "neighborhood" parameters (ε, MinPts), given a dataset D = {x1, x2, ..., x3}. ２ , ..., x m Define the following concepts:

[0138] ε-neighborhood: for x j ∈D, which contains samples D that are related to x j The samples whose distance is not greater than ε, i.e., N ε (x j )={x i ∈D|dist(x i x j )≤ε};

[0139] Core object: If x j The ε-neighborhood contains at least MinPts samples, i.e., |N ε (xj If x ≥ MinPts, then x j It is a core and an object;

[0140] Directly density-reachable: for x i With x j If there exists a sample order p1, p2, ..., p n Where p1 = x i p n =x j , and p i +1 from p i If the density is achievable, then x is called x. i By x j Density can be achieved.

[0141] Density-connected: for x i With x j If x exists k Make x i With x j All are composed of x k If the density is achievable, then x is called x. i By x j Density connected.

[0142] For example, DBSCAN defines an ε-neighborhood (MinPts = 3), with the dashed line showing ε. x1 is the core object, x2 is directly accessible from the density of x1, x3 is accessible from the density of x1, and x3 is connected to the density of x4.

[0143] Based on these concepts, DBSCAN defines a "cluster" as: the largest density-connected set of samples derived from density reachability relations. Formally speaking, given neighborhood parameters (ε, MinPts), a cluster... It is a non-empty subset of samples that satisfies the following properties;

[0144] Connectivity: x i ∈C, Density connected.

[0145] Maximality: x i ∈C by x i Density can reach

[0146] If x is the core object, and the set of all samples that can be reached by the density of x is denoted as X = {x′∈D|x′ is reachable by the density of x}, then it is not difficult to prove that X is a cluster that satisfies connectivity and maximality.

[0147] The DBSCAN algorithm first selects a core object in the dataset as a "seed" and starts dividing the data into clusters from the seed. The algorithm searches for all core objects using the neighborhood parameters (ε, MinPts). Then, starting from any core object, it divides the samples with achievable density into clusters and terminates when all core objects have been visited.

[0148] In summary, the SQL injection attack detection method based on HTTP traffic provided in this application has at least the following technical effects:

[0149] 1. By performing data cleaning on the text to be detected, the characters in the text are standardized, reducing the possibility of missed detections and false detections, and improving detection accuracy. The standardization process also reduces the number of character types in the text to be detected, thus improving detection efficiency.

[0150] 2. Historical HTTP traffic contains various SQL injection attacks. By training the SQL injection attack detection model using historical HTTP traffic, the comprehensiveness of SQL injection attack detection is ensured.

[0151] 3. Unsupervised training of the SQL injection attack detection model eliminates the need for significant initial investment in labeling, reducing costs and improving training efficiency.

[0152] 4. The Word2vec model is used for vector transformation. Because the Word2vec model learns the co-occurrence relationship between words in the word sequence and takes into account the context information, the extracted features are richer, which can make the detection of SQL injection attacks more accurate.

[0153] like Figure 3 As shown, an SQL injection attack detection device 3 based on HTTP traffic is provided in an embodiment of this application. The device 3 includes:

[0154] Traffic acquisition module 31 is used to acquire real-time HTTP request traffic corresponding to the target server;

[0155] The parameter extraction module 32 is used to extract parameter information from the payload of the real-time HTTP request traffic to obtain the text to be detected;

[0156] The parameter extraction module 32 specifically performs the following steps A31-A32:

[0157] A31. Extract the URL and POST parameter information from the HTTP header line of the real-time HTTP request traffic respectively to obtain multiple parameter values;

[0158] A32. Connect the multiple parameter values ​​using a connector to obtain the text to be detected.

[0159] Data cleaning module 33 is used to perform data cleaning processing on the text to be detected to obtain an updated text to be detected;

[0160] The data cleaning module 33 specifically performs the following steps B31-B35:

[0161] B31. Determine whether the request method corresponding to the text to be detected is a preset method. If so, perform a decoding operation on the text to be detected.

[0162] B32. Perform character case normalization processing on the text to be detected;

[0163] B33. Replace the string in the text to be detected with a preset identifier;

[0164] B34. Perform standardization processing on the characters of the preset type in the text to be detected;

[0165] The standardization process for characters of a preset type in the text to be detected includes the following steps C31-C33:

[0166] C31. Identify non-keywords in the text to be detected;

[0167] C32. Determine the character type of the non-keyword and obtain the standard identifier corresponding to the character type;

[0168] C33. Replace the corresponding non-keywords in the text to be detected with the standard identifier.

[0169] B35. Perform feature enhancement processing on the preset type of statements in the text to be detected.

[0170] In this embodiment, the preset type of statement is a conditional statement, and the feature enhancement processing performed on the preset type of statement in the text to be detected includes the following steps D31-D33:

[0171] D31. Identify the condition type of the conditional statement in the text to be detected;

[0172] D32. Obtain the mapping relationship between condition types and condition identifiers;

[0173] D33. Based on the mapping relationship, replace the conditional statements in the text to be detected with the corresponding conditional identifiers.

[0174] Feature extraction module 34 is used to perform feature extraction processing on the updated text to be detected to obtain the feature vector to be detected;

[0175] The feature extraction module 34 specifically performs the following steps E31-E32:

[0176] E31. Perform word segmentation on the updated text to be detected to obtain a word sequence;

[0177] E32. Perform vector transformation processing on the word sequence to obtain the feature vector to be detected.

[0178] The vector transformation process performed on the word sequence to obtain the feature vector to be detected includes the following steps F31-F33:

[0179] F31. Input the word sequence into the input layer of the word vector conversion model, and obtain the initial vector of each word in the word sequence based on the input weight matrix of the input layer;

[0180] F32. Input the initial vector into the hidden layer of the word vector conversion model and perform the corresponding operation to obtain the hidden vector of the word sequence;

[0181] F33. Input the latent vector into the output layer of the word vector conversion model, and obtain the detection feature vector of the word sequence based on the output weight matrix of the output layer.

[0182] The attack detection module 35 is used to input the feature vector to be detected into the trained SQL injection attack detection model to obtain the SQL injection attack detection result.

[0183] The attack detection module 35 is also used to: pre-train an SQL injection attack detection model;

[0184] The pre-trained SQL injection attack detection model includes the following steps G31-G35:

[0185] G31. Obtain the historical HTTP request traffic corresponding to the target server;

[0186] G32. Extract parameter information from the payload of the historical HTTP request traffic to generate data samples;

[0187] G33. Perform data cleaning processing on the data sample to obtain an updated data sample;

[0188] G34. Perform feature extraction processing on the updated data sample to obtain the target feature vector;

[0189] G35. Input the target feature vector into the SQL injection attack detection model for unsupervised training to obtain the trained SQL injection attack detection model.

[0190] Reference Figure 4The diagram shown is a structural schematic of a preferred embodiment of the electronic device 4 of this application.

[0191] The electronic device 4 includes, but is not limited to, a memory 41, a processor 42, a display 43, and a network interface 44. The electronic device 4 is connected to a network via the network interface 44. The network can be an intranet, the Internet, a Global System for Mobile communication (GSM), a Wideband Code Division Multiple Access (WCDMA) network, a 4G network, a 5G network, Bluetooth, Wi-Fi, a voice communication network, or other wireless or wired networks.

[0192] The memory 41 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 41 may be an internal storage unit of the electronic device 4, such as the hard disk or memory of the electronic device 4. In other embodiments, the memory 41 may also be an external storage device of the electronic device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped with the electronic device 4. Of course, the memory 41 may include both the internal storage unit and the external storage device of the electronic device 4. In this embodiment, the memory 41 is typically used to store the operating system and various application software installed on the electronic device 4, such as the program code of the SQL injection attack detection program 40 based on HTTP traffic. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or will be output.

[0193] In some embodiments, processor 42 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. This processor 42 is typically used to control the overall operation of the electronic device 4, such as performing data interaction or communication-related control and processing. In this embodiment, the processor 42 is used to run program code stored in the memory 41 or process data, for example, running the program code of an HTTP traffic-based SQL injection attack detection program 40.

[0194] Display 43 may be referred to as a display screen or display unit. In some embodiments, display 43 may be an LED display, a liquid crystal display, a touch liquid crystal display, or an organic light-emitting diode (OLED) touch screen, etc. Display 43 is used to display information processed in electronic device 4 and to display a visual working interface.

[0195] The network interface 44 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface), which is typically used to establish communication connections between the electronic device 4 and other electronic devices.

[0196] Figure 4 Only an electronic device 4 with components 41-44 and an HTTP traffic-based SQL injection attack detection program 40 is shown. However, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0197] Optionally, the electronic device 4 may further include a user interface, which may include a display, an input unit such as a keyboard, and optionally, a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an organic light-emitting diode (OLED) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device 4 and to display a visual user interface.

[0198] The electronic device 4 may also include radio frequency (RF) circuits, sensors, and audio circuits, etc., which will not be described in detail here.

[0199] In the above embodiments, when the processor 42 executes the SQL injection attack detection program 40 based on HTTP traffic stored in the memory 41, it can perform the following steps:

[0200] Obtain the real-time HTTP request traffic corresponding to the target server;

[0201] The parameter information in the payload of the real-time HTTP request traffic is extracted to obtain the text to be detected;

[0202] Perform data cleaning processing on the text to be detected to obtain the updated text to be detected;

[0203] Perform feature extraction processing on the updated text to be detected to obtain the feature vector to be detected;

[0204] The feature vector to be detected is input into the trained SQL injection attack detection model to obtain the SQL injection attack detection result.

[0205] The storage device can be the memory 41 of the electronic device 4, or it can be other storage devices that are communicatively connected to the electronic device 4.

[0206] For a detailed explanation of the above steps, please refer to the above. Figure 1 This document describes a flowchart illustrating an embodiment of a method for detecting SQL injection attacks based on HTTP traffic.

[0207] Furthermore, this application embodiment also proposes a computer-readable storage medium, which can be non-volatile or volatile. This computer-readable storage medium can be any one or any combination of several of the following: hard disk, multimedia card, SD card, flash memory card, SMC, read-only memory (ROM), erasable programmable read-only memory (EPROM), portable compact disk read-only memory (CD-ROM), USB memory, etc. The computer-readable storage medium includes a data storage area and a program storage area. The data storage area stores data created based on the use of blockchain nodes, and the program storage area stores an HTTP traffic-based SQL injection attack detection program 40. When executed by a processor, the HTTP traffic-based SQL injection attack detection program 40 performs the following operations:

[0208] Obtain the real-time HTTP request traffic corresponding to the target server;

[0209] The parameter information in the payload of the real-time HTTP request traffic is extracted to obtain the text to be detected;

[0210] Perform data cleaning processing on the text to be detected to obtain the updated text to be detected;

[0211] Perform feature extraction processing on the updated text to be detected to obtain the feature vector to be detected;

[0212] The feature vector to be detected is input into the trained SQL injection attack detection model to obtain the SQL injection attack detection result.

[0213] The specific implementation of the computer-readable storage medium in this application is largely the same as the specific implementation of the SQL injection attack detection method based on HTTP traffic described above, and will not be repeated here.

[0214] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0215] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, electronic device, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0216] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A method for detecting SQL injection attacks based on HTTP traffic, characterized in that, The method includes: Obtain the real-time HTTP request traffic corresponding to the target server; The parameter information in the payload of the real-time HTTP request traffic is extracted to obtain the text to be detected; The step of extracting parameter information from the payload of the real-time HTTP request traffic to obtain the text to be detected includes: The parameter information in the URL and the parameter information in the POST header of the real-time HTTP request traffic are extracted to obtain multiple parameter values; The multiple parameter values ​​are connected using a connector to obtain the text to be detected; Perform data cleaning processing on the text to be detected to obtain the updated text to be detected; The data cleaning process performed on the text to be detected includes: Determine whether the request method corresponding to the text to be detected is a preset method. If so, perform a decoding operation on the text to be detected. Perform character case normalization processing on the text to be detected; Replace the strings in the text to be detected with preset identifiers; Perform feature extraction processing on the updated text to be detected to obtain the feature vector to be detected; The step of performing feature extraction processing on the updated text to be detected to obtain the feature vector to be detected includes: The updated text to be detected is segmented into words to obtain a word sequence; wherein the updated text to be detected is segmented into words based on word boundaries and special symbols. Perform vector transformation processing on the word sequence to obtain the feature vector to be detected; The vector transformation process performed on the word sequence to obtain the feature vector to be detected includes: The word sequence is input into the input layer of the word vector conversion model, and the initial vector of each word in the word sequence is obtained based on the input weight matrix of the input layer. The initial vector is input into the hidden layer of the word vector conversion model to perform the corresponding operation, thereby obtaining the hidden vector of the word sequence; The latent vector is input into the output layer of the word vector conversion model, and the detection feature vector of the word sequence is obtained based on the output weight matrix of the output layer. The word vector conversion model is the Word2vec model, which defines the dimension of the word vector space as V. If the word sequence is [x 1k ,x 2k , …,x Ck The word sequence contains C words, and the input weight matrix of the Word2vec model's input layer is W. V×N Multiply each word in the word sequence by W. V×N Then the output of the input layer is C initial vectors of dimension V; Input C initial vectors of dimension V into the hidden layer of the Word2vec model and perform the corresponding operation: add the C initial vectors and calculate the average value. The resulting hidden vector is the output of the hidden layer. The output weight matrix of the output layer of the Word2vec model is W¹ V×N Multiply the latent vector by W¹ V×N The resulting feature vector to be detected is the output of the output layer. The feature vector to be detected is input into the trained SQL injection attack detection model to obtain the SQL injection attack detection result.

2. The method as described in claim 1, characterized in that, The method also includes: pre-training an SQL injection attack detection model; The pre-trained SQL injection attack detection model includes: Obtain the historical HTTP request traffic corresponding to the target server; Extract parameter information from the payload of the historical HTTP request traffic to generate data samples; Perform data cleaning on the data sample to obtain an updated data sample; Perform feature extraction processing on the updated data samples to obtain the target feature vector; The target feature vector is input into the SQL injection attack detection model for unsupervised training to obtain the trained SQL injection attack detection model.

3. The method as described in claim 1, characterized in that, The data cleaning process performed on the text to be detected further includes: Perform standardization processing on characters of a preset type in the text to be detected; Feature enhancement processing is performed on statements of a preset type in the text to be detected.

4. The method as described in claim 3, characterized in that, The standardization process for characters of a preset type in the text to be detected includes: Identify non-keywords in the text to be detected; Determine the character type of the non-keyword and obtain the standard identifier corresponding to the character type; The corresponding non-keywords in the text to be detected are replaced with the standard identifiers.

5. The method as described in claim 3, characterized in that, The preset type of statement is a conditional statement, and the feature enhancement processing performed on the preset type of statements in the text to be detected includes: Identify the condition type of the conditional statements in the text to be detected; Get the mapping relationship between condition types and condition identifiers; Based on the mapping relationship, the conditional statements in the text to be detected are replaced with the corresponding conditional identifiers.

6. The method as described in claim 1, characterized in that, The parameter information extracted from the payload of the real-time HTTP request traffic is used to obtain the text to be detected, including: The parameter information in the URL and the parameter information in the POST header of the real-time HTTP request traffic are extracted to obtain multiple parameter values; The multiple parameter values ​​are connected using a connector to obtain the text to be detected.

7. A device for detecting SQL injection attacks based on HTTP traffic, characterized in that, The device includes: The traffic acquisition module is used to acquire the real-time HTTP request traffic corresponding to the target server; The parameter extraction module is used to extract parameter information from the payload of the real-time HTTP request traffic to obtain the text to be detected; The step of extracting parameter information from the payload of the real-time HTTP request traffic to obtain the text to be detected includes: The parameter information in the URL and the parameter information in the POST header of the real-time HTTP request traffic are extracted to obtain multiple parameter values; The multiple parameter values ​​are connected using a connector to obtain the text to be detected; The data cleaning module is used to perform data cleaning processing on the text to be detected to obtain an updated text to be detected; The step of performing data cleaning processing on the text to be detected includes: Determine whether the request method corresponding to the text to be detected is a preset method. If so, perform a decoding operation on the text to be detected. Perform character case normalization processing on the text to be detected; Replace the strings in the text to be detected with preset identifiers; The feature extraction module is used to perform feature extraction processing on the updated text to be detected to obtain the feature vector to be detected; The step of performing feature extraction processing on the updated text to be detected to obtain the feature vector to be detected includes: The updated text to be detected is segmented into words to obtain a word sequence; wherein the updated text to be detected is segmented into words based on word boundaries and special symbols. Perform vector transformation processing on the word sequence to obtain the feature vector to be detected; The vector transformation process performed on the word sequence to obtain the feature vector to be detected includes: The word sequence is input into the input layer of the word vector conversion model, and the initial vector of each word in the word sequence is obtained based on the input weight matrix of the input layer. The initial vector is input into the hidden layer of the word vector conversion model to perform the corresponding operation, thereby obtaining the hidden vector of the word sequence; The latent vector is input into the output layer of the word vector conversion model, and the detection feature vector of the word sequence is obtained based on the output weight matrix of the output layer. The word vector conversion model is the Word2vec model, which defines the dimension of the word vector space as V. If the word sequence is [x 1k ,x 2k , …,x Ck The word sequence contains C words, and the input weight matrix of the Word2vec model's input layer is W. V×N Multiply each word in the word sequence by W. V×N Then the output of the input layer is C initial vectors of dimension V; Input C initial vectors of dimension V into the hidden layer of the Word2vec model and perform the corresponding operation: add the C initial vectors and calculate the average value. The resulting hidden vector is the output of the hidden layer. The output weight matrix of the output layer of the Word2vec model is W¹ V×N Multiply the latent vector by W¹ V×N The resulting feature vector to be detected is the output of the output layer. The attack detection module is used to input the feature vector to be detected into the trained SQL injection attack detection model to obtain the SQL injection attack detection result.

8. An electronic device, characterized in that, The electronic device includes: at least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores an HTTP traffic-based SQL injection attack detection program that can be executed by the at least one processor, the HTTP traffic-based SQL injection attack detection program being executed by the at least one processor to enable the at least one processor to perform the steps of the HTTP traffic-based SQL injection attack detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an HTTP traffic-based SQL injection attack detection program, which, when executed by a processor, implements the steps of the HTTP traffic-based SQL injection attack detection method as described in any one of claims 1 to 6.

Images