A Cross-System General Vectorization Method and System for SQL Statements

By splitting SQL statements into key trees and name trees and using neural network training models, the universality problem of SQL statement detection in cross-system applications is solved, and rapid adaptation and high accuracy detection are achieved in different business systems.

CN115809257BActive Publication Date: 2025-08-01CHONGQING SHUDA INFORMATION SECURITY TECH CO LTD
View PDF 2 Cites 0 Cited by

Patent Information

Application Number
CN202210788126.4
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2022-07-04
Publication Date
2025-08-01
Estimated Expiration
2042-07-04

AI Technical Summary

Technical Problem

The existing SQL statement detection methods lack universality and robustness among different business systems and cannot be ported quickly, resulting in poor results when applied across systems.

Method used

The keywords and table names/field names of SQL statements are separately vectorized, split into key trees and name trees through binary trees, and vectorized using neural networks. The model is trained in combination with softmax loss function to ensure the retention of semantic and structural information.

Benefits of technology

It realizes cross-system universality, can quickly adapt to different business systems, maintain the semantic and structural characteristics of SQL statements, and improves the accuracy of detection and recognition.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN115809257B_ABST
    Figure CN115809257B_ABST
Patent Text Reader

Abstract

The present invention relates to a method and system for vectorizing SQL statements that are cross-system general-purpose, belonging to the technical field of data security. The present invention first parses the SQL statement to obtain a binary tree; then splits the binary tree into a key tree and a name tree, and respectively performs initial vectorization on their nodes; then constructs a neural network for the key tree, and uses the trained neural network to perform secondary vectorization on its nodes; finally, jointly embeds the node vectors of the key tree and the name tree to obtain a vector representation of the SQL statement. Compared with the prior art, the vectorization method and system of the present invention have cross-system generality on the premise of fully retaining the original syntax, semantics, and structural features of the SQL statement, and can be quickly migrated in different systems.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] The present invention relates to a cross - system general SQL statement vectorization method and system, belonging to the technical field of data security. Background Art

[0002] Identifying security threats by directly or indirectly analyzing SQL statements is widely applied in many fields, such as SQL injection detection, slow data leakage, etc. SQL statements are instructions that directly interact with data in the system. The security detection of SQL statements can be regarded as the last line of defense for data security. Currently, most of the related detection methods for SQL statements are based on keywords or related rules in SQL. Such methods have certain effects in specific tasks, but lack generalization ability and robustness between different business systems. For example, related models trained in an e - commerce database cannot be quickly transplanted into a medical database. In the current big data environment, there are many business systems, and the current mainstream methods cannot meet the switching between such many business systems and various quantification requirements, lacking generality. Summary of the Invention

[0003] The purpose of the present invention is to propose a cross - system general SQL statement vectorization method and software system for the above - mentioned part or all problems.

[0004] The principle of the present invention is to strip the keywords and table names / field names of the SQL statement, vectorize them separately according to their respective characteristics and then fuse them, so that the fused SQL statement vector can not only maintain the semantic information of the original SQL statement but also not lose the structural information of the original SQL statement.

[0005] The purpose of the present invention is realized through the following technical solutions:

[0006] In the first aspect, an embodiment of the present invention provides a cross - system general SQL statement vectorization method, including the following steps:

[0007] 1) Parse the SQL statement to obtain a binary tree;

[0008] 2) Split the binary tree into two trees with the same structure but different nodes, namely a key tree and a name tree; where the key tree only contains the keywords of the SQL statement, and the name tree only contains the table names and / or field names of the SQL statement;

[0009] 3) Perform initial vectorization on all nodes in the key tree and the name tree respectively;

[0010] 4) Replace the vectors of all nodes in the initially vectorized key tree from bottom to top recursively with the vectors calculated by the trained neural network to obtain a second - vectorized key tree;

[0011] 5) Jointly embed the vectors of the key tree after the secondary vectorization and the initially vectorized name tree to obtain the vectorized representation of the SQL statement.

[0012] In a second aspect, an embodiment of the present invention provides a cross-system universal SQL statement vectorization system, including:

[0013] A parsing module, configured to parse the SQL statement to obtain a binary tree;

[0014] A splitting module, configured to split the binary tree into a key tree and a name tree with the same structure but different nodes, where the key tree only contains the keywords of the SQL statement, and the name tree only contains the table names and / or field names of the SQL statement;

[0015] An initial vectorization module, configured to respectively perform initial vectorization on all nodes in the key tree and the name tree;

[0016] A secondary vectorization module, which replaces the vectors of all nodes of the initially vectorized key tree with vectors calculated by recursively using a trained neural network from bottom to top to obtain a key tree after secondary vectorization;

[0017] A joint embedding module, which jointly embeds the vectors of the key tree after the secondary vectorization and the initially vectorized name tree to obtain the vectorized representation of the SQL statement and outputs it.

[0018] In a third aspect, an embodiment of the present invention provides an electronic device, including: at least one processor; and,

[0019] A memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the cross-system universal SQL statement vectorization method described in the foregoing first aspect or any implementation manner of the first aspect.

[0020] In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium, characterized in that the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute the cross-system universal SQL statement vectorization method described in the foregoing first aspect or any implementation manner of the first aspect.

[0021] Fifth aspect, an embodiment of the present invention provides a computer program product, which includes a computing program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer is caused to execute the cross-system general SQL statement vectorization method described in the foregoing first aspect or any implementation manner of the first aspect.

[0022] Advantageous Effects

[0023] Compared with the prior art, the present invention has the following effects:

[0024] (1) Convert the SQL statement into a tree structure for vectorization processing, which is convenient for maintaining its original semantic features and structural features;

[0025] (2) Split the tree structure into a key tree and a name tree, and perform vectorization processing on the two respectively according to the syntax characteristics of the SQL statement itself, which enhances the cross-system generality of the method of the present invention; after training the neural network model with a sufficiently large-scale data set, applying the method of the present invention can achieve fast vectorization of SQL statements, and when applying cross-system, as long as the name tree vectors corresponding to the table name and field name are initialized according to the system characteristics, the method or system of the present invention can be used to quickly vectorize the SQL statements of the new system without retraining the model with the data set of the system or field;

[0026] (3) Uniformly and recursively use a neural network for vectorization of all nodes of the key tree, so that the root node vectors of each layer fully reflect the semantic information of the node keywords and the structural information of its subtrees;

[0027] (4) When training the neural network, use softmax as the loss function, and use the root node in the key tree as the supervised target of the softmax loss function to calculate the gradient of the hierarchical softmax method, which effectively improves the accuracy of the neural network in learning the syntax, semantics and structural features of SQL statements;

[0028] (5) The vector representing the SQL statement obtained after jointly embedding the vectors of the key tree and the name tree contains the structural information, semantic information and field content information of the SQL statement, fully reflecting the various features of the SQL statement, and can effectively improve the accuracy of subsequent work such as detection and recognition based on this vector. Description of the Drawings

[0029] Figure 1 is a schematic flowchart of a cross-system general SQL statement vectorization method provided by an embodiment of the present invention;

[0030] Figure 2 is a schematic diagram of the binary tree representation of the SQL statement provided by an embodiment of the present invention;

[0031] Figure 3 It is a schematic diagram of the key tree provided by the embodiment of the present invention;

[0032] Figure 4 It is a schematic diagram of the name tree provided by the embodiment of the present invention;

[0033] Figure 5 It is a schematic diagram of the initial vectorization of the key tree provided by the embodiment of the present invention;

[0034] Figure 6 It is a schematic diagram of the initial vectorization of the name tree provided by the embodiment of the present invention;

[0035] Figure 7 It is a schematic diagram of the training process of the neural network model provided by the embodiment of the present invention;

[0036] Figure 8 It is a schematic diagram of the secondary vectorization of the key tree provided by the embodiment of the present invention;

[0037] Figure 9 It is a schematic diagram of the electronic device provided by the embodiment of the present invention. Detailed implementation manners

[0038] The following further describes and details a cross-system general SQL statement vectorization method and system of the present invention in conjunction with the accompanying drawings and embodiments.

[0039] The following specific examples illustrate the embodiments of the present disclosure. Those skilled in the art can easily understand other advantages and effects of the present disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that, without conflict, the following embodiments and the features in the embodiments can be combined with each other. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present disclosure without creative efforts belong to the scope of protection of the present disclosure.

[0040] It should be noted that the following describes various aspects of embodiments within the scope of the appended claims. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is illustrative only. Based on this disclosure, those skilled in the art should understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of the aspects described herein can be used to implement an apparatus and / or practice a method. Additionally, this apparatus and / or method can be implemented using other structures and / or functionality in addition to one or more of the aspects described herein.

[0041] It should also be noted that the diagrams provided in the following embodiments only schematically illustrate the basic concept of the present disclosure. The diagrams only show the components related to the present disclosure and are not drawn according to the number, shape, and size of the components in actual implementation. The type, quantity, and proportion of each component in actual implementation can be arbitrarily changed, and the component layout type may also be more complex.

[0042] In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the aspects described herein can be practiced without these specific details.

[0043] With the development of information technology, the emergence and wide use of a large number of information systems, databases, as tools for storing and managing structured data, have become indispensable in production and life. Structured Query Language, abbreviated as SQL, is a database query and programming language used to access data and query, update, and manage relational database systems; SQL statements are a language for operating on databases. Thus, the identification of security threats by directly or indirectly analyzing SQL statements is widely applied in many fields, such as SQL injection detection, data slow leakage, etc. With the development of artificial intelligence, various analysis means of SQL statements are based on vectorized SQL statements. It can be said that the effectiveness of the analysis means has a great relationship with whether the SQL vector can fully reflect the characteristics of SQL statements. In addition, the wide use of information systems in all walks of life also poses higher requirements for the cross-system applicability of the vectorization method of SQL statements. In view of the above problems, the present invention proposes a cross-system general SQL statement vectorization method.

[0044] A cross-system general SQL statement vectorization method provided by an embodiment of the present disclosure can be executed by a computing device, which can be implemented as software, or as a combination of software and hardware, and the computing device can be integrally provided in a server, a terminal device, etc.

[0045] The terminals in the embodiments of the present disclosure may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., as well as fixed terminals such as digital TVs, desktop computers, file servers, database servers, etc.

[0046] Figure 1 The present disclosure provides a cross-system universal SQL statement vectorization method, as shown in the figure, which includes the following steps:

[0047] 1) Parse the SQL statement to obtain a binary tree;

[0048] Preferably, before parsing the SQL statement, the SQL statement can be preprocessed to remove redundant information that does not affect the meaning of the SQL statement.

[0049] As is well known, in applications such as SQL injection detection and slow data leaks, the data range retrieval content in SQL statements has little impact on the semantics of the SQL statement and is not important in feature extraction. Therefore, it can be removed before parsing, so that the SQL statement only contains semantic, structural, and table name and field name information, avoiding the interference of redundant information. Take the SQL statement "select uname from user where id=100" as an example. The purpose of this statement is to query by the field id. The value of id does not affect the meaning of the SQL statement. Therefore, it is removed, and the result is: "select uname from user where id"

[0050] You can parse SQL statements directly according to the syntax rules of SQL statements, or you can use any existing SQL parser to parse SQL statements, such as the SQL parser that comes with the DBMS, or the SQLparser provided by a third party. This example uses the SQL parser that comes with the DBMS to parse SQL statements to form a binary tree. Take the SQL statement "select sno, sname from student where sno in (select sno from sc where cno='C001')" as an example. After parsing, its tree structure is as follows: Figure 2 shown.

[0051] 2) Split the binary tree into two trees, namely the key tree and the name tree, which have the same structure but different nodes. Among them, the key tree only contains the keywords of the SQL statement, and the name tree only contains the table names and / or field names of the SQL statement;

[0052] According to the characteristics of SQL statements, the keywords of different database management systems are limited, and the keywords with the same meaning are roughly the same. Therefore, separating the keyword information defined by the system from the table name and field name information defined by the user is conducive to improving the cross-system generality of the method. Taking Figure 2 the SQL statement represented by the binary tree shown as an example, it can be seen that on the left side of each node in the tree is the keyword, and on the right side is the table name or field name information. Thus, the content on the left and right sides of the node can be simply split to form two trees, namely the key tree and the name tree, which have the same structure but different nodes. As Figure 3 shown in the key tree, and Figure 4 shown in the name tree.

[0053] 3) Initialize the vectorization of all nodes in the key tree and the name tree respectively;

[0054] Any existing method can be used to vectorize the node content in the key tree and the name tree. For example, Choi J, KimH, Choi C, et al. Efficient malicious code detection using n-gram analysisand SVM[C] / / 2011 14th International Conference on Network-Based InformationSystems. IEEE, 2011: 618-621.

[0055] Preferably, when initializing the vectorization of the key tree, the one-hot vector model is adopted; when initializing the vectorization of the name tree, the bag-of-words model is adopted.

[0056] Using the one-hot vector model to initialize the vectorization of the key tree is conducive to fully representing its semantic features. For the sake of illustration, assume that the total number of SQL keywords is 15. Therefore, the one-hot dimension is 15. Using the method of word frequency statistics, confirm which keyword each dimension in the 15-dimensional vector represents. For example, if the select keyword appears most frequently in our large-scale data, then the 0th position represents select; and so on. Replace all nodes of the key tree with the one-hot vectors corresponding to the keywords of the corresponding nodes. For Figure 3 the key tree shown, the result after vector conversion is as Figure 5 shown.

[0057] To enable the SQL2vec method of the present invention to adapt to database systems in different scenarios and be compatible with the weights of different field names and table names, the bag-of-words model is used to initially vectorize the name tree. In this example, the word frequency sorting serial number is used to represent the field name and table name. Specifically, the word frequencies of all field names and table names appearing in the dataset are counted, and they are sorted in descending order according to the number of occurrences, that is: the one with the most occurrences is 1, the second is 2, and so on. The node content in the name tree is replaced with the corresponding word frequency sorting of the table name and field name. Figure 4 The result after vector transformation of the shown name tree is as Figure 6 shown.

[0058] 4) Replace all node vectors of the initially vectorized key tree recursively from bottom to top with the vectors calculated by the trained neural network to obtain the key tree after secondary vectorization;

[0059] Each node vector in the initially vectorized key tree only reflects the semantic information of the keyword and does not fully reflect the structural information of the SQL statement. The present invention learns the syntax, semantics, and structural information of the SQL statement through a neural network and embodies it in the vectors of the nodes. The neural network model can use existing classical models, such as word2vec, bert, or RNN, or the following model:

[0060]

[0061] Among them, is the k-th leaf node in set C(j), is the only root node of set C(j). When there is only one leaf node in set C(j), this node also participates in the above operations as the root node, is the input gate of set C(j), is the forget gate of the k-th node in set C(j), is the output gate of set C(j), are respectively an intermediate transformation function of set C(j), and W, U, and b are network parameters, is the sigmoid activation function, is the result of the model's final encoding of set C(j).

[0062] Since word2vec only considers the word frequency problem, although bert considers the word order, it lacks the feature processing of the overall structure. In an SQL statement, in addition to the word order, the structural relationship is also particularly important. Therefore, the above model, which can be subsequently called the TModel, fully considers the relevant special features of the SQL statement - the word order features and structural features related to syntax and semantics.

[0063] The following is an explanation from two dimensions: training the TModel and using the TModel.

[0064] When training the TModel, the loss function is the average of the recursive softmax losses between the model encodings of all root nodes in the key tree and their initial vectors, that is, only the root nodes of each layer are considered and supervised during training. As Figure 7 shown, the training process is as follows:

[0065] (1) Construction of hierarchical softmax

[0066] Perform softmax splitting on the key tree from bottom to top, so that each softmax subtree contains two layers, and the root node and leaf node values of the softmax subtree are its initial vectors; when the leaf node of a softmax subtree C(j) is the root node of another softmax subtree S, the C(S) obtained by calculating S using the neural network model is also used as the leaf node of C(j);

[0067] (2) Gradient collection

[0068] For each softmax subtree, use softmax as the loss function and the root node as the supervision target of the softmax loss function to calculate the gradient; perform parameter update on the neural network model after weighted averaging the gradients of all softmax subtrees in the key tree;

[0069] In this training process, a key tree is regarded as a batch, and each softmax subtree is regarded as a group of inputs.

[0070] (3) Iterative training

[0071] Repeat the content of (1) and (2) for all key trees in the training dataset as one iteration, and perform iterative calculation until the loss no longer decreases. At this time, the neural network model is trained.

[0072] The above training process does not consider leaf nodes and only uses the root nodes of the key tree for supervised learning, so that the learned network can fully reflect the structural characteristics of the SQL statement. When the network is trained and used for prediction, for leaf nodes, they are both elements of the set C(j) and their root nodes, and participate in the network calculation to obtain the secondary vectors of the corresponding keywords in the SQL statement.

[0073] Taking the Figure 5 shown key tree as an example, the above training process is described as follows:

[0074] 1. Traverse the key tree level by level from bottom to top to obtain the set C(j) of all softmax subtrees. For the convenience of subsequent calculations, take the root node of the softmax subtree as the first node, and take the leaf nodes from left to right as the subsequent nodes of the set. For this tree, there are 3 softmax subtrees, so j ∈ {1, 2, 3}. Each softmax subtree contains the following nodes:

[0075] C(0) = [4, 5, 6], and its root node label is 4, that is the node vector with label 4;

[0076] C(1) = [2, 3, 4, C(0)], and its root node label is 2, that is the node vector with label 2;

[0077] C(2) = [0, 1, 2, C(1)], and its root node label is 0, that is the node vector with label 0;

[0078] 2. Substitute C(0) into TModel, calculate and obtain , and use the softmax loss to calculate the loss with node 4, and obtain the gradient ;

[0079] Substitute C(1) into TModel, calculate and obtain , and use the softmax loss to calculate the loss with node 2, and obtain the gradient ;

[0080] Substitute C(2) into TModel, calculate and obtain , and use the softmax loss to calculate the loss with node 0, and obtain the gradient ;

[0081] 3. Take loss = as the gradient of the entire network, and for the network parameters W , U , b (that is W (i) , U (i) , b (i) , W (f) , U (f) , b (f) ,W (o) , U (o) , b (o) , W (u) , U (u) , b (u) ) for updating.

[0082] The training process of the above key tree is a training for one batch. Executing the above process once for all SQL statements in the training dataset is regarded as one iterative training for the TModel. Iterate several times until the loss no longer decreases, and it is considered that the model training is completed.

[0083] The trained neural network can be used to perform node replacement for the secondary vectorization of the key tree of any input SQL statement. For the key tree in this example Figure 5 , recalculate the vector of each node using the TModel to obtain the secondary vectorization result as shown in Figure 8 .

[0084] The reason for only training the key tree using the neural network model is as follows: First, it is to be able to loosely couple the key tree and the name tree, facilitating the expansion of the method of the present invention between different business systems; second, the data of field names and table names is extremely sparse, and all information can be retained after the SQL vector embeds the keyword content and structural features.

[0085] 5) Perform joint embedding of the vectors of the secondary vectorized key tree and the initially vectorized name tree to obtain the vectorized representation of the SQL statement.

[0086] This step aims to merge the vector results after splitting the previously split key tree and name tree, so as to obtain the vector of the entire SQL statement. Any embedding method can be used in this step, such as restoring the SQL statement from the vectors in the key tree and name tree, and then performing sen2vec (sentence to vector) on the SQL statement replaced by vectors. The following method can also be used: multiply the corresponding nodes in the key tree and name tree and then perform weighted average on all nodes. According to the different vectorization methods of the name tree, the specific practices are as follows:

[0087] i) When the node value type in the name tree is a vector, the SQL statement vector is the mean of the sum of the dot products of the corresponding node vectors in the key tree and the name tree;

[0088] ii) When the node value type in the name tree is a numerical value, the SQL statement vector is the sum average after multiplying the corresponding nodes in the key tree and the name tree. For Figure 6 and Figure 8 the name tree and key tree shown in

[0089]

[0090] At this point, the vectorization of the SQL statement is completed, and the result is the combined embedding result vector of the key tree and the name tree.

[0091] A cross-system general SQL statement vectorization system provided by the present disclosure includes the following modules:

[0092] A parsing module for parsing the SQL statement to obtain a binary tree;

[0093] A splitting module for splitting the binary tree into a key tree and a name tree with the same structure but different nodes, where the key tree only contains the keywords of the SQL statement, and the name tree only contains the table names and / or field names of the SQL statement;

[0094] An initial vectorization module for respectively performing initial vectorization on all nodes in the key tree and the name tree;

[0095] A secondary vectorization module that recursively replaces all node vectors of the initially vectorized key tree from bottom to top with vectors calculated by a trained neural network to obtain a key tree after secondary vectorization;

[0096] A combined embedding module for performing combined embedding of vectors on the key tree after secondary vectorization and the initially vectorized name tree to obtain a vectorized representation of the SQL statement and output it.

[0097] For the specific implementation methods of each module, refer to the relevant content of the aforementioned cross-system general SQL statement vectorization method, which will not be elaborated here.

[0098] Refer to Figure 9 , the present disclosure also provides an electronic device 60, which includes:

[0099] At least one processor; and,

[0100] A memory communicatively connected to the at least one processor; wherein,

[0101] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the foregoing embodiments.

[0102] The present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute any of the foregoing embodiments.

[0103] The present disclosure also provides a computer program product including a computing program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to execute any of the foregoing embodiments.

[0104] Reference is made below Figure 4 , which shows a schematic structural diagram of an electronic device 60 suitable for implementing the embodiments of the present disclosure. The electronic device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Tablet Computers), PMPs (Portable Multimedia Players), in-vehicle terminals (such as in-vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The illustrated electronic device is merely an example and should not impose any limitation on the functions and usage scope of the embodiments of the present disclosure.

[0105] As Figure 9 shown, the electronic device 60 may include a processing device (such as a central processing unit, a graphics processing unit, etc.) 601, which may execute various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 60 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0106] Generally, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 60 to communicate with other devices wirelessly or wiredly to exchange data. Although Figure 9 the illustrated electronic device 60 has various devices, it should be understood that it is not required to implement or include all the illustrated devices. More or fewer devices may be alternatively implemented or included.

[0107] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product that includes a computer program carried on a computer-readable medium, the computer program including program code for performing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by a processing device 601, the above-described functions defined in the methods of the embodiments of the present disclosure are performed.

[0108] It should be noted that the above-mentioned computer-readable medium in the present disclosure can be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of a computer-readable storage medium can include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. And in the present disclosure, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted by any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0109] The above-mentioned computer-readable medium can be included in the above-mentioned electronic device; or it can exist separately without being assembled into the electronic device.

[0110] The above computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: obtain at least two Internet protocol addresses; send a node evaluation request including the at least two Internet protocol addresses to a node evaluation device, wherein the node evaluation device selects an Internet protocol address from the at least two Internet protocol addresses and returns it; receive the Internet protocol address returned by the node evaluation device; wherein the obtained Internet protocol address indicates an edge node in a content delivery network.

[0111] Alternatively, the above computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: receive a node evaluation request including at least two Internet protocol addresses; select an Internet protocol address from the at least two Internet protocol addresses; return the selected Internet protocol address; wherein the received Internet protocol address indicates an edge node in a content delivery network.

[0112] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0113] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a segment of a program, or a part of code that contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as combinations of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based system that performs the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0114] The units involved in the embodiments described in the present disclosure can be implemented in software or in hardware. Among them, the name of the unit does not constitute a limitation to the unit itself in some cases. For example, the first acquisition unit can also be described as "the unit for acquiring at least two Internet protocol addresses".

[0115] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware, or a combination thereof.

[0116] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A vectorization method for SQL statements that is cross-system general, characterized in that: It includes the following: 1) Parse the SQL statement to obtain a binary tree; 2) Split the binary tree into two key trees and name trees with the same structure but different nodes; among them, the key tree only contains the keywords of the SQL statement, and the name tree only contains the table names and / or field names of the SQL statement; 3) Initialize the vectors of all nodes in the key tree and name tree respectively; 4) Replace the vectors of all nodes in the initially vectorized key tree with the vectors calculated by the trained neural network recursively from bottom to top, and obtain the key tree after secondary vectorization; 5) Perform joint embedding of the vectors of the key tree after secondary vectorization and the initially vectorized name tree to obtain the vectorized representation of the SQL statement.

2. The method according to claim 1, characterized in that: Before parsing the SQL statement using an SQL parser to obtain a binary tree, preprocess the SQL statement to remove redundant information that does not affect the meaning of the SQL statement.

3. The method according to claim 1, wherein: When initializing the vector of the key tree, use the one-hot vector model; when initializing the vector of the name tree, use the bag-of-words model.

4. The method according to claim 1, wherein: The neural network model is as follows: ; Among them, is the k-th node in C(j), is the unique root node of C(j), is the input gate of C(j), is the forget gate of the k-th node in C(j), is the output gate of C(j), are respectively an intermediate transformation function of C(j), and W, U, and b are network parameters, is the sigmoid activation function, is the result of the model's final encoding of C(j), and C(j) is a softmax subtree.

5. The method according to claim 4, characterized in that: The training of the neural network model includes the following: (1) Construction of hierarchical softmax Perform softmax splitting on the key tree from bottom to top, so that each softmax subtree contains 2 layers, and each node belongs to only one softmax subtree. The root node and leaf node values of the softmax subtree are its initial vectors; When there is another softmax subtree S1 under the leaf node of a softmax subtree C(j), regard S1 as the leaf node of C(j), and the value of this leaf node is the calculation result of the neural network model; (2) Gradient collection For each softmax subtree, use softmax as the loss function and the root node as the supervision target of the softmax loss function to calculate the gradient; perform parameter update on the neural network model after weighted averaging of the gradients of all softmax subtrees in the key tree; (3) Iterative training Repeating the content of (1) and (2) for all key trees in the training dataset is regarded as one iteration, and iterate until the loss no longer decreases. At this time, the training of the neural network model is completed.

6. The method according to any one of claims 1-5, characterized in that: The joint embedding of the vectors is realized by multiplying the corresponding node vectors in the key tree and name tree and then performing weighted averaging on all nodes.

7. A vectorization system for SQL statements that is cross-system general-purpose, characterized in that: It includes: A parsing module for parsing the SQL statement to obtain a binary tree; A splitting module for splitting the binary tree into two key trees and name trees with the same structure but different nodes, where the key tree only contains the keywords of the SQL statement, and the name tree only contains the table names and / or field names of the SQL statement; An initial vectorization module for initializing the vectors of all nodes in the key tree and name tree respectively; The secondary vectorization module replaces the vectors of all nodes of the initially vectorized key tree with vectors calculated by a trained neural network recursively from bottom to top, obtaining a key tree after secondary vectorization; The joint embedding module performs joint embedding of vectors on the key tree after secondary vectorization and the initially vectorized name tree, obtaining a vectorized representation of the SQL statement and outputting it.

8. The system according to claim 7, wherein: The neural network model is as follows: ; Among them, is the k-th node in C(j), is the unique root node of C(j), is the input gate of C(j), is the forget gate of the k-th node in C(j), is the output gate of C(j), are respectively an intermediate transformation function of C(j), and W, U, and b are network parameters respectively, is the sigmoid activation function, is the result of the model's final encoding of the set C(j), and C(j) is a softmax subtree.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the cross-system universal SQL statement vectorization method according to any one of claims 1-6.

10. A non-transitory computer-readable storage medium, characterized in that, This non-transitory computer-readable storage medium stores computer instructions for causing the computer to execute the cross-system universal SQL statement vectorization method according to any one of claims 1-6.

Citation Information

Patent Citations

  • Structured query language (SQL) injection attack detection method and device

    CN106991322A

  • Structured query language SQL injection detection method and device

    CN110362597A