A method for SQL injection interception and illegal user identification based on differential testing

Abstract

The application discloses a SQL injection interception and illegal user identification method based on differential testing, which comprises the following steps: firstly, constructing a message information set containing SQL injection, and building an illegal user information record database; secondly, obtaining the IP address of each message information in the message information set, and inputting the IP address as a keyword into the illegal user information record database for interception discrimination; then, obtaining the keyword information of a target field in the message information which has not been intercepted, and performing differential testing on the keyword information; finally, screening the keyword information and user information such as the IP address in the differential testing case which does not pass, and storing the keyword information and user information into the illegal user information record database, so that the user is an illegal user. The application can actively intercept and record illegal operations of illegal users, effectively reduce the false negative rate, improve the interception rate, and improve the work efficiency of network security maintenance personnel.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for intercepting SQL injection based on keyword information and identifying unauthorized users using differential testing. Background Technology

[0002] Web page input fields, as a primary means of interaction between users, clients, servers, and databases, are highly vulnerable to security vulnerabilities. SQL injection attacks can exploit vulnerabilities to steal sensitive information from databases, import and export files, and maliciously add or modify information, ultimately attacking servers and posing significant threats to both enterprise and personal servers. Therefore, addressing malicious SQL injection attacks via web page input fields and identifying unauthorized users to prevent subsequent penetration attacks is urgently needed.

[0003] Currently, preventative measures against SQL injection primarily focus on two aspects: database security and input filtering. Database security measures include hierarchical user management and permission allocation, database encryption and multi-layered authentication, and utilizing third-party scanning tools (such as sqlmap) for vulnerability scanning. Input filtering measures include matching security parameters and passing variables to input fields, and filtering or converting special characters. However, these methods are insufficient for complex SQL statements and are easily breached, resulting in high false negative rates and low execution efficiency. Furthermore, personal and corporate servers have limited resources. Prolonged monitoring and handling of unauthorized operations would place a significant burden on server and network security personnel. Therefore, failing to reduce unauthorized user activity will severely compromise personal and corporate information security. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention discloses a method for intercepting SQL injection based on keyword information and identifying unauthorized users, specifically including the following steps:

[0005] S1. Generate a batch of message information containing SQL injection using the existing random generation method to obtain a message information set. Then, use the existing random SQL injection method to perform random SQL injection on the message information that does not contain SQL injection to obtain message information containing SQL injection and supplement the message information set with the message information containing SQL injection.

[0006] Collect complex message information containing SQL injection vulnerabilities from open-source websites to expand the message information set.

[0007] S2. Build an illegal user information record database to store illegal user operations and related user information records.

[0008] S3. Obtain the IP address of each message in the message information set, and input the IP address as a keyword into the illegal user information record database for interception and identification.

[0009] S4. Obtain the keyword information of the target field in the uninterrupted message information, perform differential testing on the keyword information, and generate differential test results.

[0010] S5. Filter out user information such as keyword information and IP address from the differential test cases that failed, and store them in the illegal user information record database. The user is an illegal user.

[0011] The message information should include message type, message version, message length, message entity, etc. Among them, the data information and IP address information in the message entity are important data in this invention.

[0012] Unauthorized user operation, in practical applications, generally refers to entering keyword information into a web page input box, while in this invention, it specifically refers to keyword information in message information.

[0013] In the interception and discrimination step, the IP address is sent as a keyword to the illegal user information record database for field comparison. If the IP address record is found, it is considered that the user has performed illegal operations, and all subsequent operations of its message information will be interrupted in this invention.

[0014] The target field in the message information should be determined based on the actual field name set by the web interface for the input box in the actual environment. This will not be elaborated in this invention.

[0015] Differential testing involves copying the keyword information of the target field of the message information n times to generate n copies of the information. The copied information is then filtered, transformed, and input into the target field of the original message information. The information is then input into the server for judgment. The server outputs n+1 judgment results. If the judgment results are all consistent, the differential test is successful; otherwise, it fails.

[0016] The message information generated by using existing random message SQL injection methods, the message information generated by SQL injection methods on existing message information, and the complex message information containing SQL injection in open source websites all contain this information by default.

[0017] By adopting the above technical solution, this invention provides a method for intercepting SQL injection and identifying illegal users based on differential testing. This method intercepts and judges the message information entered in the web page input box, filters the keyword information, and performs differential testing. This can actively intercept and record illegal operations by illegal users, effectively reduce the false negative rate, improve the interception rate, and improve the work efficiency of network security maintenance personnel. At the same time, this invention also has a certain degree of self-protection effect. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of the method of the present invention;

[0020] Figure 2 This is a flowchart illustrating the process of determining IP address information in this invention.

[0021] Figure 3 This is a schematic diagram of the keyword difference test in this invention. Detailed Implementation

[0022] To make the technical solutions and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention:

[0023] like Figure 1 The method for intercepting SQL injection and identifying unauthorized users based on differential testing, as shown, specifically includes the following steps:

[0024] Step S101: Construct the message information set:

[0025] In this step, existing random message SQL injection methods and methods for injecting SQL into existing message information are used to generate a set of message information to be used.

[0026] Furthermore, the complex message information containing SQL injection vulnerabilities collected from open-source websites used to expand the message information set is described in detail and is open-source.

[0027] Furthermore, the message information is integrated and summarized, and messages with missing information are deleted to form a usable message information set.

[0028] In addition, a message information set is a collection of message information. Message information is the data unit exchanged and transmitted in the network. In this invention, it is assumed to be the information form and content of keyword information entered through a web page input box under the Transmission Control Protocol / Internet Protocol (hereinafter referred to as TCP / IP protocol) to simulate the actual application scenario of the server, after being encapsulated by the network.

[0029] In addition, the message information data contains, by default, keywords that are consistent across the entire message information set, as well as randomly generated keywords that are different for each message.

[0030] Step S102: Establish an illegal user information record database:

[0031] In this step, an illegal user information record database is built to store illegal user operations and related user information records.

[0032] Specifically, a database table is created in the illegal user information record database to store the illegal user information of the aforementioned illegal operations and related user information records.

[0033] Specifically, the fields in the table are "Serial Number", "Source IP Address", "Keyword Information", and "Access Time", among which:

[0034] (1) The “serial number” is a primary key generated in an incrementing manner using a unique method to conform to the database table specification.

[0035] (2) The “source IP address” originates from the message information and is the IP address of the user’s client that identifies the source of the message information.

[0036] (3) "Keyword information" refers to the "data" content in the message information. In the actual application scenario of the server, keyword information refers to the information content entered through the web page input box.

[0037] In addition, the message information usually records the source IP address and the destination IP address. In this invention, the destination IP address is not referenced because the data sources in the message information set are wide and the destination IP addresses are very different. In practical applications, the IP address of the server where this invention is located should be used.

[0038] Step S103: Intercept and identify packet information IP address:

[0039] In this step, the IP address is obtained for each packet in the packet information set, and the IP address is used as a keyword to be entered into the illegal user information record database for interception and identification. Figure 2 As shown.

[0040] (1) In the message information IP address extraction stage 21, the content of each message information in the message information set will be split, and the content containing the source IP address information will be extracted and saved as a new source IP address.

[0041] (2) The new source IP address extracted and saved by the message information IP address extraction stage 21 through the message information IP address input stage 22 is compared with the "source IP address" field in the database table of the illegal user information record database from top to bottom.

[0042] (3) If the database table “Source IP Address” field already contains information about a new source IP address 23, it means that the new source IP address has attempted an illegal operation and its subsequent operation will be rejected 24.

[0043] (4) Conversely, if the new source IP address does not appear in the "Source IP Address" field of the database table, it means that it has not attempted illegal operations and is allowed to perform subsequent operations.

[0044] Step S104: Keyword Information Differential Test

[0045] In this step, differential testing is performed on the keyword information within the packet information containing the new source IP address whose IP address was already identified through interception in step S103. For example... Figure 3 As shown.

[0046] (1) Copy the keyword information in the message information of each message information set N times to generate copied information (N is a letter that represents a quantifier in mathematics, and its specific value depends on the actual use).

[0047] (2) Keep one copy information unchanged and name it as the unprocessed copy information X1.

[0048] (3) Perform special character filtering, regular expression matching and other conventional anti-SQL processing on other copy information to generate copy information A1 after operation and copy information B1 after operation, and other copy information.

[0049] (4) The above-mentioned copied information is put back into the original message information to generate message information containing the original keyword information, message A2 containing copied information, message B2 containing copied information, etc., which have been changed.

[0050] (5) Input these message information into the corresponding message information processing interface of the server to generate result X3, result A3 and result B3.

[0051] (6) If the keyword information in the message does not perform any illegal operation on the server SQL or database, then the message A2 containing the replication information and the message B2 containing the replication information after being processed by special character filtering, regular expression matching and other conventional SQL prevention methods should have the same output result as the message X2 containing the original keyword information. That is, the output results of result X3, result A3 and result B3 should be consistent, and the differential test is passed.

[0052] (7) If the message contains illegal operations, the content of the copied information will be changed after being processed by special character filtering, regular expression matching and other conventional SQL prevention methods. In this case, the expected output results will be inconsistent and the differential test will fail.

[0053] In addition, the output includes all data information except for timestamps and other time-varying data, such as the amount of data returned by the server, data length, and data content.

[0054] In addition to filtering regular punctuation marks, special character filtering should also include commonly used SQL statements that modify table content, such as common SQL keywords like ALERT, UPDATE, and INSERT. This will help prevent the message information from causing actual harm to the server when executed on the server in this step, and this point should also be taken into consideration in practical application scenarios.

[0055] In addition, the keyword information comes from the data in the message information. In step S101, it is emphasized that the data in the message information contains, by default, keywords that are consistent throughout the message information set, as well as randomly generated keywords that are different from each other.

[0056] Step S105: Filter information and store it in the illegal user information record database:

[0057] Specifically, the new source IP address of the keyword information that fails the differential test is recorded in the illegal user information record database, and is used for interception in step S103 when other message information interacts with the server.

[0058] Additionally, the data to be recorded will be filled in according to the three fields of "source IP address", "keyword information", and "access time" in the illegal user information record database.

[0059] Additionally, the data in the "Source IP Address" field originates from the new source IP address, the "Keyword Information" field originates from the keyword information within the data of the message information, and the "Access Time" field originates from the timestamp in the message information.

[0060] Additionally, the timestamp can be converted into date-formatted text using existing programming languages ​​or tools such as Excel, and the date-formatted text can be stored in the "Access Time" field.

[0061] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for intercepting SQL injection and identifying unauthorized users based on differential testing, characterized in that, Includes the following steps: S1. Construct a message set containing SQL injection; S2. Build a database to store illegal user operations and records of illegal user information. S3. Obtain the IP address of each message in the message information set, and input the IP address as a keyword into the illegal user information record database for interception and identification; S4. Obtain the keyword information of the target field in the uninterrupted message information, perform differential testing on the keyword information, and generate differential test results; The differential test is as follows: The keyword information within the message information of each message information set is copied N times to generate copied information; Retain one copy message unchanged and name it the "unprocessed copy message"; Other copied information is filtered for special characters and processed by regular expressions to generate the copied information after the operation. All copied information is then put back into the original message information to generate a message containing the original keyword information and a message containing the copied information. The copied information is inserted into the original message information to generate a message information. This message information is then input into the corresponding message information processing interface on the server for execution, and a result is generated. If the keyword information in the message does not perform any illegal operations on the server SQL or database, and the message containing the copy information after special character filtering and regular expression matching maintains the same output result as the message containing the original keyword information, the differential test is passed. If the message contains illegal operations, the copied message content will be changed after being filtered by special characters and processed by regular expression matching, resulting in inconsistent output results and failure of the differential test. S5. Filter the keyword information and IP address in the message information that failed the differential test, and store them in the illegal user information record database. The user is an illegal user.

2. The method for SQL injection interception and illegal user identification based on differential testing according to claim 1, characterized in that, The specific process of S1 is as follows: S1.

1. Use existing random generation methods to generate a batch of message information containing SQL injection, and obtain a message information set; S1.

2. Using existing random SQL injection methods, random SQL injection is performed on message information that does not contain SQL injection to obtain message information containing SQL injection, and the message information containing SQL injection is added to the message information set. S1.3 Collect SQL injection message information from open source websites and add it to the message information set.

3. A method for intercepting SQL injection and identifying unauthorized users based on differential testing according to claim 1 or 2, characterized in that, The message information includes message type, message version, message length, and message entity, wherein the message entity contains data information and IP address information.

4. The method for SQL injection interception and illegal user identification based on differential testing according to claim 3, characterized in that, The illegal user operation mentioned in S2 refers to the keyword information in the message information.

5. The method for SQL injection interception and illegal user identification based on differential testing according to claim 4, characterized in that, The specific operations for interception and discrimination described in S3 are as follows: The IP address of the message is sent as a keyword to the illegal user information record database for field comparison.

6. The method for SQL injection interception and illegal user identification based on differential testing according to claim 5, characterized in that, S3 also includes the following: if the IP address is recorded in the illegal user information record database after interception and judgment, it is considered that the user has performed an illegal operation, and all subsequent operations of its message information are interrupted.

7. The method for SQL injection interception and illegal user identification based on differential testing according to claim 6, characterized in that, The specific operation of the differential test described in S4 is as follows: The keyword information in the target field of the message information is copied n times to generate n copies. The copied information is then filtered and transformed before being input into the target field of the original message information. The information is then input into the server for judgment. The server outputs n+1 judgment results. If the judgment results are all consistent, the differential test is successful; otherwise, it fails.

8. The method for SQL injection interception and illegal user identification based on differential testing according to claim 7, characterized in that, The discrimination result output by each server includes the amount of data, data length, and data content returned by the server.

Images