A Web application firewall SQL injection defense regular rule extraction method and device

Abstract

The present invention provides a method and device for extracting regular rules for SQL injection defense of a Web application firewall. The method initiates a query on the Web application firewall using pre-collected SQL injection data and normal SQL query data to obtain the response from the Web application firewall. A decision tree algorithm is used to extract the classification logic of SQL injection defense rules for SQL queries in the Web application firewall from the query data. The internal decision paths and nodes of the decision tree are separated, extracted, and integrated, and converted into regular rules.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method and device for extracting regular rules for SQL injection defense of a Web application firewall. Background Art

[0002] With the continuous advancement of network technology, a growing number of web applications are being deployed. Similarly, attacks targeting these applications are also increasing, such as SQL injection, cross-site scripting, and remote code execution. A web application firewall (WAF) is a detection system for application-layer attacks. It provides HTTP / HTTPS request detection for various web applications, ensuring their security. Traditional WAFs, as a key line of defense for web applications, can provide a certain level of protection. They use regular expressions or fingerprint matching to classify and filter user input, thereby preventing hacker attacks. However, with the ever-changing types and methods of attacks, attackers often need to detect the internal rules of the targeted web application firewall, such as SQL injection rules. Furthermore, with the application of deep learning technology, deep learning is also being applied to WAFs.

[0003] When launching attacks against web applications, such as SQL injection attacks, attackers often need to detect the firewall's SQL defense rules to circumvent the firewall. However, there is currently no method that can automatically detect and extract SQL injection defense rules from web application firewalls. This would better assist attackers in constructing attack code and increase their attack success rate. This method can also be used to verify the security of the web application firewall's SQL injection defense rules themselves, ensuring the security of the web application firewall. Furthermore, due to the difficulty of interpreting deep learning models, and the need for a certain degree of interpretability in web application firewalls, a method is needed to extract SQL defense rules from black-box web application firewalls and explain the detection logic of the web application firewall. Furthermore, deep learning models require extensive computational processing of input, resulting in a lower overall processing speed compared to regular rules. Therefore, web application firewall owners are also seeking to replace the internal logic of deep learning-based web application firewalls with regular rules to increase their speed.

[0004] Therefore, the present invention designs a method for extracting regular rules for SQL injection defense against web application firewalls. Unlike traditional methods for bypassing attacks against web application firewalls, this method for extracting SQL injection defense rules from web application firewalls primarily extracts the internal SQL injection classification logic and converts it into regular rules. The extracted regular rules are then aligned with the data classification of the regular rules of the attacked web application firewall. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the prior art and provide a method and device for extracting regular rules for SQL injection defense in a Web application firewall.

[0006] The object of the present invention is to achieve the following technical solution: a method for extracting regular rules for SQL injection defense of a Web application firewall, comprising the following steps:

[0007] (1) Randomly sort the SQL injection data input by the user to form a query data set D1; initiate a query for the extracted Web application firewall, simplify the return of the extracted Web application firewall, and obtain a data set D2;

[0008] (2) Perform word segmentation on dataset D2 to obtain dataset D3. Count the N decision words that appear the most times in dataset D3 and count the frequency of occurrence of each decision word to obtain dataset D4. Construct a decision tree T using datasets D2 and D4 and the CART algorithm.

[0009] (3) Convert the decision tree T into a set of regular rules.

[0010] Furthermore, the step (1) includes the following sub-steps:

[0011] (1.1) Collect the SQL injection data input by the user, including P SQL injection samples and P normal SQL query samples. Use the random sequence generation algorithm to assign a sequence number to each sample and perform random sorting to form a query data set D1: D1 = {X1, X2, ..., X h ,…,X 2P}, where X h For any sample, h=1,2,…,h,…,2P;

[0012] (1.2) Using any sample X in the query dataset D1 h , initiate a query on the extracted Web application firewall, simplify the return of the extracted Web application firewall to L h , when L h =0 means it is allowed to pass. When L h =1 means no passing;

[0013] Repeat the above steps for each sample in the query data set D1, get the corresponding return for each sample, and get the data set D2: D2 = {L1, L2, ..., L h ,…,L 2P}.

[0014] Furthermore, the step (2) includes the following sub-steps:

[0015] (2.1) Using spaces and single-character English punctuation characters other than underscores as word separators, for any sample X in the query dataset D1, h Perform word segmentation to obtain word list Y h When segmenting words, retain all word separators except spaces and treat each word separator as a separate word. After segmentation, save each sample as a list of words, where each element in the list is a word obtained after segmentation, in the same order as it appears in the original sample.

[0016] Repeat the above steps for each sample in the query data set D1 to obtain the data set D3: D3 = {Y1, Y2, ..., Y h ,…,Y 2P};

[0017] (2.2) Count the N decision words that appear the most times in the statistical data set D3 and sort them from high to low according to the number of occurrences, and record them as: Token1, Token2, ..., Tokeni, ..., TokenN;

[0018] (2.3) Count any word list Y in the statistical data set D3 h The number of Token1, Token2, ..., Tokeni, ..., TokenN that appear in the Token1, Token2, ..., Tokeni, ..., TokenN are respectively denoted as: Num Token1,h 、Num Token2,h 、…、Num Tokeni,h 、…、Num TokenN,h , get the array Z h ={Num Token1,h ,Num Token2,h ,…,Num Tokeni,h ,…,Num TokenN,h}, where Num T o keni,h Indicates the i-th decision word in the word list Y h Repeat the above steps for each word list in the dataset D3 to obtain the dataset D4: D4={Z1,Z2,…,Z h ,…,Z 2P};

[0019] (2.4) Construct a decision tree T using datasets D2 and D4 and the CART algorithm.

[0020] Furthermore, the step (3) includes the following sub-steps:

[0021] (3.1) Using the backtracking algorithm, we extract K decision paths from the root node to the leaf node in the decision tree T: decision path Dec1, decision path Dec2, ..., decision path DecK;

[0022] (3.2) Process the decision path Dec1 to obtain a new decision path Dec1′;

[0023] (3.3) Convert the new decision path Dec1′ into a regular rule Regex;

[0024] (3.4) Repeat steps (3.2) to (3.3) to convert the decision paths Dec1, Dec2, ..., DecK in the decision tree T into corresponding regular rules, and obtain a set of regular rules.

[0025] Furthermore, the step (3.2) includes the following sub-steps:

[0026] (3.2.1) Processing the decision path Dec1: The decision path Dec1 consists of M decisions and a leaf node E1, and the leaf node E1 represents the output of the decision path Dec1; wherein, the form of any decision is: min j ≤NUM j or NUM j <max j , NUM j A random Num Tokeni,h , min j is the minimum threshold value of the j-th decision in the decision path Dec1, max j is the maximum value of the threshold of the j-th decision in the decision path Dec1, j = 1, 2, ..., j, ..., M;

[0027] (3.2.2) For the M decisions in the decision path Dec1, filter out all decisions containing the decision word Tokeni. If the decision path Dec1 does not contain a decision with the decision word Tokeni, repeat the above steps for the next decision word. If the decision path Dec1 contains a decision with the decision word Tokeni, construct a new decision:

[0028] When all decisions containing the decision word Tokeni are of the form min j ≤NUM j When j Mini , and to Min i Round up to get (Min i )′, and get a new decision Q i :(Min i )′≤NUM Tokeni And add it to the decision path Dec1, and delete other decisions containing the decision word Tokeni;

[0029] When all decisions containing the decision word Tokeni are in the form of NUM j <max j When , select the smallest max j Max i ; If Max i is an integer, and we get (Max i )′=Max i -1; if Max i If it is a non-integer, round it down to get (Max i )′; thus obtaining a new decision Q i :NUM Tokeni ≤(Max i )′ and added to the decision path Dec1, while deleting other decisions containing the decision word Tokeni;

[0030] When all decisions containing the decision word Tokeni are of the form min j ≤NUM j or NUM j <max j When j Min i And select the smallest max j Max i , to Min i Round up to get (Min i )′;If Max i is an integer, and we get (Max i )′=Max i -1; if Max i If it is a non-integer, round it down to get (Max i )′; thus obtaining a new decision Q i :(Min i )′≤NUM Tokeni ≤(Max i )′ and added to the decision path Dec1, while deleting other decisions containing the decision word Tokeni.

[0031] Furthermore, the step (3.3) includes the following sub-steps:

[0032] (3.3.1) For any decision Q in the decision path Dec1′ i , when the decision Q i The form is (Min i )′≤NUM Tokeni ≤(Max i )′, the decision Q i Converted to regular expression: ^((((?!(\bTokeni\b)).)*)(\bTokeni\b)){(Min i )′,(Max i )′}(((?!(\bTokeni\b)).)*)$;

[0033] When the decision Q i The form is NUM Tokeni ≤(Max i )′ and (Max i )′=0, the decision Q i Converted to regular expression: ^(((?!(\bTokeni\b)).)*)$;

[0034] When the decision Q i The form is NUM Tokeni ≤(Max i )′ and (Max i )′>0, the decision Q i Converted to regular expression: ^((((?!(\bTokeni\b)).)*)(\bTokeni\b)){0,(Max i )′}(((?!(\bTokeni\b)).)*)$;

[0035] When the decision Q i The form is (Min i )′≤NUM Tokeni When the decision Q i Converted to regular expression: ^((((?!(\bTokeni\b)).)*)(\bTokeni\b)){(Min i )′,}(((?!(\bTokeni\b)).)*)$;

[0036] (3.3.2) Repeat step (c3.1) for the M2 decisions in the decision path Dec1′, convert the M2 decisions in the decision path Dec1′ into corresponding regular expressions, and obtain a regular rule Regex, wherein the regular rule Regex contains M2 regular expressions; and use the leaf node E1 as the output of the regular rule Regex.

[0037] The present invention also provides a Web application firewall SQL injection defense regular rule extraction device, comprising: a Web application firewall query module, a Web application firewall logic extraction module and a regular rule generation module;

[0038] The Web application firewall query module is used to randomly sort the SQL injection data input by the user to form a query data set D1; initiate a query on the extracted Web application firewall, simplify the return of the extracted Web application firewall, and obtain a data set D2;

[0039] The Web application firewall logic extraction module is used to perform word segmentation processing on the data set D2 to obtain a data set D3, calculate the N decision words that appear the most times in the data set D3, and calculate the frequency of occurrence of each decision word to obtain a data set D4; and construct a decision tree T using the data set D2, the data set D4 and the CART algorithm;

[0040] The regular rule generation module is used to convert the decision tree T into a set of regular rules.

[0041] The present invention also provides a Web application firewall SQL injection defense regular rule extraction device, which includes one or more processors for implementing the above-mentioned Web application firewall SQL injection defense regular rule extraction method.

[0042] The present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, it is used to implement the above-mentioned Web application firewall SQL injection defense regular rule extraction method.

[0043] The beneficial effects of the present invention are:

[0044] (1) The present invention deeply analyzes the internal principle of the SQL injection defense function of the web application firewall, uses a data query method to analyze and extract the internal logic of the SQL injection defense function of the web application firewall, and converts it into regular rules to meet its interpretability. In addition, the extracted rules and the extracted SQL injection defense function of the web application firewall have highly similar classification results for normal samples and SQL injection samples in a preferred SQL injection dataset;

[0045] (2) The present invention uses a decision tree to extract SQL injection defense rules from a Web application firewall and converts them into regular rules, thereby ensuring the interpretability of the regular rule generation process and the similarity with the extracted Web application firewall SQL injection defense function;

[0046] (3) The present invention can extract regular rules for defending against SQL injection from a Web application firewall based on a deep learning model. The deep learning model contains tens of thousands of parameters, and tens of thousands of calculations are required for the input. Regular rules are a character matching algorithm, and the amount of calculation is less than that of the deep learning model. Therefore, the present invention can improve the classification processing speed of the input of the Web application firewall based on the deep learning model to a certain extent, and reduce the impact of the Web application firewall based on the deep learning model on the performance of the Web application. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 Schematic diagram of the process of step (1) in Example 1;

[0048] Figure 2 Schematic diagram of the process of step (2) in Example 1;

[0049] Figure 3 Schematic diagram of the process of step (3) in Example 1;

[0050] Figure 4 This is a schematic diagram of a device for extracting regular rules from a Web application firewall SQL injection defense system in Example 2;

[0051] Figure 5 This is a structural diagram of a Web application firewall SQL injection defense regular rule extraction device in Example 3. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to illustrate the present invention, rather than to represent all embodiments. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0053] Example 1

[0054] The present invention provides a method for extracting regular rules for SQL injection defense of a Web application firewall, comprising the following steps:

[0055] (1) Randomly sort the SQL injection data input by the user to form a query data set D1; initiate a query for the extracted Web application firewall, simplify the return of the extracted Web application firewall, and obtain a data set D2; Figure 1 shown.

[0056] The step (1) includes the following sub-steps:

[0057] (1.1) Collect the SQL injection data input by the user, including P SQL injection samples and P normal SQL query samples. Use the random sequence generation algorithm to assign a sequence number to each sample and perform random sorting to form a query data set D1: D1 = {X1, X2, ..., X h ,…,X 2P}, where X h For any sample, h=1,2,…,h,…,2P;

[0058] (1.2) Determine the extracted Web application firewall; use any sample X in the query dataset D1 h , initiate a query on the extracted Web application firewall, simplify the return of the extracted Web application firewall to L h , when L h =0 means it is allowed to pass. When L h =1 means no passing;

[0059] Repeat the above steps for each sample in the query data set D1, get the corresponding return for each sample, and get the data set D2: D2 = {L1, L2, ..., L h ,…,L 2P}.

[0060] (2) Perform word segmentation on the dataset D2 to obtain the dataset D3. Count the N decision words that appear the most times in the dataset D3 and count the frequency of each decision word to obtain the dataset D4. Use the datasets D2 and D4 and the CART algorithm to construct a decision tree T. Figure 2 shown.

[0061] The step (2) includes the following sub-steps:

[0062] (2.1) Using spaces and single-character English punctuation characters other than underscores as word separators, for any sample X in the query dataset D1, h Perform word segmentation to obtain word list Y hWhen segmenting words, retain all word separators except spaces and treat each word separator as a separate word. After segmentation, save each sample as a list of words, where each element in the list is a word obtained after segmentation, in the same order as it appears in the original sample.

[0063] Repeat the above steps for each sample in the query data set D1 to obtain the data set D3: D3 = {Y1, Y2, ..., Y h ,…,Y 2P};

[0064] (2.2) Count the N decision words that appear the most times in the statistical data set D3 and sort them from high to low according to the number of occurrences, and record them as: Token1, Token2, ..., Tokeni, ..., TokenN;

[0065] (2.3) Count any word list Y in the statistical data set D3 h The number of Token1, Token2, ..., Tokeni, ..., TokenN that appear in the Token1, Token2, ..., Tokeni, ..., TokenN are respectively denoted as: Num Token1,h 、Num Token2,h 、…、Num Tokeni,h 、…、Num TokenN,h , get the array Z h ={Num Token1,h ,Num Token2,h ,…,Num Tokeni,h ,…,Num TokenN,h}, where Num T o keni,h Indicates the i-th decision word in the word list Y h Repeat the above steps for each word list in the dataset D3 to obtain the dataset D4: D4={Z1,Z2,…,Z h ,…,Z 2P};

[0066] (2.4) Construct a decision tree T using datasets D2 and D4 and the CART algorithm.

[0067] (3) Convert the decision tree T into a set of regular rules; Figure 3 shown.

[0068] The step (3) includes the following sub-steps:

[0069] (3.1) Using the backtracking algorithm, we extract K decision paths from the root node to the leaf node in the decision tree T: decision path Dec1, decision path Dec2, ..., decision path DecK.

[0070] (3.2) The decision path Dec1 is processed to obtain a new decision path Dec1′.

[0071] The step (3.2) includes the following sub-steps:

[0072] (3.2.1) Processing the decision path Dec1: The decision path Dec1 consists of M decisions and a leaf node E1, and the leaf node E1 represents the output of the decision path Dec1; wherein, the form of any decision is: min j ≤NUM j or NUM j <max j , NUM j A random Num Tokeni,h , min j is the minimum threshold value of the j-th decision in the decision path Dec1, max j is the maximum value of the threshold of the j-th decision in the decision path Dec1, j = 1, 2, ..., j, ..., M;

[0073] (3.2.2) For the M decisions in the decision path Dec1, filter out all decisions containing the decision word Tokeni. If the decision path Dec1 does not contain a decision with the decision word Tokeni, repeat the above steps for the next decision word. If the decision path Dec1 contains a decision with the decision word Tokeni, construct a new decision:

[0074] When all decisions containing the decision word Tokeni are of the form min j ≤NUM j When j Min i , and to Min i Round up to get (Min i )′, and get a new decision Q i :(Min i )′≤NUM Tokeni And add it to the decision path Dec1, and delete other decisions containing the decision word Tokeni;

[0075] When all decisions containing the decision word Tokeni are in the form of NUM j <max j When , select the smallest max j Max i ; If Max i is an integer, and we get (Max i )′=Max i -1; if Max iIf it is a non-integer, round it down to get (Max i )′; thus obtaining a new decision Q i :NUM Tokeni ≤(Max i )′ and added to the decision path Dec1, while deleting other decisions containing the decision word Tokeni;

[0076] When all decisions containing the decision word Tokeni are of the form min j ≤NUM j or NUM j <max j When j Min i And select the smallest max j Max i , to Min i Round up to get (Min i )′;If Max i is an integer, and we get (Max i )′=Max i -1; if Max i If it is a non-integer, round it down to get (Max i )′; thus obtaining a new decision Q i :(Min i )′≤NUM Tokeni ≤(Max i )′ and added to the decision path Dec1, while deleting other decisions containing the decision word Tokeni.

[0077] (3.3) Convert the new decision path Dec1′ into a regular rule Regex;

[0078] The step (3.3) includes the following sub-steps:

[0079] (3.3.1) For any decision Q in the decision path Dec1′ i , when the decision Q i The form is (Min i )′≤NUM Tokeni ≤(Max i )′, the decision Q i Converted to regular expression: ^((((?!(\bTokeni\b)).)*)(\bTokeni\b)){(Min i )′,(Max i )′}(((?!(\bTokeni\b)).)*)$;

[0080] When the decision Q i The form is NUM Tokeni ≤(Max i )′ and (Max i )′=0, the decision Q i Converted to regular expression: ^(((?!(\bTokeni\b)).)*)$;

[0081] When the decision Q i The form is NUM Tokeni ≤(Max i )′ and (Max i )′>0, the decision Q i Converted to regular expression: ^((((?!(\bTokeni\b)).)*)(\bTokeni\b)){0,(Max i )′}(((?!(\bTokeni\b)).)*)$;

[0082] When the decision Q i The form is (Min i )′≤NUM Tokeni When the decision Q i Converted to regular expression: ^((((?!(\bTokeni\b)).)*)(\bTokeni\b)){(Min i )′,}(((?!(\bTokeni\b)).)*)$;

[0083] (3.3.2) Repeat step (c3.1) for the M2 decisions in the decision path Dec1′, convert the M2 decisions in the decision path Dec1′ into corresponding regular expressions, and obtain a regular rule Regex, wherein the regular rule Regex contains M2 regular expressions; and use the leaf node E1 as the output of the regular rule Regex.

[0084] (3.4) Repeat steps (3.2) to (3.3) to convert the decision paths Dec1, Dec2, ..., DecK in the decision tree T into corresponding regular rules, and obtain a set of regular rules.

[0085] Example 2

[0086] like Figure 4 As shown, the present invention provides a Web application firewall SQL injection defense regular rule extraction device, comprising: a Web application firewall query module, a Web application firewall logic extraction module and a regular rule generation module;

[0087] The Web application firewall query module is used to randomly sort the SQL injection data input by the user to form a query data set D1; initiate a query on the extracted Web application firewall, simplify the return of the extracted Web application firewall, and obtain a data set D2;

[0088] The Web application firewall logic extraction module is used to perform word segmentation processing on the data set D2 to obtain a data set D3, calculate the N decision words that appear the most times in the data set D3, and calculate the frequency of occurrence of each decision word to obtain a data set D4; and construct a decision tree T using the data set D2, the data set D4 and the CART algorithm;

[0089] The regular rule generation module is used to convert the decision tree T into a set of regular rules.

[0090] Example 3

[0091] Corresponding to the aforementioned embodiment 1 of the method for extracting regular rules for SQL injection defense of a Web application firewall, the present invention also provides an embodiment of a device for extracting regular rules for SQL injection defense of a Web application firewall.

[0092] See also Figure 5 An embodiment of the present invention provides a Web application firewall SQL injection defense regular rule extraction device, which includes one or more processors for implementing a Web application firewall SQL injection defense regular rule extraction method in the above embodiment.

[0093] The embodiment of the Web application firewall SQL injection defense regular rule extraction device of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory for execution. From the hardware level, if Figure 5 As shown in the figure, it is a hardware structure diagram of a device with data processing capability where a Web application firewall SQL injection defense regular rule extraction device of the present invention is located. Figure 5 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiment is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0094] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0095] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present invention. A person of ordinary skill in the art can understand and implement the present invention without inventive work.

[0096] An embodiment of the present invention also provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, it implements a method for extracting regular rules for SQL injection defense against a Web application firewall in the above-mentioned embodiment. The computer-readable storage medium can be an internal storage unit of any device with data processing capabilities described in any of the above-mentioned embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device of any device with data processing capabilities, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium can also include both an internal storage unit and an external storage device of any device with data processing capabilities. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and can also be used to temporarily store data that has been output or is to be output.

[0097] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for extracting regular rules for SQL injection defense in a Web application firewall, characterized in that: The following steps are involved: (1) Randomly sort the SQL injection data input by the user to form a query data set D1; initiate a query for the extracted Web application firewall, simplify the return of the extracted Web application firewall, and obtain a data set D2; (2) Perform word segmentation on the query data set D1 to obtain data set D3. Count the N decision words that appear the most times in data set D3, and count the frequency of occurrence of each decision word to obtain data set D4. Use data sets D2, D4 and the CART algorithm to construct a decision tree T. (3) Convert the decision tree T into a set of regular rules; The step (3) includes the following sub-steps: (3.1) Use the backtracking algorithm to extract K decision paths from the root node to the leaf node in the decision tree T: decision path Dec1, decision path Dec2, ..., decision path DecK; (3.2) Process the decision path Dec1 to obtain a new decision path ; (3.3) The new decision path Convert to regular rule Regex; (3.4) Repeat steps (3.2) to (3.3) to convert the decision paths Dec1, Dec2, …, and DecK in the decision tree T into corresponding regular rules to obtain a set of regular rules.

2. A Web application firewall SQL injection defense regular rule extraction method according to claim 1, characterized in that: The step (1) includes the following sub-steps: (1.1) Collect SQL injection data input by users, including P SQL injection samples and P normal SQL query samples. Use a random sequence generation algorithm to assign a sequence number to each sample and randomly sort them to form a query dataset D1: ,in, For any sample, ; (1.2) Use any sample in the query dataset D1 , initiate a query on the extracted Web application firewall, and simplify the return of the extracted Web application firewall to ,when Indicates that passage is allowed. Indicates that passage is prohibited; Repeat the above steps for each sample in the query dataset D1, get the corresponding response for each sample, and get the dataset D2: .

3. A Web application firewall SQL injection defense regular rule extraction method according to claim 1, characterized in that: The step (2) includes the following sub-steps: (2.1) Use spaces and single-character English punctuation characters other than underscores as word separators to query any sample in the dataset D1. Perform word segmentation to obtain a word list When segmenting words, retain all word separators except spaces and treat each word separator as a separate word. After segmentation, save each sample as a list of words, where each element in the list is a word obtained after segmentation, in the same order as it appears in the original sample. Repeat the above steps for each sample in the query dataset D1 to obtain dataset D3: ; (2.2) Count the N decision words that appear the most times in the statistical data set D3 and sort them from high to low according to the number of occurrences, and record them as: 、 、…、 、…、 ; (2.3) Count any word list in the statistical data set D3 middle 、 、…、 、…、 The number of occurrences is recorded as: 、 、…、 、…、 , get the array ,in, Indicates the i-th decision word in the word list The number of occurrences in Repeat the above steps for each word list in dataset D3 to obtain dataset D4: ; (2.4) Construct a decision tree T using datasets D2 and D4 and the CART algorithm.

4. A Web application firewall SQL injection defense regular rule extraction method according to claim 3, characterized in that: The step (3.2) includes the following sub-steps: (3.2.1) Processing the decision path Dec1: The decision path Dec1 consists of M decision nodes and leaf nodes The leaf nodes represents the output of the decision path Dec1; where any decision is in the form of: or , For a random , is the minimum threshold value of the j-th decision in the decision path Dec1, is the maximum threshold value of the j-th decision in the decision path Dec1, ; (3.2.2) For the M decisions in the decision path Dec1, filter out all the decisions containing the decision word If the decision path Dec1 does not contain the decision word Repeat the above steps for the next decision word; if the decision path Dec1 contains the decision word , then construct a new decision: When all contain decision words The decision-making forms are When Recorded as , and Round up to get , get a new decision : And add it to the decision path Dec1, and delete other decision words decision-making; When all contain decision words The decision-making forms are When Recorded as ;like is an integer, we get ;like For non-integer Round down to get ; thus getting a new decision : And add it to the decision path Dec1, and delete other decision words decision-making; When all contain decision words The decision-making form is or When Recorded as And select the smallest Recorded as ,right Round up to get ;like is an integer, we get ;like For non-integer Round down to get ; thus getting a new decision : And add it to the decision path Dec1, and delete other decision words decision.

5. A Web application firewall SQL injection defense regular rule extraction method according to claim 4, characterized in that: The step (3.3) includes the following sub-steps: (3.3.1) For decision paths Any decision , when making decisions The form is When the decision Converted to regular expression: ^((((?!(\bTokeni\b)).)∗)(\bTokeni\b)){ , }(((?!(\bTokeni\b)).)*)$; When decision The form is and When the decision Converted to regular expression: ^(((?!(\bTokeni\b)).)∗)$; When decision The form is and When the decision Converted to regular expression: ^((((?!(\bTokeni\b)).)∗)(\bTokeni\b)){0, }(((?!(\bTokeni\b)).)∗)$; When decision The form is When the decision Converted to regular expression: ^((((?!(\bTokeni\b)).)∗)(\bTokeni\b)){ ,}(((?!(\bTokeni\b)).)∗)$; (3.3.2) Decision path Repeat step (3.3.1) for M2 decisions and convert the decision path The M2 decisions are converted into corresponding regular expressions to obtain the regular rule Regex, which contains M2 regular expressions; and the leaf node As the output of the regular rule Regex.

6. A web application firewall SQL injection defense regular rule extraction device, characterized in that: include: Web application firewall query module, Web application firewall logic extraction module and regular rule generation module; The Web application firewall query module is used to randomly sort the SQL injection data input by the user to form a query data set D1; initiate a query on the extracted Web application firewall, simplify the return of the extracted Web application firewall, and obtain a data set D2; The Web application firewall logic extraction module is used to perform word segmentation processing on the query data set D1 to obtain a data set D3, calculate the N decision words that appear the most times in the data set D3, and calculate the frequency of occurrence of each decision word to obtain a data set D4; and construct a decision tree T using the data set D2, the data set D4 and the CART algorithm; The regular rule generation module is used to convert the decision tree T into a set of regular rules; The conversion of the decision tree T into a set of regular rules includes the following sub-steps: (3.1) Use the backtracking algorithm to extract K decision paths from the root node to the leaf node in the decision tree T: decision path Dec1, decision path Dec2, ..., decision path DecK; (3.2) Process the decision path Dec1 to obtain a new decision path ; (3.3) The new decision path Convert to regular rule Regex; (3.4) Repeat steps (3.2) to (3.3) to convert the decision paths Dec1, Dec2, …, and DecK in the decision tree T into corresponding regular rules to obtain a set of regular rules.

7. A web application firewall SQL injection defense regular rule extraction device, characterized in that: The method comprises one or more processors for implementing the method for extracting regular rules for SQL injection defense against Web application firewalls according to any one of claims 1 to 5.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, it is used to implement the Web application firewall SQL injection defense regular rule extraction method described in any one of claims 1 to 5.

Images