A SQL injection vulnerability detection method, device, equipment and medium

Abstract

The application provides a SQL injection vulnerability detection method, device, equipment and medium, the method comprises the following steps: obtaining a first DOM tree and a second DOM tree to be compared, wherein the first DOM tree is a DOM tree corresponding to a normal web page, and the second DOM tree is a DOM tree corresponding to a web page to be compared; determining whether the sequence length of the first leaf node and the sequence length of the second leaf node are the same; if not, it is determined that a SQL injection vulnerability is detected; if yes, according to the first distance between the two nodes of the first key node pair of the first DOM tree and the second distance between the two nodes of the second key node pair of the second DOM tree, it is determined whether a SQL injection vulnerability is detected. Therefore, the application avoids a large consumption of client resources, saves the time of SQL injection vulnerability detection, improves the efficiency of SQL injection vulnerability detection, and improves the detection accuracy.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, apparatus, device and medium for detecting SQL injection vulnerabilities. Background Technology

[0002] SQL (Structured Query Language) injection vulnerability detection refers to the use of certain techniques to inject SQL into the URL (Uniform Resource Locator) of a target web site, executing query statements in the database and thus generating SQL code. SQL injection vulnerabilities can bypass authentication, steal user information, or tamper with data, causing security problems.

[0003] Currently, the detection of SQL injection vulnerabilities is mainly divided into three methods: white-box detection, black-box detection, and DOM tree construction. White-box detection technology primarily analyzes the source code, using static or dynamic detection methods to discover potential SQL injection vulnerabilities in the program code. Black-box detection technology, on the other hand, does not require knowledge of the system source code and database structure; instead, it directly analyzes the returned results to determine whether SQL injection vulnerabilities exist. DOM tree construction, however, detects SQL injection vulnerabilities by judging the status codes, size, length, and keywords of the page resources returned by the server.

[0004] The above three methods have the following drawbacks: white-box and black-box detection technologies have low detection accuracy and efficiency, while the method of building a DOM tree requires recording and traversing all nodes in the tree, which is time-consuming when the page is complex, has low detection efficiency, is prone to errors, and has low accuracy. Summary of the Invention

[0005] This invention provides a method, apparatus, device, and medium for detecting SQL injection vulnerabilities, in order to solve the technical problem that the efficiency and accuracy of SQL injection vulnerability detection methods in related technologies are both low.

[0006] In a first aspect, embodiments of the present invention provide a method for detecting SQL injection vulnerabilities, the method comprising:

[0007] Obtain the first DOM tree and the second DOM tree to be compared, wherein the first DOM tree is the DOM tree corresponding to the normal web page, and the second DOM tree is the DOM tree corresponding to the web page to be compared;

[0008] Determine whether the sequence length of the first leaf node is the same as the sequence length of the second leaf node;

[0009] If not, then an SQL injection vulnerability has been detected.

[0010] If so, then determine whether an SQL injection vulnerability has been detected based on the first distance between the two nodes of the first critical node pair in the first DOM tree and the second distance between the two nodes of the second critical node pair in the second DOM tree.

[0011] Optionally, determining whether an SQL injection vulnerability has been detected based on a first distance between two nodes in a first key node pair of the first DOM tree and a second distance between two nodes in a second key node pair of the second DOM tree includes:

[0012] In the first DOM tree, a preset number of first key node pairs are selected, and in the second DOM tree, a preset number of second key node pairs corresponding one-to-one with the first key node pairs are selected;

[0013] Determine the first distance between the two nodes of each pair of first key nodes to be compared, and determine the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared.

[0014] If the first distance between the two nodes of each pair of first key nodes to be compared is the same as the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared, then it is determined that the SQL injection vulnerability has not been detected.

[0015] If the comparison results show that the first distance and the second distance are different, then it is determined that the SQL injection vulnerability has been detected.

[0016] Optionally, obtaining the first DOM tree and the second DOM tree to be compared includes:

[0017] The first DOM tree is generated based on the HTML file;

[0018] Using ess files and / or Javascript files, based on the first DOM tree, render and generate the normal web page;

[0019] After rendering and generating the normal web page, obtain the first DOM tree;

[0020] When page elements in the normal web page change, the DOM tree corresponding to the web page whose page elements have changed is obtained, and the DOM tree is used as the second DOM tree.

[0021] Optionally, in the first DOM tree, selecting a preset number of first key node pairs includes:

[0022] Based on the first DOM tree, determine the traversal path set (p1, p2, ..., p...). n );

[0023] In the set of traversal paths, the frequency of each traversal path becoming a critical traversal path is determined sequentially, forming a frequency set (f1, f2, ..., f...). n );

[0024] Based on the total length set of common substrings corresponding to the traversal path set (L1, L2, ..., L...), n ) and the frequency set (f1, f2, ..., f) corresponding to the traversal path set. n ), from the traversal path set (p1, p2, ..., p) of the first DOM tree n Select the most critical path from the given information.

[0025] On the most critical path, a preset number of first critical node pairs are randomly selected.

[0026] Optionally, based on the first DOM tree, determine the traversal path set (p1, p2, ..., p...). n Prior to this, the method further includes:

[0027] Obtain the node information of the first DOM tree, and based on the node information, extract N keywords corresponding to the first DOM tree to form a keyword set (k1, k2, ..., k). n );

[0028] After determining the traversal path set (p1, p2, ..., p...), n Following this, the method further includes:

[0029] The keyword set (k1, k2, ..., k) is used to... n Each keyword in the set is associated with the traversal path set (p1, p2, ..., p...). n Each traversal path in the sequence is matched to obtain the length of the common substring matched by each keyword under each traversal path;

[0030] For each keyword, determine the length of the longest common substring among all common substring lengths that match the keyword;

[0031] The traversal path corresponding to the length of the longest common substring is determined as the key traversal path; where N is a positive integer.

[0032] Optionally, based on the total length set of common substrings corresponding to the traversed path set (L1, L2, ..., L...), n ) and the frequency set (f1, f2, ..., f) corresponding to the traversal path set.n ), from the traversal path set (p1, p2, ..., p) of the first DOM tree n In the selection process, the most critical path is chosen, including:

[0033] Based on the frequency set (f1, f2, ..., f n Determine the fitting weight δ for each traversal path, forming a fitting weight set (δ1, δ2, ..., δ). n );

[0034] The total length set of the common substrings (L1, L2, ..., L) n ) and the fitted weight set (δ1, δ2, ..., δ n Perform the corresponding fitting to obtain the fitting length set (L1*δ1, L2*δ2, ..., L...). n *δ n );

[0035] The traversal path corresponding to the maximum fitting length in the set of fitting lengths is determined as the most critical path.

[0036] Optionally, determining the first distance between the two nodes of each pair of first key nodes to be compared includes:

[0037] Traverse the first DOM tree to obtain the nearest first common ancestor node corresponding to each pair of first key nodes;

[0038] Determine the distances from each node to the first common ancestor node in each pair of first key nodes;

[0039] The sum of the distances from the two nodes to the first common ancestor node is determined as the first distance between the two nodes; and / or,

[0040] Determining the second distance between the two nodes of the second key node pair corresponding to the first key node pair to be compared includes:

[0041] Traverse the second DOM tree to obtain the nearest second common ancestor node for each pair of second key nodes;

[0042] Determine the distances from each of the two nodes to the second common ancestor node in each pair of second key nodes;

[0043] The sum of the distances from the two nodes to the second common ancestor node is determined as the second distance between the two nodes.

[0044] Secondly, embodiments of the present invention provide an SQL injection vulnerability detection device, the device comprising:

[0045] The acquisition module is used to acquire the first DOM tree and the second DOM tree to be compared, wherein the first DOM tree is the DOM tree corresponding to the normal web page, and the second DOM tree is the DOM tree corresponding to the web page to be compared;

[0046] The execution module is used to determine whether the sequence length of the first leaf node and the sequence length of the second leaf node are the same;

[0047] If not, then an SQL injection vulnerability has been detected.

[0048] If so, then determine whether an SQL injection vulnerability has been detected based on the first distance between the two nodes of the first critical node pair in the first DOM tree and the second distance between the two nodes of the second critical node pair in the second DOM tree.

[0049] Optionally, the execution module is further configured to select a preset number of first key node pairs in the first DOM tree, and select a preset number of second key node pairs that correspond one-to-one with the first key node pairs in the second DOM tree;

[0050] Determine the first distance between the two nodes of each pair of first key nodes to be compared, and determine the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared.

[0051] If the first distance between the two nodes of each pair of first key nodes to be compared is the same as the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared, then it is determined that the SQL injection vulnerability has not been detected.

[0052] If the comparison results show that the first distance and the second distance are different, then it is determined that the SQL injection vulnerability has been detected.

[0053] Optionally, the acquisition module is further configured to generate the first DOM tree based on the HTML file;

[0054] Using ess files and / or Javascript files, based on the first DOM tree, render and generate the normal web page;

[0055] After rendering and generating the normal web page, obtain the first DOM tree;

[0056] When page elements in the normal web page change, the DOM tree corresponding to the web page whose page elements have changed is obtained, and the DOM tree is used as the second DOM tree.

[0057] Optionally, the execution module is further configured to determine the traversal path set (p1, p2, ..., p) based on the first DOM tree. n );

[0058] In the set of traversal paths, the frequency of each traversal path becoming a critical traversal path is determined sequentially, forming a frequency set (f1, f2, ..., f...). n );

[0059] Based on the total length set of common substrings corresponding to the traversal path set (L1, L2, ..., L...), n ) and the frequency set (f1, f2, ..., f) corresponding to the traversal path set. n ), from the traversal path set (p1, p2, ..., p) of the first DOM tree n Select the most critical path from the given information.

[0060] On the most critical path, a preset number of first critical node pairs are randomly selected.

[0061] Optionally, the execution module is further configured to determine, based on the first DOM tree, a set of traversal paths (p1, p2, ..., p...). n Before that, obtain the node information of the first DOM tree, and based on the node information, extract N keywords corresponding to the first DOM tree to form a keyword set (k1, k2, ..., k). n );

[0062] After determining the traversal path set (p1, p2, ..., p...), n After that, the keyword set (k1, k2, ..., k) is... n Each keyword in the set is associated with the traversal path set (p1, p2, ..., p...). n Each traversal path in the sequence is matched to obtain the length of the common substring matched by each keyword under each traversal path;

[0063] For each keyword, determine the length of the longest common substring among all common substring lengths that match the keyword;

[0064] The traversal path corresponding to the length of the longest common substring is determined as the key traversal path; where N is a positive integer.

[0065] Optionally, the execution module is further configured to, based on the frequency set (f1, f2, ..., f... n Determine the fitting weight δ for each traversal path, forming a fitting weight set (δ1, δ2, ..., δ). n );

[0066] The total length set of the common substrings (L1, L2, ..., L) n ) and the fitted weight set (δ1, δ2, ..., δ n Perform the corresponding fitting to obtain the fitting length set (L1*δ1, L2*δ2, ..., L...). n *δ n );

[0067] The traversal path corresponding to the maximum fitting length in the set of fitting lengths is determined as the most critical path.

[0068] Optionally, the execution module is further configured to traverse the first DOM tree and obtain the nearest first common ancestor node corresponding to each pair of first key nodes;

[0069] Determine the distances from each node to the first common ancestor node in each pair of first key nodes;

[0070] The sum of the distances from the two nodes to the first common ancestor node is determined as the first distance between the two nodes; and / or,

[0071] Traverse the second DOM tree to obtain the nearest second common ancestor node for each pair of second key nodes;

[0072] Determine the distances from each of the two nodes to the second common ancestor node in each pair of second key nodes;

[0073] The sum of the distances from the two nodes to the second common ancestor node is determined as the second distance between the two nodes.

[0074] Thirdly, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of an SQL injection vulnerability detection method as described in the first aspect.

[0075] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of an SQL injection vulnerability detection method as described in the first aspect.

[0076] Therefore, compared with related technologies that compare the sequences of all nodes generated by two DOM trees to determine SQL injection vulnerabilities, the method shown in this embodiment of the invention does not require comparing all node sequences. Instead, it first compares the length of the node sequences and then compares the node distances of key node pairs. This avoids a large consumption of client resources, saves the time for SQL injection vulnerability detection, improves the efficiency of SQL injection vulnerability detection, and improves the accuracy of detection. Attached Figure Description

[0077] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0078] Figure 1 A flowchart illustrating an SQL injection vulnerability detection method provided in an embodiment of the present invention;

[0079] Figure 2 A flowchart illustrating an SQL injection vulnerability detection method provided in an embodiment of the present invention;

[0080] Figure 3 A schematic diagram of a DOM tree structure provided in an embodiment of the present invention;

[0081] Figure 4 A flowchart illustrating an SQL injection vulnerability detection method provided in an embodiment of the present invention;

[0082] Figure 5 A flowchart illustrating an SQL injection vulnerability detection method provided in an embodiment of the present invention;

[0083] Figure 6 A flowchart illustrating an SQL injection vulnerability detection method provided in an embodiment of the present invention;

[0084] Figure 7 A flowchart illustrating an SQL injection vulnerability detection method provided in an embodiment of the present invention;

[0085] Figure 8 A flowchart illustrating an SQL injection vulnerability detection method provided in an embodiment of the present invention;

[0086] Figure 9 This is a structural block diagram of an SQL injection vulnerability detection device provided in an embodiment of the present invention;

[0087] Figure 10 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0088] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0089] Figure 1 An SQL injection vulnerability detection method according to an embodiment of the present invention is shown, such as... Figure 1 As shown, the method includes:

[0090] Step S101: Obtain the first DOM tree and the second DOM tree to be compared.

[0091] Among them, the first DOM tree is the DOM tree corresponding to the normal web page, and the second DOM tree is the DOM tree corresponding to the web page to be compared;

[0092] Step S102: Determine whether the sequence length of the first leaf node and the sequence length of the second leaf node are the same;

[0093] If not, proceed to step S103 to confirm that an SQL injection vulnerability has been detected;

[0094] If so, proceed to step S104: determine whether an SQL injection vulnerability has been detected based on the first distance between the two nodes of the first critical node pair in the first DOM tree and the second distance between the two nodes of the second critical node pair in the second DOM tree.

[0095] In step S101, optionally, obtaining the first DOM tree and the second DOM tree to be compared includes: generating a first DOM tree based on an HTML file; rendering and generating a normal web page based on the first DOM tree using a CSS file and / or a Javascript file; obtaining the first DOM tree after rendering and generating the normal web page; and obtaining the DOM tree corresponding to the web page whose page elements have changed when changes occur in the normal web page, and using this DOM tree as the second DOM tree (see reference). Figure 2 ).

[0096] The DOM (Document Object Model) allows for the access and modification of a document's content and structure in a platform- and language-independent manner. The process of building a website involves transforming HTML files into a DOM tree structure, modifying the DOM tree using CSS and JavaScript files, and ultimately rendering it into a functional, dynamic website (corresponding to rendering and generating a normal web page based on the first DOM tree using CSS and / or JavaScript files). SQL injection vulnerabilities can affect page layout, page display, and redirect URLs (Uniform Resource Locators), all of which are reflected in the DOM tree structure. Figure 3 This illustrates the DOM tree structure corresponding to a typical basic webpage. The DOM tree starts from the root node of the webpage and represents the webpage's structure level by level downwards. The root node corresponds to the `<!DOCTYPE html>` tag in the HTML document; the leaf nodes are the `<html>` tags, followed by `` and `` tags, then some markup tags, and finally text nodes. These nodes can contain and nest within each other, forming a tree-like structure.<h1>

[0097] In one possible implementation, such as Figure 4 As shown, step S104, determining whether an SQL injection vulnerability has been detected based on the first distance between two nodes in the first critical node pair of the first DOM tree and the second distance between two nodes in the second critical node pair of the second DOM tree, includes:

[0098] Step S1041: In the first DOM tree, select a preset number of first key node pairs, and in the second DOM tree, select a preset number of second key node pairs that correspond one-to-one with the first key node pairs;

[0099] Step S1042: Determine the first distance between the two nodes of each pair of first key nodes to be compared, and determine the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared.

[0100] Step S1043: If the first distance between the two nodes of each pair of first key nodes to be compared is the same as the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared, then it is determined that no SQL injection vulnerability has been detected.

[0101] Step S1044: If there is a comparison result where the first distance and the second distance are different, then it is determined that an SQL injection vulnerability has been detected.

[0102] It should be noted that after the page is built and rendered, most of the leaf nodes in the DOM tree correspond to the displayed elements on the page. SQL injection attacks generally do not change the global structure of the DOM; their alterations to the DOM tree mainly occur in localized areas. Therefore, in this embodiment of the invention, SQL injection vulnerabilities can be detected by comparing the DOM tree structure before and after the attack. The specific method is as follows: Figure 1 and Figure 4 As shown, the process first determines the length of the leaf nodes in the two DOM trees. Optionally, determining the length of the first leaf node sequence in the first DOM tree and the second leaf node sequence in the second DOM tree involves: traversing the first and second DOM trees to obtain the first leaf node sequence in the first DOM tree and the second leaf node sequence in the second DOM tree; determining the length of the first leaf node sequence based on the first leaf node sequence; and determining the length of the second leaf node sequence based on the second leaf node sequence (the two DOM trees to be compared can be traversed using the same traversal algorithm). A preliminary judgment is made by comparing the sequence lengths of the leaf nodes in the first and second DOM trees. Then, the similarity of the DOM trees is further determined by determining the distance between two nodes in a preset number of key node pairs (based on experience, the preset number can be set to 5 to balance accuracy and efficiency, and the key nodes can be page elements such as dialog boxes). If both comparisons pass, it means that the structures of the two DOM trees are the same and no SQL injection vulnerability is detected; otherwise, it means that an SQL injection vulnerability has been detected on the current website.

[0103] Therefore, compared with related technologies that compare the sequences of all nodes generated by two DOM trees to determine SQL injection vulnerabilities, the method shown in this embodiment of the invention does not require comparing all node sequences. Instead, it first compares the length of the node sequences and then compares the node distances of key node pairs. This avoids a large consumption of client resources, saves the time for SQL injection vulnerability detection, improves the efficiency of SQL injection vulnerability detection, and improves the accuracy of detection.

[0104] The method for comparing the distance between key node pairs described in the DOM tree comparison process above is explained in detail. Optionally, the distance between nodes can be calculated based on the critical path. That is, the most critical path of the DOM tree is analyzed based on a deep learning model, and multiple pairs (up to 5 pairs) of key node pairs are selected from the most critical path to calculate the node distance. Specifically, this can be divided into the following aspects:

[0105] 1. Keyword Extraction: Obtain the node information of the first DOM tree. Based on the node information, extract N (or several) keywords corresponding to the first DOM tree, forming a keyword set (k1, k2, ..., k...). n), and obtain the keyword set (k1, k2, ..., k n The weights of each keyword in the set are used to form the keyword weight set (θ1, θ2, ..., θ). n ), where N is a positive integer, which can be determined according to actual needs, or N keywords are all the keywords corresponding to the DOM tree.

[0106] 2. Path matching and critical path selection: First, based on the first DOM tree, determine the traversal path set (p1, p2, ..., p...). n Optionally, based on the first DOM tree, determine the traversal path set (p1, p2, ..., p...). n After that, such as Figure 5 As shown, the method also includes:

[0107] Step S401: Combine the keyword set (k1, k2, ..., k...) n Each keyword in the set is associated with a traversal path set (p1, p2, ..., p...). n Each traversal path in the sequence is matched to obtain the length of the common substring matched by each keyword under each traversal path;

[0108] Step S402: For each keyword, determine the length of the longest common substring among all common substrings that match the keyword, and determine the traversal path corresponding to the length of the longest common substring as the key traversal path;

[0109] Where N is a positive integer.

[0110] This allows us to identify the critical traversal path, providing a foundation for determining the frequency set based on the critical traversal path.

[0111] 3. Selection of the most critical path: Among possible implementation methods, such as Figure 6 As shown, in the first DOM tree, the most critical paths include:

[0112] Step S501: Based on the first DOM tree, determine the traversal path set (p1, p2, ..., p...). n );

[0113] Step S502: In the traversal path set, determine each traversal path as a critical traversal path in turn (critical traversal paths are determined by the above). Figure 5 The frequencies of (as shown) are determined in the manner described, forming a frequency set (f1, f2, ..., f...). n );

[0114] Step S503: Based on the total length set of common substrings corresponding to the traversed path set (L1, L2, ..., L...), n) and the frequency set (f1, f2, ..., f) corresponding to the traversal path set. n ), from the traversal path set (p1, p2, ..., p) of the first DOM tree n In the process, select the most critical path.

[0115] It should be noted that after selecting the most critical path, a preset number of key node pairs can be randomly selected on that path. In specific application scenarios, after determining the most critical path corresponding to the first DOM tree, a preset number of first key node pairs can be randomly selected on that path, and a preset number of second key node pairs corresponding to the first key node pairs can be selected in the second DOM tree (as shown in step S1041). However, this is not a limitation. It can be understood that the above method of analyzing the most critical path of the DOM tree based on the deep learning model can be performed in both the first and second DOM trees to obtain the most critical path corresponding to the first and second DOM trees; alternatively, only the most critical path corresponding to the first DOM tree can be obtained, and a preset number of first key node pairs can be randomly selected. Then, based on the randomly selected first key node pairs, a preset number of second key node pairs corresponding to the first key node pairs can be selected in the second DOM tree. Either of the above two methods can be selected according to actual needs, providing greater flexibility.

[0116] Understandably, before step S503, it is necessary to determine (L1, L2, ..., L...). n ) and frequency set (f1, f2, ..., f n ).

[0117] After determining (L1, L2, ..., L...) n When using the keyword weight set (θ1, θ2, ..., θ), it can be based on the keyword weight set (θ1, θ2, ..., θ). n ) and the character length set (l1, l2, ..., l) corresponding to each traversal path to be processed n Determine the total length set of common substrings corresponding to the traversal path set (L1, L2, ..., L...). n ). Where (l1, l2, ..., l n The character length set (l1, l2, ..., l) can be obtained as follows: For each traversal path to be processed, combine the lengths of the common substrings matched by each keyword under the traversal path to obtain the character length set (l1, l2, ..., l) corresponding to the traversal path to be processed. n ).

[0118] Furthermore, based on the aforementioned keywords, the determined keyword weight set (θ1, θ2, ..., θ) can be extracted from this part. nAdjust the character length set (l1, l2, ..., l) corresponding to each traversal path to be processed. n After adjustment, for each traversal path to be processed, the adjusted character length set (l1, l2, ..., l) corresponding to the traversal path to be processed is... n The lengths of each common substring in the path are summed to obtain the total length of the common substrings corresponding to each traversal path to be processed; the total lengths of the common substrings corresponding to each traversal path to be processed are combined to obtain the traversal path set (p1, p2, ..., p...). n The set of total lengths of the common substrings corresponding to ) (L1, L2, ..., L) n ).

[0119] Understandably, when the frequency set (f1, f2, ..., f) is determined... n When performing this step, it is necessary to confirm the key traversal path, that is, to execute step S502, in the traversal path set (p1, p2, ..., p...). n In the process, the frequency of each traversal path becoming a critical traversal path is determined sequentially, forming a frequency set (f1, f2, ..., f...). n ).

[0120] Therefore, after determining the total length set of the common substrings (L1, L2, ..., L...), n ) and frequency set (f1, f2, ..., f n After that, perform the action shown in step S503, which is to select the most critical path.

[0121] In one possible implementation, such as Figure 7 As shown, the method for selecting the most critical path has been further refined, and the methods include:

[0122] Step S601: Based on the frequency set (f1, f2, ..., f n Determine the fitting weight δ for each traversal path, forming a fitting weight set (δ1, δ2, ..., δ). n );

[0123] Step S602: Set the total length of the common substrings (L1, L2, ..., L...) n ) and the fitted weight set (δ1, δ2, ..., δ n Perform the corresponding fitting to obtain the fitting length set (L1*δ1, L2*δ2, ..., L...). n *δ n );

[0124] Step S603: In the set of fitting lengths, the traversal path corresponding to the longest fitting length is determined as the most critical path.

[0125] Understandably, the higher the frequency, the greater the corresponding fitting weight.

[0126] Therefore, the most critical path can be determined, and in general, the most critical path in a DOM tree refers to the longest path from the root node to the leaf node.

[0127] In one possible implementation, such as Figure 8 As shown, determining the first distance between the two nodes of each pair of first key nodes to be compared includes:

[0128] Step S701: Traverse the first DOM tree and obtain the nearest first common ancestor node corresponding to each pair of first key nodes;

[0129] Step S702: Determine the distances from each node to the first common ancestor node in each pair of first key nodes:

[0130] Step S703: The sum of the distances from the two nodes to the first common ancestor node is determined as the first distance between the two nodes.

[0131] Assume the node pair is <k m k n The corresponding critical path is > <P m p n > Traverse the DOM tree to obtain the nearest common ancestor k of each node. x Calculate the distances d from each of the two nodes to their common ancestor. m =length(p m )-length(p x );d n =length(p n )-length(p x The distance between node pairs is d = d m +d n .

[0132] Similarly, determining the second distance between the two nodes of the second key node pair corresponding to the first key node pair to be compared includes: traversing the second DOM tree to obtain the nearest second common ancestor node for each pair of second key node pairs; determining the distance from each node to the second common ancestor node in each pair of second key node pairs; and summing the distances from the two nodes to the second common ancestor node as the second distance between the two nodes. Therefore, the method shown in this embodiment of the invention is based on black-box detection technology and determines whether a website has been attacked by SQL injection vulnerabilities by comparing the DOM trees corresponding to normal and abnormal web pages. Furthermore, the tree structure comparison method has been optimized by combining the comparison method of DOM leaf node sequence length and key node distance, greatly improving the comparison efficiency and reducing the comparison complexity.

[0133] Figure 9 A structural block diagram of an SQL injection vulnerability detection device according to an embodiment of the present invention is shown, such as... Figure 9 As shown, the device 80 includes:

[0134] Module 801 is used to obtain the first and second DOM trees to be compared.

[0135] Among them, the first DOM tree is the DOM tree corresponding to the normal web page, and the second DOM tree is the DOM tree corresponding to the web page to be compared;

[0136] The execution module 802 is used to determine whether the sequence length of the first leaf node and the sequence length of the second leaf node are the same;

[0137] If not, then an SQL injection vulnerability has been detected.

[0138] If so, then determine whether an SQL injection vulnerability has been detected based on the first distance between the two nodes of the first critical node pair in the first DOM tree and the second distance between the two nodes of the second critical node pair in the second DOM tree.

[0139] In one possible implementation, the execution module 802 is further configured to select a preset number of first key node pairs in the first DOM tree, and select a preset number of second key node pairs that correspond one-to-one with the first key node pairs in the second DOM tree;

[0140] Determine the first distance between the two nodes of each pair of first key nodes to be compared, and determine the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared.

[0141] If the first distance between the two nodes of each pair of first key nodes to be compared is the same as the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared, then it is determined that no SQL injection vulnerability has been detected.

[0142] If the comparison results show that the first distance and the second distance are different, then an SQL injection vulnerability has been detected.

[0143] In one possible implementation, module 801 is also used to generate the first DOM tree based on the HTML file;

[0144] Using ess files and / or Javascript files, based on the first DOM tree, render and generate a normal web page:

[0145] After rendering and generating a normal web page, obtain the first DOM tree;

[0146] When page elements change in a normal web page, obtain the DOM tree corresponding to the web page whose page elements have changed, and use the DOM tree as the second DOM tree.

[0147] In one possible implementation, execution module 802 is further configured to determine the traversal path set (p1, p2, ..., p) based on the first DOM tree. n );

[0148] In the set of traversal paths, the frequency of each traversal path becoming a critical traversal path is determined sequentially, forming a frequency set (f1, f2, ..., f...). n );

[0149] Based on the total length set of common substrings corresponding to the traversed path set (L1, L2, ..., L... n ) and the frequency set (f1, f2, ..., f) corresponding to the traversal path set. n ), from the traversal path set (p1, p2, ..., p) of the first DOM tree n Select the most critical path from the given information.

[0150] On the most critical path, a preset number of first critical node pairs are randomly selected.

[0151] In one possible implementation, execution module 802 is further configured to determine the traversal path set (p1, p2, ..., p) based on the first DOM tree. n Before that, obtain the node information of the first DOM tree. Based on the node information, extract the N keywords corresponding to the first DOM tree to form a keyword set (k1, k2, ..., k). n );

[0152] After determining the traversal path set (p1, p2, ..., p...), n After that, the keyword set (k1, k2, ..., k) is... n Each keyword in the set is associated with a traversal path set (p1, p2, ..., p...). n Each traversal path in the sequence is matched to obtain the length of the common substring matched by each keyword under each traversal path;

[0153] For each keyword, determine the length of the longest common substring among all common substring lengths that match the keyword;

[0154] The traversal path corresponding to the length of the longest common substring is determined as the critical traversal path; where N is a positive integer.

[0155] In one possible implementation, execution module 802 is further configured to base its work on the frequency set (f1, f2, ..., f...). n Determine the fitting weight δ for each traversal path, forming a fitting weight set (δ1, δ2, ..., δ). n );

[0156] The total length set of common substrings (L1, L2, ..., L) n ) and the fitted weight set (δ1, δ2, ..., δ n Perform the corresponding fitting to obtain the fitting length set (L1*δ1, L2*δ2, ..., L...). n *δ n );

[0157] The traversal path corresponding to the longest fitting length in the set of fitting lengths is determined as the most critical path.

[0158] In one possible implementation, the execution module 802 is also used to traverse the first DOM tree and obtain the nearest first common ancestor node corresponding to each pair of first key nodes;

[0159] Determine the distances from the first common ancestor node to each of the two nodes in each pair of first critical nodes;

[0160] The sum of the distances from the two nodes to their first common ancestor node is used to determine the first distance between the two nodes; and / or,

[0161] Traverse the second DOM tree to obtain the nearest second common ancestor node for each pair of second key nodes;

[0162] Determine the distances from the two nodes to the second common ancestor node in each pair of second key nodes;

[0163] The sum of the distances from the two nodes to their second common ancestor node is determined as the second distance between the two nodes.

[0164] Therefore, compared with related technologies that compare the sequences of all nodes generated by two DOM trees to determine SQL injection vulnerabilities, the method shown in this embodiment of the invention does not require comparing all node sequences. Instead, it first compares the length of the node sequences and then compares the node distances of key node pairs. This avoids a large consumption of client resources, saves the time for SQL injection vulnerability detection, improves the efficiency of SQL injection vulnerability detection, and improves the accuracy of detection.

[0165] This invention also provides an electronic device 90, such as... Figure 10 As shown, it includes: a processor 901, a memory 902, and a program stored on the memory 902 and executable on the processor 901. When the program is executed by the processor, it implements the steps of an SQL injection vulnerability detection method as shown in the above embodiment.

[0166] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of the SQL injection vulnerability detection method shown in the above embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0167] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0168] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0169] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A method for detecting SQL injection vulnerabilities, characterized in that, The method includes: Obtain the first DOM tree and the second DOM tree to be compared, wherein the first DOM tree is the DOM tree corresponding to the normal web page, and the second DOM tree is the DOM tree corresponding to the web page to be compared; Determine whether the sequence length of the first leaf node is the same as the sequence length of the second leaf node; If not, then an SQL injection vulnerability has been detected. If so, determine whether an SQL injection vulnerability has been detected based on the first distance between the two nodes of the first critical node pair in the first DOM tree and the second distance between the two nodes of the second critical node pair in the second DOM tree. Determining whether an SQL injection vulnerability has been detected based on the first distance between two nodes in the first critical node pair of the first DOM tree and the second distance between two nodes in the second critical node pair of the second DOM tree includes: In the first DOM tree, a preset number of first key node pairs are selected, and in the second DOM tree, a preset number of second key node pairs corresponding one-to-one with the first key node pairs are selected; Determine the first distance between the two nodes of each pair of first key nodes to be compared, and determine the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared. If the first distance between the two nodes of each pair of first key nodes to be compared is the same as the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared, then it is determined that the SQL injection vulnerability has not been detected. If there is a comparison result where the first distance and the second distance are different, then it is determined that the SQL injection vulnerability has been detected; Obtaining the first and second DOM trees to be compared includes: The first DOM tree is generated based on the HTML file; Using CSS and / or Javascript files, based on the first DOM tree, render and generate the normal web page; After rendering and generating the normal web page, obtain the first DOM tree; When page elements in the normal web page change, the DOM tree corresponding to the web page whose page elements have changed is obtained, and the DOM tree is used as the second DOM tree.

2. The method according to claim 1, characterized in that, In the first DOM tree, selecting a preset number of first key node pairs includes: Based on the first DOM tree, determine the set of traversal paths; In the set of traversal paths, the frequency of each traversal path becoming a key traversal path is determined in turn, forming a frequency set; Based on the total length set of common substrings corresponding to the traversal path set and the frequency set corresponding to the traversal path set, the most critical path is selected from the traversal path set of the first DOM tree. On the most critical path, a preset number of first critical node pairs are randomly selected.

3. The method according to claim 2, characterized in that, Before determining the traversal path set based on the first DOM tree, the method further includes: Obtain the node information of the first DOM tree, and based on the node information, extract N keywords corresponding to the first DOM tree to form a keyword set; After determining the set of traversal paths, the method further includes: Each keyword in the keyword set is matched with each traversal path in the traversal path set to obtain the length of the common substring matched by each keyword under each traversal path; For each keyword, determine the length of the longest common substring among all common substring lengths that match the keyword; The traversal path corresponding to the length of the longest common substring is determined as the most critical path; where N is a positive integer.

4. The method according to claim 2, characterized in that, Based on the total length set of common substrings corresponding to the traversal path set and the frequency set corresponding to the traversal path set, the most critical paths are selected from the traversal path set of the first DOM tree, including: Based on the frequency set, the fitting weights corresponding to each traversal path are determined, forming a fitting weight set; The total length set of the common substrings is fitted to the fitting weight set to obtain the fitting length set; The traversal path corresponding to the maximum fitting length in the set of fitting lengths is determined as the most critical path.

5. The method according to claim 1, characterized in that, Determining the first distance between the two nodes of each pair of first key nodes to be compared includes: Traverse the first DOM tree to obtain the nearest first common ancestor node corresponding to each pair of first key nodes; Determine the distances from each node to the first common ancestor node in each pair of first key nodes; The sum of the distances from the two nodes to the first common ancestor node is determined as the first distance between the two nodes; and / or, Determining the second distance between the two nodes of the second key node pair corresponding to the first key node pair to be compared includes: Traverse the second DOM tree to obtain the nearest second common ancestor node for each pair of second key nodes; Determine the distances from each of the two nodes to the second common ancestor node in each pair of second key nodes; The sum of the distances from the two nodes to the second common ancestor node is determined as the second distance between the two nodes.

6. An SQL injection vulnerability detection device, characterized in that, The device includes: The acquisition module is used to acquire the first DOM tree and the second DOM tree to be compared, wherein the first DOM tree is the DOM tree corresponding to the normal web page, and the second DOM tree is the DOM tree corresponding to the web page to be compared; The execution module is used to determine whether the sequence length of the first leaf node and the sequence length of the second leaf node are the same; If not, then an SQL injection vulnerability has been detected. If so, determine whether an SQL injection vulnerability has been detected based on the first distance between the two nodes of the first critical node pair in the first DOM tree and the second distance between the two nodes of the second critical node pair in the second DOM tree. Specifically, determining whether an SQL injection vulnerability has been detected based on the first distance between two nodes in the first critical node pair of the first DOM tree and the second distance between two nodes in the second critical node pair of the second DOM tree includes: In the first DOM tree, a preset number of first key node pairs are selected, and in the second DOM tree, a preset number of second key node pairs corresponding one-to-one with the first key node pairs are selected; Determine the first distance between the two nodes of each pair of first key nodes to be compared, and determine the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared. If the first distance between the two nodes of each pair of first key nodes to be compared is the same as the second distance between the two nodes of the pair of second key nodes corresponding to the pair of first key nodes to be compared, then it is determined that the SQL injection vulnerability has not been detected. If there is a comparison result where the first distance and the second distance are different, then it is determined that the SQL injection vulnerability has been detected; Obtaining the first and second DOM trees to be compared includes: The first DOM tree is generated based on the HTML file; Using CSS and / or Javascript files, based on the first DOM tree, render and generate the normal web page; After rendering and generating the normal web page, obtain the first DOM tree; When page elements in the normal web page change, the DOM tree corresponding to the web page whose page elements have changed is obtained, and the DOM tree is used as the second DOM tree.

7. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the SQL injection vulnerability detection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the SQL injection vulnerability detection method as described in any one of claims 1 to 5.

Images