Traffic sample generation method and apparatus, program product, medium, and device

Abstract

The application relates to the technical field of network security, and provides a traffic sample generation method and device, a program product, a medium and equipment. The method comprises the following steps: generating sql injection payloads by using a sql injection tool; and encapsulating the sql injection payloads to generate http traffic samples. The method combines the advantages of two types of traffic sample generation methods, namely, packet generation and packet capture. On one hand, a large number of sql injection payloads are automatically generated by directly using the sql injection tool, thereby avoiding the process of manually collecting the payloads. On the other hand, the http traffic samples are generated by directly encapsulating the sql injection payloads, without the need to build a target range and perform sql injection in the target range. The sample generation is not constrained by target machines and network performance, thereby significantly simplifying the generation process of the http traffic samples, improving the sample generation efficiency, being beneficial to generating a large number of samples in a short time, and thereby better training a deep learning model for sql injection detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a traffic sample generation method and device, program product, medium and equipment. BACKGROUND

[0002] Due to the fact that web applications do not strictly judge and filter the legitimacy of user input data, attackers can add additional sql statements in the predefined query statements in web applications to implement the execution of unauthorized arbitrary queries on the database server, so as to further obtain the corresponding data information. This attack method is generally referred to as sql injection.

[0003] In recent years, with the development of artificial intelligence technology, deep learning technology has also been introduced into the detection of sql injection, that is, a trained deep learning model is used to detect http traffic packets for data query to identify whether there is sql injection behavior.

[0004] However, in order to improve the detection effect, a large amount of http traffic samples need to be provided to train the above deep learning model. At present, there are generally two types of ways to generate training samples: the first type is referred to as packet generation, that is, according to the pre-collected sql injection payloads, the characteristics of http traffic are simulated to generate corresponding http traffic packets as samples. This type of method usually requires manual entry of a large number of sql injection payloads, which is very time-consuming and labor-intensive; the second type is referred to as packet capture, that is, a sql injection vulnerability target range is built, and then a sql injection tool is used to generate sql injection payloads and launch a scanning attack on the target machine in the target range. In the process of simulating the attack, a traffic capture tool is used to capture the corresponding http traffic packets as samples. This type of method requires the construction of multiple different types of target ranges to obtain more samples, which is very cumbersome to implement. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a traffic sample generation method and device, a storage medium and an electronic equipment to improve the above technical problems.

[0006] To achieve the above purpose, the present application provides the following technical solutions:

[0007] In a first aspect, the embodiments of the present application provide a traffic sample generation method, comprising: generating sql injection payloads by using a sql injection tool; and encapsulating http traffic samples according to the sql injection payloads.

[0008] The flow sample generation method combines the advantages of the two types of flow sample generation methods, i.e., the packet generation and the packet capture, directly uses a sql injection tool to automatically generate a large number of sql injection payloads, avoids the process of manually collecting the payloads, directly encapsulates the http flow samples based on the sql injection payloads, does not need to build a target field, and does not need to perform sql injection in the target field, and the sample generation is not constrained by the target machine and the network performance. In general, the method significantly simplifies the generation process of the http flow samples, improves the sample generation efficiency, is beneficial to generating a large number of samples in a short time, and thus better trains the deep learning model for sql injection detection.

[0009] In an implementation form of the first aspect, the sql injection tool is called to generate the sql injection payload by traversing a plurality of value combinations of the sql injection parameters, and a corresponding sql injection instruction is generated for each value combination.

[0010] In the implementation form, the sql injection tool is called to generate the sql injection payload by traversing a plurality of value combinations of the sql injection parameters, which ensures the richness of the payload, and thus is beneficial to improving the richness of the http flow sample. In addition, the above implementation form actively calls the sql injection tool to generate the payload based on the sql injection parameters, rather than letting the sql injection tool attack the target machine to generate the payload, so that the generation of the payload is not limited to the target field environment, and is also beneficial to improving the richness of the payload. In addition, when the sql injection tool is used to attack autonomously, the sql injection is often repeated for different attack paths, and a large number of highly similar http flow samples are generated, which not only makes the sample redundancy too high, but also consumes a large amount of time. The above implementation form does not use sql autonomous attack, and thus does not have these problems.

[0011] In an implementation form of the first aspect, the sql injection parameters used to generate the sql injection instruction are determined according to the performance of a device that executes the flow sample generation method.

[0012] In the implementation form, since the execution of the sql injection instruction relatively consumes system resources, the sql injection parameters used to generate the sql injection instruction can be selected according to the performance of the device, so as to avoid generating too many sql injection instructions and affecting the normal operation of the device. Of course, the number of sql injection instructions cannot be too small, which will make it difficult to fully utilize the performance of the device.

[0013] In an implementation form of the first aspect, the SQL injection parameters used to generate the SQL injection instruction are first-type SQL injection parameters, and the SQL injection parameters not used to generate the SQL injection instruction are second-type SQL injection parameters; the step of iterating through the value combinations of the plurality of SQL injection parameters and generating a corresponding SQL injection instruction for each value combination comprises: iterating through value combinations of the first-type SQL injection parameters and generating a corresponding SQL injection instruction for each value combination of the first-type SQL injection parameters; and the step of invoking the SQL injection tool to execute the SQL injection instruction to generate a SQL injection payload comprises: invoking the SQL injection tool to execute the SQL injection instruction, and the SQL injection instruction, when executed, iterates through value combinations of the second-type SQL injection parameters and generates a corresponding SQL injection payload for each value combination of the second-type SQL injection parameters.

[0014] In the implementation form described above, the SQL injection parameters not used to generate the SQL injection instruction can be iterated through when the SQL injection instruction is executed, which on the one hand ensures the richness of the payload and on the other hand avoids generating too many SQL injection instructions to affect the normal operation of the device.

[0015] In an implementation form of the first aspect, the first-type SQL injection parameters comprise whether the SQL injection uses a bypass script, and the second-type SQL injection parameters comprise a bypass script used by the SQL injection.

[0016] In the implementation form described above, in order to avoid generating too many SQL injection instructions, a SQL injection parameter "whether the SQL injection uses a bypass script" can be constructed and used to generate the SQL injection instruction, instead of directly iterating through all the bypass scripts when generating the SQL injection instruction. In addition, the parameter "whether the SQL injection uses a bypass script" can also be regarded as an option switch, and a user can select whether to consider the bypass script when generating the HTTP traffic sample.

[0017] In an implementation form of the first aspect, the step of encapsulating the HTTP traffic sample according to the SQL injection payload comprises: splicing the SQL injection payload into a plurality of preset positions in an HTTP request to obtain an HTTP request with a payload; and encapsulating the HTTP traffic sample according to the HTTP request.

[0018] In the implementation form described above, the same SQL injection payload is spliced into a plurality of preset positions in an HTTP request to generate different HTTP traffic samples, which not only enriches the number of samples but also reflects the diversity of actual SQL injection attacks.

[0019] In an implementation form of the first aspect, the generating the HTTP traffic sample according to the HTTP request encapsulation comprises: encapsulating the HTTP request as an HTTP request message, constructing an HTTP response corresponding to the HTTP request, and encapsulating the HTTP response as an HTTP response message to obtain the HTTP traffic sample comprising the HTTP request message and the HTTP response message corresponding thereto.

[0020] In the implementation form, the HTTP request message is encapsulated based on the generated SQL injection payload, and the HTTP response message is directly constructed, thereby facilitating rapid generation of a large number of samples. In addition, the implementation form regards one HTTP request message and the corresponding HTTP response message as one HTTP traffic sample, which is reasonable in granularity and is conducive to detection of SQL injection.

[0021] In the second aspect, an embodiment of the present application provides a traffic sample generation apparatus, comprising: a payload generation module configured to generate a SQL injection payload by using a SQL injection tool; and a sample generation module configured to generate an HTTP traffic sample according to the SQL injection payload encapsulation.

[0022] In the third aspect, an embodiment of the present application provides a computer program product comprising computer program instructions, which, when read and run by a processor, perform the method provided in the first aspect or any implementation form of the first aspect.

[0023] In the fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer program instructions, and the computer program instructions, when read and run by a processor, perform the method provided in the first aspect or any implementation form of the first aspect.

[0024] In the fifth aspect, an embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores computer program instructions, and the computer program instructions, when read and run by the processor, perform the method provided in the first aspect or any implementation form of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0026] Figure 1A possible flow of the traffic sample generation method provided by the embodiment of the present application is shown;

[0027] Figure 2 Another possible flow of the traffic sample generation method provided by the embodiment of the present application is shown;

[0028] Figure 3 A possible structure of the traffic sample generation apparatus provided by the embodiment of the present application is shown;

[0029] Figure 4 A possible structure of the electronic device provided by the embodiment of the present application is shown. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0031] The term "comprising" or "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or further includes elements inherent to such a process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0032] The terms "first", "second", and the like are only used to distinguish one entity or operation from another entity or operation, and cannot be understood as indicating or implying relative importance, nor can it be understood as requiring or implying any such actual relationship or order between the entities or operations.

[0033] Before starting to introduce the traffic sample generation method provided by the embodiment of the present application, some basic concepts related to sql injection are described:

[0034] Sql injection: due to the fact that the web application on the database server does not strictly judge and filter the legitimacy of user input data, the attacker can add additional sql statements in the query statement defined in advance in the web application, so as to achieve the purpose of cheating the database server to execute unauthorized arbitrary queries, and further obtain the corresponding data information.

[0035] Sql injection payload: sql injection can be initiated through an http request, and the malicious information carried in the http request is called sql injection payload.

[0036] SQL injection vulnerability: a flaw in a web application that is exploited by SQL injection to launch an attack on a database server.

[0037] SQL injection tool: a software that can automatically detect and exploit SQL injection vulnerabilities for SQL injection. SQL injection tools can be used by attackers to launch SQL injection attacks, or by network security engineers to improve server security, and are themselves neutral products. For example, the open-source penetration testing tool sqlmap is a SQL injection tool.

[0038] SQL injection detection: detecting SQL injection attacks using security techniques.

[0039] Deep learning: using neural network models to learn deep features of data and performing tasks such as classification and recognition of data based on the learned features, which is an important branch of artificial intelligence.

[0040] Deep learning-based SQL injection detection: inputting the http traffic packet to be detected into a trained SQL injection detection model, and the model gives the detection result of whether there is SQL injection in the http traffic packet. The SQL injection detection model can be a neural network model in deep learning technology.

[0041] HTTP traffic sample: a sample used to train the SQL injection detection model, and each http traffic sample can include one or more http traffic packets. Generally speaking, the more abundant the http traffic samples, the better the performance of the SQL injection detection model trained.

[0042] Packet generation: a way to generate http traffic samples. This way simulates the characteristics of http traffic according to the pre-collected sql injection payloads to generate corresponding http traffic packets as samples. The packet generation method usually requires manual entry of a large number of sql injection payloads, which is very time-consuming and labor-intensive.

[0043] SQL injection target range: an artificial simulation environment for simulating and testing SQL injection attacks, with target machines, i.e. SQL injection targets, deployed in the target range. The target machine can be a database server with SQL injection vulnerabilities.

[0044] Packet capture: a way to generate http traffic samples. Build a sql injection target range, and then use a sql injection tool (such as sqlmap) to generate sql injection payloads and launch a scanning attack on the target machine in the target range, and use a traffic capture tool (such as wireshark) to capture the corresponding http traffic packets as samples during the simulation attack. The packet capture method needs to build multiple different types of target ranges to obtain more samples, for example, different target ranges need to be built for different databases, different operating systems, and different sql injection vulnerabilities, which is very cumbersome to implement.

[0045] Figure 1 A possible flow of the traffic sample generation method provided by the embodiments of the present application is shown. The method can, but is not limited to, be executed by an electronic device Figure 4 The electronic device shown performs, and specific reference can be made to the description of the electronic device Figure 4 below. Referring to Figure 1 , the method comprises:

[0046] Step S110: generating sql injection payloads using a sql injection tool.

[0047] In the traditional process of generating http traffic samples by packet capture, the sql injection tool can automatically scan sql injection vulnerabilities, and generate corresponding sql injection payloads according to the sql injection vulnerabilities, and generate http requests based on the sql injection payloads, and finally use the http requests to launch sql injection on the target machine in the target range. That is, the sql injection tool has the ability to automatically generate sql injection payloads.

[0048] The scheme of the present application can also use the sql injection tool to generate sql injection payloads, but the main difference from the packet capture scheme is:

[0049] First, the scheme of the present application does not build a target range, so the sql injection tool will not launch a scan on the sql injection vulnerability of the target machine, so it is necessary to actively call the sql injection tool to generate sql injection payloads. The way to call can be to pass some running parameters to the sql injection tool, called sql injection parameters. For example, the sql injection parameters can include the database targeted by the sql injection, so the sql injection tool does not have to scan to obtain the database to be attacked.

[0050] Second, in the packet capture scheme, the sql injection tool performs vulnerability scanning and launches sql injection attacks through the network, which is not needed for the scheme of the present application. The present application only needs the sql injection tool to generate sql injection payloads.

[0051] The sql injection tool in the present application can be obtained by modifying an existing sql injection tool, or can be newly developed to meet the requirements of the present application.

[0052] For the former, for example, the code related to network communication in sqlmap can be shielded, i.e. only the payload automatic generation function of sqlmap is used, but no sql injection attack is performed based on the generated sql injection payload through the network. The shielding method includes adding a conditional branch in the original code of sqlmap to bypass the network communication related code, or directly returning the function with network communication function, etc. For another example, the original design of sqlmap is not intended to collect http traffic samples, so when generating sql injection payloads, it may skip some payloads that it considers to have no attack effect, but the present application is intended to collect http traffic samples, so it is desirable to generate as many sql injection payloads as possible, so the skip logic of some payloads in sqlmap can be removed to generate more sql injection payloads.

[0053] In some implementations, some configurable parameters can be added to the original code of sqlmap to indicate what working mode sqlmap is in, and different processing logic (e.g. entering different conditional branches) is executed in different working modes. For example, a regular mode and a sample collection mode can be included, in the regular mode, sqlmap continues to execute the original code logic to implement the original function, such as network communication can be performed; in the sample collection mode, the newly added or modified code logic of the present application is executed to implement the collection of http traffic samples, such as the network communication function is shielded.

[0054] The sqlmap tool is open source, so there is no implementation barrier for the above-mentioned code modification measures.

[0055] Step S120: encapsulating the http traffic samples according to the sql injection payloads.

[0056] According to each sql injection payload obtained in step S110, one or more corresponding http traffic samples can be generated, which can be executed by the sql injection tool or by other programs. An http traffic sample can include an http request packet and a corresponding http response packet, both of which can be regarded as an http traffic packet.

[0057] In this context, the HTTP request message is generated by encapsulating an SQL injection payload. For example, an HTTP request without an SQL injection payload can be constructed according to the HTTP protocol. Then, the SQL injection payload can be appended to a preset position in the HTTP request to obtain an HTTP request with a payload. Finally, this payload-laden HTTP request is encapsulated into an HTTP message. Here, the HTTP request can be understood as an application-layer data packet (the HTTP protocol is an application-layer protocol), while the HTTP request message can be understood as a data packet containing all lower-layer protocols that can be directly transmitted over the network.

[0058] Since the solution in this application does not actually send HTTP request messages in the test range, it is impossible to obtain real HTTP response messages. Instead, HTTP response messages need to be generated through construction. For example, an HTTP response corresponding to an HTTP request can be constructed based on the HTTP protocol, and then the HTTP response can be encapsulated into an HTTP response message. Here, the HTTP response can be understood as an application-layer data packet, while the HTTP response message can be understood as a data packet containing all lower-layer protocols that can be directly transmitted over the network.

[0059] It should be understood that HTTP traffic samples can be defined differently than those described above. For example, an HTTP traffic sample may consist of only one HTTP request message; or it may include all HTTP request and response messages involved in a single data query. However, the inventors have found that treating an HTTP request message and its corresponding HTTP response message as a single HTTP traffic sample is more reasonable in terms of granularity and more conducive to the detection of SQL injection.

[0060] The generated HTTP traffic samples can be used to train SQL injection detection models, but are not limited to this purpose. For example, these samples can also be used for statistical analysis and other purposes.

[0061] Brief summary Figure 1 The proposed method combines the advantages of both packet creation and packet capture methods for generating traffic samples. On one hand, it automatically generates a large number of SQL injection payloads using SQL injection tools, avoiding the manual collection process. On the other hand, it directly encapsulates and generates HTTP traffic samples based on these SQL injection payloads, eliminating the need to build a target environment or perform SQL injection within it. Sample generation is not constrained by target machine or network performance. In summary, this method significantly simplifies the HTTP traffic sample generation process, improves sample generation efficiency, and facilitates the generation of a large number of samples in a short time. These samples, when used to train SQL injection detection models, can improve the performance of these models.

[0062] In some implementations, step S110 can further include: traversing the value combination of the plurality of sql injection parameters, generating a corresponding sql injection instruction for each value combination; calling the sql injection tool to execute the sql injection instruction to generate the sql injection payload.

[0063] Among them, the sql injection parameter can be understood as the running parameter of the sql injection tool, and the sql injection parameter includes but is not limited to the following parameters:

[0064] (1) The attack operation performed by sql injection: that is, through sql injection, what attack behavior is specifically performed on the database server, for example, data theft, file access, execution of specific commands, etc.

[0065] (2) The database targeted by sql injection: for example, MySQL, PostgreSQL, Oracle, etc.

[0066] (3) The operating system targeted by sql injection: for example, Linux, Windows, etc.

[0067] (4) The version of the server targeted by sql injection: which can be understood as the system version of the database server, and here the system can be an operating system or a business system.

[0068] (5) The programming language of the server targeted by sql injection: for example, php, jsp, asp, etc.

[0069] (6) The business component targeted by sql injection: which can be understood as the constituent unit of the business system of the database server.

[0070] (7) The injection type of sql injection: for example, error injection, time injection, boolean blind injection, union injection, stack injection, etc.

[0071] (8) The bypass script used by sql injection: the bypass script can perform certain deformation on the sql injection payload to bypass the detection of the security system and achieve the purpose of sql injection. Different bypass scripts correspond to different deformation methods.

[0072] (9) Whether sql injection uses bypass script: whether to consider bypass script in the process of generating http traffic sample, (9) is only a parameter belonging to (8), and its purpose will be explained later.

[0073] Different values of the sql injection parameter may affect the form of the sql injection payload, therefore, if you want to generate as many sql injection payloads as possible (and thus generate as many http traffic samples as possible), you can traverse the value combination of all sql injection parameters to generate the corresponding sql injection payload.

[0074] The literal meaning of the sql injection instruction is the instruction of sql injection, of course, the sql injection tool of the present application will not really perform sql injection, so the purpose of the sql injection tool executing the instruction is only to generate the sql injection payload (can be regarded as the preparation stage of sql injection).

[0075] How to generate sql injection instructions according to the values of sql injection parameters will be described in conjunction with examples in the following. If a corresponding sql injection instruction is generated for each value combination of all sql injection parameters, the total number of sql injection instructions will be very large, and the execution and storage of sql injection instructions consume a lot of system resources, which may affect the normal operation of the device (i.e. the device executing the traffic sample generation method).

[0076] Therefore, in an optional solution, a part of all sql injection parameters can be selected to generate sql injection instructions, and the selected sql injection parameters can be referred to as first-class sql injection parameters. When selecting the first-class sql injection parameters, the performance of the device can be considered. For example, the value combination of the selected first-class sql injection parameters cannot be too much to avoid too many sql injection instructions affecting the normal operation of the device. For another example, the value combination of the selected first-class sql injection parameters cannot be too few, otherwise it is difficult to fully utilize the performance of the device, causing resource waste.

[0077] The above "too much" and "too few" can be judged according to the performance of the device by setting a corresponding threshold, for example, for a certain device, the number of value combinations of the first-class sql injection parameters in the interval of 5000-10000 is more appropriate. Of course, it is also not excluded that the first-class sql injection parameters are selected by other rules or factors.

[0078] For example, the above (1) (2) (7) (9) four parameters can be selected as the first-class sql injection parameters, wherein the attack operation of the sql injection is 26, the database targeted by the sql injection is 27, the injection type of the sql injection is 6, and the sql injection uses bypass script or not has 2 options, so the number of value combinations of the first-class sql injection parameters is 26x27x6x2=8424, which is in the interval of 5000-10000. The number of sql injection instructions to be generated is also 8424, and these instructions can have the following forms:

[0079] sqlmap-A 0-B 0-C 0-D 0

[0080] sqlmap-A 1-B 0-C 0-D 0

[0081] ……

[0082] sqlmap -A 25 -B 0 -C 0 -D 0

[0083] sqlmap -A 0 -B 1 -C 0 -D 0

[0084] …

[0085] sqlmap -A 25 -B 1 -C 0 -D 0

[0086] sqlmap -A 0 -B 2 -C 0 -D 0

[0087] …

[0088] sqlmap -A 25 -B 26 -C 5 -D 1

[0089] Wherein, sqlmap represents sql injection tool (reformed), parameter A represents attack operation executed by sql injection, the value range is 0-25 integer, parameter B represents database aimed by sql injection, the value range is 0-26 integer, parameter C represents injection type of sql injection, the value range is 0-5 integer, parameter D represents whether bypass script is used by sql injection, the value is 0 or 1.The above 8424 instructions can be automatically generated, and form an instruction list, which is executed by system process in turn (of course, a plurality of instructions can be executed in parallel), and the system process executes an instruction, and then sqlmap is called according to the instruction content, and sqlmap generates corresponding sql injection payload according to the value combination of the first type of sql injection parameter passed by calling.

[0090] In the generation of sql injection instruction, the regular command in it can be fixed, for example, the sqlmap, -A, -B, -C, -D and other parts in each instruction, then the value of each sql injection parameter is traversed and spliced with the regular command, and the complete instruction content can be obtained.

[0091] It should be understood that if the device performance is good enough, all sql injection parameters can also be used as the first type of sql injection parameter.

[0092] In the above implementation mode, the sql injection tool is called to generate sql injection payload by traversing the value combination of multiple sql injection parameters, which ensures the richness of the payload, thereby facilitating the improvement of the richness of the http flow sample.

[0093] In addition, the above implementation manner is based on the sql injection parameter to actively call the sql injection tool to generate the payload, rather than leaving the sql injection tool to attack the target machine to generate the payload, so that the generation of the payload is not limited to the target environment, and the richness of the payload is also improved. In contrast, in the existing packet capture scheme, the sql injection tool only generates sql injection payloads that match the target environment, for example, if the target environment uses a MySQL database, only sql injection payloads suitable for the MySQL database are generated. If payloads suitable for other databases are to be generated, a new target environment must be built.

[0094] In addition, when using the sql injection tool to attack autonomously, the existing packet capture scheme often repeats sql injection for different attack paths (which can be understood as URL paths on the target machine), thereby generating a large number of highly similar http traffic samples (these http traffic samples may have the same payload, only the attack path is different). Not only does this result in high redundancy of the samples, but it also consumes a lot of generation time. The above implementation manner does not use sql autonomous attack, so there are no such problems.

[0095] If the first type of sql injection parameter is only a part of all sql injection parameters, the remaining sql injection parameters that are not used to generate sql injection instructions can be referred to as second type of sql injection parameters. When calling the sql injection tool to execute each sql injection instruction, the value combinations of the second type of sql injection parameters are traversed, and corresponding sql injection payloads are generated for each value combination of the second type of sql injection parameters.

[0096] The significance of dividing the first type of sql injection parameter and the second type of sql injection parameter can be understood as follows: if the purpose is to generate as many sql injection payloads as possible, each value combination of the sql injection parameters will be traversed whether the two types of sql injection parameters are divided or not, but the efficiency of traversing the value combinations is different in the two ways.

[0097] If the two types of sql injection parameters are not divided, each value combination of all sql injection parameters will generate a corresponding sql injection instruction, and the number of sql injection instructions is too large. If the two types of sql injection parameters are divided, only the value combinations of the first type of sql injection parameter will generate corresponding sql injection instructions, and the value combinations of the second type of sql injection parameter are only traversed when the sql injection instruction is executed. In this way, on the one hand, the richness of the sql injection payload is not affected, and on the other hand, the generation of too many sql injection instructions is avoided, which affects the normal operation of the device.

[0098] For example, there are 80 bypass scripts used by sql injection, if the above item (8) parameter is directly used as the first type of sql injection parameter, a total of 26x27x6x80=336960 sql injection instructions will be generated, which far exceeds the expected upper limit of 10000 instructions. Therefore, the above item (9) parameter can be constructed, the parameter "whether sql injection uses bypass script" is used as an item in the first type of sql injection parameter, and "sql injection uses bypass script" is used as an item in the second type of sql injection parameter, so that the number of generated sql injection instructions can be significantly reduced, and the normal operation of the device can be avoided.

[0099] In addition, the parameter "whether sql injection uses bypass script" can also be regarded as an option switch, and the user can select whether to consider bypass script when generating http traffic samples. For example, if the sql injection detection model wants to focus more on learning other characteristics of sql injection rather than bypass script, the value of "whether sql injection uses bypass script" can also be set to "no", so that the generated sql injection payload is not related to bypass script. For example, if you want to get a more comprehensive sql injection payload, both "yes" and "no" of "whether sql injection uses bypass script" should be considered.

[0100] In the execution of the sql injection instruction, the specific generation of the sql injection payload can refer to the examples in Figure 2 , which will be described later.

[0101] In some implementations, step S120 can further include: splicing the sql injection payload into a plurality of preset positions in the http request respectively to obtain an http request with the payload; and generating an http traffic sample according to the http request encapsulation.

[0102] For example, the above plurality of preset positions can include 6 positions of body, uri, cookie, user-agent, host, and referer in the http request, which are the positions in the http request where the sql injection payload can be embedded, wherein the body belongs to the request body of the http request, and the remaining 5 positions belong to the request header of the http request. Splicing the same sql injection payload into the 6 preset positions can obtain 6 different http traffic samples, thereby greatly enriching the sample quantity and reflecting the diversity of actual sql injection attacks (the closer the http traffic sample is to the actual, the better the training model effect).

[0103] As to the way of generating the http traffic sample according to the http request encapsulation, the foregoing has been introduced. For example, if the http traffic sample includes the http request message and the corresponding http response message, the following way can be adopted: encapsulating the http request into the http request message (by adding the header of the lower layer protocol, etc.), constructing the http response corresponding to the http request, and encapsulating the http response into the http response message (by adding the header of the lower layer protocol, etc.), so as to obtain the http traffic sample including the http request message and the corresponding http response message.

[0104] Figure 2 Another possible flow of the traffic sample generation method provided by the embodiment of the application is shown. Referring to Figure 2 , the traffic sample generation method can include the following steps:

[0105] (a) generating an instruction execution list according to 4 first-type sql injection parameters of the attack operation performed by the sql injection, the database targeted by the sql injection, the injection type of the sql injection, and whether the sql injection uses bypass scripts, wherein the instruction execution list contains sql injection instructions.

[0106] (b) judging whether there is still a sql injection instruction in the instruction execution list, if the result of the judgment is "yes", executing step (c), otherwise executing step (r). This step is the control logic of traversing the instruction execution list.

[0107] (c) calling the sql injection tool to execute the current sql injection instruction to generate the sql injection payload, and the specific generation process is described in the following steps.

[0108] (d) judging whether bypass scripts are used, if the result of the judgment is "yes", executing step (e), otherwise executing step (m). The judgment in this step can be completed according to the value of the calling parameter "whether the sql injection uses bypass scripts".

[0109] (e) reading all bypass scripts to obtain a bypass script list. The bypass scripts can be stored in a specific directory of the device, and this step reads them into the memory to construct the bypass script list.

[0110] (f) looping through the bypass script list to judge whether the loop is ended, if the result of the judgment is "yes", executing step (p), otherwise executing step (g). This step is the control logic of traversing the bypass script list.

[0111] (g) reading all payload formats.

[0112] (h) reading all filling groups.

[0113] (i) generating original sql injection payloads.

[0114] The above three steps are combined to illustrate that the sql injection payloads are mainly composed of boundary formats and filling groups, wherein the boundary formats are obtained from step (g) and there are, for example, 331 kinds, and the filling groups are obtained from step (h) and there are, for example, 53 kinds, and the two can generate 331 x 53 combinations, and each combination can generate a corresponding sql injection payload.

[0115] In addition, the boundary format and the filling group are also affected by some sql injection parameters, such as "database targeted by sql injection" and "operation system targeted by sql injection", when the values of the two parameters change, the boundary format and the filling group will also change. Therefore, steps (g) and (h) also read the corresponding boundary format and filling group according to the values of the two parameters when they are executed.

[0116] The payload generated in step (i) is called "original sql injection payload" because it has not been processed by bypassing scripts.

[0117] (j) processing the original sql injection payload according to the current bypassing script to obtain a sql injection payload.

[0118] (k) concatenating the sql injection payload to different injection points to generate http request headers, http request bodies, and fake http response headers and http response bodies. The injection points in this step are the pre-set positions such as body and uri in the http request mentioned above. In addition, since the scheme of the present application does not actually send the http request, it will not produce a real http response, so the http response headers and the http response bodies are fake, but their contents are consistent with the real response.

[0119] (l) recording information such as http request headers, http request bodies, http response headers, and http response bodies. After step (l) is executed, jump to step (f) for continuous execution.

[0120] (m) reading all payload formats.

[0121] (n) reading all filling groups.

[0122] (o) generating sql injection payloads.

[0123] The above three steps are similar to steps (g)-(h), except that since this method does not use bypassing scripts, the sql injection payload obtained in step (o) is directly obtained. After step (o) is executed, jump to step (k) for continuous execution.

[0124] (p) deleting the executed sql injection instruction from the instruction execution list. After executing a sql injection instruction, it can be deleted from the instruction execution list to avoid occupying storage space and to avoid repeated execution of the sql injection instruction.

[0125] (q) storing the information recorded in step (l) into a database. Note that the database here is used to generate the http traffic sample, not the database used as the sql injection attack target. After step (q) is executed, jump to step (b) for continuous execution.

[0126] (r) reading the records in the database to generate the http traffic sample. The database has stored the information of the http request header, the http request body, the http response header, the http response body, etc. at this time. The application layer information is encapsulated and the information of the lower layer protocol is added to obtain the http traffic sample.

[0127] Figure 2 The details not mentioned in the method in Figure 1 will be described with reference to the method in Figure 2 . Note that, for simplicity, in the method in , only the sql injection bypass script used in the sql injection is shown in the figure, and the value traversal of the second type of sql injection parameter is not shown in the figure.

[0128] Figure 3 Fig. 1 shows a possible structure of a traffic sample generation device provided by an embodiment of the present application, which can be used to execute the traffic sample generation method provided by the embodiment of the present application.

[0129] Referring to Figure 3 , the traffic sample generation device 200 includes:

[0130] The payload generation module 210 is configured to generate a sql injection payload by using a sql injection tool.

[0131] The sample generation module 220 is configured to encapsulate the http traffic sample according to the sql injection payload.

[0132] In an implementation of the traffic sample generation device, the payload generation module 210 generates a sql injection payload by using a sql injection tool, including: traversing a plurality of value combinations of sql injection parameters, and generating a corresponding sql injection instruction for each value combination; and calling the sql injection tool to execute the sql injection instruction to generate the sql injection payload.

[0133] In an implementation form of the traffic sample generation apparatus, the sql injection parameters used to generate the sql injection instruction are determined according to the performance of a device executing the traffic sample generation method.

[0134] In an implementation form of the traffic sample generation apparatus, the sql injection parameters used to generate the sql injection instruction are first-type sql injection parameters, and the sql injection parameters not used to generate the sql injection instruction are second-type sql injection parameters; the payload generation module 210 traverses value combinations of multiple sql injection parameters, and generates a corresponding sql injection instruction for each value combination, including: traversing value combinations of the first-type sql injection parameters, and generating a corresponding sql injection instruction for each value combination of the first-type sql injection parameters; the payload generation module 210 calls the sql injection tool to execute the sql injection instruction, so as to generate a sql injection payload, including: calling the sql injection tool to execute the sql injection instruction, and the sql injection instruction, when executed, traverses value combinations of the second-type sql injection parameters, and generates a corresponding sql injection payload for each value combination of the second-type sql injection parameters.

[0135] In an implementation form of the traffic sample generation apparatus, the first-type sql injection parameters include whether the sql injection uses bypass scripts, and the second-type sql injection parameters include bypass scripts used by the sql injection.

[0136] In an implementation form of the traffic sample generation apparatus, the sample generation module 220 encapsulates the http traffic sample according to the sql injection payload, including: splicing the sql injection payload in multiple preset positions in an http request respectively, to obtain an http request with a payload; and encapsulating the http traffic sample according to the http request.

[0137] In an implementation form of the traffic sample generation apparatus, the sample generation module 220 encapsulates the http traffic sample according to the http request, including: encapsulating the http request as an http request packet, constructing an http response corresponding to the http request, and encapsulating the http response as an http response packet, to obtain an http traffic sample including the http request packet and the http response packet corresponding to the http request.

[0138] The traffic sample generation apparatus 200 provided by the embodiments of the present application has the implementation principle and the technical effects introduced in the foregoing method embodiments, and for brevity of description, the part not mentioned in the device embodiment can be referred to the corresponding content in the method embodiments.

[0139] Figure 4A possible structure of an electronic device provided by an embodiment of the present application is shown. Refer to Figure 4 The electronic device 300 includes a processor 310 and a memory 320, which are interconnected and communicate with each other through a communication bus 330 and / or other forms of connection mechanism (not shown).

[0140] The processor 310 includes one or more (only one is shown in the figure), which can be an integrated circuit chip with signal processing capability. The processor 310 described above can be a general-purpose processor, including a central processing unit (CPU), a micro controller unit (MCU), a network processor (NP), or other conventional processors; it can also be a special-purpose processor, including a graphics processing unit (GPU), a neural network processing unit (NPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. And when the processor 310 is multiple, some of them can be general-purpose processors, and the other part can be special-purpose processors.

[0141] The memory 320 includes one or more (only one is shown in the figure), which can be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The processor 310 and other possible components can access, read and / or write data in the memory 320.

[0142] In particular, one or more computer program instructions can be stored in the memory 320, and the processor 310 can read and run the computer program instructions to implement the traffic sample generation method provided by the embodiments of the present application.

[0143] It can be understood that, Figure 4 The structure shown is only schematic, and the electronic device 300 can further include more components than those shown in the figure. Figure 4 For example, if the electronic device 300 needs to interact with other devices for data, the electronic device 300 can further include a communication unit.

[0144] Figure 4 The components shown in the figure can be implemented in hardware, software, or a combination thereof. The electronic device 300 can be a physical device such as a PC, a notebook, a tablet, a mobile phone, a server, an embedded device, etc., or a virtual device such as a virtual machine, a virtualization container, etc. Moreover, the electronic device 300 is not limited to a single device, but can also be a combination of multiple devices or a cluster of a large number of devices.

[0145] The embodiments of the present application also provide a computer readable storage medium having computer program instructions stored thereon, and the computer program instructions are read and run by a processor of a computer to execute the traffic sample generation method provided by the embodiments of the present application. For example, the computer readable storage medium can be implemented as Figure 4 the memory 320 in the electronic device 300 in the figure.

[0146] The embodiments of the present application also provide a computer program product including computer program instructions, and the computer program instructions are read and run by a processor of a computer to execute the traffic sample generation method provided by the embodiments of the present application. For example, the computer program product can be saved in the memory 320 in the electronic device 300 and read and run by the processor 310. Of course, the computer program product can also be saved in a storage medium independent of the electronic device 300, such as an optical disc, a U disk, etc. Figure 4

[0147] The above only describes the embodiments of the present application and is not used to limit the protection scope of the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, scheme combination, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.​

Claims

1. A method for generating traffic samples, characterized in that, include: Use SQL injection tools to generate SQL injection payloads; Generate HTTP traffic samples based on the SQL injection payload encapsulation; The method of generating SQL injection payloads using SQL injection tools includes: Iterate through various combinations of SQL injection parameters and generate corresponding SQL injection instructions for each combination. The SQL injection tool is invoked to execute the SQL injection instructions to generate the SQL injection payload; Among them, the SQL injection parameters used to generate the SQL injection command are the first type of SQL injection parameters, and the SQL injection parameters not used to generate the SQL injection command are the second type of SQL injection parameters. The process iterates through various combinations of SQL injection parameters and generates corresponding SQL injection instructions for each combination, including: Iterate through the possible combinations of values ​​for the first type of SQL injection parameters, and generate corresponding SQL injection instructions for each combination of values ​​for the first type of SQL injection parameters. The process of calling the SQL injection tool to execute the SQL injection command to generate the SQL injection payload includes: The SQL injection tool is invoked to execute the SQL injection instruction. When the SQL injection instruction is executed, it iterates through the value combinations of the second type of SQL injection parameters and generates a corresponding SQL injection payload for each value combination of the second type of SQL injection parameters. The step of generating HTTP traffic samples based on the SQL injection payload encapsulation includes: The SQL injection payload is concatenated into multiple preset positions in the HTTP request to obtain an HTTP request with a payload; HTTP traffic samples are generated based on the HTTP request encapsulation.

2. The method for generating traffic samples according to claim 1, characterized in that, The SQL injection parameters used to generate the SQL injection command are determined based on the device performance that executes the traffic sample generation method.

3. The method for generating traffic samples according to claim 1, characterized in that, The first type of SQL injection parameter includes whether the SQL injection uses a bypass script, and the second type of SQL injection parameter includes the bypass script used by the SQL injection.

4. The method for generating traffic samples according to claim 1, characterized in that, The step of generating an HTTP traffic sample based on the HTTP request includes: The HTTP request is encapsulated into an HTTP request message, the corresponding HTTP response is constructed, and the HTTP response is encapsulated into an HTTP response message to obtain an HTTP traffic sample including the HTTP request message and its corresponding HTTP response message.

5. A flow rate sample generation device, characterized in that, include: The payload generation module is used to generate SQL injection payloads using SQL injection tools. The sample generation module is used to encapsulate and generate HTTP traffic samples based on the SQL injection payload; Specifically, the payload generation module is used to iterate through various combinations of SQL injection parameters, generate corresponding SQL injection instructions for each combination of parameters, and call an SQL injection tool to execute the SQL injection instructions to generate an SQL injection payload. Among them, the SQL injection parameters used to generate the SQL injection command are the first type of SQL injection parameters, and the SQL injection parameters not used to generate the SQL injection command are the second type of SQL injection parameters. The payload generation module is specifically used to iterate through the value combinations of the first type of SQL injection parameters, generate a corresponding SQL injection instruction for each value combination of the first type of SQL injection parameters, and call the SQL injection tool to execute the SQL injection instruction. When the SQL injection instruction is executed, it iterates through the value combinations of the second type of SQL injection parameters and generates a corresponding SQL injection payload for each value combination of the second type of SQL injection parameters. Specifically, the sample generation module is used to concatenate the SQL injection payload into multiple preset positions in the HTTP request to obtain an HTTP request with a payload; and to encapsulate and generate an HTTP traffic sample based on the HTTP request.

6. A computer program product, characterized in that, It includes computer program instructions, which, when read and executed by a processor, perform the method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when read and executed by a processor, perform the method as described in any one of claims 1-4.

8. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores computer program instructions, which are read and executed by the processor to perform the method of any one of claims 1-4.

Images