AI-based intrusion protection response data processing method and server

Abstract

The invention discloses an AI-based intrusion protection response data processing method and a server, which can analyze a code of an SQL (Structured Query Language) instruction by collecting the code of the SQL instruction and utilizing a data processing and semantic comprehension algorithm based on artificial intelligence and deep learning. According to the method, abstract syntax tree semantic embedding representation of SQL instruction codes is captured and depicted, filtering is carried out on the basis of association information between node embedding semantics in the embedding representation, and node embedding semantics with higher semantic expression quality are purified to replace original nodes. Then, SQL code semantic coding based on a tree-shaped long-short-term memory network is carried out on the semantic embedded representation of the abstract syntax tree subjected to filtering and purification processing, so that accurate recognition and detection of SQL injection vulnerabilities are achieved by enhancing the structured dependency relationship among words in SQL instruction codes. Therefore, intrusion protection response data processing can be performed more intelligently, and automatic identification and detection of SQL injection attacks are facilitated, so that the problem of horse hanging is solved from the source, and the security of a website is enhanced.

Description

Technical Field

[0001] The present application relates to the field of data processing, and more specifically, to an AI-based intrusion protection response data processing method and server. Background Art

[0002] With the rapid development of Internet technology, Web applications have become one of the main platforms for enterprises and individuals to exchange information. However, the security issues of Web applications have become increasingly prominent. SQL injection attacks, as one of the most common security threats, have brought serious security risks to many websites and applications. SQL injection attacks insert malicious SQL code into the input received by the application, taking advantage of the lack of sufficient input validation by the application, thereby inducing the execution of unauthorized database operations. This may not only lead to the leakage of sensitive data, but also damage the database, thus affecting the stability and security of the entire system.

[0003] However, traditional SQL injection protection mechanisms mainly include input validation, parameterized queries, stored procedures, and the use of secure APIs. These measures often rely on the experience of developers and their understanding of security. With the continuous advancement of hacker technology, these traditional methods have become increasingly difficult to cope with new types of attacks. Especially for some complex application scenarios, traditional methods may not be able to fully cover all potential injection risk points, nor can they effectively identify complex attack patterns.

[0004] Therefore, an AI-based intrusion protection response data processing solution is desired. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides an AI-based intrusion protection response data processing method and server, which can collect the code of SQL instructions, and use the data processing and semantic understanding algorithm based on artificial intelligence and deep learning to analyze the code of the SQL instruction, so as to capture and characterize the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the association information between the embedded semantics of each node in the embedded representation, so as to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantic encoding based on the tree-shaped long short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to realize the accurate identification and detection of SQL injection vulnerabilities by enhancing the structured dependency relationship between each word in the SQL instruction code. In this way, the intrusion protection response data processing can be carried out more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of hanging horses from the source and enhance the security of the website.

[0006] According to one aspect of the present application, there is provided an AI-based intrusion protection response data processing method, which includes: Get the code of the SQL instruction to be identified; Performing semantic analysis and embedding mapping processing on the code of the SQL instruction to be identified to obtain a semantic embedding representation of an abstract syntax tree of the SQL instruction, wherein the semantic embedding representation of the abstract syntax tree of the SQL instruction includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors; Inputting the set of node semantic embedding vectors into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors; Using the filtered set of node semantic embedding vectors to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain a SQL instruction abstract syntax tree semantic enhanced embedding representation; The SQL command abstract syntax tree semantic enhancement embedding representation is input into a SQL code semantic encoder based on a tree-shaped long short-term memory network to obtain a SQL code semantic structure encoding feature vector; Based on the SQL code semantic structure encoding feature vector, it is determined whether there is an SQL injection security vulnerability.

[0007] According to another aspect of the present application, a server is provided, comprising: processor; A memory, in which computer program instructions are stored, and when the computer program instructions are executed by the processor, the processor executes the AI-based intrusion protection response data processing method as described in any one of claims 1 to 7.

[0008] Compared with the prior art, the present application provides an AI-based intrusion protection response data processing method and server, which can collect the code of SQL instructions and analyze the code of the SQL instructions using data processing and semantic understanding algorithms based on artificial intelligence and deep learning, so as to capture and characterize the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the association information between the embedded semantics of each node in the embedded representation, so as to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantic encoding based on the tree-shaped long and short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to realize the accurate identification and detection of SQL injection vulnerabilities by enhancing the structured dependency relationship between each word in the SQL instruction code. In this way, the intrusion protection response data processing can be carried out more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of hanging horses from the source and enhance the security of the website. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0010] Figure 1 is a flowchart of an AI-based intrusion protection response data processing method according to an embodiment of the present application; Figure 2 A data flow diagram of an AI-based intrusion protection response data processing method according to an embodiment of the present application; Figure 3 Flow chart of sub-step S2 of the AI-based intrusion protection response data processing method according to an embodiment of the present application; Figure 4 A block diagram of a server according to an embodiment of the present application. DETAILED DESCRIPTION

[0011] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0012] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0013] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0014] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0015] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0016] It should be understood that if a website has Trojans, it will cause website users to be infected and the website itself to be blocked, affecting user experience and traffic. In addition, existing automated Trojan tools will automatically scan the Internet on a large scale, automatically find websites with SQL injection vulnerabilities, and automatically inject Trojan codes. SQL injection vulnerabilities can cause website database information to be stolen, tampered with, and deleted, further causing the website to be Trojanized and even the attacker to obtain the website server management rights. Therefore, it is necessary to detect whether the website has SQL injection vulnerabilities in order to solve the Trojan problem from the source and strengthen the security of the website.

[0017] Traditional SQL injection protection mechanisms mainly include input validation, parameterized queries, stored procedures, and the use of secure APIs. These measures often rely on the experience of developers and their understanding of security. With the continuous advancement of hacker technology, these traditional methods have become increasingly difficult to cope with new types of attacks. Especially for some complex application scenarios, traditional methods may not be able to fully cover all potential injection risk points, nor can they effectively identify complex attack patterns. Therefore, an AI-based intrusion protection response data processing solution is expected.

[0018] In recent years, artificial intelligence technology has been widely used in various fields, and network security protection is no exception. Combined with artificial intelligence technology, SQL instructions can be deeply semantically analyzed to help automatically identify and classify SQL injection attacks, thereby achieving more accurate SQL injection detection and protection.

[0019] In the technical solution of the present application, an AI-based intrusion protection response data processing method is proposed. Figure 1 It is a flowchart of an AI-based intrusion protection response data processing method according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of the AI-based intrusion protection response data processing method according to an embodiment of the present application. Figure 1 and Figure 2As shown, according to the embodiment of the present application, the AI-based intrusion protection response data processing method includes the following steps: S1, obtaining the code of the SQL instruction to be identified; S2, performing semantic analysis and embedding mapping processing on the code of the SQL instruction to be identified to obtain the SQL instruction abstract syntax tree semantic embedding representation, wherein the SQL instruction abstract syntax tree semantic embedding representation includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors; S3, inputting the set of node semantic embedding vectors into a feature filtering network based on pseudo-anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors; S4, using the set of filtered node semantic embedding vectors to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain a SQL instruction abstract syntax tree semantic enhanced embedding representation; S5, inputting the SQL instruction abstract syntax tree semantic enhanced embedding representation into a SQL code semantic encoder based on a tree-shaped long short-term memory network to obtain a SQL code semantic structure encoding feature vector; S6, based on the SQL code semantic structure encoding feature vector, determining whether there is an SQL injection security vulnerability.

[0020] In particular, the S1 obtains the code of the SQL instruction to be identified. The code concept of SQL (Structured Query Language) instruction refers to the components of SQL statements and their grammatical rules. SQL keywords are predefined words with specific meanings. They are used to specify the type and operation of the instruction.

[0021] In particular, the S2 performs semantic analysis and embedding mapping processing on the code of the SQL instruction to be identified to obtain a semantic embedding representation of the SQL instruction abstract syntax tree, wherein the semantic embedding representation of the SQL instruction abstract syntax tree includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors. In a specific example of the present application, Figure 3 As shown, S2 includes: S21, semantically parsing the code of the SQL instruction to be identified to obtain a SQL instruction abstract syntax tree corresponding to the code of the SQL instruction to be identified; S22, semantically embedding encoding each node and each edge in the SQL instruction abstract syntax tree to obtain a semantic embedding representation of the SQL instruction abstract syntax tree.

[0022] Specifically, the S21 performs semantic parsing on the code of the SQL instruction to be identified to obtain a SQL instruction abstract syntax tree corresponding to the code of the SQL instruction to be identified. It is worth mentioning that the SQL instruction abstract syntax tree can provide a structured representation of the SQL instruction code to be identified, so that the logical structure and potential behavior of the SQL instruction to be identified can be more easily understood and analyzed. In other words, by constructing an SQL instruction abstract syntax tree, the different elements of the code statements in the SQL instruction to be identified can be better identified, and it is helpful to understand the meaning and intention of the code statements to determine whether the SQL statement conforms to the expected behavior pattern, thereby improving the accuracy of SQL injection detection. For example, it is easier to identify which parts are normal data queries and which parts may be malicious SQL injection attempts. This is because the abstract syntax tree can reveal the logical flow and execution order inside the SQL statement.

[0023] Specifically, the S22 performs semantic embedding coding on each node and each edge in the SQL instruction abstract syntax tree to obtain the semantic embedding representation of the SQL instruction abstract syntax tree. It is worth mentioning that the semantic embedding representation of the SQL instruction abstract syntax tree includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors. In particular, through semantic embedding coding, the semantic features of each node and edge can be converted into vector representations, and these vectors are not just simple identifiers, but contain rich semantic information. This means that even if two SQL instruction codes look similar, if their actual meanings are different, their corresponding vectors may be far apart. This vectorized form can retain the semantic information of the SQL instruction code, allowing the computer to understand the deep meaning of the code. In addition, the embedded coding method can map nodes and edges to a high-dimensional feature space, so that the model can capture more complex semantic relationships, and identify potential SQL injection behaviors and potential security vulnerabilities by learning the relationship between the semantics of these SQL instruction codes.

[0024] It is worth mentioning that in other specific examples of the present application, the code of the SQL instruction to be identified can also be semantically analyzed and embedded in other ways to obtain a semantic embedding representation of the abstract syntax tree of the SQL instruction, for example: using a SQL parser to parse the SQL instruction into an abstract syntax tree (AST); performing semantic analysis on the AST to determine the meaning of the instruction; identifying semantic elements in the AST, such as tables, columns, functions, and conditions; assigning a unique integer ID to each semantic element; creating an embedding map that maps each ID to a semantic embedding vector; the semantic embedding vector can be pre-trained or generated using unsupervised learning techniques (such as Word2Vec or GloVe); traversing the AST and generating a semantic embedding representation for each node and edge; mapping the semantic element ID of the node to the corresponding embedding vector in the embedding map; assigning a predefined embedding vector to each edge connecting the nodes to represent the edge type.

[0025] In particular, the S3 inputs the set of node semantic embedding vectors into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors. It should be understood that since each node semantic embedding vector in the set of node semantic embedding vectors contains tree node semantic features in the abstract syntax tree of the SQL instruction, it is part of the SQL instruction code semantics. At the same time, these different node semantic features will have different importance, and have different contributions to the subsequent SQL instruction code semantic understanding and the identification and detection tasks of SQL injection vulnerabilities. Therefore, in order to be able to filter out the most representative features that best reflect the true intention of the SQL instruction from a large amount of node semantic information, thereby improving the accuracy and efficiency of SQL injection detection, in the technical solution of the present application, the set of node semantic embedding vectors is further input into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors. The feature filtering network based on pseudo anchor center contribution semantic query can optimize the expression of node embedding semantics through clustering analysis and semantic contribution evaluation, thereby improving the accuracy of understanding the semantics of the SQL instruction code.

[0026] In an embodiment of the present application, the set of node semantic embedding vectors is input into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors, including: first, clustering analysis is performed on the set of node semantic embedding vectors to obtain node semantic cluster center representation vectors as pseudo anchor centers; clustering analysis is performed on the set of node semantic embedding vectors to extract cluster center representation vectors as pseudo anchor centers, which helps to capture the intrinsic structure and distribution between SQL instruction code node semantic features. The determination of the pseudo anchor center provides a reference point for subsequent node semantic embedding vector evaluation, which helps to identify and strengthen node semantic features related to the central semantics in the data set and subsequent tasks. Then, the semantic contribution representation matrix of each node semantic embedding vector in the set of node semantic embedding vectors is calculated relative to the pseudo anchor center to obtain a sequence of node semantic contribution representation matrices; in this way, the contribution of each node embedded semantics to the overall SQL instruction code semantic expression is quantified, that is, the relative importance of the node semantic embedding vector to the data semantics is evaluated by calculating the semantic contribution representation matrix, which provides a basis for feature screening and weighting. Furthermore, each node semantic contribution representation matrix in the sequence of the node semantic contribution representation matrix is ​​subjected to a contribution simulated mask sparse module based on a random dropout mechanism to obtain a sequence of masked sparse node semantic contribution representation matrices; here, the random dropout mechanism is used to perform sparse processing on each node semantic contribution representation matrix to generate a sequence of masked sparse node semantic contribution representation matrices to enhance the generalization ability of the model and reduce the number of parameters and feature quantity. The contribution simulated mask sparse processing strengthens the model's attention to the semantic features of key SQL instruction code nodes by randomly "closing" a part of unimportant node embedding semantic features, while reducing the complexity of the model and preventing overfitting. Finally, each masked sparse node semantic contribution representation matrix in the sequence of the masked sparse node semantic contribution representation matrix is ​​used as a modulation matrix, and the matrix product between it and each node semantic embedding vector is calculated to obtain the set of the filtered node semantic embedding vectors. Here, the masked sparse node semantic contribution representation matrix is ​​used as a modulation matrix and matrix product operations are performed with each node semantic embedding vector to achieve feature filtering. That is, by weighting the original node semantic embedding vector with a modulation matrix, unimportant or noisy node semantic features are filtered out, thereby purifying the node feature expression of the SQL instruction code, enhancing the feature expression ability and the model's detection performance for SQL injection security vulnerabilities.

[0027] Among them, the process of performing cluster analysis on the set of node semantic embedding vectors to obtain a node semantic clustering center representation vector as a pseudo anchor center includes: calculating the positional mean between each node semantic embedding vector in the set of node semantic embedding vectors to obtain the node semantic clustering center representation vector.

[0028] More specifically, the process of calculating the semantic contribution representation matrix of each node semantic embedding vector in the set of node semantic embedding vectors relative to the pseudo anchor center to obtain a sequence of node semantic contribution representation matrices includes: calculating the positional division between the transposed vector of the node semantic cluster center representation vector and the bi-norm of the node semantic cluster center representation vector to obtain a transformed node semantic cluster center vector; calculating the vector multiplication between each node semantic embedding vector and the transformed node semantic cluster center vector respectively, and then using The function performs soft maximum normalization processing on the obtained sequence of association matrices to obtain the sequence of node semantic contribution representation matrices.

[0029] More specifically, the process of obtaining a sequence of masked sparse node semantic contribution representation matrices by passing each node semantic contribution representation matrix in the sequence of node semantic contribution representation matrices through a contribution simulated masked sparse module based on a random deactivation mechanism includes: performing random deactivation processing on each node semantic contribution representation matrix to obtain a sequence of masked sparse node semantic contribution representation matrices.

[0030] In summary, in the above embodiment, the set of node semantic embedding vectors is input into the feature filtering network based on pseudo anchor center contribution semantic query to obtain the set of filtered node semantic embedding vectors, including: inputting the set of node semantic embedding vectors into the feature filtering network based on pseudo anchor center contribution semantic query and processing them with the following semantic query feature filtering formula to obtain the set of filtered node semantic embedding vectors; wherein the semantic query feature filtering formula is: in, is the set of semantic embedding vectors of the nodes, are the first, second and third nodes in the set of semantic embedding vectors of the node respectively. node semantic embedding vector, is the first node in the set of semantic embedding vectors of the node node semantic embedding vector, is the number of feature vectors in the set of semantic embedding vectors of the node, is the node semantic clustering center representation vector, represents the two-norm of a vector, for function, For random dropout, For the said The masked sparse node semantic contribution representation matrix corresponding to the node semantic embedding vector, is the first node in the set of filtered node semantic embedding vectors The filtered node semantic embedding vector.

[0031] Furthermore, since in the above-mentioned feature filtering process, the features that contribute less to the overall SQL instruction code semantic expression have been identified through semantic contribution evaluation and sparse processing, and eliminated through a random inactivation mechanism. Therefore, in order to apply the filtered and purified SQL instruction code node semantic features to perform SQL code semantic understanding and capture its structured dependencies, in the technical solution of the present application, the set of node semantic embedding vectors after filtering is further used to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain the SQL instruction abstract syntax tree semantic enhanced embedding representation. In this way, the filtered vector set can be used to replace the original vector set to remove node feature information that may introduce noise or redundant information, thereby highlighting those features that are closely related to SQL injection attacks, making the final SQL instruction abstract syntax tree semantic representation more refined and accurate.

[0032] In particular, the S4 uses the set of node semantic embedding vectors after filtering to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain the SQL instruction abstract syntax tree semantic enhanced embedding representation. Since in the above-mentioned feature filtering process, the features that contribute less to the overall SQL instruction code semantic expression have been identified through semantic contribution evaluation and sparse processing, and are eliminated through a random inactivation mechanism. Therefore, in order to apply this filtered and purified SQL instruction code node semantic feature to perform SQL code semantic understanding and capture its structured dependencies, in the technical solution of the present application, the set of node semantic embedding vectors after filtering is further used to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain the SQL instruction abstract syntax tree semantic enhanced embedding representation. In this way, the filtered vector set can be used to replace the original vector set to remove the node feature information that may introduce noise or redundant information, thereby highlighting the features that are closely related to SQL injection attacks, making the final SQL instruction abstract syntax tree semantic representation more refined and accurate.

[0033] In particular, in S5, the SQL instruction abstract syntax tree semantic enhancement embedding representation is input into the SQL code semantic encoder based on the tree-shaped long short-term memory network to obtain the SQL code semantic structure encoding feature vector. Since the abstract syntax tree of the SQL instruction is essentially a structured data representation, it contains the grammatical structure and logical relationship of the SQL statement. Therefore, in the technical solution of the present application, the SQL instruction abstract syntax tree semantic enhancement embedding representation is further input into the SQL code semantic encoder based on the tree-shaped long short-term memory network to obtain the SQL code semantic structure encoding feature vector. It should be understood that the tree-shaped long short-term memory network, as a variant of a recursive neural network (RNN), is specially designed to process the semantics and grammatical structure of such structured data, and can effectively capture the hierarchical relationship and dependency between nodes in the SQL instruction abstract syntax tree semantic enhancement embedding representation. In particular, since the semantically enhanced SQL instruction abstract syntax tree semantic embedding representation already contains important semantic information of the node. The SQL code semantic encoder based on the tree-shaped long short-term memory network can further process these semantically enhanced embedding representations, and by transmitting information along the tree structure, the information of each node is integrated to form a global semantic structure encoding feature representation. In this way, even complex SQL instructions can be effectively encoded into a compact semantic structure encoding feature vector. In addition, the SQL code semantic encoder based on the tree-shaped long short-term memory network can capture the long-distance dependencies between nodes when processing the tree structure, which is crucial for understanding the deep semantics of the SQL instruction code statement. For example, in a complex SQL query, some keywords or operators may appear on different branches of the tree, but there is a logical association between them. The SQL code semantic encoder based on the tree-shaped long short-term memory network can handle this long-distance dependency well, so as to better understand the intention of the SQL instruction and provide strong support for subsequent SQL injection detection.

[0034] In particular, the S6 determines whether there is a SQL injection security vulnerability based on the SQL code semantic structure encoding feature vector. In a specific example of the present application, the SQL code semantic structure encoding feature vector is input into a classifier-based SQL injection identifier to obtain an identification result, and the identification result is used to indicate whether there is a SQL injection security vulnerability. That is, the SQL code semantic structure encoding feature is used to perform classification processing, thereby performing SQL injection identification, and thereby determining whether there is a SQL injection security vulnerability. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the Trojan horse problem from the source and enhance the security of the website.

[0035] In a preferred example, inputting the SQL code semantic structure encoding feature vector into a classifier-based SQL injection identifier to obtain an identification result includes: Determine the SQL code semantic structure encoding maximum eigenvalue and the SQL code semantic structure encoding minimum eigenvalue of the SQL code semantic structure encoding feature vector, and calculate the SQL code semantic structure encoding mean and the SQL code semantic structure encoding standard deviation of the feature set of the SQL code semantic structure encoding feature vector; Calculating the quotient of the SQL code semantic structure encoding mean and the SQL code semantic structure encoding standard deviation to obtain the SQL code semantic structure encoding statistical normalization value; Calculate the inverse of each eigenvalue of the SQL code semantic structure encoding eigenvalue vector, multiply it by the difference between the maximum eigenvalue of the SQL code semantic structure encoding and the minimum eigenvalue of the SQL code semantic structure encoding, and then subtract it from the SQL code semantic structure encoding statistical normalization value to obtain the SQL code semantic structure encoding distribution approximation vector; Calculate an exponential function with a natural constant as the base and each eigenvalue of the SQL code semantic structure encoding distribution approximation vector as the exponent to obtain the SQL code semantic structure encoding distribution class approximation vector; Performing dot-addition on the SQL code semantic structure encoding distribution class approximation vector and the SQL code semantic structure encoding statistical normalization value, and calculating the base-two logarithm of the absolute value of each eigenvalue of the dot-added vector to obtain an optimized SQL code semantic structure encoding eigenvector; and The optimized SQL code semantic structure encoding feature vector is input into a classifier-based SQL injection identifier to obtain an identification result.

[0036] Among them, the SQL code semantic structure encoding feature vector is recorded as The optimization expression is: in, is the SQL code semantic structure encoding feature vector, is the mean value of the semantic structure encoding of the SQL code, is the standard deviation of the SQL code semantic structure encoding, Encode statistical standardized values ​​for the semantic structure of SQL code, and are respectively the SQL code semantic structure encoding maximum eigenvalue and the SQL code semantic structure encoding minimum eigenvalue of the SQL code semantic structure encoding feature vector, and is the difference between the maximum eigenvalue of the SQL code semantic structure encoding and the minimum eigenvalue of the SQL code semantic structure encoding, is the distributional approximation vector encoding the semantic structure of the SQL code, is the logarithm to base 2, () is the exponential operation, Indicates point addition, represents dot product, Indicates point reduction, is the optimized SQL code semantic structure encoding feature vector.

[0037] Here, in the preferred example, since the sets of filtered node semantic embedding vectors respectively represent the filtered query semantics based on the embedded semantic pseudo-central contribution of each node, when the SQL instruction abstract syntax tree semantic enhanced embedding representation obtained therefrom is input into the SQL code semantic encoder based on the tree-shaped long short-term memory network, the node semantic filtering query differences will have different semantic encoding weights based on the tree-shaped long short-term memory association, so that the SQL code semantic structure encoding feature vector will also have a diversified set expression distribution of aggregated reasoning features. Therefore, it is expected to improve the balance between the regression mapping accuracy and completeness when the SQL code semantic structure encoding feature vector is input into the classifier-based SQL injection identifier for class regression, thereby improving the accuracy of the obtained recognition results.

[0038] Therefore, by performing random statistical normalization on the diversified feature set of the SQL code semantic structure encoding feature vector, the confidence space constructed based on the overall feature value of the SQL code semantic structure encoding feature vector is approximated by the standardized continuous probability density distribution relative to the response hypothesis test of each feature value of the SQL code semantic structure encoding feature vector, thereby establishing the target reachability of the diversified feature distribution of the SQL code semantic structure encoding feature vector to the unified regression target, so as to achieve the balanced executableness between mapping accuracy and mapping completeness in the class regression process based on the diversified feature distribution of the SQL code semantic structure encoding feature vector, and improve the accuracy of the recognition result obtained by the SQL code semantic structure encoding feature vector input into the classifier-based SQL injection identifier. In this way, the identification and detection of SQL injection vulnerabilities can be realized more accurately, so as to more intelligently perform intrusion protection response data processing, help automatically identify and detect SQL injection attacks, so as to solve the Trojan horse problem from the source and enhance the security of the website.

[0039] In summary, according to the AI-based intrusion protection response data processing method of the embodiment of the present application, it is explained that it can collect the code of the SQL instruction, and use the data processing and semantic understanding algorithm based on artificial intelligence and deep learning to analyze the code of the SQL instruction, so as to capture and characterize the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the association information between the embedded semantics of each node in the embedded representation, so as to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantic encoding based on the tree-shaped long and short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to utilize the structured dependency relationship between each word in the enhanced SQL instruction code to realize the accurate identification and detection of SQL injection vulnerabilities. In this way, the intrusion protection response data processing can be carried out more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of hanging horses from the source and enhance the security of the website.

[0040] Below, reference Figure 4 To describe the server according to an embodiment of the present application.

[0041] Figure 4 The figure illustrates a block diagram of a server according to an embodiment of the present application.

[0042] like Figure 4 As shown, the server 10 includes one or more processors 11 and a memory 12 .

[0043] The processor 11 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the server 10 to perform desired functions.

[0044] The memory 12 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may run the program instructions to implement the functions of the AI-based intrusion protection response data processing method of each embodiment of the present application described above and / or other desired functions. Various contents such as SQL code semantic structure encoding feature vectors may also be stored in the computer-readable storage medium.

[0045] In one example, the server 10 may further include: an input device 13 and an output device 14 , and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0046] The input device 13 may include, for example, a keyboard, a mouse, etc.

[0047] The output device 14 can output various information to the outside, including classification results, etc. The output device 14 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0048] Of course, to simplify, Figure 4 Only some of the components in the server 10 related to the present application are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the server 10 may also include any other appropriate components.

[0049] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. An AI-based intrusion protection response data processing method, characterized in that: include: Get the code of the SQL instruction to be identified; Performing semantic analysis and embedding mapping processing on the code of the SQL instruction to be identified to obtain a semantic embedding representation of an abstract syntax tree of the SQL instruction, wherein the semantic embedding representation of the abstract syntax tree of the SQL instruction includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors; Inputting the set of node semantic embedding vectors into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors; Using the filtered set of node semantic embedding vectors to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain a SQL instruction abstract syntax tree semantic enhanced embedding representation; The SQL command abstract syntax tree semantic enhancement embedding representation is input into a SQL code semantic encoder based on a tree-shaped long short-term memory network to obtain a SQL code semantic structure encoding feature vector; Based on the SQL code semantic structure encoding feature vector, it is determined whether there is an SQL injection security vulnerability.

2. The AI-based intrusion protection response data processing method according to claim 1, characterized in that: The code of the SQL instruction to be identified is subjected to semantic analysis and embedding mapping processing to obtain a semantic embedding representation of an abstract syntax tree of the SQL instruction, including: Performing semantic analysis on the code of the SQL instruction to be identified to obtain a SQL instruction abstract syntax tree corresponding to the code of the SQL instruction to be identified; Semantic embedding coding is performed on each node and each edge in the SQL instruction abstract syntax tree to obtain a semantic embedding representation of the SQL instruction abstract syntax tree.

3. The AI-based intrusion protection response data processing method according to claim 2, characterized in that: Inputting the set of node semantic embedding vectors into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors, including: Performing cluster analysis on the set of node semantic embedding vectors to obtain node semantic cluster center representation vectors as pseudo anchor centers; Calculating a semantic contribution representation matrix of each node semantic embedding vector in the set of node semantic embedding vectors relative to the pseudo anchor center to obtain a sequence of node semantic contribution representation matrices; Passing each node semantic contribution representation matrix in the sequence of node semantic contribution representation matrices through a contribution pseudo-masked sparse module based on a random dropout mechanism to obtain a sequence of masked sparse node semantic contribution representation matrices; Each masked sparse node semantic contribution representation matrix in the sequence of the masked sparse node semantic contribution representation matrices is used as a modulation matrix, and the matrix product between the masked sparse node semantic contribution representation matrix and each node semantic embedding vector is calculated to obtain the set of filtered node semantic embedding vectors.

4. The AI-based intrusion protection response data processing method according to claim 3, characterized in that: Cluster analysis is performed on the set of node semantic embedding vectors to obtain a node semantic clustering center representation vector as a pseudo anchor center, including: calculating the positional mean between each node semantic embedding vector in the set of node semantic embedding vectors to obtain the node semantic clustering center representation vector.

5. The AI-based intrusion protection response data processing method according to claim 4, characterized in that: Calculating the semantic contribution representation matrix of each node semantic embedding vector in the set of node semantic embedding vectors relative to the pseudo anchor center to obtain a sequence of node semantic contribution representation matrices, including: Calculating the positional division between the transposed vector of the node semantic cluster center representation vector and the bi-norm of the node semantic cluster center representation vector to obtain a transformed node semantic cluster center vector; After calculating the vector multiplication between the semantic embedding vector of each node and the semantic clustering center vector of the transformed node, use The function performs soft maximum normalization processing on the obtained sequence of association matrices to obtain the sequence of node semantic contribution representation matrices.

6. The AI-based intrusion protection response data processing method according to claim 5, characterized in that: Each node semantic contribution representation matrix in the sequence of node semantic contribution representation matrices is passed through a contribution simulated masked sparse module based on a random deactivation mechanism to obtain a sequence of masked sparse node semantic contribution representation matrices, including: performing random deactivation processing on each node semantic contribution representation matrix to obtain the sequence of masked sparse node semantic contribution representation matrices.

7. The AI-based intrusion protection response data processing method according to claim 6, characterized in that: Based on the SQL code semantic structure encoding feature vector, determining whether there is an SQL injection security vulnerability includes: inputting the SQL code semantic structure encoding feature vector into a classifier-based SQL injection identifier to obtain a recognition result, wherein the recognition result is used to indicate whether there is an SQL injection security vulnerability.

8. A server, characterized in that: include: processor; A memory, in which computer program instructions are stored, and when the computer program instructions are executed by the processor, the processor executes the AI-based intrusion protection response data processing method as described in any one of claims 1 to 7.

Images