AI-based intrusion protection response data processing method and server

Abstract

The present application discloses an AI-based intrusion protection response data processing method and server, which can collect the code of SQL instructions and analyze the code of the SQL instructions using data processing and semantic understanding algorithms based on artificial intelligence and deep learning, so as to capture and depict the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the correlation information between the embedded semantics of each node in the embedded representation, so as to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantic encoding based on the tree-shaped long short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to utilize the structured dependency relationship between each word in the enhanced SQL instruction code to achieve accurate identification and detection of SQL injection vulnerabilities. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of Trojans from the source and enhance the security of the website.

Description

Technical Field

[0001] The present application relates to the field of data processing, and more specifically, to an AI-based intrusion protection response data processing method and server. Background Art

[0002] With the rapid development of internet technology, web applications have become one of the primary platforms for information exchange between businesses and individuals. However, the security issues of web applications have also become increasingly prominent. SQL injection attacks, one of the most common security threats, pose a serious security risk to many websites and applications. SQL injection attacks insert malicious SQL code into application input, exploiting the lack of adequate input validation to induce unauthorized database operations. This can not only lead to the leakage of sensitive data but also damage the database, compromising the stability and security of the entire system.

[0003] However, traditional SQL injection protection mechanisms primarily include input validation, parameterized queries, stored procedures, and the use of secure APIs. These measures often rely on developer experience and security awareness. As hacker technology continues to advance, these traditional methods are becoming increasingly inadequate to address new attack vectors. Especially in complex application scenarios, traditional methods may not fully cover all potential injection risk points, nor effectively identify complex attack patterns.

[0004] Therefore, an AI-based intrusion protection response data processing solution is desired. Summary of the Invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides an AI-based intrusion protection response data processing method and server, which can collect the code of SQL instructions and analyze the code of the SQL instructions using data processing and semantic understanding algorithms based on artificial intelligence and deep learning, so as to capture and characterize the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the correlation information between the embedded semantics of each node in the embedded representation, so as to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantics encoding based on the tree-shaped long short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to utilize the structured dependency relationship between each word in the enhanced SQL instruction code to achieve accurate identification and detection of SQL injection vulnerabilities. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of Trojans from the source and enhance the security of the website.

[0006] According to one aspect of the present application, a method for processing intrusion protection response data based on AI is provided, which includes:

[0007] Get the code of the SQL instruction to be identified;

[0008] Performing semantic analysis and embedding mapping processing on the code of the SQL instruction to be identified to obtain a semantic embedding representation of an abstract syntax tree of the SQL instruction, wherein the semantic embedding representation of the abstract syntax tree of the SQL instruction includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors;

[0009] Inputting the set of node semantic embedding vectors into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors;

[0010] Using the filtered set of node semantic embedding vectors to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain a SQL instruction abstract syntax tree semantic enhanced embedding representation;

[0011] The SQL instruction abstract syntax tree semantic enhancement representation is embedded into a SQL code semantic encoder based on a tree-shaped long short-term memory network to obtain a SQL code semantic structure encoding feature vector;

[0012] Based on the SQL code semantic structure encoding feature vector, it is determined whether there is an SQL injection security vulnerability.

[0013] According to another aspect of the present application, a server is provided, comprising:

[0014] processor;

[0015] A memory, wherein computer program instructions are stored in the memory, and when the computer program instructions are executed by the processor, the processor executes the AI-based intrusion protection response data processing method according to any one of claims 1 to 7.

[0016] Compared with the prior art, the present application provides an AI-based intrusion protection response data processing method and server, which can collect the code of SQL instructions and use data processing and semantic understanding algorithms based on artificial intelligence and deep learning to analyze the code of the SQL instructions, so as to capture and characterize the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the correlation information between the embedded semantics of each node in the embedded representation to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the abstract syntax tree semantic embedding representation after filtering and purification is subjected to SQL code semantic encoding based on a tree-shaped long short-term memory network, so as to utilize the structured dependency relationship between each word in the enhanced SQL instruction code to achieve accurate identification and detection of SQL injection vulnerabilities. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of Trojans from the source and enhance the security of the website. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other purposes, features, and advantages of the present application will become more apparent through a more detailed description of the embodiments of the present application in conjunction with the accompanying drawings. The accompanying drawings are intended to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the drawings, the same reference numerals generally represent the same components or steps.

[0018] Figure 1 Flowchart of an AI-based intrusion protection response data processing method according to an embodiment of the present application;

[0019] Figure 2 Schematic diagram of data flow of an AI-based intrusion protection response data processing method according to an embodiment of the present application;

[0020] Figure 3 Flowchart of sub-step S2 of the AI-based intrusion protection response data processing method according to an embodiment of the present application;

[0021] Figure 4 4 is a block diagram of a server according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described herein.

[0023] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0024] Although the present application makes various references to certain modules in the system according to embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are illustrative only, and different aspects of the system and method can use different modules.

[0025] Flowcharts are used in this application to illustrate the operations performed by the systems according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, the various steps may be processed in reverse order or simultaneously, as needed. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0026] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described herein.

[0027] It's understandable that the presence of Trojans on a website can cause users to become infected and the website itself to be blocked, impacting user experience and traffic. Furthermore, existing automated Trojan-installation tools automatically scan the internet, identifying websites with SQL injection vulnerabilities and then automatically injecting Trojan code. SQL injection vulnerabilities can lead to the theft, modification, and deletion of website database information, further compromising the website and even allowing attackers to gain administrative privileges on the website server. Therefore, it's essential to detect websites for SQL injection vulnerabilities to address Trojan-installation issues at the source and enhance website security.

[0028] Traditional SQL injection protection mechanisms primarily include input validation, parameterized queries, stored procedures, and the use of secure APIs. These measures often rely on developer experience and security awareness. With the continuous advancement of hacker technology, these traditional methods are becoming increasingly inadequate to address new attack vectors. Especially in complex application scenarios, traditional methods may not fully cover all potential injection risk points, nor effectively identify complex attack patterns. Therefore, an AI-based intrusion prevention response data processing solution is desired.

[0029] In recent years, artificial intelligence (AI) technology has been widely used in various fields, including network security. Combining AI technology can perform deep semantic analysis on SQL commands to help automatically identify and classify SQL injection attacks, enabling more accurate SQL injection detection and protection.

[0030] In the technical solution of this application, an AI-based intrusion protection response data processing method is proposed. Figure 1 Flowchart of an AI-based intrusion protection response data processing method according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of the AI-based intrusion protection response data processing method according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to an embodiment of the present application, the AI-based intrusion protection response data processing method includes the following steps: S1, obtaining the code of the SQL instruction to be identified; S2, performing semantic analysis and embedding mapping processing on the code of the SQL instruction to be identified to obtain the SQL instruction abstract syntax tree semantic embedding representation, wherein the SQL instruction abstract syntax tree semantic embedding representation includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors; S3, inputting the set of node semantic embedding vectors into a feature filtering network based on pseudo-anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors; S4, using the set of filtered node semantic embedding vectors to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain a SQL instruction abstract syntax tree semantic enhanced embedding representation; S5, inputting the SQL instruction abstract syntax tree semantic enhanced embedding representation into a SQL code semantic encoder based on a tree-shaped long short-term memory network to obtain a SQL code semantic structure encoding feature vector; S6, determining whether there is an SQL injection security vulnerability based on the SQL code semantic structure encoding feature vector.

[0031] Specifically, S1 obtains the code of the SQL instruction to be identified. The concept of SQL (Structured Query Language) instruction code refers to the components of an SQL statement and its grammatical rules. SQL keywords are predefined words with specific meanings. They are used to specify the type and operation of the instruction.

[0032] In particular, the S2 performs semantic analysis and embedding mapping on the code of the SQL instruction to be identified to obtain a semantic embedding representation of the SQL instruction abstract syntax tree, wherein the semantic embedding representation of the SQL instruction abstract syntax tree includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors. In a specific example of the present application, Figure 3As shown, the S2 includes: S21, performing semantic parsing on the code of the SQL instruction to be identified to obtain a SQL instruction abstract syntax tree corresponding to the code of the SQL instruction to be identified; S22, performing semantic embedding encoding on each node and each edge in the SQL instruction abstract syntax tree to obtain a semantic embedding representation of the SQL instruction abstract syntax tree.

[0033] Specifically, the S21 performs semantic parsing on the code of the SQL instruction to be identified to obtain a SQL instruction abstract syntax tree corresponding to the code of the SQL instruction to be identified. It is worth mentioning that the SQL instruction abstract syntax tree can provide a structured representation of the SQL instruction code to be identified, making it easier to understand and analyze the logical structure and potential behavior of the SQL instruction to be identified. That is to say, by constructing an SQL instruction abstract syntax tree, the different elements of the code statements in the SQL instruction to be identified can be better identified, and it is helpful to understand the meaning and intention of the code statements to determine whether the SQL statement conforms to the expected behavior pattern, thereby improving the accuracy of SQL injection detection. For example, it is easier to identify which parts are normal data queries and which parts may be malicious SQL injection attempts. This is because the abstract syntax tree can reveal the logical flow and execution order within the SQL statement.

[0034] Specifically, the S22 performs semantic embedding coding on each node and each edge in the SQL instruction abstract syntax tree to obtain a semantic embedding representation of the SQL instruction abstract syntax tree. It is worth mentioning that the semantic embedding representation of the SQL instruction abstract syntax tree includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors. In particular, through semantic embedding coding, the semantic features of each node and edge can be converted into vector representations. These vectors are not just simple identifiers, but contain rich semantic information. This means that even if two SQL instruction codes look similar, if their actual meanings are different, their corresponding vectors may be far apart. This vectorized form can retain the semantic information of the SQL instruction code, allowing the computer to understand the deep meaning of the code. In addition, the embedded coding method can map nodes and edges to a high-dimensional feature space, allowing the model to capture more complex semantic relationships and identify potential SQL injection behaviors and potential security vulnerabilities by learning the relationship between the semantics of these SQL instruction codes.

[0035] It is worth mentioning that in other specific examples of the present application, the code of the SQL instruction to be identified can also be semantically analyzed and embedded in other ways to obtain a semantic embedding representation of the SQL instruction abstract syntax tree, for example: using a SQL parser to parse the SQL instruction into an abstract syntax tree (AST); performing semantic analysis on the AST to determine the meaning of the instruction; identifying semantic elements in the AST, such as tables, columns, functions, and conditions; assigning a unique integer ID to each semantic element; creating an embedding map to map each ID to a semantic embedding vector; the semantic embedding vector can be pre-trained or generated using unsupervised learning techniques (such as Word2Vec or GloVe); traversing the AST and generating a semantic embedding representation for each node and edge; mapping the semantic element ID of the node to the corresponding embedding vector in the embedding map; assigning a predefined embedding vector to each edge connecting the nodes to represent the edge type.

[0036] In particular, in S3, the set of node semantic embedding vectors is input into a feature filtering network based on a pseudo-anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors. It should be understood that since each node semantic embedding vector in the set of node semantic embedding vectors contains tree node semantic features related to the SQL instruction abstract syntax tree, which is part of the SQL instruction code semantics, these different node semantic features will have different importance and have different contributions to the subsequent SQL instruction code semantic understanding and the identification and detection tasks of SQL injection vulnerabilities. Therefore, in order to be able to filter out the most representative features that best reflect the true intention of the SQL instruction from a large amount of node semantic information, thereby improving the accuracy and efficiency of SQL injection detection, in the technical solution of the present application, the set of node semantic embedding vectors is further input into a feature filtering network based on a pseudo-anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors. The feature filtering network based on the pseudo-anchor center contribution semantic query can optimize the expression of node embedding semantics through clustering analysis and semantic contribution evaluation, thereby improving the accuracy of understanding the semantics of the SQL instruction code.

[0037] In an embodiment of the present application, the set of node semantic embedding vectors is input into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors, including: first, clustering analysis is performed on the set of node semantic embedding vectors to obtain node semantic cluster center representation vectors as pseudo anchor centers; clustering analysis is performed on the set of node semantic embedding vectors to extract cluster center representation vectors as pseudo anchor centers, which helps capture the intrinsic structure and distribution between the semantic features of SQL instruction code nodes. The determination of pseudo anchor centers provides a reference point for subsequent node semantic embedding vector evaluation, which helps to identify and strengthen node semantic features related to the central semantics in the data set and subsequent tasks. Then, the semantic contribution representation matrix of each node semantic embedding vector in the set of node semantic embedding vectors relative to the pseudo anchor center is calculated to obtain a sequence of node semantic contribution representation matrices; this is used to quantify the contribution of each node semantic embedding to the overall SQL instruction code semantic expression. That is, by calculating the semantic contribution representation matrix, the relative importance of the node semantic embedding vector to the data semantics is evaluated, providing a basis for feature screening and weighting. Furthermore, each node semantic contribution representation matrix in the sequence of node semantic contribution representation matrices is subjected to a contribution-simulated masked sparsification module based on a random dropout mechanism to obtain a sequence of masked sparse node semantic contribution representation matrices. Here, the random dropout mechanism is used to perform sparsification on each node semantic contribution representation matrix to generate a sequence of masked sparse node semantic contribution representation matrices, thereby enhancing the generalization capability of the model and reducing the number of parameters and features. The contribution-simulated masked sparsification process randomly "turns off" some unimportant node embedding semantic features, thereby strengthening the model's focus on the semantic features of key SQL instruction code nodes, while reducing model complexity and preventing overfitting. Finally, each masked sparse node semantic contribution representation matrix in the sequence of masked sparse node semantic contribution representation matrices is used as a modulation matrix, and the matrix product between it and each node semantic embedding vector is calculated to obtain the set of filtered node semantic embedding vectors. Here, the masked sparse node semantic contribution representation matrix is ​​used as a modulation matrix and matrix-producted with each node semantic embedding vector to achieve feature filtering. That is, by weighting the original node semantic embedding vector with a modulation matrix, unimportant or noisy node semantic features are filtered out, thereby purifying the node feature expression of the SQL instruction code, enhancing the feature expression ability and the model's detection performance for SQL injection security vulnerabilities.

[0038] Among them, the process of performing cluster analysis on the set of node semantic embedding vectors to obtain a node semantic cluster center representation vector as a pseudo anchor center includes: calculating the positional mean between each node semantic embedding vector in the set of node semantic embedding vectors to obtain the node semantic cluster center representation vector.

[0039] More specifically, the process of calculating the semantic contribution representation matrix of each node semantic embedding vector in the set of node semantic embedding vectors relative to the pseudo anchor center to obtain a sequence of node semantic contribution representation matrices includes: calculating the positional division between the transposed vector of the node semantic cluster center representation vector and the bi-norm of the node semantic cluster center representation vector to obtain a transformed node semantic cluster center vector; calculating the vector multiplication between each node semantic embedding vector and the transformed node semantic cluster center vector respectively, and then using The function performs soft maximum normalization processing on the obtained sequence of association matrices to obtain a sequence of node semantic contribution representation matrices.

[0040] More specifically, the process of passing each node semantic contribution representation matrix in the sequence of node semantic contribution representation matrices through a contribution simulated masked sparse module based on a random deactivation mechanism to obtain a sequence of masked sparse node semantic contribution representation matrices includes: performing random deactivation processing on each node semantic contribution representation matrix to obtain a sequence of masked sparse node semantic contribution representation matrices.

[0041] In summary, in the above embodiment, the set of node semantic embedding vectors is input into the feature filtering network based on pseudo anchor center contribution semantic query to obtain the set of filtered node semantic embedding vectors, including: inputting the set of node semantic embedding vectors into the feature filtering network based on pseudo anchor center contribution semantic query and processing them with the following semantic query feature filtering formula to obtain the set of filtered node semantic embedding vectors; wherein, the semantic query feature filtering formula is:

[0042]

[0043]

[0044]

[0045]

[0046] in, is the set of semantic embedding vectors of the nodes, are the first, second and third nodes in the set of semantic embedding vectors of the node node semantic embedding vectors, is the first node in the set of semantic embedding vectors of the node node semantic embedding vectors, is the number of feature vectors in the set of node semantic embedding vectors, is the node semantic clustering center representation vector, represents the two-norm of the vector, for function, For random dropout processing, For the said The masked sparse node semantic contribution representation matrix corresponding to the node semantic embedding vector is is the first node in the set of filtered node semantic embedding vectors The filtered node semantic embedding vector.

[0047] Furthermore, since in the above-mentioned feature filtering process, those features that contribute less to the overall SQL instruction code semantic expression have been identified through semantic contribution evaluation and sparse processing, and have been eliminated through a random inactivation mechanism. Therefore, in order to apply this filtered and purified SQL instruction code node semantic feature to perform SQL code semantic understanding and capture its structured dependencies, in the technical solution of the present application, the set of node semantic embedding vectors after filtering is further used to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain the SQL instruction abstract syntax tree semantic enhanced embedding representation. In this way, the filtered vector set can be used to replace the original vector set to remove those node feature information that may introduce noise or redundant information, thereby highlighting those features that are closely related to SQL injection attacks, making the final SQL instruction abstract syntax tree semantic representation more refined and accurate.

[0048] In particular, the S4 uses the set of filtered node semantic embedding vectors to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain the SQL instruction abstract syntax tree semantic enhanced embedding representation. Since in the above-mentioned feature filtering process, the features that contribute less to the overall SQL instruction code semantic expression have been identified through semantic contribution evaluation and sparse processing, and have been eliminated through a random inactivation mechanism. Therefore, in order to apply this filtered and purified SQL instruction code node semantic feature to perform SQL code semantic understanding and capture its structured dependencies, in the technical solution of the present application, the set of filtered node semantic embedding vectors is further used to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain the SQL instruction abstract syntax tree semantic enhanced embedding representation. In this way, the filtered vector set can be used to replace the original vector set to remove node feature information that may introduce noise or redundant information, thereby highlighting those features that are closely related to SQL injection attacks, making the final SQL instruction abstract syntax tree semantic representation more refined and accurate.

[0049] In particular, in S5, the semantically enhanced embedding representation of the SQL instruction abstract syntax tree is input into a SQL code semantic encoder based on a tree-shaped long short-term memory network to obtain a SQL code semantic structure encoding feature vector. Since the SQL instruction abstract syntax tree is essentially a structured data representation that contains the grammatical structure and logical relationships of the SQL statement, the technical solution of the present application further inputs the semantically enhanced embedding representation of the SQL instruction abstract syntax tree into a SQL code semantic encoder based on a tree-shaped long short-term memory network to obtain a SQL code semantic structure encoding feature vector. It should be understood that the tree-shaped long short-term memory network, as a variant of a recurrent neural network (RNN), is specifically designed to process the semantics and grammatical structure of this type of structured data and can effectively capture the hierarchical relationships and dependencies between nodes in the semantically enhanced embedding representation of the SQL instruction abstract syntax tree. In particular, since the semantically enhanced semantic embedding representation of the SQL instruction abstract syntax tree already contains important semantic information about the nodes, the SQL code semantic encoder based on the tree-shaped long short-term memory network can further process these semantically enhanced embedding representations, transferring information along the tree structure and integrating the information of each node to form a global semantic structure encoding feature representation. In this way, even complex SQL instructions can be effectively encoded into a compact semantic structure encoding feature vector. In addition, the SQL code semantic encoder based on the tree-shaped long short-term memory network can capture the long-distance dependency between nodes when processing the tree structure, which is crucial for understanding the deep semantics of the SQL instruction code statement. For example, in a complex SQL query, certain keywords or operators may appear on different branches of the tree, but there is a logical connection between them. The SQL code semantic encoder based on the tree-shaped long short-term memory network can handle this long-distance dependency well, thereby better understanding the intention of the SQL instruction and providing strong support for subsequent SQL injection detection.

[0050] In particular, the S6 determines whether there is an SQL injection security vulnerability based on the SQL code semantic structure encoding feature vector. In a specific example of the present application, the SQL code semantic structure encoding feature vector is input into a classifier-based SQL injection identifier to obtain an identification result, and the identification result is used to indicate whether there is an SQL injection security vulnerability. That is, the SQL code semantic structure encoding feature is used to perform classification processing, thereby performing SQL injection identification, and thereby determining whether there is an SQL injection security vulnerability. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of Trojans at the source and enhance the security of the website.

[0051] In a preferred example, inputting the SQL code semantic structure encoding feature vector into a classifier-based SQL injection identifier to obtain an identification result includes:

[0052] Determining a maximum SQL code semantic structure encoding eigenvalue and a minimum SQL code semantic structure encoding eigenvalue of the SQL code semantic structure encoding feature vector, and calculating a SQL code semantic structure encoding mean and a SQL code semantic structure encoding standard deviation of a feature set of the SQL code semantic structure encoding feature vector;

[0053] Calculating the quotient of the SQL code semantic structure encoding mean and the SQL code semantic structure encoding standard deviation to obtain a SQL code semantic structure encoding statistical normalization value;

[0054] Calculating the inverse of each eigenvalue of the SQL code semantic structure encoding eigenvalue vector, multiplying it by the difference between the maximum eigenvalue of the SQL code semantic structure encoding and the minimum eigenvalue of the SQL code semantic structure encoding, and then subtracting it from the statistical normalization value of the SQL code semantic structure encoding to obtain a SQL code semantic structure encoding distribution approximation vector;

[0055] Calculating an exponential function with a natural constant as the base and each eigenvalue of the SQL code semantic structure encoding distribution approximation vector as the exponent to obtain the SQL code semantic structure encoding distribution class approximation vector;

[0056] performing a dot-add operation on the SQL code semantic structure encoding distribution class approximation vector and the SQL code semantic structure encoding statistical normalized value, and calculating the base-two logarithm of the absolute value of each eigenvalue of the dot-added vector to obtain an optimized SQL code semantic structure encoding feature vector; and

[0057] The optimized SQL code semantic structure encoding feature vector is input into a classifier-based SQL injection identifier to obtain an identification result.

[0058] Among them, the SQL code semantic structure encoding feature vector is recorded as The optimization expression is:

[0059]

[0060]

[0061]

[0062]

[0063] in, is the SQL code semantic structure encoding feature vector, is the mean value of the SQL code semantic structure encoding, is the standard deviation of the SQL code semantic structure encoding, Encoding statistically standardized values ​​for the semantic structure of SQL code, and are respectively the SQL code semantic structure encoding maximum eigenvalue and the SQL code semantic structure encoding minimum eigenvalue of the SQL code semantic structure encoding feature vector, and is the difference between the maximum eigenvalue of the SQL code semantic structure encoding and the minimum eigenvalue of the SQL code semantic structure encoding, is the SQL code semantic structure encoding distribution class approximation vector, is the logarithm to base 2, () is the exponential operation, Indicates point addition, represents dot product, Indicates point reduction, is the optimized SQL code semantic structure encoding feature vector.

[0064] Here, in the preferred example, since the set of filtered node semantic embedding vectors respectively represents the filtered query semantics based on the embedded semantic pseudo-central contribution of each node, when the SQL instruction abstract syntax tree semantic enhanced embedding representation obtained therefrom is input into the SQL code semantic encoder based on the tree-shaped long short-term memory network, the node semantic filtering query differences will have different semantic encoding weights based on the tree-shaped long short-term memory association, so that the SQL code semantic structure encoding feature vector will also have a diversified set expression distribution of aggregated reasoning features. Therefore, it is expected to improve the balance between the regression mapping accuracy and completeness when the SQL code semantic structure encoding feature vector is input into the classifier-based SQL injection identifier for class regression, thereby improving the accuracy of the obtained recognition results.

[0065] Therefore, by performing random statistical normalization on the diverse feature set of the SQL code semantic structure encoding feature vector, a standardized continuous probability density distribution is approximated for the response hypothesis test of the confidence space constructed based on the overall eigenvalue of the SQL code semantic structure encoding feature vector relative to each eigenvalue of the SQL code semantic structure encoding feature vector, thereby establishing the target reachability of the diverse feature distribution of the SQL code semantic structure encoding feature vector to a unified regression target, so as to achieve a balanced executable performance between mapping accuracy and mapping completeness in the class regression process based on the diverse feature distribution of the SQL code semantic structure encoding feature vector, and improve the accuracy of the recognition result obtained by the SQL code semantic structure encoding feature vector input into the classifier-based SQL injection identifier. In this way, the identification and detection of SQL injection vulnerabilities can be achieved more accurately, thereby performing intrusion protection response data processing more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the Trojan horse problem at the source and enhance the security of the website.

[0066] In summary, according to the embodiment of the present application, the AI-based intrusion protection response data processing method is explained, which can collect the code of the SQL instruction and use the data processing and semantic understanding algorithm based on artificial intelligence and deep learning to analyze the code of the SQL instruction, so as to capture and characterize the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the correlation information between the embedded semantics of each node in the embedded representation to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantic encoding based on the tree-shaped long short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to utilize the structured dependency relationship between each word in the enhanced SQL instruction code to achieve accurate identification and detection of SQL injection vulnerabilities. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of Trojans from the source and enhance the security of the website.

[0067] Below, reference Figure 4 To describe the server according to an embodiment of the present application.

[0068] Figure 4 The figure illustrates a block diagram of a server according to an embodiment of the present application.

[0069] like Figure 4 As shown, the server 10 includes one or more processors 11 and a memory 12 .

[0070] The processor 11 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the server 10 to perform desired functions.

[0071] The memory 12 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), a hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may execute the program instructions to implement the functions of the AI-based intrusion protection response data processing method of each embodiment of the present application described above and / or other desired functions. Various contents such as SQL code semantic structure encoding feature vectors may also be stored in the computer-readable storage medium.

[0072] In one example, the server 10 may further include an input device 13 and an output device 14 , and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0073] The input device 13 may include, for example, a keyboard, a mouse, and the like.

[0074] The output device 14 can output various information to the outside, including classification results, etc. The output device 14 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0075] Of course, to simplify, Figure 4 Only some of the components of the server 10 related to the present application are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, the server 10 may further include any other appropriate components according to specific application scenarios.

[0076] While various embodiments of the present disclosure have been described above, the above descriptions are illustrative, non-exhaustive, and not intended to be limiting of the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to existing technologies, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. An AI-based intrusion protection response data processing method, characterized in that: include: Get the code of the SQL instruction to be identified; Performing semantic analysis and embedding mapping processing on the code of the SQL instruction to be identified to obtain a semantic embedding representation of an abstract syntax tree of the SQL instruction, wherein the semantic embedding representation of the abstract syntax tree of the SQL instruction includes a set of node semantic embedding vectors and a set of edge semantic embedding vectors; Inputting the set of node semantic embedding vectors into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors; Using the filtered set of node semantic embedding vectors to replace the set of node semantic embedding vectors in the SQL instruction abstract syntax tree semantic embedding representation to obtain a SQL instruction abstract syntax tree semantic enhanced embedding representation; The SQL instruction abstract syntax tree semantic enhancement representation is embedded into a SQL code semantic encoder based on a tree-shaped long short-term memory network to obtain a SQL code semantic structure encoding feature vector; Determining whether there is an SQL injection security vulnerability based on the SQL code semantic structure encoding feature vector; The step of inputting the set of node semantic embedding vectors into a feature filtering network based on pseudo anchor center contribution semantic query to obtain a set of filtered node semantic embedding vectors comprises: Performing cluster analysis on the set of node semantic embedding vectors to obtain node semantic cluster center representation vectors as pseudo anchor centers; Calculating a semantic contribution representation matrix of each node semantic embedding vector in the set of node semantic embedding vectors relative to the pseudo anchor center to obtain a sequence of node semantic contribution representation matrices; Passing each node semantic contribution representation matrix in the sequence of node semantic contribution representation matrices through a contribution simulated mask sparse module based on a random dropout mechanism to obtain a sequence of masked sparse node semantic contribution representation matrices; Each masked sparse node semantic contribution representation matrix in the sequence of the masked sparse node semantic contribution representation matrix is ​​used as a modulation matrix, and the matrix product between it and each node semantic embedding vector is calculated respectively to obtain the set of filtered node semantic embedding vectors.

2. The AI-based intrusion protection response data processing method according to claim 1, characterized in that: Performing semantic analysis and embedding mapping processing on the code of the SQL instruction to be identified to obtain a semantic embedding representation of the SQL instruction abstract syntax tree, including: Performing semantic parsing on the code of the SQL instruction to be identified to obtain an SQL instruction abstract syntax tree corresponding to the code of the SQL instruction to be identified; Semantic embedding coding is performed on each node and each edge in the SQL instruction abstract syntax tree to obtain a semantic embedding representation of the SQL instruction abstract syntax tree.

3. The AI-based intrusion protection response data processing method according to claim 2, characterized in that: Cluster analysis is performed on the set of node semantic embedding vectors to obtain a node semantic cluster center representation vector as a pseudo anchor center, including: calculating the positional mean between each node semantic embedding vector in the set of node semantic embedding vectors to obtain the node semantic cluster center representation vector.

4. The AI-based intrusion protection response data processing method according to claim 3, characterized in that: Calculating a semantic contribution representation matrix of each node semantic embedding vector in the set of node semantic embedding vectors relative to the pseudo anchor center to obtain a sequence of node semantic contribution representation matrices, including: Calculating a positional division between a transposed vector of the node semantic cluster center representation vector and a two-norm of the node semantic cluster center representation vector to obtain a transformed node semantic cluster center vector; After calculating the vector multiplication between the semantic embedding vector of each node and the semantic clustering center vector of the transformed node, use The function performs soft maximum normalization processing on the obtained sequence of association matrices to obtain a sequence of node semantic contribution representation matrices.

5. The AI-based intrusion protection response data processing method according to claim 4, characterized in that: Each node semantic contribution representation matrix in the sequence of the node semantic contribution representation matrix is ​​passed through a contribution simulated mask sparse module based on a random deactivation mechanism to obtain a sequence of masked sparse node semantic contribution representation matrices, including: performing random deactivation processing on each node semantic contribution representation matrix to obtain the sequence of masked sparse node semantic contribution representation matrices.

6. The AI-based intrusion protection response data processing method according to claim 5, characterized in that: Determining whether there is an SQL injection security vulnerability based on the SQL code semantic structure encoding feature vector includes: inputting the SQL code semantic structure encoding feature vector into a classifier-based SQL injection identifier to obtain a recognition result, wherein the recognition result is used to indicate whether there is an SQL injection security vulnerability.

7. A server, characterized in that: include: processor; A memory, wherein computer program instructions are stored in the memory, and when the computer program instructions are executed by the processor, the processor executes the AI-based intrusion protection response data processing method according to any one of claims 1 to 6.

Images