Method and device for non-invasive detection of sql injection and storage medium

Through dynamic annotation and redefinition of Class objects, non-invasive detection of SQL injection is achieved, solving the problem that SQL injection defense method in the existing technology requires modifying existing functional code, and achieving comprehensive detection and defense of SQL injection attacks.

CN119249433APending Publication Date: 2025-01-03中国邮政储蓄银行股份有限公司
View PDF 0 Cites 0 Cited by

Patent Information

Application Number
CN202411411339.0
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-10-10
Publication Date
2025-01-03

AI Technical Summary

Technical Problem

The existing technology SQL injection defense method requires modifying existing functional code, resulting in strong coupling and security risks, and it is difficult to fully detect SQL injection attacks.

Method used

By obtaining multiple code packages on the server, dynamically obtaining Class objects, and encapsulating the preset SQL injection verification rules as annotations at runtime, labeling them on potential risk fields, and redefining the Class objects with ByteBuddy to implement input to the client Real-time verification of requests to avoid SQL injection attacks.

Benefits of technology

It realizes non-invasive detection of SQL injection, which can directly verify the attack keywords and characters in the client input request before the SQL statement is executed, detect all attacks, avoid the risk of SQL injection, and reduce the existing code Revise.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN119249433A_ABST
    Figure CN119249433A_ABST
Patent Text Reader

Abstract

The invention provides a non-invasive sql injection detection method and device and a storage medium. The method comprises the following steps: acquiring a plurality of code packets of a server, and acquiring Class objects of the code packets according to packet names of the code packets; a preset sql injection verification rule is obtained, the preset sql injection verification rule is packaged, an sql injection verification annotation is obtained, the sql injection verification annotation is labeled on a preset field, an annotation labeling field is obtained, the preset field is a field with the sql injection risk, and the preset sql injection verification rule is a keyword and a character rule for splicing and constructing a payload; and binding the annotation labeling field with the corresponding Class object to obtain a verification object, obtaining an input request of the client, and verifying the input request by adopting the verification object. The method solves the problem that existing function codes need to be modified in an sql injection defense method in the prior art.
Need to check novelty before this filing date? Find Prior Art