Analysis method and device of injection hazard, equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of software development, and discloses an injection hazard analysis method, device and equipment and a storage medium, the method comprises the following steps: acquiring attack information of injecting a structured query language (SQL) to be analyzed into an attacked object, the attack information comprising at least one piece of target attack attribute information; determining a target evaluation score corresponding to the at least one piece of target attack attribute information in a preset first mapping relationship; according to the target evaluation score corresponding to the at least one piece of target attack attribute information, a target analysis result of the to-be-analyzed SQL injection is determined, and the target analysis result is used for representing the target hazard degree of the to-be-analyzed SQL injection. By applying the technical scheme of the invention, the harm severity of SQL injection can be clearer.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of software development technology, and in particular to an injection hazard analysis method, device, equipment and storage medium. Background Art

[0002] At present, Structured Query Language (SQL) injection vulnerabilities are very harmful, but their impact varies in the specific scenarios of different enterprises.

[0003] In actual scenarios, when security personnel discover SQL injection, they usually define it as high risk or serious, which may affect the progress of business development to a certain extent.

[0004] Therefore, a method is needed to evaluate the hazards of SQL injection and avoid the impact of existing direct definitions on the progress of business development. Summary of the invention

[0005] In view of the above problems, the embodiments of the present invention provide an injection hazard analysis method, apparatus, device and storage medium, which are used to solve the problem of inaccurate SQL injection hazard assessment in the prior art.

[0006] According to one aspect of an embodiment of the present invention, a method for analyzing injection hazards is provided, the method comprising:

[0007] Acquire attack information of an SQL injection attacked object of a structured query statement to be analyzed, wherein the attack information includes: at least one target attack attribute information;

[0008] Determine the target evaluation score corresponding to the at least one target attack attribute information in a preset first mapping relationship, wherein the first mapping relationship is a correspondence relationship between multiple attack attribute information and multiple evaluation scores;

[0009] According to the target evaluation score corresponding to the at least one target attack attribute information, a target analysis result of the SQL injection to be analyzed is determined, and the target analysis result is used to indicate the target harm degree of the SQL injection to be analyzed.

[0010] According to another aspect of an embodiment of the present invention, there is provided an injection hazard analysis device, comprising:

[0011] An acquisition module is used to acquire attack information of an SQL injection attacked object of a structured query statement to be analyzed, wherein the attack information includes: at least one target attack attribute information;

[0012] A first determination module is used to determine the target evaluation score corresponding to the at least one target attack attribute information in a preset first mapping relationship, wherein the first mapping relationship records a plurality of attack attribute information and the evaluation score corresponding to each attack attribute information;

[0013] The second determination module is used to determine the target analysis result of the SQL injection to be analyzed according to the target evaluation score corresponding to the at least one target attack attribute information, and the target analysis result is used to indicate the target harm degree of the SQL injection to be analyzed.

[0014] According to another aspect of an embodiment of the present invention, there is provided an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0015] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the operation of the injection hazard analysis method described above.

[0016] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and when the executable instruction is executed on an electronic device / an analysis device for injecting hazard, the electronic device / an analysis device for injecting hazard performs the operations of the above-mentioned analysis method for injecting hazard.

[0017] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, which implements the operations of the above-mentioned injection hazard analysis method when executed by a processor.

[0018] The embodiment of the present invention uses an injection hazard analysis method, device, equipment and storage medium to obtain attack information of an attacked object when a SQL injection to be analyzed is obtained, and a correspondence between multiple attack attribute information and multiple evaluation scores is stored in advance, so that the existing evaluation scores are matched one by one, the total score corresponding to the SQL injection to be analyzed is obtained, and the degree of hazard of the SQL injection to be analyzed is determined, which helps to ensure the security of business development and optimize the development process.

[0019] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are only used to illustrate the embodiments and are not to be considered as limiting the present invention. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings. In the accompanying drawings:

[0021] Figure 1 A flow chart showing a first embodiment of the injection hazard analysis method provided by the present invention;

[0022] Figure 2 A flow chart showing a second embodiment of the injection hazard analysis method provided by the present invention;

[0023] Figure 3 A flow chart showing a third embodiment of the injection hazard analysis method provided by the present invention;

[0024] Figure 4 A schematic structural diagram of an embodiment of an injection hazard analysis device provided by the present invention is shown;

[0025] Figure 5 A schematic structural diagram of an embodiment of an electronic device provided by the present invention is shown. DETAILED DESCRIPTION

[0026] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0027] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0028] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the embodiments provided herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the embodiments provided below are partial embodiments for implementing the present invention, rather than providing all embodiments for implementing the present invention. In the absence of conflict, the technical solutions recorded in the embodiments of the present invention can be implemented in any combination.

[0029] It should be noted that, in the embodiments of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a method or apparatus including a series of elements includes not only the elements explicitly recorded, but also includes other elements not explicitly listed, or also includes elements inherent to the implementation of the method or apparatus. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other related elements (such as steps in a method or modules in an apparatus, such as a module that can be a part of a circuit, a part of a processor, a part of a program or software, etc.) in the method or apparatus including the element.

[0030] For example, the injection hazard analysis method provided in the embodiment of the present invention includes a series of steps, but the injection hazard analysis method provided in the embodiment of the present invention is not limited to the steps described in this document. Similarly, the injection hazard analysis device provided in the embodiment of the present invention includes a series of modules, but the injection hazard analysis device provided in the embodiment of the present invention is not limited to the modules explicitly described, and may also include modules required to obtain relevant information or perform processing based on the information.

[0031] Before introducing the analysis method of injection hazard, the application background of the present invention is first explained.

[0032] The harm caused by SQ injection vulnerabilities is very serious, but their impact varies in the specific scenarios of different enterprises.

[0033] For example, in some cases, SQL injection occurs on the external network, and attackers can easily access the injection point and conduct SQL injection attacks, but some SQL injections may be limited to the internal network. In this case, attackers need to use other vulnerabilities to enter the internal network to conduct SQL injection attacks. There are also some SQL injection vulnerabilities that only allow attackers to obtain a small amount of test data or non-sensitive information. The direct harm in this scenario may be low.

[0034] However, in actual scenarios, when security personnel discover SQL injection, they usually define it as high risk or severe, which may affect the progress of business development to a certain extent.

[0035] Based on the above technical problems, the technical concept of the present invention is as follows: the harm of SQL injection cannot be generalized, and its actual risk must be evaluated in combination with the specific network environment, data sensitivity, and the level of authority that the attacker may reach. That is, the scores corresponding to different attack attributes can be set (such as the greater the degree of harm of the attack attribute, the greater the score). After a specific attack is injected, the score involved can be obtained, thereby obtaining the final degree of harm of the attack injection to inform the user, so that the user can adjust or not change the current development process and reduce the impact on business development.

[0036] The technical solution of the present invention is described in detail below through specific embodiments. The execution subject of the present invention is an electronic device, which can be a terminal device, a service device, a server, a computer, etc.

[0037] Figure 1 FIG. 1 is a flow chart of an embodiment 1 of the method for analyzing injection hazards provided by the present invention, wherein the method is executed by an electronic device. Figure 1 As shown, the method comprises the following steps:

[0038] Step 11: Obtain attack information of the SQL injection attack object to be analyzed;

[0039] The attack information includes: at least one target attack attribute information;

[0040] In this step, in order to facilitate the analysis of the degree of harm caused by the SQL injection to be analyzed, the specific situation caused or related to the SQL injection to be analyzed can be obtained first, which can be the "attack characteristics" or "attack attributes" of the SQL injection, which are recorded as at least one target attack attribute information in the present invention.

[0041] Optionally, at least one item of target attack attribute information may include: target attack type, target data type acquired, target execution data extracted or commanded by the attack, and the amount of target sensitive data.

[0042] Correspondingly, the target attack type can be obtained by executing the following steps: obtaining the Uniform Resource Locator (URL) of the SQL injection attack object to be analyzed; and determining the target attack type according to the Uniform Resource Locator.

[0043] In this implementation, the URL of the SQL injection attack object to be analyzed can be extracted from the access log or error log, and the host (English: Host) information can be parsed from the URL. Based on the Host, the Internet Protocol (IP) address can be parsed and compared with the address range of the intranet. If the IP address is within the address range of the intranet, the target attack type is the intranet; if the IP address is not within the address range of the intranet, the target attack type is the extranet.

[0044] Correspondingly, the target data type to be acquired can be acquired by performing the following acquisition: acquiring the identifier of at least one item of data acquired by the SQL to be analyzed; determining the target data type to be acquired in a preset sensitive data list based on the identifier of at least one item of data, and the sensitive data list records the identifier of at least one sensitive data.

[0045] In this implementation, the data identifier is usually the unique value of a field, which is often used as the primary key. For example, in the user information table, the user identifier can be used as the data identifier. When analyzing SQL injection, some data may be illegally obtained. The identifiers of these data can be extracted and compared with the identifiers of sensitive data recorded in the sensitive data list to determine whether there is an identifier of sensitive data in the obtained data. If the target data type is sensitive, then it is considered that the target data type is non-sensitive.

[0046] In a possible implementation, some identifications of sensitive data are given: a) VIN, b) Username, c) Password / psw / pass, d) Phone, e) Secret, f) Idcard, g) Passport, h) Email, i) Card_number, j) Address, k) Card_number, l) Token.

[0047] In some implementations, after the sensitive type is determined, the amount of corresponding sensitive data may be counted.

[0048] Correspondingly, the target data type can be obtained by executing the following: when injecting the SQL to be analyzed, calling the preset tool to perform command execution and privilege escalation test, and obtaining the test result, which is used to indicate whether the target execution data exists.

[0049] In this implementation, the preset tool may be SQLMap or other tools.

[0050] After confirming the injection point of the SQL to be analyzed in the attacked object, use the preset tool to perform the injection operation, execute the basic commands to obtain table and column information, and then execute the command to obtain the command line interface; perform the privilege escalation test, the goal is to escalate privileges, first confirm the database user permissions and obtain the database user permissions.

[0051] Record the output (i.e., test results) of SQLMap or other tools and check whether the test results contain sensitive information, such as user credentials, system configuration, etc., that is, the target execution data is sensitive information, such as user credentials, system configuration, etc.

[0052] Step 12: Determine the target evaluation score corresponding to at least one target attack attribute information in the preset first mapping relationship;

[0053] The first mapping relationship is a correspondence between multiple attack attribute information and multiple evaluation scores;

[0054] In this step, after at least one item of target attack attribute information is obtained, the target evaluation scores corresponding to each item of target attack attribute information may be determined in the first mapping relationship.

[0055] Optionally, the attack attribute information includes at least one of the following: attack type, attack-related extraction or command execution data, and acquired data type.

[0056] Correspondingly, the first mapping relationship includes:

[0057] 1. If the attack type is an intranet attack, the evaluation score is the first score; if the attack type is an extranet attack, the evaluation score is the second score, which is greater than the first score;

[0058] 2. The attack involves extracting or executing command data, and the evaluation score is the third score;

[0059] 3. The data type obtained is non-sensitive data, and the evaluation score is the fourth score;

[0060] 4. The type of data obtained is sensitive data, and the evaluation score is the fifth score, which is greater than the fourth score.

[0061] In the above, as an example, the first score may be 0 points; the second score may be 15 points; the third score may be 50 points; the fourth score may be 15 points; and the fifth score may be 35 points.

[0062] Optionally, the attack attribute information also includes: the amount of sensitive data.

[0063] Correspondingly, the first mapping relationship also includes:

[0064] 5, the amount of sensitive data is greater than the first value and less than or equal to the second value, the fifth score is replaced by the sixth score, and the sixth score is greater than the fifth score;

[0065] 6. The amount of sensitive data is greater than the second value, and the fifth score is replaced by the seventh score, which is greater than the sixth score.

[0066] As an example, the first value may be 5,000; the second value may be 50,000; the sixth score may be 50 points; and the seventh score may be 75 points.

[0067] That is, in one implementation, when the number of sensitive data is no more than 5,000, the corresponding evaluation score is the fifth score, which is 35 points.

[0068] It should be understood that the setting of the evaluation score is related to the degree of harm corresponding to the attack attribute information, that is, the greater the degree of harm corresponding to the attack attribute information, the greater the corresponding evaluation score (conversely in other examples, the smaller the score, the greater the degree of harm, which is adjusted based on actual implementation).

[0069] Example 1: If the target attack type is an intranet attack, the evaluation score is the first score, such as 0 points; if there is an attack involving the extraction or command of target execution data, the evaluation score is the third score, such as 50 points; if the type of target data obtained is non-sensitive, the evaluation score is the fourth score, such as 15 points.

[0070] Example 2: If the target attack type is an external network attack, the evaluation score is the second score, such as 15 points; there is no attack involving the extraction or command of target execution data; if the target data type obtained is sensitive data, the evaluation score is the fifth score, such as 35 points (optional, if the amount of sensitive data is 6000, which is greater than the second value (such as 50000), the fifth score is replaced by the seventh score, i.e. 75 points).

[0071] Step 13: Determine the target analysis result of the SQL injection to be analyzed according to the target evaluation score corresponding to at least one target attack attribute information;

[0072] The target analysis result is used to indicate the target harm degree of the SQL injection to be analyzed.

[0073] In this step, after determining the target evaluation scores corresponding to each target attack attribute information, the target analysis result of the SQL injection to be analyzed can be determined to actually determine the target harm degree of the SQL injection to be analyzed.

[0074] In the following implementation, different degrees of harm are exemplified to correspond to different levels.

[0075] Furthermore, based on the target analysis results, the subsequent development strategy can be adjusted.

[0076] The embodiment of the present invention adopts an injection hazard analysis method, by obtaining the attack information of the attacked object of the structured query statement SQL injection to be analyzed, the attack information includes: at least one target attack attribute information, determining the target evaluation score corresponding to at least one target attack attribute information in a preset first mapping relationship, the first mapping relationship is the correspondence relationship between multiple attack attribute information and multiple evaluation scores, and determining the target analysis result of the SQL injection to be analyzed according to the target evaluation score corresponding to at least one target attack attribute information, and the target analysis result is used to represent the target hazard degree of the SQL injection to be analyzed. This technical solution can obtain the attack information of the attacked object when the SQL injection to be analyzed is obtained, and the correspondence relationship between multiple attack attribute information and multiple evaluation scores is reserved in advance, so as to match the existing evaluation scores one by one, obtain the total score corresponding to the SQL injection to be analyzed, and determine the hazard degree of the SQL injection to be analyzed, which is helpful to ensure the security of business development and optimize the development process.

[0077] Based on the above embodiments, Figure 2 FIG. 2 is a flow chart showing a second embodiment of the injection hazard analysis method provided by the present invention, wherein the method is executed by an electronic device. Figure 2 As shown, the above step 13 includes the following steps:

[0078] Step 21: Determine the total evaluation score of the SQL injection to be analyzed according to the target evaluation score corresponding to at least one target attack attribute information;

[0079] In this step, after determining the target evaluation scores corresponding to the target attack attribute information involved in the SQL injection to be analyzed, the target evaluation scores are summed to obtain the total evaluation score of the SQL injection to be analyzed.

[0080] Continuing with Example 1, if the target attack type is an intranet attack, the evaluation score is the first score, such as 0 points; if there is an attack involving the extraction or command of target execution data, the evaluation score is the third score, such as 50 points; if the type of target data obtained is non-sensitive, the evaluation score is the fourth score, such as 15 points.

[0081] Then, the total evaluation score of the SQL injection to be analyzed is 0+15+50=65 points.

[0082] Continuing with Example 2, if the target attack type is an external network attack, the evaluation score is the second score, such as 15 points; there is no attack involving the extraction or command of target execution data; if the target data type obtained is sensitive data, the evaluation score is the fifth score, such as 35 points (optional, the amount of sensitive data is 6000, which is greater than the second value (such as 50000), then the fifth score is replaced by the seventh score, i.e. 75 points).

[0083] Then, the total evaluation score of the SQL injection to be analyzed is 15+75=80 points.

[0084] Step 22: According to the total evaluation score, determine the target analysis result of the SQL injection to be analyzed in the preset second mapping relationship;

[0085] The second mapping relationship is a correspondence between different score ranges and different analysis results, and different analysis results are used to represent the degree of harm of different score ranges.

[0086] In this step, after obtaining the total evaluation score corresponding to each target attack attribute information, the score range corresponding to the total evaluation score can be found in the second mapping relationship, and the analysis result corresponding to the score range is used as the target analysis result of the SQL injection to be analyzed.

[0087] Optionally, the second mapping relationship may be as follows:

[0088] 1. Score range: 19 points and below, analysis result: low risk;

[0089] 2. The score range is: 20 to 49 points, and the analysis results are: moderate risk;

[0090] 3. The score range is: 50 to 79 points, and the analysis result is: high risk;

[0091] 4. The score range is: 80 points and above, and the analysis result is: severe.

[0092] In the above example 1, it is determined that the total score of the SQL injection to be analyzed is 65, and the corresponding score range is 50 to 79. The analysis results corresponding to 50 to 79 are high risk, so the target analysis result of the SQL injection to be analyzed is high risk;

[0093] In the above example 2, it is determined that the total score of the SQL injection to be analyzed is 80, and the corresponding score range is 80 points and above. The analysis result corresponding to 80 points and above is severe, and the target analysis result of the SQL injection to be analyzed is severe.

[0094] It should be understood that the correspondence between the score range and the analysis result can be adjusted based on actual conditions, and the number of score ranges can also vary, and the above is only an example.

[0095] Furthermore, corresponding strategies can be formulated according to different analysis results, so that users can adjust the progress of business development according to the corresponding strategies.

[0096] The embodiment of the present invention uses an injection hazard analysis method to determine the total evaluation score of the SQL injection to be analyzed according to the target evaluation score corresponding to at least one target attack attribute information, and determines the target analysis result of the SQL injection to be analyzed in a preset second mapping relationship according to the total evaluation score. The second mapping relationship is a correspondence relationship between different score ranges and different analysis results, and different analysis results are used to represent the degree of harm of different score ranges. In this technical solution, based on the correspondence relationship between different score ranges and different analysis results, the degree of harm of the SQL injection to be analyzed is directly visualized, so that users can intuitively feel the harm of the SQL injection to be analyzed.

[0097] Based on the above embodiments, Figure 3 FIG. 4 is a flow chart showing a third embodiment of the injection hazard analysis method provided by the present invention. Figure 3 As shown, the method may include the following examples:

[0098] Step 1. Start;

[0099] Step 2. Enter the URL.

[0100] Step 3: Host determination; if it is an external network address, the score increases by 15; if it is an internal network address, the score remains unchanged;

[0101] Step 4: Scan with the Sqlmap tool;

[0102] Step 5: Database traversal;

[0103] Step 6: Sensitive data determination; if there is no sensitive data, the score remains unchanged; if there is sensitive data, the score increases by 35 if the data volume is less than 5k, and by 75 if the data volume is greater than 5w, and by 50 in other cases;

[0104] Step 7: Command execution / privilege escalation test;

[0105] Step 8: Test whether there is command execution / privilege escalation. If yes, the score will increase by 75. If not, the score will remain unchanged.

[0106] Step 9: Total score statistics;

[0107] Step 10: Determine the rating level based on the total score;

[0108] Step 11. End.

[0109] The embodiment of the present invention injects a hazard analysis method, and the implementation principle of the technical solution is similar to that of the above embodiment, and has the following technical effects:

[0110] Technical effect 1. Automated scoring improves efficiency. The hazard level of SQL injection is evaluated through automated scoring methods, which significantly improves the efficiency and accuracy of scoring compared to traditional manual evaluation methods. Traditional methods rely on manual analysis and manual scoring, which are easily affected by subjective factors. The present invention uses automated technology to reduce human errors and speed up the evaluation process.

[0111] Technical Effect 2: Multi-dimensional scoring mechanism: A multi-dimensional scoring mechanism is adopted, which comprehensively considers multiple factors such as the external network / intranet situation of SQL injection, data acquisition method, data volume, privilege escalation and command execution. Compared with the single-dimensional scoring method of existing technologies, this multi-dimensional mechanism can more comprehensively evaluate the actual harm of SQL injection and more accurately reflect its risk level;

[0112] Technical effect 3: Improved decision support capabilities: The data and reports generated by the automated scoring system can provide clear decision support for the security team, helping them to quickly identify high-risk vulnerabilities and prioritize them. This decision support capability greatly enhances the effectiveness of security management and improves the overall security protection level of the organization.

[0113] Figure 4 A schematic structural diagram of an embodiment of an injection hazard analysis device provided by the present invention is shown.

[0114] like Figure 4 As shown, the device is applied to electronic equipment, including:

[0115] The acquisition module 41 is used to acquire attack information of the SQL injection attacked object of the structured query statement to be analyzed, and the attack information includes: at least one target attack attribute information;

[0116] A first determination module 42 is used to determine a target evaluation score corresponding to at least one target attack attribute information in a preset first mapping relationship, wherein the first mapping relationship records multiple attack attribute information and the evaluation score corresponding to each attack attribute information;

[0117] The second determination module 43 is used to determine the target analysis result of the SQL injection to be analyzed according to the target evaluation score corresponding to at least one target attack attribute information, and the target analysis result is used to indicate the target harm degree of the SQL injection to be analyzed.

[0118] In one or more embodiments, the second determining module 43 is specifically configured to:

[0119] Determine a total evaluation score of the SQL injection to be analyzed according to the target evaluation score corresponding to at least one target attack attribute information;

[0120] According to the total evaluation score, the target analysis result of the SQL injection to be analyzed is determined in a preset second mapping relationship. The second mapping relationship is a correspondence between different score ranges and different analysis results. Different analysis results are used to represent the degree of harm of different score ranges.

[0121] In one or more embodiments, the attack attribute information includes at least one of the following: the attack type, the execution data of the attack involving extraction or command, and the type of data obtained;

[0122] Correspondingly, the first mapping relationship includes:

[0123] The attack type is intranet attack, and the evaluation score is the first score;

[0124] The attack type is an external network attack, and the evaluation score is the second score, which is greater than the first score;

[0125] The attack involves extracting or executing data of commands, and the evaluation score is the third score;

[0126] The data type obtained is non-sensitive data, and the evaluation score is the fourth score;

[0127] The type of data obtained is sensitive data, the evaluation score is the fifth score, and the fifth score is greater than the fourth score.

[0128] In one or more embodiments, the attack attribute information further includes: the amount of sensitive data;

[0129] Correspondingly, the first mapping relationship also includes:

[0130] The amount of sensitive data is greater than the first value and less than or equal to the second value, the fifth score is replaced by the sixth score, and the sixth score is greater than the fifth score;

[0131] The amount of sensitive data is greater than the second value, the fifth score is replaced by the seventh score, and the seventh score is greater than the sixth score.

[0132] In one or more embodiments, at least one item of target attack attribute information includes: a target attack type;

[0133] Correspondingly, the acquisition module 41 acquires the target attack type, which is specifically used for:

[0134] Obtain the uniform resource locator of the SQL injection attack object to be analyzed;

[0135] Based on the uniform resource locator, determine the target attack type.

[0136] In one or more embodiments, at least one item of target attack attribute information includes: the acquired target data type;

[0137] Correspondingly, the acquisition module 41 acquires the acquired target data type, specifically for:

[0138] Obtaining an identifier of at least one item of data obtained by the SQL to be analyzed;

[0139] According to the identification of at least one item of data, the target data type to be acquired is determined in a preset sensitive data list, and the sensitive data list records the identification of at least one item of sensitive data.

[0140] In one or more embodiments, at least one item of target attack attribute information includes: target execution data that the attack involves extracting or commanding;

[0141] Correspondingly, the acquisition module 41 acquires the target execution data, specifically for:

[0142] When injecting the SQL to be analyzed, the preset tool is called to perform command execution and privilege escalation tests to obtain test results. The test results are used to indicate whether the target execution data exists.

[0143] From the above, it can be seen that the injection hazard analysis device provided by the embodiment of the present invention can obtain the attack information of the attacked object when the SQL injection to be analyzed is obtained, and the correspondence between multiple attack attribute information and multiple evaluation scores is reserved in advance, so as to match the existing evaluation scores one by one, obtain the total score corresponding to the SQL injection to be analyzed, and determine the degree of hazard of the SQL injection to be analyzed, which is helpful to ensure the security of business development and optimize the development process.

[0144] It should be noted that it should be understood that the division of the various modules of the device involved above is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements. They can also be all implemented in the form of hardware. Some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. In addition, all or part of these modules can be integrated together or implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0145] Figure 5 The schematic diagram of the structure of an embodiment of the electronic device provided by the present invention is shown, and the specific embodiment of the present invention does not limit the specific implementation of the electronic device.

[0146] The electronic device may include: a processor (processor) 502 , a communication interface (Communications Interface) 504 , a memory (memory) 506 , and a communication bus 508 .

[0147] The processor 502, the communication interface 504, and the memory 506 communicate with each other via the communication bus 508. The communication interface 504 is used to communicate with other devices such as a client or other server network elements. The processor 502 is used to execute the program 510, which can specifically execute the relevant steps in the above method embodiment.

[0148] Specifically, the program 510 may include program code including computer-executable instructions.

[0149] The processor 502 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. The one or more processors included in the electronic device may be processors of the same type, such as one or more CPUs. They may also be processors of different types, such as one or more CPUs and one or more ASICs.

[0150] The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0151] The program 510 may be specifically called by the processor 502 to enable the electronic device to perform the following operations:

[0152] Acquire attack information of the SQL injection attacked object of the structured query statement to be analyzed, the attack information including: at least one target attack attribute information;

[0153] Determine the target evaluation score corresponding to at least one target attack attribute information in a preset first mapping relationship, where the first mapping relationship is a correspondence relationship between multiple attack attribute information and multiple evaluation scores;

[0154] According to the target evaluation score corresponding to at least one target attack attribute information, a target analysis result of the SQL injection to be analyzed is determined, and the target analysis result is used to indicate the target harm degree of the SQL injection to be analyzed.

[0155] In one or more embodiments, determining a target analysis result of the SQL injection to be analyzed according to a target evaluation score corresponding to at least one target attack attribute information includes:

[0156] Determine a total evaluation score of the SQL injection to be analyzed according to the target evaluation score corresponding to at least one target attack attribute information;

[0157] According to the total evaluation score, the target analysis result of the SQL injection to be analyzed is determined in a preset second mapping relationship. The second mapping relationship is a correspondence between different score ranges and different analysis results. Different analysis results are used to represent the degree of harm of different score ranges.

[0158] In one or more embodiments, the attack attribute information includes at least one of the following: the attack type, the execution data of the attack involving extraction or command, and the type of data obtained;

[0159] Correspondingly, the first mapping relationship includes:

[0160] The attack type is intranet attack, and the evaluation score is the first score;

[0161] The attack type is an external network attack, and the evaluation score is the second score, which is greater than the first score;

[0162] The attack involves extracting or executing data of commands, and the evaluation score is the third score;

[0163] The data type obtained is non-sensitive data, and the evaluation score is the fourth score;

[0164] The type of data obtained is sensitive data, the evaluation score is the fifth score, and the fifth score is greater than the fourth score.

[0165] In one or more embodiments, the attack attribute information further includes: the amount of sensitive data;

[0166] Correspondingly, the first mapping relationship also includes:

[0167] The amount of sensitive data is greater than the first value and less than or equal to the second value, the fifth score is replaced by the sixth score, and the sixth score is greater than the fifth score;

[0168] The amount of sensitive data is greater than the second value, the fifth score is replaced by the seventh score, and the seventh score is greater than the sixth score.

[0169] In one or more embodiments, at least one item of target attack attribute information includes: a target attack type;

[0170] Accordingly, the target attack type is obtained, including:

[0171] Obtain the uniform resource locator of the SQL injection attack object to be analyzed;

[0172] Based on the uniform resource locator, determine the target attack type.

[0173] In one or more embodiments, at least one item of target attack attribute information includes: the acquired target data type;

[0174] Accordingly, the target data type to be obtained includes:

[0175] Obtaining an identifier of at least one item of data obtained by the SQL to be analyzed;

[0176] According to the identification of at least one item of data, the target data type to be acquired is determined in a preset sensitive data list, and the sensitive data list records the identification of at least one item of sensitive data.

[0177] In one or more embodiments, at least one item of target attack attribute information includes: target execution data that the attack involves extracting or commanding;

[0178] Accordingly, the target execution data is obtained, including:

[0179] When injecting the SQL to be analyzed, the preset tool is called to perform command execution and privilege escalation tests to obtain test results. The test results are used to indicate whether the target execution data exists.

[0180] From the above, it can be seen that the electronic device provided by the embodiment of the present invention can obtain the attack information of the attacked object when the SQL injection to be analyzed is obtained, and the correspondence between multiple attack attribute information and multiple evaluation scores is reserved in advance, so as to match the existing evaluation scores one by one, obtain the total score corresponding to the SQL injection to be analyzed, and determine the degree of harm of the SQL injection to be analyzed, which is helpful to ensure the security of business development and optimize the development process.

[0181] An embodiment of the present invention provides a computer-readable storage medium, which stores at least one executable instruction. When the executable instruction is executed on a device / equipment, the device / equipment executes the injection hazard analysis method in any of the above method embodiments.

[0182] The executable instructions may be used to enable the device / equipment to perform the following operations:

[0183] Acquire attack information of the SQL injection attacked object of the structured query statement to be analyzed, the attack information including: at least one target attack attribute information;

[0184] Determine the target evaluation score corresponding to at least one target attack attribute information in a preset first mapping relationship, where the first mapping relationship is a correspondence relationship between multiple attack attribute information and multiple evaluation scores;

[0185] According to the target evaluation score corresponding to at least one target attack attribute information, a target analysis result of the SQL injection to be analyzed is determined, and the target analysis result is used to indicate the target harm degree of the SQL injection to be analyzed.

[0186] In one or more embodiments, determining a target analysis result of the SQL injection to be analyzed according to a target evaluation score corresponding to at least one target attack attribute information includes:

[0187] Determine a total evaluation score of the SQL injection to be analyzed according to the target evaluation score corresponding to at least one target attack attribute information;

[0188] According to the total evaluation score, the target analysis result of the SQL injection to be analyzed is determined in a preset second mapping relationship. The second mapping relationship is a correspondence between different score ranges and different analysis results. Different analysis results are used to represent the degree of harm of different score ranges.

[0189] In one or more embodiments, the attack attribute information includes at least one of the following: the attack type, the execution data of the attack involving extraction or command, and the type of data obtained;

[0190] Correspondingly, the first mapping relationship includes:

[0191] The attack type is intranet attack, and the evaluation score is the first score;

[0192] The attack type is an external network attack, and the evaluation score is the second score, which is greater than the first score;

[0193] The attack involves extracting or executing data of commands, and the evaluation score is the third score;

[0194] The data type obtained is non-sensitive data, and the evaluation score is the fourth score;

[0195] The type of data obtained is sensitive data, the evaluation score is the fifth score, and the fifth score is greater than the fourth score.

[0196] In one or more embodiments, the attack attribute information further includes: the amount of sensitive data;

[0197] Correspondingly, the first mapping relationship also includes:

[0198] The amount of sensitive data is greater than the first value and less than or equal to the second value, the fifth score is replaced by the sixth score, and the sixth score is greater than the fifth score;

[0199] The amount of sensitive data is greater than the second value, the fifth score is replaced by the seventh score, and the seventh score is greater than the sixth score.

[0200] In one or more embodiments, at least one item of target attack attribute information includes: a target attack type;

[0201] Accordingly, the target attack type is obtained, including:

[0202] Obtain the uniform resource locator of the SQL injection attack object to be analyzed;

[0203] Based on the uniform resource locator, determine the target attack type.

[0204] In one or more embodiments, at least one item of target attack attribute information includes: the acquired target data type;

[0205] Accordingly, the target data type to be obtained includes:

[0206] Obtaining an identifier of at least one item of data obtained by the SQL to be analyzed;

[0207] According to the identification of at least one item of data, the target data type to be acquired is determined in a preset sensitive data list, and the sensitive data list records the identification of at least one item of sensitive data.

[0208] In one or more embodiments, at least one item of target attack attribute information includes: target execution data that the attack involves extracting or commanding;

[0209] Accordingly, the target execution data is obtained, including:

[0210] When injecting the SQL to be analyzed, the preset tool is called to perform command execution and privilege escalation tests to obtain test results. The test results are used to indicate whether the target execution data exists.

[0211] From the above, it can be seen that the electronic device / device provided by the embodiment of the present invention can obtain the attack information of the attacked object when the SQL injection to be analyzed is obtained, and the correspondence between multiple attack attribute information and multiple evaluation scores is reserved in advance, so as to match the existing evaluation scores one by one, obtain the total score corresponding to the SQL injection to be analyzed, and determine the degree of harm of the SQL injection to be analyzed, which is helpful to ensure the security of business development and optimize the development process.

[0212] An embodiment of the present invention provides a computer program product, including a computer program, which implements the operations of the above method when executed by a processor.

[0213] Its implementation principle and technical effects are shown in the above disclosure.

[0214] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0215] The methods disclosed in the various method embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new method embodiments.

[0216] The features disclosed in the various product embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new product embodiments.

[0217] The features disclosed in the various method or device embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0218] It should be noted that the computer-readable storage medium may be a ROM, a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM), etc. It may also be various vehicles including one or any combination of the above memories, such as a mobile phone, a computer, a tablet device, a personal digital assistant, etc.

[0219] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0220] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0221] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for a device to execute the methods described in each embodiment of the present invention.

[0222] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices, apparatuses, and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0223] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0224] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0225] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

Claims

1. A method for analyzing injection hazards, characterized in that: The method comprises: Acquire attack information of an SQL injection attacked object of a structured query statement to be analyzed, wherein the attack information includes: at least one target attack attribute information; Determine the target evaluation score corresponding to the at least one target attack attribute information in a preset first mapping relationship, wherein the first mapping relationship is a correspondence relationship between multiple attack attribute information and multiple evaluation scores; According to the target evaluation score corresponding to the at least one target attack attribute information, a target analysis result of the SQL injection to be analyzed is determined, and the target analysis result is used to indicate the target harm degree of the SQL injection to be analyzed.

2. The method according to claim 1, characterized in that The determining the target analysis result of the SQL injection to be analyzed according to the target evaluation score corresponding to the at least one target attack attribute information respectively includes: Determine the total evaluation score of the SQL injection to be analyzed according to the target evaluation scores respectively corresponding to the at least one target attack attribute information; According to the total evaluation score, the target analysis result of the SQL injection to be analyzed is determined in a preset second mapping relationship, wherein the second mapping relationship is a correspondence between different score ranges and different analysis results, and different analysis results are used to represent the degree of harm of different score ranges.

3. The method according to claim 1, characterized in that: The attack attribute information includes at least one of the following: the attack type, the execution data of the extraction or command involved in the attack, and the type of data obtained; Correspondingly, the first mapping relationship includes: The attack type is an intranet attack, and the evaluation score is a first score; The attack type is an external network attack, the evaluation score is a second score, and the second score is greater than the first score; The attack involves extracting or commanding execution data, and the evaluation score is a third score; The acquired data type is non-sensitive data, and the evaluation score is a fourth score; The acquired data type is sensitive data, the evaluation score is a fifth score, and the fifth score is greater than the fourth score.

4. The method according to claim 3, characterized in that Attack attribute information also includes: the amount of sensitive data; Correspondingly, the first mapping relationship also includes: The amount of the sensitive data is greater than the first value and less than or equal to the second value, the fifth score is replaced by a sixth score, and the sixth score is greater than the fifth score; The amount of the sensitive data is greater than the second value, the fifth score is replaced by a seventh score, and the seventh score is greater than the sixth score.

5. The method according to claim 3 or 4, characterized in that: The at least one target attack attribute information includes: target attack type; Accordingly, obtaining the target attack type includes: Obtain the uniform resource locator of the SQL injection to be analyzed into the attacked object; The target attack type is determined according to the uniform resource locator.

6. The method according to claim 3 or 4, characterized in that: The at least one target attack attribute information includes: the acquired target data type; Accordingly, obtaining the acquired target data type includes: Obtaining an identifier of at least one item of data obtained by the SQL to be analyzed; According to the identification of the at least one item of data, the acquired target data type is determined in a preset sensitive data list, and the sensitive data list records the identification of the at least one item of sensitive data.

7. The method according to claim 3 or 4, characterized in that: The at least one item of target attack attribute information includes: target execution data involved in the attack to extract or command; Accordingly, obtaining the target execution data includes: When the SQL to be analyzed is injected, a preset tool is called to perform command execution and privilege escalation test to obtain a test result, which is used to indicate whether the target execution data exists.

8. An injection hazard analysis device, characterized in that: The device comprises: An acquisition module is used to acquire attack information of an SQL injection attacked object of a structured query statement to be analyzed, wherein the attack information includes: at least one target attack attribute information; A first determination module is used to determine the target evaluation score corresponding to the at least one target attack attribute information in a preset first mapping relationship, wherein the first mapping relationship records a plurality of attack attribute information and the evaluation score corresponding to each attack attribute information; The second determination module is used to determine the target analysis result of the SQL injection to be analyzed according to the target evaluation score corresponding to the at least one target attack attribute information, and the target analysis result is used to indicate the target harm degree of the SQL injection to be analyzed.

9. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the operation of the injection hazard analysis method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one executable instruction. When the executable instruction is executed on the electronic device / the hazard injection analysis device, the electronic device / the hazard injection analysis device executes the operation of the hazard injection analysis method as described in any one of claims 1 to 7.

Images