SQL (Structured Query Language) security assessment method and device based on feature analysis, equipment, storage medium and program product

Abstract

The invention discloses an SQL security assessment method and device based on feature analysis, equipment, a storage medium and a program product, and relates to the technical field of database security, and the method comprises the steps: based on an SQL feature library, calculating feature values of SQL statements in a statement white list and a statement black list through a weighted TF-I DF algorithm, obtaining white list statement feature vectors and blacklist statement feature vectors of SQL statements in the statement white list and the statement blacklist; obtaining a to-be-evaluated SQL statement, and obtaining a feature vector of the to-be-evaluated SQL statement through a weighted TF-I DF algorithm; and performing a similarity calculation algorithm on the white list statement feature vector, the black list statement feature vector and the to-be-evaluated feature vector to obtain a security evaluation result of the to-be-evaluated SQL statement. By introducing a weighted TF-I DF algorithm, important features are highlighted, and the accuracy of SQL security assessment is improved; and by calculating the similarity, the evaluation efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of database security technology, and in particular to a SQL security assessment method, apparatus, device, storage medium, and program product based on feature analysis. Background Art

[0002] In the process of using information systems, especially for database maintenance personnel, it is necessary to frequently execute SQL statements on the database to maintain the long-term and stable operation of the database. In this process, the maintenance of the database faces high risks and also puts forward relatively high requirements for database maintenance personnel. First of all, database maintenance personnel need to be fully familiar with the type of database and business data characteristics of the operation, but even this is far from enough. Before executing SQL statements on the database, the more prudent way is to add an audit link. After the audit, the designed SQL statements can be verified by multiple experts before they are officially executed to ensure the execution safety of the SQL statements to the greatest extent. However, when there are only a few SQL statements to be audited, the manual audit method can meet the requirements, and because the quality of manual audit is guaranteed, it can provide more accurate audit results to ensure the safe operation of the business system; but when there are a large number of SQL statements to be audited, the manual audit method has become very laborious and even impractical. Therefore, before the manual audit, it is very necessary to be able to automatically evaluate the designed SQL statements to indicate the degree of danger of the SQL statements themselves.

[0003] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide a SQL security assessment method, device, equipment, storage medium and program product based on feature analysis, aiming to solve the technical problem of improving the efficiency of SQL statement security assessment.

[0005] To achieve the above objectives, this application proposes a SQL security assessment method based on feature analysis, the method comprising:

[0006] Based on the SQL feature library, the feature values ​​of the SQL statements in the statement whitelist are calculated by a weighted TF-IDF algorithm to obtain whitelist statement feature vectors of the SQL statements in the statement whitelist;

[0007] Based on the SQL feature library, a feature value of the SQL statement in the statement blacklist is calculated by a weighted TF-IDF algorithm to obtain a blacklist statement feature vector of the SQL statement in the statement blacklist;

[0008] Obtaining a SQL statement to be evaluated, calculating a feature value of the SQL statement to be evaluated by using a weighted TF-IDF algorithm, and obtaining a feature vector to be evaluated;

[0009] The whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be evaluated are subjected to a similarity calculation algorithm to obtain a security evaluation result of the SQL statement to be evaluated.

[0010] In one embodiment, before the step of calculating the feature values ​​of the SQL statements in the statement whitelist by the weighted TF-IDF algorithm based on the SQL feature library to obtain the whitelist statement feature vectors of the SQL statements in the statement whitelist, the step further includes:

[0011] A basic database is created, wherein the basic database includes a statement whitelist, a statement blacklist, and an SQL feature library.

[0012] In one embodiment, the step of calculating the feature values ​​of the SQL statements in the statement whitelist by a weighted TF-IDF algorithm based on the SQL feature library to obtain the whitelist statement feature vectors of the SQL statements in the statement whitelist includes:

[0013] Extract features of SQL statements in the statement whitelist based on the SQL feature library to obtain whitelist features;

[0014] Calculate the feature values ​​of the features in the SQL statements in the statement whitelist by using a weighted TF-IDF algorithm;

[0015] The feature values ​​of the features in the SQL statements in the statement whitelist are concatenated to obtain a whitelist statement feature vector of the SQL statements in the statement whitelist.

[0016] In one embodiment, the step of calculating feature values ​​of SQL statements in the statement blacklist by weighted TF-IDF algorithm based on the SQL feature library to obtain blacklist statement feature vectors of the SQL statements in the statement blacklist includes:

[0017] Extract features of SQL statements in the statement blacklist based on the SQL feature library to obtain blacklist features;

[0018] Calculate the feature values ​​of the features in the SQL statements in the statement blacklist by using a weighted TF-IDF algorithm;

[0019] The feature values ​​of the features in the SQL statements in the statement blacklist are concatenated to obtain a blacklist statement feature vector of the SQL statements in the statement blacklist.

[0020] In one embodiment, the step of calculating the feature value of the feature in the SQL statement in the statement whitelist by using the weighted TF-IDF algorithm includes:

[0021] Assign corresponding weights to the features in the SQL feature library;

[0022] According to the number of features in the SQL statements in the statement whitelist, the word frequency of the corresponding features of the SQL statements in the statement whitelist is obtained;

[0023] According to the number of SQL statements in the statement whitelist, the number of SQL statements in the statement blacklist, and the weights of the corresponding features of the SQL statements in the whitelist in the SQL feature library, the inverse document frequency of the corresponding features of the SQL statements in the statement whitelist is obtained;

[0024] According to the word frequency and inverse document frequency of the corresponding feature of the SQL statement in the statement whitelist, the feature value of the corresponding feature in the SQL statement in the statement whitelist is obtained.

[0025] In one embodiment, the step of calculating the feature value of the feature in the SQL statement in the statement blacklist by using the weighted TF-IDF algorithm includes:

[0026] Assign corresponding weights to the features in the SQL feature library;

[0027] According to the number of features in the SQL statements in the statement blacklist, the word frequencies of the corresponding features of the SQL statements in the statement blacklist are obtained;

[0028] According to the number of SQL statements in the statement blacklist, the number of SQL statements in the statement whitelist, and the weights of the corresponding features of the SQL statements in the blacklist in the SQL feature library, the inverse document frequency of the corresponding features of the SQL statements in the statement blacklist is obtained;

[0029] According to the word frequency and the inverse document frequency of the corresponding feature of the SQL statement in the statement blacklist, the feature value of the corresponding feature in the SQL statement in the statement blacklist is obtained.

[0030] In one embodiment, the step of obtaining a SQL statement to be evaluated, calculating a feature value of the SQL statement to be evaluated by a weighted TF-IDF algorithm, and obtaining a feature vector to be evaluated includes:

[0031] Get the SQL statement to be evaluated;

[0032] Extracting features in the SQL statement to be evaluated based on the SQL feature library to obtain features to be evaluated;

[0033] Calculate the feature value of the feature in the SQL statement to be evaluated by using a weighted TF-IDF algorithm;

[0034] The feature values ​​of the features in the SQL statement to be evaluated are concatenated to obtain a feature vector to be evaluated.

[0035] In one embodiment, the step of obtaining a security assessment result of the SQL statement to be assessed by using a similarity calculation algorithm for the whitelist statement feature vector, the blacklist statement feature vector, and the feature vector to be assessed comprises:

[0036] The whitelist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statement in the statement whitelist and the SQL statement to be evaluated;

[0037] The blacklist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statement in the statement blacklist and the SQL statement to be evaluated;

[0038] According to the similarity between the statements in the statement whitelist and the SQL statement to be evaluated, and the similarity between the statements in the statement blacklist and the SQL statement to be evaluated, a security evaluation result of the SQL statement to be evaluated is obtained.

[0039] In one embodiment, the step of obtaining the security assessment result of the SQL statement to be evaluated according to the similarity between the statements in the statement whitelist and the SQL statement to be evaluated, and the similarity between the statements in the statement blacklist and the SQL statement to be evaluated comprises:

[0040] Sort the similarities between the statements in the statement whitelist and the SQL statements to be evaluated to obtain a whitelist similarity table;

[0041] Sort the similarities between the statements in the statement blacklist and the SQL statement to be evaluated to obtain a blacklist similarity table;

[0042] Comparing the maximum value in the whitelist similarity table with a preset first threshold;

[0043] When the maximum value in the whitelist similarity table is greater than a preset first threshold, the security assessment result of the SQL statement to be assessed is safe;

[0044] Comparing the maximum value in the blacklist similarity table with a preset second threshold;

[0045] When the maximum value in the blacklist similarity table is greater than a preset second threshold, the security assessment result of the SQL statement to be assessed is dangerous.

[0046] In addition, to achieve the above purpose, the present application also proposes a SQL security assessment device based on feature analysis, and the SQL security assessment device based on feature analysis includes:

[0047] A whitelist feature module is used to calculate feature values ​​of SQL statements in the statement whitelist by a weighted TF-IDF algorithm based on the SQL feature library to obtain whitelist statement feature vectors of the SQL statements in the statement whitelist;

[0048] A blacklist feature module, used to calculate feature values ​​of SQL statements in the statement blacklist by a weighted TF-IDF algorithm based on the SQL feature library, and obtain a blacklist statement feature vector of the SQL statement in the statement blacklist;

[0049] The feature module to be evaluated is used to obtain the SQL statement to be evaluated, calculate the feature value of the SQL statement to be evaluated by using the weighted TF-IDF algorithm, and obtain the feature vector to be evaluated;

[0050] The security assessment module is used to obtain a security assessment result of the SQL statement to be evaluated by performing a similarity calculation algorithm on the whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be evaluated.

[0051] In addition, to achieve the above-mentioned purpose, the present application also proposes a SQL security assessment device based on feature analysis, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the SQL security assessment method based on feature analysis as described above.

[0052] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the SQL security assessment method based on feature analysis as described above are implemented.

[0053] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the SQL security assessment method based on feature analysis as described above are implemented.

[0054] One or more technical solutions proposed in this application have at least the following technical effects:

[0055] The embodiment of the present application proposes a SQL security assessment method, device, equipment, storage medium and program product based on feature analysis. Based on the SQL feature library, the feature values ​​of SQL statements in the statement whitelist are calculated by the weighted TF-IDF algorithm to obtain the whitelist statement feature vector of the SQL statements in the statement whitelist; based on the SQL feature library, the feature values ​​of SQL statements in the statement blacklist are calculated by the weighted TF-IDF algorithm to obtain the blacklist statement feature vector of the SQL statements in the statement blacklist; the SQL statement to be evaluated is obtained, and the feature values ​​of the SQL statement to be evaluated are calculated by the weighted TF-IDF algorithm to obtain the feature vector to be evaluated; the whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be evaluated are subjected to a similarity calculation algorithm to obtain the security assessment result of the SQL statement to be evaluated. By introducing the weighted TF-IDF algorithm, important features are highlighted to improve the accuracy of SQL security assessment; by combining the features in the whitelist and blacklist to calculate the similarity of the SQL statement to be evaluated, the efficiency of SQL statement security assessment is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0057] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0058] Figure 1 A flowchart of the first embodiment of the SQL security assessment method based on feature analysis provided in this application;

[0059] Figure 2 This is a schematic diagram of the module structure of the SQL security assessment device based on feature analysis in an embodiment of the present application;

[0060] Figure 3 Schematic diagram of the device structure of the hardware operating environment involved in the SQL security assessment method based on feature analysis in the embodiment of the present application.

[0061] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0062] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0063] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0064] The main solution of the embodiment of the present application is: based on the SQL feature library, the feature values ​​of the SQL statements in the statement whitelist are calculated by the weighted TF-IDF algorithm to obtain the whitelist statement feature vector of the SQL statements in the statement whitelist; based on the SQL feature library, the feature values ​​of the SQL statements in the statement blacklist are calculated by the weighted TF-IDF algorithm to obtain the blacklist statement feature vector of the SQL statements in the statement blacklist; the SQL statement to be evaluated is obtained, and the feature values ​​of the SQL statement to be evaluated are calculated by the weighted TF-IDF algorithm to obtain the feature vector to be evaluated; the whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be evaluated are subjected to a similarity calculation algorithm to obtain the security assessment result of the SQL statement to be evaluated.

[0065] In the process of using information systems, especially for database maintenance personnel, it is necessary to frequently execute SQL statements on the database to maintain the long-term and stable operation of the database. In this process, the maintenance of the database faces high risks and also puts forward relatively high requirements for database maintenance personnel. First of all, database maintenance personnel need to be fully familiar with the type of database and business data characteristics of the operation, but even this is far from enough. Before executing SQL statements on the database, the more prudent way is to add an audit link. After the audit, the designed SQL statements can be verified by multiple experts before they are officially executed to ensure the execution safety of the SQL statements to the greatest extent. However, when there are only a few SQL statements to be audited, the manual audit method can meet the requirements, and because the quality of manual audit is guaranteed, it can provide more accurate audit results to ensure the safe operation of the business system; but when there are a large number of SQL statements to be audited, the manual audit method has become very laborious and even impractical. Therefore, before the manual audit, it is very necessary to be able to automatically evaluate the designed SQL statements to indicate the degree of danger of the SQL statements themselves.

[0066] This application introduces a weighted TF-IDF algorithm to highlight important features and improve the accuracy of SQL security assessment; by combining the features in the whitelist and blacklist to calculate the similarity of the SQL statements to be evaluated, the efficiency of SQL statement security assessment is improved.

[0067] In this embodiment, for ease of description, the following description is made by taking the identification of a SQL security assessment device based on feature analysis as the execution subject.

[0068] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a SQL security assessment device based on feature analysis, etc. The following takes the SQL security assessment device based on feature analysis as an example to illustrate this embodiment and the following embodiments.

[0069] Based on this, the embodiment of the present application provides a SQL security assessment method based on feature analysis, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the SQL security assessment method based on feature analysis of the present application.

[0070] In this embodiment, the SQL security assessment method based on feature analysis includes steps S10 to S40:

[0071] Step S10, based on the SQL feature library, calculate the feature values ​​of the SQL statements in the statement whitelist by using a weighted TF-IDF algorithm to obtain whitelist statement feature vectors of the SQL statements in the statement whitelist.

[0072] It should be noted that the TF-IDF algorithm is used to evaluate the importance of a word to a document set or one of the documents in a corpus. The importance of a word increases in direct proportion to the number of times it appears in a document, but at the same time it decreases in inverse proportion to the frequency of its appearance in the corpus. Term frequency TF (Term Frequency) refers to the number of times a word appears in a document. For a word t in a specific document d, its term frequency TF (t, d) can be simply calculated as the number of times word t appears in document d. However, in order to avoid the deviation of document length (the term frequency of a long document may be higher than that of a short document), it is usually normalized, that is, the term frequency is divided by the total number of words in the document. Inverse document frequency IDF (Inverse Document Frequency) is a measure of the general importance of a word. The IDF of a specific word can be obtained by dividing the total number of documents by the number of documents containing the word, and then taking the logarithm of the quotient. If the fewer documents containing word t, the larger the IDF, it means that word t has a good ability to distinguish categories. The TF-IDF value is actually the product of TF and IDF, that is:

[0073] TF-IDF(t,d)=TF(t,d)×IDF(t)

[0074] Wherein, TF(t,d) is the term frequency of word t in document d, and IDF(t) is the inverse document frequency of word t. In the embodiment of the present application, the value of TF-IDF is the feature value of the feature.

[0075] In the embodiment of the present application, a weighted operation is performed on the TF-IDF algorithm, that is, different weights are assigned to the features in the SQL feature database according to their importance, and the weights of the features are combined for calculation when the TF-IDF algorithm is used for calculation.

[0076] In addition, it should be noted that the SQL feature library includes 38 basic SQL keywords and some important object names, such as some important table names, view names, etc. The 38 basic SQL keywords specifically include: "select, insert, replace, into, delete, truncate, update, distinct, where, and, or, order, by, group, having, top, limit, like, between, left, join, full, outer, union, all, as, exists, create, table, drop, temporary, alter, index, view, procedure, trigger, schema, domain". Once operations are performed on these feature objects in the SQL feature library, serious security or performance issues may occur, causing a significant impact on the database, so special attention needs to be paid. Furthermore, during use, the database administrator needs to dynamically maintain the names of these feature objects according to the importance of the business.

[0077] In addition, it should be noted that the statement whitelist stores several SQL statements, which have been reviewed before and confirmed to have no execution risks, are highly secure, and can be executed again later.

[0078] In addition, it should be noted that the feature value of the SQL statement in the statement whitelist refers to the TF-IDF value obtained by extracting the features corresponding to the SQL feature library in the SQL statement in the statement whitelist based on the features in the SQL feature library, and then calculating it through the weighted TF-IDF algorithm.

[0079] In addition, it should be noted that the whitelist statement feature vector refers to a vector obtained by concatenating the feature values ​​of the SQL statements in the statement whitelist.

[0080] Specifically, the SQL statements in the statement whitelist are first split, and then the features in the SQL statements in the statement whitelist are extracted based on the features in the SQL feature library to obtain whitelist features; then the feature values ​​of the features in the SQL statements in the statement whitelist are calculated by the weighted TF-IDF algorithm; finally, the feature values ​​of the features in the SQL statements in the statement whitelist are concatenated according to the storage order of the features in the SQL feature library, and the feature values ​​of the non-existent features are taken as 0, so as to obtain the whitelist statement feature vectors of the SQL statements in the statement whitelist.

[0081] Step S20: Based on the SQL feature library, the feature values ​​of the SQL statements in the statement blacklist are calculated by a weighted TF-IDF algorithm to obtain blacklist statement feature vectors of the SQL statements in the statement blacklist.

[0082] It should be noted that the statement blacklist stores several SQL statements, which have been reviewed before and confirmed to have a high execution risk, and are not recommended to be executed again.

[0083] In addition, it should be noted that the feature value of the SQL statement in the statement blacklist refers to the TF-IDF value obtained by extracting the features corresponding to the SQL feature library in the SQL statement in the statement blacklist based on the features in the SQL feature library, and then calculating it through the weighted TF-IDF algorithm.

[0084] In addition, it should be noted that the blacklist statement feature vector refers to a vector obtained by concatenating the feature values ​​of the SQL statements in the statement blacklist.

[0085] Specifically, the SQL statements in the statement blacklist are first split, and then the features in the SQL statements in the statement blacklist are extracted based on the features in the SQL feature library to obtain the blacklist features; then the feature values ​​of the features in the SQL statements in the statement blacklist are calculated by the weighted TF-IDF algorithm; finally, the feature values ​​of the features in the SQL statements in the statement blacklist are concatenated according to the storage order of the features in the SQL feature library, and the feature values ​​of the non-existent features are taken as 0, so as to obtain the blacklist statement feature vectors of the SQL statements in the statement blacklist.

[0086] Step S30, obtaining a SQL statement to be evaluated, and calculating a feature value of the SQL statement to be evaluated by using a weighted TF-IDF algorithm to obtain a feature vector to be evaluated.

[0087] It should be noted that the SQL statement to be evaluated refers to an SQL statement that needs to be executed in the database and is waiting for security evaluation.

[0088] In addition, it should be noted that the feature value of the SQL statement to be evaluated refers to the TF-IDF value obtained by extracting the features in the SQL statement to be evaluated corresponding to the SQL feature library based on the features in the SQL feature library, and then calculating it through the weighted TF-IDF algorithm.

[0089] In addition, it should be noted that the feature vector to be evaluated refers to a vector obtained by concatenating the feature values ​​of the SQL statement to be evaluated.

[0090] Specifically, firstly, the SQL statement to be evaluated is obtained and split; then, the features in the SQL statement to be evaluated are extracted based on the SQL feature library to obtain the features to be evaluated; then, the feature values ​​of the features in the SQL statement to be evaluated are calculated by the weighted TF-IDF algorithm; finally, the feature values ​​of the features in the SQL statement to be evaluated are concatenated to obtain the feature vector to be evaluated.

[0091] Step S40: The whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be evaluated are subjected to a similarity calculation algorithm to obtain a security evaluation result of the SQL statement to be evaluated.

[0092] It should be noted that the similarity calculation algorithm is an algorithm for calculating the similarity between the feature vector of the whitelist statement and the feature vector to be evaluated, and the feature vector of the blacklist statement and the feature vector to be evaluated. In one embodiment of the present application, the similarity calculation algorithm refers to the cosine similarity calculation algorithm. The cosine similarity calculation algorithm is a measure of the degree of similarity between two vectors in direction. In the fields of text analysis, recommendation systems, information retrieval, etc., cosine similarity is often used to calculate the similarity between two documents, two queries, or between a document and a query.

[0093] Specifically, the whitelist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statements in the statement whitelist and the SQL statement to be evaluated; the blacklist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statements in the statement blacklist and the SQL statement to be evaluated; based on the similarity between the statements in the statement whitelist and the SQL statement to be evaluated, and the similarity between the statements in the statement blacklist and the SQL statement to be evaluated, the security assessment result of the SQL statement to be evaluated is obtained.

[0094] This embodiment uses the above solution to introduce a weighted TF-IDF algorithm to highlight important features and improve the accuracy of SQL security assessment; by combining the features in the whitelist and the blacklist to calculate the similarity of the SQL statement to be evaluated, the efficiency of SQL statement security assessment is improved.

[0095] Based on the above implementation scheme, in a feasible implementation manner, the method further includes step S50 before calculating the feature values ​​of the SQL statements in the statement whitelist based on the SQL feature library by using the weighted TF-IDF algorithm to obtain the whitelist statement feature vector of the SQL statements in the statement whitelist:

[0096] Step S50, creating a basic database, wherein the basic database includes a statement whitelist, a statement blacklist and an SQL feature library.

[0097] It should be noted that the basic database is used to create and maintain a statement whitelist, a statement blacklist and an SQL feature library.

[0098] Specifically, a basic database is created, which includes but is not limited to a statement whitelist, a statement blacklist, and an SQL feature library. The statement whitelist stores audited SQL statements that have no execution risk and are highly secure; the statement blacklist stores audited SQL statements that have execution risk and are highly dangerous; and the SQL feature library stores 38 basic SQL keywords and some important object names, such as some important table names, view names, etc., as feature words.

[0099] Through the above scheme, this embodiment creates a statement whitelist, a statement blacklist and an SQL feature library in the basic database, and uses them as a basis for judging the security of the SQL statement to be evaluated. It can more comprehensively and accurately measure the similarity between the SQL statement and the SQL statements in the whitelist and blacklist, facilitate the work of database maintenance personnel, and improve the work efficiency of database maintenance personnel.

[0100] Based on the above implementation scheme, in a feasible implementation manner, the feature value of the SQL statement in the statement whitelist is calculated by the weighted TF-IDF algorithm based on the SQL feature library to obtain the whitelist statement feature vector of the SQL statement in the statement whitelist, including steps S11 to S13:

[0101] Step S11, extracting features of SQL statements in the statement whitelist based on the SQL feature library to obtain whitelist features.

[0102] Specifically, first, each SQL statement in the statement whitelist is decomposed into its components, such as commands (SELECT, INSERT, etc.), table names, column names, conditional expressions, etc., through existing libraries (such as Python's sqlparse library) or regular expressions; then, sqlparse or similar libraries are used to traverse the parsed SQL statement tree, and based on the SQL feature library, the features of each SQL statement in the statement whitelist are extracted to obtain the whitelist features.

[0103] Step S12, calculating the feature values ​​of the features in the SQL statements in the statement whitelist by using a weighted TF-IDF algorithm.

[0104] Specifically, firstly, corresponding weights are assigned to several features in the SQL database according to their importance, and the more important the feature is, the greater the weight value is; then, according to the number of a certain feature in a SQL statement in the statement whitelist, the word frequency of the corresponding feature in the SQL statement in the statement whitelist is obtained; then, according to the number of SQL statements in the statement whitelist, the number of SQL statements in the statement blacklist and the weight of the corresponding features of the SQL statements in the whitelist in the SQL feature library, the inverse document frequency of the corresponding features of the SQL statements in the statement whitelist is obtained; finally, according to the word frequency and inverse document frequency of the corresponding features of the SQL statements in the statement whitelist, the feature value of the corresponding feature in the SQL statement in the statement whitelist is obtained through the weighted TF-IDF algorithm.

[0105] Step S13, concatenating the feature values ​​of the features in the SQL statements in the statement whitelist to obtain a whitelist statement feature vector of the SQL statements in the statement whitelist.

[0106] Specifically, after calculating the feature value of the feature contained in each SQL statement in the statement whitelist, based on the feature storage order in the SQL feature library, the feature value contained in the SQL statement is concatenated to obtain the whitelist statement feature vector corresponding to each SQL statement.

[0107] Based on the above implementation scheme, in a feasible implementation manner, the step of calculating the feature value of the feature in the SQL statement in the statement whitelist by using the weighted TF-IDF algorithm includes S121 to S124:

[0108] Step S121, assigning corresponding weights to the features in the SQL feature library.

[0109] Specifically, several features are stored in the SQL feature library, including 38 basic SQL keywords and important object names dynamically added by database maintenance personnel. Corresponding weights are assigned to several features in the SQL database according to their importance. The more important the feature, the greater the weight value.

[0110] For example, suppose there are F features in the SQL feature library in the basic database module, and suppose the F features are represented as f1, f2, …, f F; Among the above F features, some features are of high importance, such as important object names, and SQL keywords such as update and delete; however, features such as select in SQL keywords represent that the SQL statement only performs query operations, which may have a relatively small impact on the database, and accordingly, the importance may be relatively low; Based on the above analysis, the above F features are assigned different weights according to their importance, recorded as w1, w2, …, w F , where w i represents the weight of the i-th feature, 0 <w i <1, i is an integer, and 1≤i≤F; feature f i The more important it is, the larger the corresponding weight value is, that is, the closer it is to 1; conversely, the feature f i The less important it is, the smaller the corresponding weight value is, that is, the closer it is to 0.

[0111] Step S122, according to the number of features in the SQL statements in the statement whitelist, obtain the word frequency of the corresponding features of the SQL statements in the statement whitelist.

[0112] It should be noted that the word frequency of the corresponding feature of the SQL statement in the statement whitelist refers to the number of times a certain feature appears in an SQL statement in the statement whitelist.

[0113] Specifically, according to the number of occurrences of a feature in an SQL statement in the statement whitelist, the word frequency of the feature in the SQL statement in the statement whitelist is obtained. For example, assuming that there are W SQL statements in the statement whitelist in the basic database module, the SQL statements in the whitelist can be represented as a vector G m =(g m1 ,g m2 ,…,g mF ), where G m Represents the vector corresponding to the mth SQL statement in the statement whitelist, where m is an integer and 1≤m≤W, where SQLG m Indicates the mth SQL statement in the whitelist, TF(f i ,SQLG m ) represents the feature word f i In SQLG m The number of times it appears in the feature word f i In SQLG m The frequency of words in .

[0114] Step S123, obtaining the inverse document frequency of the corresponding features of the SQL statements in the statement whitelist according to the number of SQL statements in the statement whitelist, the number of SQL statements in the statement blacklist, and the weights of the corresponding features of the SQL statements in the whitelist in the SQL feature library.

[0115] Specifically, according to the number of SQL statements in the statement whitelist, the number of SQL statements in the statement blacklist, and the weights of the corresponding features of the SQL statements in the whitelist in the SQL feature library, the inverse document frequency of the corresponding features of the SQL statements in the statement whitelist is obtained by the inverse document frequency calculation formula.

[0116] For example, assuming that there are W SQL statements in the statement whitelist in the basic database module and B SQL statements in the statement blacklist, the calculation formula for the inverse document frequency is:

[0117]

[0118] Among them, IDF(f i ) is the feature f i The inverse document frequency of the statement; W is the number of SQL statements in the statement whitelist; B is the number of SQL statements in the statement blacklist; DF(f i ) indicates that all SQL statements in the statement whitelist and statement blacklist contain the characteristic word f i The number of SQL statements; i Represents feature f i The weight of .

[0119] Step S124, obtaining feature values ​​of corresponding features in the SQL statements in the statement whitelist according to the word frequencies and inverse document frequencies of the corresponding features in the SQL statements in the statement whitelist.

[0120] Specifically, according to the word frequency and inverse document frequency of the corresponding feature of the SQL statement in the statement whitelist, the feature value of the corresponding feature in the SQL statement in the statement whitelist is obtained by the feature value calculation formula. For example, the feature value calculation formula is:

[0121] g mi =TF(f i ,SQLG m )*IDF(f i )

[0122] Among them, g mi Represents vector G m The eigenvalue of the i-th feature among the corresponding F features; IDF(f i ) is the feature f in the nth SQL statement in the statement whitelist i The corresponding inverse document frequency; TF(f i ,SQLG m ) is the feature f in the nth SQL statement in the statement whitelist i The corresponding word frequency.

[0123] Based on the above implementation scheme, in a feasible implementation manner, the step of calculating the feature value of the SQL statement in the statement blacklist by the weighted TF-IDF algorithm based on the SQL feature library to obtain the blacklist statement feature vector of the SQL statement in the statement blacklist includes steps S21 to S23:

[0124] Step S21, extracting features of SQL statements in a statement blacklist based on a SQL feature library to obtain blacklist features.

[0125] Specifically, first, each SQL statement in the statement blacklist is decomposed into its components, such as commands (SELECT, INSERT, etc.), table names, column names, conditional expressions, etc., through existing libraries (such as Python's sqlparse library) or regular expressions; then, sqlparse or similar libraries are used to traverse the parsed SQL statement tree, and based on the SQL feature library, the features of each SQL statement in the statement blacklist are extracted to obtain the blacklist features.

[0126] Step S22, calculating the feature values ​​of the features in the SQL statements in the statement blacklist by using a weighted TF-IDF algorithm.

[0127] Specifically, firstly, corresponding weights are assigned to several features in the SQL database according to their importance, and the more important the feature is, the greater the weight value is; then, according to the number of a certain feature in a SQL statement in the statement blacklist, the word frequency of the corresponding feature in the SQL statement in the statement blacklist is obtained; then, according to the number of SQL statements in the statement blacklist, the number of SQL statements in the statement whitelist and the weight of the corresponding features of the SQL statements in the blacklist in the SQL feature library, the inverse document frequency of the corresponding features of the SQL statements in the statement blacklist is obtained; finally, according to the word frequency and inverse document frequency of the corresponding features of the SQL statements in the statement blacklist, the feature value of the corresponding feature in the SQL statement in the statement blacklist is obtained through the weighted TF-IDF algorithm.

[0128] Step S23, concatenating the feature values ​​of the features in the SQL statements in the statement blacklist to obtain a blacklist statement feature vector of the SQL statements in the statement blacklist.

[0129] Specifically, after calculating the feature value of the feature contained in each SQL statement in the statement blacklist, based on the feature storage order in the SQL feature library, the feature values ​​contained in the SQL statement are concatenated to obtain the blacklist statement feature vector corresponding to each SQL statement.

[0130] Based on the above implementation scheme, in a feasible implementation manner, the step of calculating the feature value of the feature in the SQL statement in the statement blacklist by using the weighted TF-IDF algorithm includes steps S221 to S224:

[0131] Step S221, assigning corresponding weights to the features in the SQL feature library.

[0132] Specifically, several features are stored in the SQL feature library, including 38 basic SQL keywords and important object names dynamically added by database maintenance personnel. Corresponding weights are assigned to several features in the SQL database according to their importance. The more important the feature, the greater the weight value.

[0133] For example, suppose there are F features in the SQL feature library in the basic database module, and suppose the F features are represented as f1, f2, …, f F ; Among the above F features, some features are of high importance, such as important object names, and SQL keywords such as update and delete; however, features such as select in SQL keywords represent that the SQL statement only performs query operations, which may have a relatively small impact on the database, and accordingly, the importance may be relatively low; Based on the above analysis, the above F features are assigned different weights according to their importance, recorded as w1, w2, …, w F , where w i represents the weight of the i-th feature, 0 <w i <1, i is an integer, and 1≤i≤F; feature f i The more important it is, the larger the corresponding weight value is, that is, the closer it is to 1; conversely, the feature f i The less important it is, the smaller the corresponding weight value is, that is, the closer it is to 0.

[0134] Step S222: obtaining the word frequencies of the corresponding features of the SQL statements in the statement blacklist according to the number of features in the SQL statements in the statement blacklist.

[0135] It should be noted that the word frequency of the corresponding feature of the SQL statement in the statement blacklist refers to the number of times a certain feature appears in an SQL statement in the statement blacklist.

[0136] Specifically, according to the number of occurrences of a feature in an SQL statement in the statement blacklist, the word frequency of the feature in the SQL statement in the statement blacklist is obtained. For example, assuming that there are B SQL statements in the statement blacklist in the basic database module, the SQL statements in the statement blacklist can be represented as a vector H n =(h n1 ,h n2 ,…,h nF ), where H n Represents the vector corresponding to the nth SQL statement in the statement blacklist, where n is an integer and 1≤n≤B. nIndicates the nth SQL statement in the statement blacklist, TF(f i ,SQLH n ) represents the feature word f i In SQLH n The number of times it appears in the feature word f i In SQLH n The frequency of words in .

[0137] Step S223, obtaining the inverse document frequency of the corresponding features of the SQL statements in the statement blacklist according to the number of SQL statements in the statement blacklist, the number of SQL statements in the statement whitelist, and the weights of the corresponding features of the SQL statements in the blacklist in the SQL feature library.

[0138] Specifically, according to the number of SQL statements in the statement blacklist, the number of SQL statements in the statement whitelist, and the weights of the corresponding features of the SQL statements in the blacklist in the SQL feature library, the inverse document frequency calculation formula is used to obtain the inverse document frequency of the corresponding features of the SQL statements in the statement blacklist. The calculation formula of the inverse document frequency is the same as the above calculation formula (1).

[0139] Step S224, obtaining feature values ​​of corresponding features in the SQL statements in the statement blacklist according to the word frequencies and inverse document frequencies of the corresponding features in the SQL statements in the statement blacklist.

[0140] Specifically, according to the word frequency and inverse document frequency of the corresponding feature of the SQL statement in the statement blacklist, the feature value of the corresponding feature in the SQL statement in the statement blacklist is obtained by the feature value calculation formula. For example, the feature value calculation formula is:

[0141] h ni =TF(f i ,SQLH n )*IDF(f i )

[0142] Among them, h ni Represents the vector H n The eigenvalue corresponding to the i-th feature among F features; IDF(f i ) is the feature f in the nth SQL statement in the statement blacklist i The corresponding inverse document frequency; TF(f i ,SQLH n ) is the feature f in the nth SQL statement in the statement blacklist i The corresponding word frequency.

[0143] Based on the above implementation scheme, in a feasible implementation manner, obtaining the SQL statement to be evaluated, calculating the feature value of the SQL statement to be evaluated by the weighted TF-IDF algorithm, and obtaining the feature vector to be evaluated includes steps S31 to S34:

[0144] Step S31, obtaining the SQL statement to be evaluated.

[0145] Specifically, the SQL security assessment device based on feature analysis obtains the SQL statement to be assessed. In one embodiment of the present application, the SQL statement to be assessed is designed and submitted by a database maintenance personnel.

[0146] Step S32: extracting features in the SQL statement to be evaluated based on the SQL feature library to obtain features to be evaluated.

[0147] Specifically, first, the SQL statement to be evaluated is decomposed into its components, such as commands (SELECT, INSERT, etc.), table names, column names, conditional expressions, etc., through existing libraries (such as Python's sqlparse library) or regular expressions; then sqlparse or similar libraries are used to traverse the parsed SQL statement tree, and based on the SQL feature library, the features of the SQL statement to be evaluated are extracted to obtain the features to be evaluated.

[0148] Step S33: Calculate the feature value of the feature in the SQL statement to be evaluated by using a weighted TF-IDF algorithm.

[0149] Specifically, firstly, corresponding weights are assigned to several features in the SQL database according to their importance. The more important the feature is, the greater the weight value is. Then, after extracting the SQL statement to be evaluated, the word frequency of a feature in the SQL statement to be evaluated is obtained according to the number of times a feature appears in the SQL statement to be evaluated, and the word frequency is used as the feature value of the feature.

[0150] For example, obtain a SQL statement to be evaluated, which is recorded as SQLC. Assume that the SQL statement to be evaluated can be represented by a vector S = (s1, s2, ..., s F ), where the element s of the vector S i Indicates the eigenvalue of the i-th feature among the F features corresponding to the vector S, s i The calculation method is s i =TF(f i ,SQLC), TF(f i , SQLC) represents the feature f i The number of times it appears in the SQLC to be evaluated, that is, the feature f i The frequency of the word in the SQLC to be evaluated.

[0151] Step S34, concatenating the feature values ​​of the features in the SQL statement to be evaluated to obtain a feature vector to be evaluated.

[0152] Specifically, after calculating the feature values ​​of the features included in the SQL statement to be evaluated, based on the feature storage order in the SQL feature library, the feature values ​​included in the SQL statement to be evaluated are concatenated to obtain the feature vector to be evaluated of the SQL statement to be evaluated.

[0153] Based on the above implementation scheme, in a feasible implementation manner, the step of obtaining the security assessment result of the SQL statement to be assessed by subjecting the whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be assessed to a similarity calculation algorithm includes steps S41 to S43:

[0154] Step S41, calculating the whitelist statement feature vector and the to-be-evaluated feature vector by a similarity calculation algorithm, and obtaining the similarity between the statements in the statement whitelist and the to-be-evaluated SQL statement.

[0155] Specifically, the whitelist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statement in the statement whitelist and the SQL statement to be evaluated. In one embodiment of the present application, the similarity calculation algorithm is a cosine similarity calculation algorithm. For example, the similarity between the SQL statement to be evaluated SQLC and the SQL statement in the statement whitelist SQLG is calculated. m The similarity between sim(SQLC,SQLG m ), the specific calculation formula is:

[0156]

[0157] Among them, sim(SQLC,SQLG m ) is the SQL statement SQLC to be evaluated and the SQL statement SQLG in the statement whitelist m The similarity between i g is the feature value of the i-th feature among the F features in the SQL feature library corresponding to the SQL statement to be evaluated; mi Indicates the feature value of the i-th feature among the F features in the SQL feature library corresponding to the m-th SQL statement in the statement whitelist.

[0158] Step S42: The blacklist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statement in the statement blacklist and the SQL statement to be evaluated.

[0159] Specifically, the blacklist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statement in the statement blacklist and the SQL statement to be evaluated. In one embodiment of the present application, the similarity calculation algorithm is a cosine similarity calculation algorithm. For example, the similarity between the SQL statement SQLC to be evaluated and the SQL statement SQLH in the blacklist is calculated. n The similarity between sim(SQLC, SQLH n ), the specific calculation formula is:

[0160]

[0161] Among them, sim(SQLC, SQLH n ) is the SQL statement SQLC to be evaluated and the SQL statement SQLH in the statement white and black list n The similarity between i h is the feature value of the i-th feature among the F features in the SQL feature library corresponding to the SQL statement to be evaluated; ni Indicates the feature value of the i-th feature among the F features in the SQL feature library corresponding to the n-th SQL statement in the statement blacklist.

[0162] Step S43, obtaining a security assessment result of the SQL statement to be assessed based on the similarity between the statements in the statement whitelist and the SQL statement to be assessed, and the similarity between the statements in the statement blacklist and the SQL statement to be assessed.

[0163] Specifically, the similarities between the statements in the statement whitelist and the SQL statement to be evaluated are sorted to obtain a whitelist similarity table; the similarities between the statements in the statement blacklist and the SQL statement to be evaluated are sorted to obtain a blacklist similarity table; the maximum value in the whitelist similarity table is compared with a preset first threshold; when the maximum value in the whitelist similarity table is greater than the preset first threshold, the security assessment result of the SQL statement to be evaluated is safe; the maximum value in the blacklist similarity table is compared with a preset second threshold; when the maximum value in the blacklist similarity table is greater than the preset second threshold, the security assessment result of the SQL statement to be evaluated is dangerous.

[0164] Based on the above implementation scheme, in a feasible implementation manner, obtaining the security assessment result of the SQL statement to be evaluated according to the similarity between the statements in the statement whitelist and the SQL statement to be evaluated, and the similarity between the statements in the statement blacklist and the SQL statement to be evaluated includes steps S431 to S436:

[0165] Step S431, sorting the similarities between the statements in the statement whitelist and the SQL statement to be evaluated to obtain a whitelist similarity table.

[0166] Specifically, the similarity between each SQL statement in the statement whitelist and the SQL statement to be evaluated is calculated to obtain a corresponding similarity value, and the obtained similarities are sorted. The sorting method can be from high to low or from low to high. After sorting, a whitelist similarity table is obtained, which records the similarities between the SQL statements in the statement whitelist and the SQL statement to be evaluated in order.

[0167] Step S432: sort the similarities between the statements in the statement blacklist and the SQL statement to be evaluated to obtain a blacklist similarity table.

[0168] Specifically, the similarity between each SQL statement in the statement blacklist and the SQL statement to be evaluated is calculated to obtain a corresponding similarity value, and the obtained similarities are sorted. The sorting method can be from high to low or from low to high. After sorting, a blacklist similarity table is obtained, which records the similarities between the SQL statements in the statement blacklist and the SQL statement to be evaluated in order.

[0169] Step S433: compare the maximum value in the whitelist similarity table with a preset first threshold.

[0170] It should be noted that the preset first threshold is used to determine the similarity between the SQL statement to be evaluated and the SQL statements in the statement whitelist.

[0171] Specifically, firstly, a first threshold is determined, then a maximum value in the whitelist similarity table is obtained, and the maximum value in the whitelist similarity table is compared with a preset first threshold.

[0172] Step S434: When the maximum value in the whitelist similarity table is greater than a preset first threshold, the security assessment result of the SQL statement to be assessed is safe.

[0173] Specifically, if the similarity between statement SQLC and a certain SQL statement in the statement whitelist is very high, it means that the risk of statement SQLC is very small. The preset first threshold is used for judgment, and the maximum value in the whitelist similarity table is obtained. When the maximum value in the whitelist similarity table is greater than the preset first threshold, the security assessment result of the SQL statement to be evaluated is safe. The first threshold is determined by the database maintenance personnel according to the specific actual situation.

[0174] Step S435: compare the maximum value in the blacklist similarity table with a preset second threshold.

[0175] It should be noted that the preset second threshold is used to determine the similarity between the SQL statement to be evaluated and the SQL statements in the statement blacklist.

[0176] Specifically, firstly, the second threshold is determined, then the maximum value in the blacklist similarity table is obtained, and the maximum value in the blacklist similarity table is compared with the preset second threshold.

[0177] Step S436: When the maximum value in the blacklist similarity table is greater than a preset second threshold, the security assessment result of the SQL statement to be assessed is dangerous.

[0178] Specifically, if the similarity between the SQL statement SQLC to be evaluated and a certain SQL statement in the statement blacklist is relatively high, it means that the statement SQLC is very risky and needs to be executed with great caution. The preset second threshold is used for judgment to obtain the maximum value in the blacklist similarity table. When the maximum value in the blacklist similarity table is greater than the preset second threshold, the security assessment result of the SQL statement to be evaluated is dangerous. The second threshold is determined by the database maintenance personnel according to the specific situation.

[0179] Optionally, if the database maintenance personnel believe that the SQL statement SQLC to be evaluated has good reference significance, the SQL statement SQLC can be added to the statement whitelist or statement blacklist according to the security assessment result. If the security assessment result is safe, the SQL statement to be evaluated is added to the statement whitelist; if the security assessment result is dangerous, the SQL statement to be evaluated is added to the statement blacklist.

[0180] For example, in order to help understand the implementation process of the data verification method of this embodiment, this embodiment provides a specific scenario-based description of the solution:

[0181] 1. Create a basic database, which includes a statement whitelist, a statement blacklist and an SQL feature library.

[0182] Create a statement whitelist, statement blacklist, and SQL signature library. Store 50 SQL statements that have been reviewed and confirmed to have no execution risk in the statement whitelist; store 30 SQL statements that have been reviewed and confirmed to have a high execution risk and are not recommended to be executed again in the statement blacklist.

[0183] 38 basic SQL keywords and 1 important object name are stored in the SQL feature library as features. The 38 basic SQL keywords include: "select, insert, replace, into, delete, truncate, update, distinct, where, and, or, order, by, group, having, top, limit, like, between, left, join, full, outer, union, all, as, exists, create, table, drop, temporary, alter, index, view, procedure, trigger, schema, domain". One important object name is the table name "SALARY". This table contains a lot of sensitive information and has a greater execution risk. Therefore, a total of 39 features are maintained in the SQL feature library.

[0184] There are 39 features in the SQL feature library, including 38 basic SQL keywords and an important object name SALARY dynamically added by the database maintenance personnel. The 39 features are represented by f1, f2, ..., f 39 ; Different weights are assigned to the above 39 features, denoted as w1, w2, …, w 39 The specific weight values ​​are 0.5, 0.8, 0.8, 0.5, 0.9, 0.8, 0.8, 0.5, 0.3, 0.1, 0.1, 0.8, 0.5, 0.5, 0.3, 0.2, 0.2, 0.5, 0.2, 0.4, 0.2, 0.3, 0.4, 0.5, 0.4, 0.3, 0.4, 0.8, 0.6, 0.9, 0.4, 0.4, 0.3, 0.2, 0.4, 0.4, 0.4, 0.9, 0.9.

[0185] 2. Based on the SQL feature library, the feature values ​​of the SQL statements in the statement whitelist are calculated by the weighted TF-IDF algorithm to obtain the whitelist statement feature vector of the SQL statements in the statement whitelist. The SQL statements in the statement whitelist are represented as vector G m =(g m1 ,g m2 ,…,g mF ); Based on the SQL feature library, the feature value of the SQL statement in the statement blacklist is calculated by the weighted TF-IDF algorithm to obtain the blacklist statement feature vector of the SQL statement in the statement blacklist, and the SQL statement in the statement blacklist is represented as a vector H n =(h n1 ,h n2 ,…,hnF ).

[0186] 3. Obtain the SQL statement to be evaluated, calculate the feature value of the SQL statement to be evaluated by the weighted TF-IDF algorithm, and obtain the feature vector to be evaluated. The SQL statement to be evaluated is "SELECT USER_NAME, USER_SALARY FROMSALARY", which is recorded as SQLC. Based on the SQL feature library, the SQL statement to be evaluated includes the features "SELECT" and "SALARY". The storage order of "SELECT" in the SQL feature library is 1st, and the storage order of "SALARY" in the SQL feature library is 39th. These two features appear once each, so the feature values ​​are both 1, because the feature vector S of the SQL statement to be evaluated is:

[0187] S=(1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1)

[0188] 4. The whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be evaluated are subjected to a similarity calculation algorithm to obtain a security evaluation result of the SQL statement to be evaluated. According to the cosine similarity calculation method, the security evaluation result of the SQL statement to be evaluated is calculated between SQLC and the SQL statement SQLG in the statement whitelist. m The similarity between sim(SQLC,SQLG m ), similarly, we can calculate SQLC and SQL statements in the statement blacklist SQLH n The similarity between sim(SQLC,SQLH n ). Sort the similarities between the statements in the statement whitelist and the SQL statement to be evaluated to obtain a whitelist similarity table; sort the similarities between the statements in the statement blacklist and the SQL statement to be evaluated to obtain a blacklist similarity table; compare the maximum value in the whitelist similarity table with a preset first threshold value of 0.5; when the maximum value in the whitelist similarity table is greater than the preset first threshold value of 0.5, the security assessment result of the SQL statement to be evaluated is safe; compare the maximum value in the blacklist similarity table with a preset second threshold value of 0.5; when the maximum value in the blacklist similarity table is greater than the preset second threshold value of 0.5, the security assessment result of the SQL statement to be evaluated is dangerous.

[0189] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the SQL security assessment method based on feature analysis of the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0190] This application also provides a SQL security assessment device based on feature analysis, please refer to Figure 2 , the SQL security assessment device based on feature analysis includes:

[0191] A whitelist feature module 201 is used to calculate feature values ​​of SQL statements in the statement whitelist by a weighted TF-IDF algorithm based on an SQL feature library to obtain whitelist statement feature vectors of the SQL statements in the statement whitelist;

[0192] A blacklist feature module 202 is used to calculate feature values ​​of SQL statements in the statement blacklist by a weighted TF-IDF algorithm based on the SQL feature library to obtain blacklist statement feature vectors of the SQL statements in the statement blacklist;

[0193] The feature module 203 to be evaluated is used to obtain the SQL statement to be evaluated, calculate the feature value of the SQL statement to be evaluated by using the weighted TF-IDF algorithm, and obtain the feature vector to be evaluated;

[0194] The security assessment module 204 is used to obtain a security assessment result of the SQL statement to be assessed by performing a similarity calculation algorithm on the whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be assessed.

[0195] The SQL security assessment device based on feature analysis provided by the present application adopts the SQL security assessment method based on feature analysis in the above embodiment, which can solve the technical problem of improving the efficiency of SQL statement security assessment. Compared with the prior art, the beneficial effects of the SQL security assessment device based on feature analysis provided by the present application are the same as the beneficial effects of the SQL security assessment method based on feature analysis provided by the above embodiment, and the other technical features in the SQL security assessment device based on feature analysis are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0196] The present application provides a SQL security assessment device based on feature analysis, and the SQL security assessment device based on feature analysis includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the SQL security assessment method based on feature analysis in the above-mentioned embodiment 1.

[0197] Reference below Figure 3, which shows a schematic diagram of the structure of a SQL security assessment device based on feature analysis suitable for implementing the embodiment of the present application. The SQL security assessment device based on feature analysis in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The SQL security assessment device based on feature analysis shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0198] like Figure 3 As shown, the SQL security assessment device based on feature analysis may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the SQL security assessment device based on feature analysis are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 may allow the feature analysis-based SQL security assessment device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a feature analysis-based SQL security assessment device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0199] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0200] The SQL security assessment device based on feature analysis provided by the present application adopts the SQL security assessment method based on feature analysis in the above embodiment, which can solve the technical problem of improving the efficiency of SQL statement security assessment. Compared with the prior art, the beneficial effects of the SQL security assessment device based on feature analysis provided by the present application are the same as the beneficial effects of the SQL security assessment method based on feature analysis provided by the above embodiment, and the other technical features in the SQL security assessment device based on feature analysis are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0201] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0202] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0203] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the SQL security assessment method based on feature analysis in the above-mentioned embodiment.

[0204] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0205] The computer-readable storage medium may be included in the SQL security assessment device based on feature analysis; or may exist independently without being assembled into the SQL security assessment device based on feature analysis.

[0206] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by a SQL security assessment device based on feature analysis, the SQL security assessment device based on feature analysis: based on the SQL feature library, calculates the feature values ​​of SQL statements in a statement whitelist by a weighted TF-IDF algorithm to obtain whitelist statement feature vectors of the SQL statements in the statement whitelist; based on the SQL feature library, calculates the feature values ​​of SQL statements in a statement blacklist by a weighted TF-IDF algorithm to obtain blacklist statement feature vectors of the SQL statements in the statement blacklist; obtains a SQL statement to be evaluated, calculates the feature values ​​of the SQL statement to be evaluated by a weighted TF-IDF algorithm to obtain a feature vector to be evaluated; and obtains a security assessment result of the SQL statement to be evaluated by using a similarity calculation algorithm for the whitelist statement feature vector, the blacklist statement feature vector, and the feature vector to be evaluated.

[0207] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0208] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0209] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0210] The readable storage medium provided in the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned SQL security assessment method based on feature analysis, and can solve the technical problem of improving the efficiency of SQL statement security assessment. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the present application are the same as the beneficial effects of the SQL security assessment method based on feature analysis provided in the above-mentioned embodiment, and will not be repeated here.

[0211] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned SQL security assessment method based on feature analysis when executed by a processor.

[0212] The computer program product provided by this application can solve the technical problem of improving the efficiency of SQL statement security assessment. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the SQL security assessment method based on feature analysis provided in the above embodiment, which will not be repeated here.

[0213] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A SQL security assessment method based on feature analysis, characterized in that: The method comprises: Based on the SQL feature library, the feature values ​​of the SQL statements in the statement whitelist are calculated by a weighted TF-IDF algorithm to obtain whitelist statement feature vectors of the SQL statements in the statement whitelist; Based on the SQL feature library, a feature value of the SQL statement in the statement blacklist is calculated by a weighted TF-IDF algorithm to obtain a blacklist statement feature vector of the SQL statement in the statement blacklist; Obtaining a SQL statement to be evaluated, calculating a feature value of the SQL statement to be evaluated by using a weighted TF-IDF algorithm, and obtaining a feature vector to be evaluated; The whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be evaluated are subjected to a similarity calculation algorithm to obtain a security evaluation result of the SQL statement to be evaluated.

2. The method according to claim 1, characterized in that Before the step of calculating the feature values ​​of the SQL statements in the statement whitelist by the weighted TF-IDF algorithm based on the SQL feature library to obtain the whitelist statement feature vectors of the SQL statements in the statement whitelist, the step further includes: A basic database is created, wherein the basic database includes a statement whitelist, a statement blacklist, and an SQL feature library.

3. The method according to claim 1, characterized in that The step of calculating the feature values ​​of the SQL statements in the statement whitelist by the weighted TF-IDF algorithm based on the SQL feature library to obtain the whitelist statement feature vectors of the SQL statements in the statement whitelist comprises: Extract features of SQL statements in the statement whitelist based on the SQL feature library to obtain whitelist features; Calculate the feature values ​​of the features in the SQL statements in the statement whitelist by using a weighted TF-IDF algorithm; The feature values ​​of the features in the SQL statements in the statement whitelist are concatenated to obtain a whitelist statement feature vector of the SQL statements in the statement whitelist.

4. The method according to claim 1, characterized in that The step of calculating the feature values ​​of the SQL statements in the statement blacklist by a weighted TF-IDF algorithm based on the SQL feature library to obtain the blacklist statement feature vectors of the SQL statements in the statement blacklist comprises: Extract features of SQL statements in the statement blacklist based on the SQL feature library to obtain blacklist features; Calculate the feature values ​​of the features in the SQL statements in the statement blacklist by using a weighted TF-IDF algorithm; The feature values ​​of the features in the SQL statements in the statement blacklist are concatenated to obtain a blacklist statement feature vector of the SQL statements in the statement blacklist.

5. The method according to claim 3, characterized in that The step of calculating the feature value of the feature in the SQL statement in the statement whitelist by using the weighted TF-IDF algorithm comprises: Assign corresponding weights to the features in the SQL feature library; According to the number of features in the SQL statements in the statement whitelist, the word frequency of the corresponding features of the SQL statements in the statement whitelist is obtained; According to the number of SQL statements in the statement whitelist, the number of SQL statements in the statement blacklist, and the weights of the corresponding features of the SQL statements in the whitelist in the SQL feature library, the inverse document frequency of the corresponding features of the SQL statements in the statement whitelist is obtained; According to the word frequency and inverse document frequency of the corresponding feature of the SQL statement in the statement whitelist, the feature value of the corresponding feature in the SQL statement in the statement whitelist is obtained.

6. The method according to claim 4, characterized in that The step of calculating the feature value of the feature in the SQL statement in the statement blacklist by using the weighted TF-IDF algorithm comprises: Assign corresponding weights to the features in the SQL feature library; According to the number of features in the SQL statements in the statement blacklist, the word frequencies of the corresponding features of the SQL statements in the statement blacklist are obtained; According to the number of SQL statements in the statement blacklist, the number of SQL statements in the statement whitelist, and the weights of the corresponding features of the SQL statements in the blacklist in the SQL feature library, the inverse document frequency of the corresponding features of the SQL statements in the statement blacklist is obtained; According to the word frequency and the inverse document frequency of the corresponding feature of the SQL statement in the statement blacklist, the feature value of the corresponding feature in the SQL statement in the statement blacklist is obtained.

7. The method according to claim 1, characterized in that The step of obtaining the SQL statement to be evaluated, calculating the feature value of the SQL statement to be evaluated by using a weighted TF-IDF algorithm, and obtaining the feature vector to be evaluated comprises: Get the SQL statement to be evaluated; Extracting features in the SQL statement to be evaluated based on the SQL feature library to obtain features to be evaluated; Calculate the feature value of the feature in the SQL statement to be evaluated by using a weighted TF-IDF algorithm; The feature values ​​of the features in the SQL statement to be evaluated are concatenated to obtain a feature vector to be evaluated.

8. The method according to claim 1, characterized in that The step of obtaining the security assessment result of the SQL statement to be assessed by using the whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be assessed through a similarity calculation algorithm comprises: The whitelist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statement in the statement whitelist and the SQL statement to be evaluated; The blacklist statement feature vector and the feature vector to be evaluated are calculated by a similarity calculation algorithm to obtain the similarity between the statement in the statement blacklist and the SQL statement to be evaluated; According to the similarity between the statements in the statement whitelist and the SQL statement to be evaluated, and the similarity between the statements in the statement blacklist and the SQL statement to be evaluated, a security evaluation result of the SQL statement to be evaluated is obtained.

9. The method according to claim 8, characterized in that The step of obtaining the security assessment result of the SQL statement to be assessed according to the similarity between the statements in the statement whitelist and the SQL statement to be assessed, and the similarity between the statements in the statement blacklist and the SQL statement to be assessed comprises: Sort the similarities between the statements in the statement whitelist and the SQL statements to be evaluated to obtain a whitelist similarity table; Sort the similarities between the statements in the statement blacklist and the SQL statement to be evaluated to obtain a blacklist similarity table; Comparing the maximum value in the whitelist similarity table with a preset first threshold; When the maximum value in the whitelist similarity table is greater than a preset first threshold, the security assessment result of the SQL statement to be assessed is safe; Comparing the maximum value in the blacklist similarity table with a preset second threshold; When the maximum value in the blacklist similarity table is greater than a preset second threshold, the security assessment result of the SQL statement to be assessed is dangerous.

10. A SQL security assessment device based on feature analysis, characterized in that: The device comprises: A whitelist feature module is used to calculate feature values ​​of SQL statements in the statement whitelist by a weighted TF-IDF algorithm based on the SQL feature library to obtain whitelist statement feature vectors of the SQL statements in the statement whitelist; A blacklist feature module, used to calculate feature values ​​of SQL statements in the statement blacklist by a weighted TF-IDF algorithm based on the SQL feature library, and obtain a blacklist statement feature vector of the SQL statement in the statement blacklist; The feature module to be evaluated is used to obtain the SQL statement to be evaluated, calculate the feature value of the SQL statement to be evaluated by using the weighted TF-IDF algorithm, and obtain the feature vector to be evaluated; The security assessment module is used to obtain a security assessment result of the SQL statement to be evaluated by performing a similarity calculation algorithm on the whitelist statement feature vector, the blacklist statement feature vector and the feature vector to be evaluated.

11. A SQL security assessment device based on feature analysis, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the SQL security assessment method based on feature analysis according to any one of claims 1 to 9.

12. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the SQL security assessment method based on feature analysis according to any one of claims 1 to 9 are implemented.

13. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the SQL security assessment method based on feature analysis according to any one of claims 1 to 9 are implemented.

Images