Structured query language injection attack detection method and device, equipment and medium

Abstract

The invention provides a structured query language injection attack detection method, and relates to the field of information security, the field of artificial intelligence, the field of financial science and technology or other technical fields. The method comprises the steps of obtaining a to-be-detected SQL statement; the SQL statement is subjected to information compression processing, first summary information is obtained, the information compression processing comprises compressing at least one of character strings and semantic information of a processing object, and the first summary information comprises at least one of part of character strings and part of semantic information of the SQL statement; and inputting the first summary information into a large language model which is subjected to SQL injection attack sample fine adjustment in advance to obtain an attack detection result of the SQL statement. The invention further provides a structured query language injection attack detection device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the fields of information security, artificial intelligence, financial technology or other technical fields, and more specifically, to a structured query language injection attack detection method, device, equipment, medium and program product. Background Art

[0002] Structured Query Language (SQL) injection attack is a network attack method against databases. Attackers can insert malicious SQL statements into the query string of web forms, URLs or page requests through interaction with applications, bypassing the application's defense mechanism to obtain, tamper with or delete database information.

[0003] When detecting SQL injection attacks, for example, abnormal query statements can be pre-stored and matched with the SQL statements to be detected to detect and block malicious SQL requests. This method has the disadvantages of high false positive rate, affecting normal business access, insufficient automation of feature library updates, and difficulty in adapting to new attack patterns.

[0004] A large language model refers to a generative natural language processing model with a large set of parameters that can perform complex language understanding and generation tasks. Due to the large number of parameters, a large number of floating-point operations are required during model training and inference, resulting in a sharp increase in the demand for computing power.

[0005] In the process of implementing the concept of the present invention, the inventor found that a large language model can be applied to the detection of structured query language injection attacks. However, the large language model requires too much computing power, and if real-time detection and defense of SQL injection attacks are to be achieved, normal business access to the application may be affected. Summary of the invention

[0006] In view of the above problems, the present disclosure provides a structured query language injection attack detection method, apparatus, device, medium and program product.

[0007] According to a first aspect of the present disclosure, a structured query language injection attack detection method is provided, comprising: obtaining an SQL statement to be detected; performing information compression processing on the SQL statement to obtain first summary information, wherein the information compression processing comprises compressing at least one of a character string and semantic information of a processing object, and the first summary information comprises at least one of a partial character string and partial semantic information of the SQL statement; inputting the first summary information into a large language model that has been fine-tuned with a SQL injection attack sample in advance to obtain an attack detection result of the SQL statement.

[0008] According to an embodiment of the present disclosure, the SQL statement is subjected to information compression processing to obtain the first summary information, including: obtaining a compression mapping file, wherein the compression mapping file includes a mapping relationship between attack-related features extracted using the SQL injection attack sample and a compression expression language, and the compression expression language makes the large language model have less computational cost than the SQL statement; based on the compression mapping file, the attack-related features in the SQL statement are converted into a compression expression language to obtain the first summary information.

[0009] According to an embodiment of the present disclosure, before obtaining the attack detection result of the SQL statement, the method also includes: obtaining associated data involved in executing the SQL statement; performing information compression processing on the associated data to obtain second summary information, wherein the second summary information includes at least one of a partial string and partial semantic information of the associated data; and inputting the second summary information into the large language model.

[0010] According to an embodiment of the present disclosure, the associated data includes financial business data, and compressing the associated data to obtain the second summary information includes: extracting financial business features from the financial business data; and compressing the financial business features to obtain the second summary information.

[0011] According to an embodiment of the present disclosure, the extracting financial business features from the financial business data includes: constructing a retrieval statement based on the SQL statement and the financial business data, wherein the retrieval statement includes one or more retrieval keywords extracted from the SQL statement and the financial business data; retrieving the financial business features from a pre-constructed knowledge base based on the retrieval statement, wherein the knowledge base includes a mapping relationship between the SQL injection attack sample, the financial business data, and the financial business features.

[0012] According to an embodiment of the present disclosure, the step of obtaining the SQL statement to be detected includes: simulating a database environment using a honeypot system; and obtaining the SQL statement sent to the simulated database environment.

[0013] According to an embodiment of the present disclosure, before obtaining the attack detection result of the SQL statement, the method also includes: predicting the amount of computing resources occupied by executing the SQL statement; in response to the amount of computing resources being less than or equal to a first threshold, adjusting the standard amount of computing resources of the large language model to the first amount of computing resources; or, in response to the amount of computing resources being greater than or equal to the first threshold, adjusting the standard amount of computing resources of the large language model to the second amount of computing resources.

[0014] Another aspect of an embodiment of the present disclosure provides a structured query language injection attack detection device, including: an acquisition module, used to acquire an SQL statement to be detected; a compression module, used to perform information compression processing on the SQL statement to obtain first summary information, wherein the information compression processing includes compressing at least one of a character string and semantic information of a processing object, and the first summary information includes at least one of a partial character string and partial semantic information of the SQL statement; a detection module, used to input the first summary information into a large language model that has been fine-tuned with a SQL injection attack sample in advance to obtain an attack detection result of the SQL statement.

[0015] Another aspect of an embodiment of the present disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method described above.

[0016] Another aspect of an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes the method as described above.

[0017] Another aspect of an embodiment of the present disclosure provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0018] One or more of the above embodiments have the following beneficial effects: compressing the SQL statement to be detected into a limited number of first summary information, reducing the number of floating point operations while maintaining the semantic analysis capability of the large language model, and allowing the identification capability of complex attacks to be achieved with less computing cost. Therefore, by optimizing the operating efficiency of the large language model, the large language model can be introduced into the structured query language injection attack detection, and the false alarm rate can be reduced, the new attack mode can be automatically adapted, and the feature library can be updated, so as to achieve the effect of efficient defense, while reducing the negative impact on the normal business access performance of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0020] Figure 1 The application scenario diagram of structured query language injection attack detection according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 2 The flowchart of the structured query language injection attack detection method according to the embodiment of the present disclosure is schematically shown;

[0022] Figure 3 The flowchart of the structured query language injection attack detection method according to another embodiment of the present disclosure is schematically shown;

[0023] Figure 4 The flowchart of the structured query language injection attack detection method according to another embodiment of the present disclosure is schematically shown;

[0024] Figure 5 The structure block diagram of the structured query language injection attack detection device according to the embodiment of the present disclosure is schematically shown;

[0025] Figure 6 A block diagram of an electronic device suitable for implementing a structured query language injection attack detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0027] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0028] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0029] Figure 1The following schematically shows an application scenario diagram of structured query language injection attack detection according to an embodiment of the present disclosure. It should be noted that: Figure 1 What is shown are merely examples to which the embodiments of the present disclosure can be applied, so as to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0030] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0031] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, for example, to send an access request to the server 105, and the access request includes an SQL statement. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0032] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0033] The server 105 may be a server that provides various services, such as a background management server that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (for example only). The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. For example, the server 105 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud computing, network services, and middleware services.

[0034] It should be noted that the structured query language injection attack detection method provided in the embodiment of the present disclosure can generally be executed by at least one of a terminal device or a server. Accordingly, the structured query language injection attack detection device provided in the embodiment of the present disclosure can generally be set in at least one of a terminal device or a server.

[0035] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0036] The following will be based on Figure 1 The scene described by Figure 2~Figure 6 The structured query language injection attack detection method of the embodiment of the present disclosure is described in detail.

[0037] Figure 2 The flowchart of the structured query language injection attack detection method according to the embodiment of the present disclosure is schematically shown.

[0038] like Figure 2 As shown, this embodiment includes:

[0039] In operation S210, a SQL statement to be detected is obtained.

[0040] For example, when a user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to initiate an access request to the server 105 in the production environment through the network 104, the server 105 can parse the received HTTP request message and extract the SQL statement therein.

[0041] Take SQL injection in GET request as an example:

[0042] GET / search?query=SELECT%20*%20FROM%20users%20

[0043] WHERE%20username='admin'%20AND%20password='password' HTTP / 1.1

[0044] Host: example.com

[0045] The attacker attempts to inject SQL statements through the URL parameter query in order to query the user record with the username admin and the password password.

[0046] In operation S220, the SQL statement is subjected to information compression processing to obtain first summary information, wherein the information compression processing includes compressing at least one of the character string and semantic information of the processing object, and the first summary information includes at least one of a partial character string and a partial semantic information of the SQL statement.

[0047] The processing objects include objects for information compression processing, including SQL statements. SQL statements include multiple character strings. The semantic information is directly related to the operation requested by the statement and the request method. The summary information refers to a simplified version of the original data, retaining key information.

[0048] Executing operation S220 can reduce the amount of data and information of the SQL statement, thereby reducing subsequent computing costs. For example, the summary information can retain key character strings and semantic information.

[0049] For example, an adaptive compression algorithm can be used to dynamically select a compression strategy based on the complexity and length of the SQL statement. For a simple SELECT statement, the WHERE clause can be compressed; for a complex INSERT operation, a more complex compression strategy can be called.

[0050] In some embodiments, information compression may be performed using at least one of the following methods: for example, a machine learning method, where the SQL statement is input into a pre-trained neural network for information compression processing to obtain summary information. Alternatively, an encoder may be provided to compress the SQL statement into summary information with a limited number of character strings.

[0051] In operation S230, the first summary information is input into a large language model that has been fine-tuned in advance using a SQL injection attack sample to obtain an attack detection result of the SQL statement.

[0052] For example, multiple SQL injection attack samples and multiple normal access request samples are obtained respectively. The SQL injection attack samples refer to access requests containing SQL injection attacks. The normal access request samples refer to normal access requests that do not contain SQL injection attacks. Both the SQL injection attack samples and the normal access request samples exist in the form of strings.

[0053] You can choose a suitable general-purpose large language model, which can be stacked using the Transformer architecture, including hundreds of millions of parameters, and can be fine-tuned for the semantic understanding of SQL statements and attack detection tasks. The training data includes multiple SQL injection attack samples and multiple normal access request samples, and the labels are determined by security experts or prior knowledge. Then, an online learning mechanism can be implemented to enable the large language model to incrementally learn new attack samples without retraining from scratch. In addition, you can also design a transfer learning strategy to apply knowledge learned from other related tasks (such as text classification, anomaly detection) to the SQL injection detection task.

[0054] The large language model can understand the meaning of complex SQL statements, thereby identifying more subtle SQL injection attacks. By training the model to recognize the structure and semantics of SQL statements, the ability to identify complex attack patterns can be improved.

[0055] For example, the deep network structure of the large language model can be used to learn the semantic representation of SQL statements, including keywords, grammatical structure, and execution intent. It can identify abnormal patterns in SQL statements, such as abnormal grammatical structure or operation logic that does not conform to conventional operations. It can also analyze the context information of SQL statements, such as database access rights and historical behavior patterns, to identify potential attacks.

[0056] According to the embodiments of the present disclosure, the SQL statements to be detected are compressed into a limited number of first summary information, and the number of floating point operations is reduced while maintaining the semantic analysis capability of the large language model, allowing the identification capability of complex attacks to be achieved with less computing cost. Therefore, by optimizing the operating efficiency of the large language model, the large language model can be introduced into the structured query language injection attack detection, and the false alarm rate can be reduced, the new attack mode can be automatically adapted, and the feature library can be updated, so as to achieve the effect of efficient defense, while reducing the negative impact on the normal business access performance of the application.

[0057] In some embodiments, an asynchronous processing flow may be designed to perform queue detection on SQL statements that do not require high real-time performance, or SQL statements may be pre-detected, for example, SQL statements in the whitelist may not be detected.

[0058] In some embodiments, a compression mapping file may also be obtained, wherein the compression mapping file includes a mapping relationship between attack-related features extracted using SQL injection attack samples and a compression expression language, and the compression expression language makes the large language model have less computational cost than the SQL statement. Based on the compression mapping file, the attack-related features in the SQL statement are converted into the compression expression language to obtain the first summary information.

[0059] Some SQL injection attacks usually perform some risky operations, so the corresponding SQL statements have some features that can be distinguished from risk-free operations, which are called attack-related features. For example, attack-related features can include function call features, encoding format features, string text features, etc. Function call features include the calls of certain functions. Encoding format features include, for example, the use of space characters and comment characters. String text features include, for example, case change features.

[0060] The compressed expression language can be defined based on expert experience to convert attack-related features in SQL statements into a more concise expression to reduce the computational cost of large language models. For example, a specific function name or operator in an SQL statement is mapped to a short symbol or code.

[0061] For example, you can use a pre-written script or program to traverse SQL statements and replace attack-related features according to the rules in the compressed mapping file. For example, use a regular expression to match "UNION SELECT" in an SQL statement and replace it with "US". Map the "OR 1=1" pattern commonly seen in SQL injection attacks to a short identifier "OR1".

[0062] It can be understood that in the process of fine-tuning the large language model using SQL injection attack samples and normal access request samples in advance, the SQL injection attack samples or normal access request samples can be converted into a compressed expression language in advance, and the large language model can be fine-tuned using the first summary information. In this way, at least one of the character string and semantic information in the SQL statement can be compressed, and the semantic understanding of the SQL statement by the large language model can be maintained, thereby maintaining the accuracy of injection attack detection.

[0063] According to the embodiments of the present disclosure, by using a compressed expression language, the amount of data that the large language model needs to process is reduced, thereby reducing the computing cost. Due to the reduction in computing cost, the large language model can analyze SQL statements faster, improve the speed of attack detection, and reduce the impact on normal access to applications.

[0064] In some embodiments, an attack-related feature set can be extracted based on historical attack data and known SQL injection patterns to construct an initial feature library. Using an expert system and an existing security knowledge base, key features of SQL injection attacks are extracted as attack-related features. The embedding layer of a large language model is used to obtain a high-dimensional representation of SQL statements as an expression of attack-related features. Therefore, a compressed mapping file can be constructed based on the attack-related features in the initial feature library.

[0065] It is also possible to regularly collect new SQL injection attack samples (for example, manually or based on the attack detection results of a large language model), and use unsupervised learning techniques such as cluster analysis to automatically identify new attack patterns that are different from known attack patterns, thereby updating the compression mapping file. That is, for new attack-related features, configure the compression expression language mapped to them.

[0066] Figure 3 The flowchart of a structured query language injection attack detection method according to another embodiment of the present disclosure is schematically shown.

[0067] like Figure 3 As shown, this embodiment, based on including operations S210 to S230, before obtaining the attack detection result of the SQL statement, may further include:

[0068] In operation S310, the associated data involved in executing the SQL statement is obtained;

[0069] Related data includes data related to the execution of SQL statements, which can be database tables, views, or other stored data collections. For example, in an e-commerce system, the related data of executing a SQL statement to query user orders may include information such as user ID, order status, and order date.

[0070] In operation S320, information compression is performed on the associated data to obtain second summary information, wherein the second summary information includes at least one of a partial character string and a partial semantic information of the associated data.

[0071] For example, machine learning can be used to input the associated data into a pre-trained neural network for information compression processing to obtain summary information. Data mining technology can be used to extract key features of the associated data, such as using a decision tree algorithm to identify the features in the order data that are most relevant to SQL injection attacks, such as abnormal values ​​of order amounts. Alternatively, an encoder can be provided to compress the associated data into summary information with a limited number of strings. Alternatively, a compression mapping file containing specific features in the associated data and a compression expression language can be used to obtain second summary information.

[0072] For example, for user order data, the second summary information may include a hash value of the user ID, an enumeration type of the order status, and a range of order dates.

[0073] In operation S330, the second summary information is input into the large language model, for example, the first summary information and the second summary information are simultaneously input into the large language model.

[0074] It is understandable that the same SQL statement may bring different risks to different businesses. The large language model is used to analyze the compressed associated data to assist in the detection of SQL injection attacks. For example, the large language model can analyze the summary of the SQL statement and the abnormal value of the order amount in the summary of the associated data to determine whether there are signs of SQL injection attacks.

[0075] According to the embodiments of the present disclosure, richer information can be provided by analyzing the associated data, and inputting the second summary information into the large language model can reduce the consumption of computing resources and improve the accuracy of attack detection.

[0076] In some embodiments, the associated data includes financial service data, for example, financial service features in the financial service data may be extracted, and the financial service features are subjected to information compression processing to obtain second summary information.

[0077] Financial business data includes data related to financial services, including but not limited to account information, transaction records, loan details, etc. For example, the deposit balance of a bank account, the transaction history of a credit card, the repayment plan of a loan, etc. Financial business features include features that can represent the core attributes of financial business data, such as transaction amount, transaction time, account type, etc. For example, for a credit card transaction, financial business features may include transaction amount, merchant category, transaction location, etc.

[0078] Convert the extracted financial business features into a more concise form to reduce the computational cost of large language models. For example, use time series analysis to encode transaction timestamps and extract the periodic features of transactions.

[0079] It can be understood that in the fine-tuning training stage, based on the use of SQL injection attack samples and normal access request samples, the financial business data involved in each SQL injection attack sample and each normal access request sample can also be obtained, and the financial business features can be compressed to obtain the second summary information for fine-tuning training of the large language model.

[0080] According to the embodiments of the present disclosure, it is possible to more accurately identify SQL injection attacks in financial scenarios by combining financial business scenarios and analyzing financial business characteristics, thereby improving the accuracy of attack detection.

[0081] First, a search statement is constructed based on the SQL statement and the financial business data; then, the financial business features are retrieved from a pre-constructed knowledge base based on the search statement, wherein the knowledge base includes a mapping relationship between SQL injection attack samples, financial business data, and financial business features.

[0082] Financial business data may include account balance tables. The SQL statement is shown in the following example:

[0083] UPDATE Accounts

[0084] SET Balance = Balance + :amount

[0085] WHERE AccountID = :accountID AND Status = 'Active';

[0086] The "Accounts" table is used to store account information, the "Balance" field records the balance of each account, and "amount" is a specific parameter that represents the amount to be added to the account balance. "AccountID" is the unique identifier of the account, which is used to distinguish different accounts, and "accountID" is the specific account ID parameter specified in actual operations. The "Status" field is used to check whether the account is active to ensure that only active accounts can perform operations such as balance changes.

[0087] The search statement includes one or more search keywords extracted from the SQL statement and the financial business data. The knowledge base may include a table that maps the relationship between different SQL attack samples, financial business data and specific financial business features.

[0088] For example, a bank's database management system receives various SQL statements in real time for querying and operating financial business data. These SQL statements and the financial business data involved can be analyzed, and keywords such as "balance" and "transfer" can be extracted, and then a search statement can be constructed. The search statement is then used to retrieve financial business features related to these keywords from the knowledge base, such as "high balance accounts" and "large transfers".

[0089] According to the embodiments of the present disclosure, the retrieval enhancement generation technology is applied to SQL injection attack detection using a large language model through a pre-built knowledge base. The financial business features retrieved from the knowledge base are obtained, and the retrieval enhancement generation technology can help the large language model understand the context and intent more accurately, reduce false positives and false negatives, and reduce economic losses caused by data leakage or illegal transactions.

[0090] In some embodiments, a honeypot system can be used to simulate a database environment and obtain SQL statements sent to the simulated database environment. For example, a honeypot system may simulate a bank's transaction database to attract SQL injection attacks. For example, the simulated database environment can respond to SQL commands such as SELECT and INSERT, but its data and operation results will not affect the production environment.

[0091] For example, by combining honeypot technology and large language models, the detection rate of SQL injection attacks can be improved by setting up a bait system. The honeypot system simulates the real database environment to attract attackers to attack, while the large language model analyzes these attack behaviors to improve the accuracy of detection.

[0092] The attack information captured by the honeypot system is provided to the large language model, which is used to identify the key semantics in the attack behavior, etc., in this way to collect new SQL injection attack samples. When the attack model identified by the large model is different from the existing attack model, the SQL attack behavior feature library can be updated according to the semantic features of the newly identified SQL statement.

[0093] According to the embodiments of the present disclosure, by simulating the database environment to capture attacks, defense measures can be tested and strengthened without affecting the production environment. For example, when no attack behavior is detected, it can be forwarded to the production environment.

[0094] Figure 4 The flowchart of a structured query language injection attack detection method according to another embodiment of the present disclosure is schematically shown.

[0095] For example, the amount of computing resources occupied by an SQL statement is usually related to its complexity. A complex SQL statement usually involves multiple tables, multiple join operations, subqueries, and complex WHERE conditions, etc., which correspondingly involve more associated data. Therefore, the amount of data of the first summary information and the second summary information also increases accordingly. For a large language model, processing this complex information requires more reasoning steps, which leads to increased resource consumption.

[0096] like Figure 4 As shown, this embodiment includes operations S210 to S230, and before obtaining the attack detection result of the SQL statement, further includes:

[0097] In operation S410, the amount of computing resources occupied by executing the SQL statement is predicted.

[0098] Computing resources include the total amount of resources required to execute SQL statements, including CPU, memory, storage, and network resources. The amount of resources consumed by CPU, memory, storage, and network resources can be predicted based on expert experience or machine learning models trained with SQL statement samples and computing resource labels. For example, the computing resources can be obtained by weight distribution, such as:

[0099] Computing resources = w CPU ×CPU resource amount + w 内存 × memory resource amount + w 存储 × Storage resources + w 网络 ×Network resources

[0100] Among them, w CPU, w 内存 ,w 存储 ,w 网络 They are the weights of CPU, memory, storage and network resources respectively.

[0101] In operation S420, the standard computing resource amount of the large language model is adjusted accordingly according to the computing resource amount, including: in response to the computing resource amount being less than or equal to the first threshold, adjusting the standard computing resource amount of the large language model to the first computing resource amount; or, in response to the computing resource amount being greater than or equal to the first threshold, adjusting the standard computing resource amount of the large language model to the second computing resource amount.

[0102] The standard amount of computing resources refers to the amount of computing resources that can be called by the large language model in theory, considering the performance of the application. The first amount of computing resources refers to the amount of computing resources allocated to the large language model when the amount of computing resources is less than or equal to the first threshold. For example, if the amount of computing resources required is expected to be low, a smaller computing resource package may be allocated, such as 1 CPU core and 2GB of memory; the second amount of computing resources refers to the amount of computing resources allocated to the large language model when the amount of computing resources is greater than or equal to the first threshold. For example, for computationally intensive tasks, more resources may need to be allocated, such as 4 CPU cores and 4GB of memory. When the amount of computing resources is between the first threshold and the second threshold, the standard amount of computing resources for the large language model remains unchanged.

[0103] According to the embodiments of the present disclosure, by dynamically adjusting the amount of computing resources that can be called by a large language model, it is possible to avoid waste of resources and improve the stability and accuracy of attack detection for different SQL statements.

[0104] Based on the above structured query language injection attack detection method, the present disclosure also provides a structured query language injection attack detection device. Figure 5 The device is described in detail.

[0105] Figure 5 The structural block diagram of the structured query language injection attack detection device according to an embodiment of the present disclosure is schematically shown.

[0106] like Figure 5 As shown, the structured query language injection attack detection device 500 of this embodiment includes an acquisition module 510 , a compression module 520 and a detection module 530 .

[0107] The acquisition module 510 is used to acquire the SQL statement to be detected.

[0108] The compression module 520 is used to perform information compression processing on the SQL statement to obtain the first summary information, wherein the information compression processing includes compressing at least one of the character string and semantic information of the processing object, and the first summary information includes at least one of the partial character string and partial semantic information of the SQL statement.

[0109] The detection module 530 is used to input the first summary information into a large language model that has been fine-tuned in advance with SQL injection attack samples to obtain an attack detection result of the SQL statement.

[0110] In some embodiments, the compression module 520 can also be used to obtain a compression mapping file, wherein the compression mapping file includes a mapping relationship between attack-related features extracted using SQL injection attack samples and a compression expression language, and the compression expression language enables a large language model to have less computational cost than SQL statements; based on the compression mapping file, the attack-related features in the SQL statement are converted into a compression expression language to obtain the first summary information.

[0111] In some embodiments, the structured query language injection attack detection device 500 may also include an associated data compression module, which is used to obtain associated data involved in executing SQL statements; compress the associated data to obtain second summary information, wherein the second summary information includes at least one of a partial string and partial semantic information of the associated data; and input the second summary information into the large language model.

[0112] In some embodiments, the associated data compression module may also be used to extract financial business features from the financial business data; and perform information compression processing on the financial business features to obtain second summary information.

[0113] In some embodiments, the structured query language injection attack detection device 500 may also include a retrieval enhancement generation module, which is used to construct a retrieval statement based on the SQL statement and the financial business data, wherein the retrieval statement includes one or more retrieval keywords extracted from the SQL statement and the financial business data; based on the retrieval statement, financial business features are retrieved from a pre-built knowledge base, wherein the knowledge base includes a mapping relationship between SQL injection attack samples, financial business data and financial business features.

[0114] In some embodiments, the acquisition module 510 may also be used to simulate a database environment using a honeypot system; and acquire SQL statements sent to the simulated database environment.

[0115] In some embodiments, the structured query language injection attack detection device 500 may also include a resource allocation module for predicting the amount of computing resources occupied by executing SQL statements; in response to the amount of computing resources being less than or equal to a first threshold, adjusting the standard amount of computing resources for the large language model to the first amount of computing resources; or, in response to the amount of computing resources being greater than or equal to the first threshold, adjusting the standard amount of computing resources for the large language model to the second amount of computing resources.

[0116] For the parts not mentioned in the device part, they can be understood with reference to the various embodiments of the above method. That is, the device part includes modules for executing the various steps of any one of the method embodiments described above. In addition, the implementation methods, technical problems solved, functions implemented, and technical effects achieved of each module / unit / subunit, etc. in the device part embodiment are respectively the same or similar to the implementation methods, technical problems solved, functions implemented, and technical effects achieved of each corresponding step in the method part embodiment, and will not be repeated here.

[0117] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 510, the compression module 520 and the detection module 530 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0118] According to an embodiment of the present disclosure, at least one of the acquisition module 510, the compression module 520 and the detection module 530 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the acquisition module 510, the compression module 520 and the detection module 530 may be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function may be executed.

[0119] Figure 6 A block diagram of an electronic device suitable for implementing a structured query language injection attack detection method according to an embodiment of the present disclosure is schematically shown.

[0120] like Figure 6As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0121] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0122] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0123] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0124] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0125] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0126] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0127] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0128] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0129] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0130] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0131] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0132] The embodiments of the present disclosure are described above. However, these embodiments are only for the purpose of illustration and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may also make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A structured query language injection attack detection method, comprising: Get the SQL statement to be tested; Performing information compression processing on the SQL statement to obtain first summary information, wherein the information compression processing includes compressing at least one of a character string and semantic information of a processing object, and the first summary information includes at least one of a partial character string and a partial semantic information of the SQL statement; The first summary information is input into a large language model that has been fine-tuned in advance with SQL injection attack samples to obtain an attack detection result of the SQL statement.

2. The method according to claim 1, characterized in that: The SQL statement is subjected to information compression processing to obtain the first summary information, which includes: Acquire a compressed mapping file, wherein the compressed mapping file includes a mapping relationship between attack-related features extracted using the SQL injection attack sample and a compressed expression language, and the compressed expression language enables the large language model to have less computational cost than the SQL statement; Based on the compression mapping file, the attack correlation features in the SQL statement are converted into a compression expression language to obtain the first summary information.

3. The method according to claim 1, characterized in that Before obtaining the attack detection result of the SQL statement, the method further includes: Obtaining associated data involved in executing the SQL statement; Performing information compression processing on the associated data to obtain second summary information, wherein the second summary information includes at least one of a partial character string and a partial semantic information of the associated data; The second summary information is input into the large language model.

4. The method according to claim 3, characterized in that The associated data includes financial business data, and the information compression processing of the associated data to obtain the second summary information includes: Extracting financial business features from the financial business data; The financial service feature is subjected to information compression processing to obtain the second summary information.

5. The method according to claim 4, characterized in that The extracting financial service features from the financial service data comprises: Constructing a search statement based on the SQL statement and the financial business data, wherein the search statement includes one or more search keywords extracted from the SQL statement and the financial business data; The financial service feature is retrieved from a pre-built knowledge base based on the search statement, wherein the knowledge base includes a mapping relationship between the SQL injection attack sample, the financial service data, and the financial service feature.

6. The method according to any one of claims 1 to 5, characterized in that The obtaining of the SQL statement to be detected includes: Use the honeypot system to simulate the database environment; The SQL statement sent to the simulated database environment is obtained.

7. The method according to any one of claims 1 to 5, characterized in that Before obtaining the attack detection result of the SQL statement, the method further includes: Predicting the amount of computing resources occupied by executing the SQL statement; In response to the computing resource amount being less than or equal to a first threshold, adjusting the standard computing resource amount of the large language model to the first computing resource amount; or, in response to the computing resource amount being greater than or equal to the first threshold, adjusting the standard computing resource amount of the large language model to the second computing resource amount.

8. A structured query language injection attack detection device, comprising: An acquisition module is used to acquire the SQL statement to be detected; a compression module, configured to perform information compression processing on the SQL statement to obtain first summary information, wherein the information compression processing includes compressing at least one of a character string and semantic information of a processing object, and the first summary information includes at least one of a partial character string and a partial semantic information of the SQL statement; The detection module is used to input the first summary information into a large language model that has been fine-tuned with SQL injection attack samples in advance to obtain an attack detection result of the SQL statement.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images