SQL injection attack protection method and device based on zero-trust framework

Abstract

The embodiment of the invention provides an SQL injection attack protection method and device based on a zero-trust framework, and the method comprises the steps: tracking a current operation behavior of operation data in a zero-trust network, and determining whether the current operation behavior belongs to a to-be-verified behavior in the zero-trust network; if yes, calling a pre-trained linear support vector classifier (LSVC) model to detect the current operation behavior; if the detection result is the SQL injection attack, refusing the current operation behavior; wherein the pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set comprises data of a plurality of malicious SQL injection attacks and normal data. The method provided by the embodiment of the invention solves the problems that the user experience is reduced and the management cost of an administrator is increased due to limitation of user input in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a SQL injection attack protection method based on a zero trust framework, a SQL injection attack protection device based on a zero trust framework, and an electronic device. Background Art

[0002] SQL injection attack is a common network attack method. It takes advantage of the improper processing of user input data by the application and embeds malicious SQL query statements into the application, thereby obtaining or tampering with sensitive data, such as account passwords, etc., which seriously threatens the user's data security. Traditional SQL injection attacks are usually carried out through user input, such as injection attacks when entering usernames and passwords, and SQL injection attacks based on URL parameters.

[0003] To prevent traditional SQL injection attacks, some traditional protection methods can be adopted. Among them, the use of parameterized queries is a common method. This method uses precompiled SQL statements and placeholders to replace the data directly entered by the user. By no longer directly splicing parameters into SQL statements, malicious users can be prevented from injecting malicious code into SQL statements. However, this method requires modifying existing SQL statements and ensuring that the program can pass parameters correctly, which increases the complexity of development and maintenance. Another effective protection method is to filter user input. You can use special character sets or regular expressions to limit user input and only allow legal characters such as numbers, letters, and some punctuation marks to be entered. You can also use input validation technology to ensure that the content entered by the user complies with the specified format and length and does not contain special characters. However, filtering user input may result in certain functional restrictions, and restricting users from entering special characters or formats may reduce user experience.

[0004] In addition, escaping user input is also a common method to prevent SQL injection attacks. You can use the functions provided by the programming language to escape the input string, automatically escaping the input string to prevent SQL injection attacks. However, although escaping input is a common defense measure, there may still be loopholes if the escaping is incomplete or incorrect. Hackers may find loopholes in the escape mechanism and try to bypass the defense measures. The principle of least privilege refers to limiting the permissions of database users to the minimum scope, allowing them to access only the necessary database tables and fields. Doing so can reduce the chances of malicious users using SQL injection attacks to obtain sensitive information. However, limiting database user permissions to the minimum scope requires careful management and configuration, otherwise it may cause the application to fail to operate normally or be unable to access the required data, increasing the management pressure of the administrator. Summary of the invention

[0005] The embodiment of the present invention provides a SQL injection attack protection method and device based on a zero-trust framework to solve the problem in the prior art that limiting user input reduces user experience and increases administrator management costs.

[0006] The embodiment of the present invention discloses a SQL injection attack protection method based on a zero-trust framework, including:

[0007] Tracking current operation behavior of operation data in the zero trust network, and determining whether the current operation behavior belongs to the behavior to be verified in the zero trust network;

[0008] If it is, the pre-trained linear support vector classifier LSVC model is called to detect the current operation behavior;

[0009] If the detection result is a SQL injection attack, the current operation behavior will be rejected;

[0010] The pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set includes: data of multiple malicious SQL injection attacks and normal data.

[0011] Optionally, the method further comprises:

[0012] The zero-trust network divides the codes of the operation data into a trusted domain, an untrusted domain, and an independent shared domain, and the trusted domain, the untrusted domain, and the independent shared domain are all pre-configured with respective processing strategies;

[0013] The zero-trust network tracks the original domain to which the data corresponding to the operation behavior belongs, and verifies the current operation behavior based on the access policy of the original domain of the data.

[0014] Optionally, the method further comprises:

[0015] Obtain a training data set, wherein the training data set includes: normal data and data of multiple different malicious SQL injection attacks;

[0016] Extract features from each data in the training data set according to the specified extraction strategy to obtain a feature vector;

[0017] Inputting the feature vector into the LSVC model to train the LSVC model;

[0018] The test set is used to verify the trained LSVC model to obtain the trained LSVC model.

[0019] Optionally, inputting the feature vector into an LSVC model to train the LSVC model comprises:

[0020] Select the Gaussian kernel function for calculation and map the input feature vector into a high-dimensional space;

[0021]

[0022] And, use the gradient descent method to iterate, update the LSVC model parameters in the opposite direction of the loss function gradient by iteration, minimize the loss function, and in each iteration, update the parameters according to the direction of the gradient and the learning rate until the convergence condition is reached;

[0023] Among them, k is the kernel function value between two sample points, gamma represents the parameter that controls the width of the kernel function, and x and y represent different sample points.

[0024] Optionally, it also includes:

[0025] The loss is calculated using the squared hinge loss function to measure the error rate of the LSVC model;

[0026] L(m,f(x))=max(0,1-m*f(x)) 2

[0027] Where m represents the true category label of the sample, f(x) represents the predicted value of the LSVC model for the input sample point x, and L(m,f(x)) represents the loss value;

[0028] Use accuracy, precision, recall, and F1 indicators to measure the trained LSVC model;

[0029]

[0030] Among them, TP is a true positive example where the prediction is correct and the actual situation is also correct, TN is a true negative example where the prediction is wrong and the actual situation is also wrong, FP is a false positive example where the prediction is wrong but the actual situation is correct, and FN is a false negative example where the prediction is correct but the actual situation is wrong.

[0031] Optionally, the training data set includes URL data in an OWASP data set;

[0032] Extract features from each data in the training data set according to the specified extraction strategy, including one or more of the following features:

[0033] If the number of spaces is greater than 1, f1 is set to 1. If it contains OR and the character ', f2 is set to 1.

[0034] If it contains OR and the character ', f4 is set to 1. If it contains ) after ', f5 is set to 1.

[0035] If it contains ',), / ,*,&, f6 is set to 1; if it contains / ,*,&, f7 is set to 1.

[0036] If it contains / , *, &, f7 is set to 1. If there is a number after the And item in the query statement, f8 is set to 1.

[0037] If the query statement contains insert after;, f9 is set to 1. If the query statement contains Version, f 10 Set to 1,

[0038] If the query statement contains Limit, f 11 Set to 1, if the query statement contains Ascii, f 12 Set to 1,

[0039] If the query statement contains Substring, f 13 Set to 1. If the query statement contains / *, f 14 Set to 1,

[0040] If the query statement contains * / , f 15 Set to 1, if select is followed by a number, f 16 Set to 1,

[0041] If the query statement contains %, f 17 Set to 1. If the CONCAT function is used in the query statement, f 18 Set to 1,

[0042] If the Load File function is used in the query statement, f 19 Set to 1 if there is a number before the x character, f 20 Set to 1,

[0043] If the Union function is used in the query statement, f 21 Set to 1, if the query after cancellation is used –, f 22 Set to 1.

[0044] The embodiment of the present invention also discloses a method for training a SQL injection attack protection model, comprising:

[0045] Obtain a training data set, wherein the training data set includes: normal data and data of multiple different malicious SQL injection attacks;

[0046] Extracting features from each data in the training data set according to a specified extraction strategy to obtain a feature vector; the feature vector is an identifying feature determined according to the codes of multiple malicious SQL injection attacks;

[0047] Inputting the feature vector into the LSVC model to train the LSVC model;

[0048] The test set is used to verify the trained LSVC model to obtain the trained LSVC model.

[0049] The embodiment of the present invention also discloses a SQL injection attack protection device based on a zero-trust network, comprising:

[0050] A tracking module, used to track the current operation behavior of the operation data in the zero trust network, and determine whether the current operation behavior belongs to the behavior to be verified in the zero trust network;

[0051] The detection module is used to call the pre-trained linear support vector classifier LSVC model to detect the current operation behavior when the tracking module determines that the tracked object belongs to the behavior to be verified;

[0052] The processing module is used to reject the current operation behavior when the detection result is a SQL injection attack;

[0053] The pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set includes: data of multiple malicious SQL injection attacks and normal data.

[0054] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0055] The memory is used to store computer programs;

[0056] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0057] The embodiment of the present invention further discloses one or more computer-readable media on which instructions are stored. When executed by one or more processors, the processors are enabled to execute the method described in the embodiment of the present invention.

[0058] The embodiments of the present invention include the following advantages:

[0059] The SQL injection attack protection method based on a zero-trust network in an embodiment of the present invention calls a pre-trained linear support vector classifier LSVC model to detect the current operation behavior when the current operation behavior of the operation data in the zero-trust network is a behavior that needs to be verified; thus, compared with other methods, it has a higher recognition rate and a lower system load.

[0060] In the embodiment of the present invention, the trained LSVC model is used to perform SQL injection attacks, which improves the accuracy of SQL injection attack detection and has strong robustness and generalization ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a step flow chart of a SQL injection attack protection method based on a zero trust framework provided in an embodiment of the present invention;

[0062] Figure 2 It is a step flow chart of a SQL injection attack protection method based on a zero trust framework provided in an embodiment of the present invention;

[0063] Figure 3 is a schematic diagram of tracing data access behavior provided in an embodiment of the present invention;

[0064] Figure 4 It is a schematic diagram of a SQL injection attack protection method based on a zero trust framework provided in an embodiment of the present invention;

[0065] Figure 5 It is a structural block diagram of a SQL injection attack protection device based on a zero trust framework provided in an embodiment of the present invention;

[0066] Figure 6 is a block diagram of an electronic device provided in an embodiment of the present invention;

[0067] Figure 7 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0068] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0069] In today's digital society, hackers have more and more means of attack, including but not limited to cross-site scripting attacks, DDoS attacks, SQL injection attacks, viruses, worms and Trojans. These attack methods can pose a great threat to the information security of individuals, organizations and countries. According to national network data, the number of visits received by the network environment every day has reached tens of billions, which further highlights the importance of network security. Traditional SQL injection attack prevention methods have their own shortcomings. For example, the use of parameterized queries will increase the complexity of development and maintenance, filtering user input may lead to certain functions being restricted, and restricting users from entering special characters or formats may reduce user experience. If the user input is escaped incompletely or incorrectly, there may still be vulnerabilities that can be exploited by hackers. The principle of least privilege increases the management pressure of administrators, etc. That is, the current network scale is getting larger and larger, and the functions are becoming more and more complex. The existing methods of protecting against SQL injection attacks cause unnecessary troubles to developers, maintenance personnel and network users.

[0070] The embodiment of the present invention provides a SQL injection attack protection method based on a zero-trust framework, which uses a zero-trust network framework to prevent SQL injection attacks, that is, by isolating the protected surface to intercept the penetration of the attack surface, thereby ensuring the access of the developer code to the data. The SQL statements in the code are feature extracted, and the linear support vector classifier (LSVC) model is used to authorize the access and modification of the data, which reduces the restrictions on developers and the work pressure of administrators, and has a higher recognition rate and lower system load than other methods.

[0071] In the embodiment of the present invention, a zero-trust network framework is used to prevent SQL injection attacks, and access to sensitive information is continuously verified to ensure the data security of enterprises and users. The core concept of zero trust is "never trust, always verify", which breaks the control risk of static policy authorization. As an important part of zero trust, MS not only ensures the authorization of access to protected resources, but also prevents the attacker from lateral penetration to continue to attack the remaining components. At the same time, zero trust takes continuous trust evaluation and dynamic authorization as the basic means, and dynamically adjusts the authorization policy by continuously monitoring and evaluating the operations of data and applications that are designed to be unprotected, adding a gray area to the traditional black and white list access model, thereby improving the security of sensitive data and ensuring the security of resources used by users. The present invention uses Linear Support Vector Classification (LSVC) to provide a solution for zero-trust micro-segmentation to resist SQL injection attacks.

[0072] Reference Figure 1 , shows a flowchart of a method for protecting against SQL injection attacks based on a zero-trust framework provided in an embodiment of the present invention, which may specifically include the following steps:

[0073] 101. Tracking current operation behavior of operation data in the zero trust network, and determining whether the current operation behavior belongs to the behavior to be verified in the zero trust network;

[0074] 102. If yes, then call the pre-trained linear support vector classifier LSVC model to detect the current operation behavior;

[0075] 103. If the detection result is a SQL injection attack, the current operation behavior will be rejected;

[0076] The pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set includes: data of multiple malicious SQL injection attacks and normal data.

[0077] The zero-trust network in this embodiment divides the code of the operation data into a trusted domain, an untrusted domain, and an independent shared domain, and each of the trusted domain, the untrusted domain, and the independent shared domain is pre-configured with its own processing strategy;

[0078] The zero-trust network tracks the original domain to which the data corresponding to the operation behavior belongs, and verifies the current operation behavior based on the access policy of the original domain of the data.

[0079] In this embodiment, the zero trust concept is used to refine MS (Micro-segmentation), divide the attack surface and the protected surface, divide the code into a trusted domain, an untrusted domain, and an independent shared domain, and use different methods to process the code in the trusted domain and the untrusted domain. When a data accessor in the untrusted domain accesses the information in the trusted domain, verification will be performed. If a SQL injection attack is detected, the access to the data in the trusted domain will be denied. If it is not a SQL injection attack, subsequent operations will be continuously verified. Compared with other methods, it has a higher recognition rate and a lower system load.

[0080] In a zero-trust network, micro-segmentation (MS) is an important security strategy used to divide the network into smaller, more secure areas, thereby reducing the attack surface and improving security. By refining MS, you can more accurately divide the trusted domain, untrusted domain, and independent shared domain, and use different security policies to handle code and data access in these domains. The following is a specific implementation example that shows how to use the LSVC model to detect SQL injection attacks under the zero-trust concept.

[0081] Micro-segmentation (MS) division: The trusted domain contains core business logic and sensitive data (such as databases, internal APIs, etc.). The untrusted domain contains external interfaces and user input processing (such as Web front-end, user registration, login, etc.). The independent shared domain contains public resources and services, such as cache, logs, third-party services, etc. Code from both the trusted domain and the untrusted domain can access the independent shared domain. Data access control: Data accessors in the untrusted domain must be strictly verified when accessing data in the trusted domain. Continuous verification Even if the initial verification is passed, subsequent operations still require continuous monitoring and verification. This embodiment uses the trained LSVC model in a zero-trust network to detect SQL injection attacks, with a high recognition rate and low system load.

[0082] In this embodiment, the zero-trust framework is used to prevent SQL injection attacks. The entire system is first divided. In this embodiment, the entry point for SQL injection attacks is defined as the attack surface, and sensitive data is the protected surface. The code is divided into a trusted domain, an untrusted domain, and an independent shared domain. The code in the trusted domain is trusted and has authorization for all sensitive resources. The code in the untrusted domain is untrusted, and its use of sensitive data requires authorization from the zero-trust network. Both the untrusted domain and the trusted domain in the independent shared domain can be used.

[0083] Reference Figure 2 , shows a flowchart of a method for protecting against SQL injection attacks based on a zero-trust framework provided in an embodiment of the present invention, which may specifically include the following steps:

[0084] 201. Obtain a training data set, where the training data set includes normal data and data of multiple different malicious SQL injection attacks.

[0085] For example, the training data set selected in this embodiment includes: URL data in the OWASP data set.

[0086] In this embodiment, the OWASP data set is taken as an example, mainly based on URL data. The URL carried by the SQL injection attack has characteristics different from those of the regular URL. It not only contains SQL-related keywords but also is more complex than ordinary parameters.

[0087] In practical applications, the training data set can be preprocessed, and the preprocessed data set can improve the performance of the subsequent training model to eliminate errors as much as possible. In this embodiment, after preprocessing the training data set, 10% is randomly selected as the test set described below, and the remaining data is used as the training set to train the model.

[0088] 202. Extract features from each data in the training set according to a specified extraction strategy to obtain a feature vector.

[0089] In this embodiment, features are extracted from each data in the training set according to a specified extraction strategy, including one or more features in Table 1. In this embodiment, only 22 features are used as examples, but the features are not limited to 22 features, and can be selected and configured according to actual needs.

[0090] That is, the URL string was feature extracted based on the characteristics of different malicious SQL statements, and 22 different features were extracted from the URL string to determine whether it is a SQL injection attack, and then these features were converted into feature vectors. Table 1 shows the standards for extracting the 22 features, and the processed feature data is used to determine whether the SQL statement is a SQL injection attack.

[0091] 203. Input the feature vector into the LSVC model to train the LSVC model.

[0092] In this embodiment, LSVC is used to detect SQL injection attacks. After training with ordinary SQL statements and SQL statements of SQL injection attacks, SQL injection attacks existing in the network can be detected. LSVC is developed based on the support vector machine (SVM) algorithm and is a commonly used classification method. It performs well when processing high-dimensional data and large-scale data. It has good robustness due to its principle of interval maximization.

[0093] For example, in this embodiment, a Gaussian kernel function is selected for calculation to map the input feature vector into a high-dimensional space;

[0094]

[0095] And, use the gradient descent method to iterate, update the LSVC model parameters by iteratively along the opposite direction of the loss function gradient, minimize the loss function, and in each iteration, update the parameters according to the direction of the gradient and the learning rate until the convergence condition is reached; obtain the trained LSVC model.

[0096] Among them, k is the kernel function value between two sample points, gamma represents the parameter that controls the width of the kernel function, and x and y represent different sample points.

[0097] 204. The trained LSVC model is verified by using the test set to obtain the trained LSVC model.

[0098] In this embodiment, in step 203, the loss is calculated using the square hinge loss function to measure the error rate of the LSVC model;

[0099] L(m,f(x))=max(0,1-m*f(x)) 2

[0100] Where m represents the true category label of the sample, f(x) represents the predicted value of the LSVC model for the input sample point x, and L(m,f(x)) represents the loss value;

[0101] In step 204, the present embodiment uses the accuracy, precision, recall, and F1 indicators to measure the trained LSVC model;

[0102]

[0103] Among them, TP is a true positive example that is predicted to be correct and the actual situation is also correct, TN is a true negative example that is predicted to be wrong and the actual situation is also wrong, FP is a false positive example that is predicted to be wrong but the actual situation is correct, and FN is a false negative example that is predicted to be correct but the actual situation is wrong.

[0104] Table 1

[0105]

[0106]

[0107] Table 2: Pseudocode for training LSVC.

[0108]

[0109]

[0110] Generally, the core of the linear support vector classification algorithm is to solve a convex optimization problem to find the optimal hyperplane. An optimization algorithm is required for calculation. In this embodiment, the gradient descent method is used for iteration. The model parameters are updated iteratively in the opposite direction of the gradient of the loss function to minimize the loss function. In each iteration, the parameters are updated according to the direction of the gradient and the learning rate until the convergence condition is reached. The trained LSVC model can be used to detect SQL injection attacks in a zero-trust framework, that is, execute the following steps 205 to 207. The pre-trained linear support vector classifier performs well in high-dimensional space, has strong generalization ability, and has strong robustness, which improves the accuracy of SQL injection attack detection and does not require a large amount of system resources for detection.

[0111] 205. Tracking the current operation behavior of the operation data in the zero trust network, and determining whether the current operation behavior belongs to the behavior to be verified in the zero trust network;

[0112] 206. If yes, then call the pre-trained linear support vector classifier LSVC model to detect the current operation behavior;

[0113] 207. If the detection result is a SQL injection attack, the current operation behavior will be rejected.

[0114] In this embodiment, if Figure 3 As shown in the figure, the code that needs to obtain sensitive data is called the untrusted domain, and the secure code is called the trusted domain. The code in the trusted domain does not need authorization to use sensitive data, while the process of obtaining or updating sensitive data in the untrusted domain requires authorization from the zero-trust network. In order to ensure the sharing of isolated domains, such as Figure 4As shown in the figure, functions and non-sensitive data in the trust domain can be exposed to other domains (including trust domains and untrust domains) for program use. The zero-trust network will track the original domain of the user accessing the data and execute different policies based on different original domain levels. Figure 1 As shown in the figure, the zero-trust network authorizes the caller's isolated domain to access sensitive data. When the data accessor in the untrusted domain accesses the information in the trusted domain, verification will be performed. If it is detected as a SQL injection attack, the access to the data in the trusted domain will be denied. If it is not a SQL injection attack, the subsequent operations will be continuously verified. The independent shared domain, the code of the trusted domain and the untrusted domain can access it.

[0115] In this embodiment, the code containing SQL statements for data extraction or modification is processed, and the code in the trusted domain is allowed to obtain or update the data in the trusted domain. For the code in the untrusted domain that applies for SQL statements that use sensitive data, the SQL statements are first extracted and then the feature vectors are extracted. The extracted feature vectors are input into the pre-trained model to determine whether the operation is a SQL injection attack. If the LSVC model determines that it is a SQL injection attack, access to sensitive data is denied. If it is determined not to be a SQL injection attack, it is temporarily allowed to read or modify sensitive data in the trusted domain. However, the next time the same access action needs to be re-verified, the security of sensitive data is improved. This is also in line with the zero-trust concept of "continuous verification, never trust", reducing restrictions on developers and reducing the work pressure of administrators.

[0116] In this embodiment, a linear support vector classifier is used to detect SQL injection attacks, and then a zero-trust network is used to continuously verify a certain section of code that accesses sensitive data to prevent SQL injection attacks.

[0117] Combination Figure 3 and Figure 4 To explain, in a zero-trust network, using the LSVC (Linear Support Vector Classification) model to detect SQL injection attacks is an effective security measure. The core principle of a zero-trust network is "never trust, always verify", which means that all access requests inside and outside the network must be strictly verified and authorized. The LSVC model can identify potential SQL injection attacks by analyzing network traffic and user behavior.

[0118] Suppose there is an enterprise-level web application that receives user requests through a web server and interacts with the backend database. Micro-segmentation and LSVC models will be used to detect SQL injection attacks to ensure that data accessors in untrusted domains are strictly verified when accessing sensitive data in trusted domains. That is, data access control: Data accessors in trusted domains: must be strictly verified when accessing data in trusted domains. Continuous verification: Even if the initial verification passes, subsequent operations still need to be continuously monitored and verified. The integration of LSVC models in zero-trust networks to detect SQL injection attacks has a high recognition rate and low system load.

[0119] In addition, this embodiment also provides a method for training a SQL injection attack protection model, which includes the following steps:

[0120] S01. Obtain a training data set, wherein the training data set includes: normal data and data of multiple different malicious SQL injection attacks;

[0121] S02. Extract features from each data in the training data set according to a specified extraction strategy to obtain a feature vector; the feature vector is an identifying feature determined according to the codes of multiple malicious SQL injection attacks.

[0122] S03, inputting the feature vector into the LSVC model to train the LSVC model; and using a test set to verify the trained LSVC model to obtain the trained LSVC model.

[0123] The pre-trained LSVC model performs well in high-dimensional space, has strong generalization ability, and has strong robustness, which improves the accuracy of SQL injection attack detection and does not require a large amount of resources for detection. In this embodiment, feature extraction is performed on the SQL statements in the code, and the trained LSVC model is used to detect SQL injection attacks.

[0124] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0125] Reference Figure 5 , shows a structural block diagram of an XX device provided in an embodiment of the present invention, which may specifically include the following modules:

[0126] A tracking module, used to track the current operation behavior of the operation data in the zero trust network, and determine whether the current operation behavior belongs to the behavior to be verified in the zero trust network;

[0127] The detection module is used to call the pre-trained linear support vector classifier LSVC model to detect the current operation behavior when the tracking module determines that the tracked object belongs to the behavior to be verified;

[0128] The processing module is used to reject the current operation behavior when the detection result is a SQL injection attack;

[0129] The pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set includes: data of multiple malicious SQL injection attacks and normal data.

[0130] In this embodiment, the trained LSVC model is used to perform SQL injection attacks, which improves the accuracy of SQL injection attack detection and has strong robustness and generalization ability.

[0131] In this embodiment, the zero trust concept is used to refine MS (Micro-segmentation), divide the attack surface and the protected surface, divide the code into a trusted domain, an untrusted domain, and an independent shared domain, and use different methods to process the code in the trusted domain and the untrusted domain. When a data accessor in the untrusted domain accesses the information in the trusted domain, verification will be performed. If a SQL injection attack is detected, the access to the data in the trusted domain will be denied. If it is not a SQL injection attack, subsequent operations will be continuously verified. Compared with other methods, it has a higher recognition rate and a lower system load.

[0132] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0133] In addition, an embodiment of the present invention further provides an electronic device, such as Figure 6 As shown, it includes a processor 1301, a communication interface 1302, a memory 1303 and a communication bus 1304, wherein the processor 1301, the communication interface 1302, and the memory 1303 communicate with each other through the communication bus 1304.

[0134] Memory 1303, used for storing computer programs;

[0135] The processor 1301 is used to implement the following steps when executing the program stored in the memory 1303:

[0136] Tracking current operation behavior of operation data in the zero trust network, and determining whether the current operation behavior belongs to the behavior to be verified in the zero trust network;

[0137] If it is, the pre-trained linear support vector classifier LSVC model is called to detect the current operation behavior;

[0138] If the detection result is a SQL injection attack, the current operation behavior will be rejected;

[0139] The pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set includes: data of multiple malicious SQL injection attacks and normal data.

[0140] The zero-trust network divides the codes for operating data into trusted domains, untrusted domains, and independent shared domains, and each of the trusted domains, untrusted domains, and independent shared domains is pre-configured with its own processing strategies;

[0141] The zero-trust network tracks the original domain to which the data corresponding to the operation behavior belongs, and verifies the current operation behavior based on the access policy of the original domain of the data.

[0142] Alternatively, the following steps are also included:

[0143] Obtain a training data set, wherein the training data set includes: normal data and data of multiple different malicious SQL injection attacks;

[0144] Extract features from each data in the training data set according to the specified extraction strategy to obtain a feature vector;

[0145] Inputting the feature vector into the LSVC model to train the LSVC model;

[0146] The test set is used to verify the trained LSVC model to obtain the trained LSVC model.

[0147] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0148] The communication interface is used for communication between the above terminal and other devices.

[0149] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0150] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0151] like Figure 7 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 1401 is also provided, in which instructions are stored. When the computer-readable storage medium 1401 is run on a computer, the computer executes a SQL injection attack protection method based on a zero trust framework described in the above embodiment.

[0152] In another embodiment provided by the present invention, a computer program product including instructions is also provided. When the computer is run on a computer, the computer executes a SQL injection attack protection method based on a zero trust framework described in the above embodiment.

[0153] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0154] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0155] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0156] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A SQL injection attack protection method based on zero-trust network, characterized in that: include: Tracking current operation behavior of operation data in the zero trust network, and determining whether the current operation behavior belongs to the behavior to be verified in the zero trust network; If it is, the pre-trained linear support vector classifier LSVC model is called to detect the current operation behavior; If the detection result is a SQL injection attack, the current operation behavior will be rejected; The pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set includes: data of multiple malicious SQL injection attacks and normal data.

2. The method according to claim 1, characterized in that The method further comprises: The zero-trust network divides the codes of the operation data into a trusted domain, an untrusted domain, and an independent shared domain, and the trusted domain, the untrusted domain, and the independent shared domain are all pre-configured with respective processing strategies; The zero-trust network tracks the original domain to which the data corresponding to the operation behavior belongs, and verifies the current operation behavior based on the access policy of the original domain of the data.

3. The method according to claim 1, characterized in that The method further comprises: Obtain a training data set, wherein the training data set includes: normal data and data of multiple different malicious SQL injection attacks; Extract features from each data in the training data set according to the specified extraction strategy to obtain a feature vector; Inputting the feature vector into the LSVC model to train the LSVC model; The test set is used to verify the trained LSVC model to obtain the trained LSVC model.

4. The method according to claim 1, characterized in that: Inputting the feature vector into the LSVC model to train the LSVC model includes: Select the Gaussian kernel function for calculation and map the input feature vector into a high-dimensional space; And, use the gradient descent method to iterate, update the LSVC model parameters in the opposite direction of the loss function gradient by iteration, minimize the loss function, and in each iteration, update the parameters according to the direction of the gradient and the learning rate until the convergence condition is reached; Among them, k is the kernel function value between two sample points, gamma represents the parameter that controls the width of the kernel function, and x and y represent different sample points.

5. The method according to claim 4, characterized in that Also includes: The loss is calculated using the squared hinge loss function to measure the error rate of the LSVC model; L(m,f(x))=max(0,1-m*f(x)) 2 Where m represents the true category label of the sample, f(x) represents the predicted value of the LSVC model for the input sample point x, and L(m,f(x)) represents the loss value; Use accuracy, precision, recall, and F1 indicators to measure the trained LSVC model; Among them, TP is a true positive example that is predicted to be correct and the actual situation is also correct, TN is a true negative example that is predicted to be wrong and the actual situation is also wrong, FP is a false positive example that is predicted to be wrong but the actual situation is correct, and FN is a false negative example that is predicted to be correct but the actual situation is wrong.

6. The method according to claim 4, characterized in that The training data set includes URL data in the OWASP data set; Extract features from each data in the training data set according to the specified extraction strategy, including one or more of the following features: If the number of spaces is greater than 1, f1 is set to 1. If it contains OR and the character ', f2 is set to 1. If it contains OR and the character ', f4 is set to 1. If it contains ) after ', f5 is set to 1. If it contains ',), / ,*,&, f6 is set to 1; if it contains / ,*,&, f7 is set to 1. If it contains / , *, &, f7 is set to 1. If there is a number after the And item in the query statement, f8 is set to 1. If the query statement contains insert after;, f9 is set to 1. If the query statement contains Version, f 10 Set to 1, If the query statement contains Limit, f 11 Set to 1, if the query statement contains Ascii, f 12 Set to 1, If the query statement contains Substring, f 13 Set to 1. If the query statement contains / *, f 14 Set to 1, If the query statement contains * / , f 15 Set to 1, if select is followed by a number, f 16 Set to 1, If the query statement contains %, f 17 Set to 1. If the CONCAT function is used in the query statement, f 18 Set to 1, If the Load File function is used in the query statement, f 19 Set to 1 if there is a number before the x character, f 20 Set to 1, If the Union function is used in the query statement, f 21 Set to 1, if the query after cancellation is used –, f 22 Set to 1.

7. A training method for a SQL injection attack protection model, characterized in that: include: Obtain a training data set, wherein the training data set includes: normal data and data of multiple different malicious SQL injection attacks; Extracting features from each data in the training data set according to a specified extraction strategy to obtain a feature vector; the feature vector is an identifying feature determined according to the codes of multiple malicious SQL injection attacks; Inputting the feature vector into the LSVC model to train the LSVC model; The test set is used to verify the trained LSVC model to obtain the trained LSVC model.

8. A SQL injection attack protection device based on zero-trust network, characterized in that: include: A tracking module, used to track the current operation behavior of the operation data in the zero trust network, and determine whether the current operation behavior belongs to the behavior to be verified in the zero trust network; The detection module is used to call the pre-trained linear support vector classifier LSVC model to detect the current operation behavior when the tracking module determines that the tracked object belongs to the behavior to be verified; The processing module is used to reject the current operation behavior when the detection result is a SQL injection attack; The pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set includes: data of multiple malicious SQL injection attacks and normal data.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1-7 or 13 when executing the program stored in the memory.

10. A computer-readable medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 7.

Images