SQL (Structured Query Language) injection attack detection method and device and processing equipment

Abstract

The invention provides an SQL (Structured Query Language) injection attack detection method and device and processing equipment, designs a novel double-layer feature matching architecture, constructs a rapid feature matching library of a first layer by using hyperscan, and continues to perform subsequent rapid feature matching based on a regular expression so as to improve the detection efficiency. And the rule matching tree in the second layer is not compiled by adopting fast features, so that the matching performance can be remarkably improved, whether the to-be-detected traffic message needs to be subjected to SQL injection attack response or not can be efficiently and accurately determined, and the high-quality network security work requirement is met.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a SQL injection attack detection method, device and processing equipment. Background Art

[0002] Structured Query Language (SQL) injection attack is a type of network attack involved in network security work. It means that the attacker inserts malicious SQL statements into the input box or other data input of the Web application, tricking the application into executing it as a legitimate SQL command, in order to illegally obtain sensitive information in the database, tamper with data, execute system commands and other malicious purposes to achieve network attacks.

[0003] As for the network security of enterprises / companies, corresponding attack detection strategies can be configured to capture corresponding features to determine whether there is SQL injection attack behavior in the traffic message, whether it is a SQL network attack, and respond to the attack in the first time.

[0004] The AC algorithm commonly used in the prior art is used to compile a fast feature matching tree for fast feature matching. The AC algorithm (Aho-Corasick algorithm) is a string search algorithm used to match substrings in a finite set of "dictionaries" in an input string. The difference from ordinary string matching is that it matches all dictionary strings at the same time. The algorithm has an amortized time complexity that is approximately linear, which is approximately the length of the string plus the number of all matches.

[0005] However, the inventors of the present application discovered that the AC algorithm only supports strings, and since all matching numbers need to be found, if each substring matches each other (such as the dictionary is a, aa, aaa, aaaa, and the input string is aaaa), the time complexity of the algorithm will be close to the quadratic function of the match. In other words, the fast feature matching tree constructed based on the AC algorithm has limitations in matching performance, which will affect the detection performance of SQL injection attacks. Summary of the invention

[0006] The present application provides a SQL injection attack detection method, apparatus and processing equipment, designs a novel two-layer feature matching architecture, uses hyperscan to build a fast feature matching library of the first layer, and continues to perform subsequent fast feature matching based on regular expressions, and does not use fast features to compile the rule matching tree in the second layer. This can significantly improve the matching performance, efficiently and accurately determine whether the traffic message to be detected needs to respond to the SQL injection attack, and meet the high-quality network security work requirements.

[0007] In a first aspect, the present application provides a method for detecting a SQL injection attack, the method comprising:

[0008] Obtaining a detection rule for an SQL injection attack, wherein the detection rule is a detection rule configured for a user behavior event determined to be an SQL injection attack;

[0009] Extract key features from the content of the detection rules as fast features, and then string them together with other members in a linked list form to obtain corresponding linked list data, and use hyperscan to compile the linked list data to obtain the corresponding fast feature matching database, in which the fast feature is the first member in the linked list data;

[0010] Compile the detection rules into corresponding rule matching trees;

[0011] Based on the fast feature matching database and the rule matching tree, configure the SQL injection attack detection configuration strategy. In the SQL injection attack detection strategy, the traffic message to be detected is processed by hyperscan based on the fast feature matching database for fast feature matching. If it hits, it continues to match with the rule matching tree. If it hits again, the traffic message to be detected will respond to the SQL injection attack.

[0012] In a second aspect, the present application provides a SQL injection attack detection device, the device comprising:

[0013] A rule acquisition unit, used to acquire a detection rule for an SQL injection attack, wherein the detection rule is a detection rule configured for a user behavior event determined to be an SQL injection attack;

[0014] The database compilation unit is used to extract key features from the rule content of the detection rule as fast features, and then string them together with other members in a linked list form to obtain corresponding linked list data, and use hyperscan to compile the linked list data to obtain a corresponding fast feature matching database, wherein the fast feature is the first member in the linked list data;

[0015] A matching tree compilation unit, used to compile the detection rules into corresponding rule matching trees;

[0016] The policy configuration unit is used to configure the SQL injection attack detection configuration policy based on the fast feature matching database and the rule matching tree. In the SQL injection attack detection policy, the traffic message to be detected is processed by hyperscan based on the fast feature matching database for fast feature matching. If it hits, it continues to match with the rule matching tree. If it hits again, the traffic message to be detected is responded to by SQL injection attack.

[0017] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0019] From the above content, it can be concluded that the present application has the following beneficial effects:

[0020] For network security, this application designs a novel two-layer feature matching architecture, which uses hyperscan to build a fast feature matching library for the first layer, and continues to perform subsequent fast feature matching based on regular expressions. The rule matching tree in the second layer is not compiled using fast features. This can significantly improve the matching performance, efficiently and accurately determine whether the traffic message to be detected needs to respond to SQL injection attacks, and meet the needs of high-quality network security work. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a SQL injection attack detection method for this application;

[0023] Figure 2 An example schematic diagram of the code involved in the container adding operation of this application;

[0024] Figure 3 A schematic diagram of an example of the code involved in compiling a fast feature matching library for this application;

[0025] Figure 4 A schematic diagram of an example of the code involved in compiling a rule matching tree for this application;

[0026] Figure 5 This is a schematic diagram of an example of a rule matching tree for this application;

[0027] Figure 6 This is a schematic diagram of an example of the flow message detection logic of this application;

[0028] Figure 7 This is an example schematic diagram of the codes involved in the fast feature matching process of this application;

[0029] Figure 8 An example schematic diagram of the code involved in inserting the query result into the queue for processing of this application;

[0030] Fig. 9 This is a schematic diagram of an example of the code involved in the rule matching tree matching process of this application;

[0031] Fig.10 A structural diagram of a SQL injection attack detection device of this application;

[0032] Fig.11 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0034] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0035] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0036] Before introducing the SQL injection attack detection method provided by this application, the background content involved in this application is first introduced.

[0037] The SQL injection attack detection method, device and computer-readable storage medium provided by the present application can be applied to processing equipment. A novel two-layer feature matching architecture is designed. Hyperscan is used to build a fast feature matching library of the first layer, and subsequent fast feature matching is continued based on regular expressions. The rule matching tree in the second layer is not compiled using fast features. This can significantly improve the matching performance, efficiently and accurately determine whether the traffic message to be detected needs to respond to an SQL injection attack, and meet the needs of high-quality network security work.

[0038] The SQL injection attack detection method mentioned in the present application can be executed by a SQL injection attack detection device, or a network security device, server, physical host or user equipment (UE) and other different types of processing devices integrated with the SQL injection attack detection device. The SQL injection attack detection device can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant (PDA), and the processing device can be set in a device cluster.

[0039] It can be understood that the processing device that executes the SQL injection attack detection method of the present application or is equipped with the application service corresponding to the SQL injection attack detection method of the present application is usually a device node responsible for network security in the internal network of an enterprise / company, typically such as firewalls, intrusion prevention systems and other types of network security devices, or the processing device can also be other types of network nodes (such as servers, physical hosts and even UE types of devices). Secondly, with the flexible and changeable application requirements in actual applications, the processing device can also be a third-party device outside the internal network of the enterprise, providing SQL injection attack detection services for the internal network of the enterprise in the form of third-party services. This is also possible in actual situations. Therefore, the present application does not make too many restrictions on the specific device form and device type of the processing device.

[0040] Next, we will introduce the SQL injection attack detection method provided by this application.

[0041] First, see Figure 1 , Figure 1 A flow chart of the SQL injection attack detection method of the present application is shown. The SQL injection attack detection method provided by the present application may specifically include the following steps S101 to S104:

[0042] Step S101, obtaining a detection rule for an SQL injection attack, wherein the detection rule is a detection rule configured for a user behavior event determined to be an SQL injection attack;

[0043] It can be understood that the preliminary configuration work corresponding to the automatic detection of SQL injection attacks may involve the acquisition of corresponding detection rules, so as to process them into SQL injection attack detection strategies / rules that can be automatically executed by the device through corresponding data processing.

[0044] For this detection rule, specifically, it is a detection rule configured for a user behavior event determined to be an SQL injection attack. At this time, the rule is not directly used or run. Its main purpose is to describe the traffic message characteristics of user behavior events that have the nature of an SQL injection attack and belong to an SQL injection attack. Among them, the user behavior events involved are usually real user behavior events. Of course, in some cases, they can also be simulated user behavior events that are modified on the basis of real user behavior events or directly obtained through scenario simulation, so as to further meet more diverse business processing needs.

[0045] In specific operations, the acquisition and processing of detection rules here can be manual input, reception from other devices, or local reading. At the same time, in addition to the acquisition of ready-made data, real-time configuration data can also be obtained, which are all possible in actual situations.

[0046] In addition, for the present application solution, in actual application, the solution processing is usually initiated in the form of a task, that is, it may involve SQL injection attack detection strategy configuration tasks, and the method of obtaining specific tasks is the same as the above-mentioned acquisition process of detection rules.

[0047] When there is a task, the corresponding detection rules can be obtained under the guidance of the task information.

[0048] Furthermore, in order to promote a more adaptive automated SQL injection attack detection effect, the detection rules obtained here can also be configured according to the specific devices and their specific application scenarios (both are preset) that are subsequently equipped with the SQL injection attack detection configuration strategy configured by this application to perform the corresponding SQL injection attack detection processing. In other words, the detection rules obtained here are customized for the subsequent processing equipment, rather than adopting the general detection rules commonly understood. At the same time, this setting also corresponds to the situation where the devices that configure the SQL injection attack detection configuration strategy and the devices that use the SQL injection attack detection configuration strategy may be different in actual situations.

[0049] At the same time, when considering the specific devices and their specific application scenarios for the subsequent SQL injection attack detection and processing, we can also consider the previously predetermined specific devices and their specific application scenarios, and the changes in conditions that may be faced in subsequent applications. That is, we can also introduce a condition change prediction mechanism as a reference factor for details to configure highly adaptive and compatible detection rules. This way, while maintaining the advantages of customization, it also has adaptability and stability, further ensuring excellent SQL injection attack detection effects in actual applications.

[0050] Step S102, extracting key features from the rule content of the detection rule as fast features, and then stringing them together with other members in a linked list form to obtain corresponding linked list data, and using hyperscan to compile the linked list data to obtain a corresponding fast feature matching database, wherein the fast feature is the first member in the linked list data;

[0051] It can be understood that based on the detection rules obtained previously, the construction process of the fast feature matching library involved in the first layer of the two-layer feature matching architecture of this application can be carried out (there is also a second layer in the architecture, involving the application of the rule matching tree).

[0052] In the prior art, the detection of SQL injection attacks may also involve fast feature matching. However, it should be noted that the prior art uses the AC algorithm to construct a fast feature matching tree, and the AC algorithm only supports strings. In addition, since all matching numbers need to be found, if each substring matches each other (such as the dictionary is a, aa, aaa, aaaa, and the input string is aaaa), the time complexity of the algorithm will be close to the quadratic function of the matching. In other words, the fast feature matching tree constructed based on the AC algorithm has limitations in matching performance, which will affect the detection performance of SQL injection attacks.

[0053] In this regard, the present application considers introducing hyperscan to build a fast feature matching library in a specially designed two-layer feature matching architecture, and continues to perform fast feature matching processing through hyperscan.

[0054] Hyperscan itself involves the use of regular expressions. Therefore, when hyperscan is introduced to build a fast feature matching library (a regular matching library) and matching processing is performed based on the fast feature matching library, the application of regular expressions can be involved. In this way, the feature matching goal can be completed efficiently and accurately based on regular expressions, and high-quality judgments can be made on SQL injection attacks.

[0055] Among them, Hyperscan further ensures its practicality in real network scenarios in terms of details by adding specific syntax and working modes. At the same time, the use of a large number of efficient algorithms and Intel SIMD* instructions also helps to achieve high-performance matching. It also supports and open source intrusion prevention system / intrusion detection system products, making its application more extensive. Hyperscan has significant performance advantages when processing large-scale regular expression sets and large amounts of data. After being highly optimized, it can make full use of modern CPU instruction sets such as SSE4.2, AVX2, etc. to achieve parallel processing, greatly improving the matching speed. It is suitable for specific business scenarios involved in this application, such as network intrusion detection, which require processing a large number of complex regular expression rules and high-speed data streams.

[0056] In the specific construction process of the fast feature matching library, it is necessary to first convert the detection rules obtained previously, which may specifically involve the extraction of fast features and the generation of linked list data.

[0057] Fast features can be used as key features to achieve fast matching during feature matching. Fast features need to be parsed and extracted from the original feature content.

[0058] As an example, the present application solution can be applied to the following three detection rules in practical applications:

[0059] Rule 1: tcp(msg:"SQL injection attack";content:"regex:" / ^530\s+(Login|User) / ",fast_pattern";content:"tmsr-poc-vghiy";

[0060] content:"LIKE";)

[0061] Rule 2: tcp(msg:"SQL injection attack";content:"regex:" / SELECT\ / *{2}\ / IFNULL / ",fast_pattern"content:"AND";)

[0062] Rule 3: tcp(msg:"Cross-site scripting attack"; content:"tmsr-poc-vghiy"; content:"IFNULL"; content:"regex:"DELETE")

[0063] Next, the above three detection rules are further analyzed to extract the corresponding fast features. Specifically, there are the following three fast features:

[0064] Quick matching feature of rule 1 / ^530\s+(Login|User) /

[0065] The fast matching feature of rule 2 is / SELECT\ / *{2}\ / IFNULL] /

[0066] Fast matching feature tmsr-poc-vghiy of rule 3

[0067] Next, the quick feature can be used as the first member of the linked list data, and then the other extracted features / members corresponding to the linked list data can be strung together to obtain the following three linked list data:

[0068] (Link list 1):->Member 1( / [^\x20-\x7e\r\n]{3} / )->Member 2(tmsr-poc-vghiy)->Member 3(LIKE)

[0069] (Link list 2):->Member 1( / SELECT\ / *{2}\ / IFNULL / )->Member 2(AND)

[0070] (Link list 3):->Member 1 (tmsr-poc-vghiy)->Member 2 (IFNULL)->Member 3 (DELETE)

[0071] In this way, we can obtain a linked list corresponding to the previous detection rules by building a fast feature matching library through hyperscan.

[0072] Further, as an exemplary embodiment here, before using hyperscan to compile the data in the linked list form, the method of the present application may also include:

[0073] Add the data in linked list form to the hyperscan container.

[0074] It can be understood that in the embodiment here, corresponding to the application of hyperscan, it involves the addition operation of the linked list data in the container involved in hyperscan, so that hyperscan can be more conveniently identified, located, and used.

[0075] Here, you can also combine the container adding operation with Figure 2 An example schematic diagram of the code involved in the container adding operation of the present application is shown for a more vivid understanding.

[0076] For the compilation and processing of the fast feature matching library based on the linked list data, you can refer to Figure 3 An example schematic diagram of the codes involved in compiling a fast feature matching library of the present application is shown to provide a more vivid understanding.

[0077] In this way, the compilation of the fast feature matching library is completed for the linked list data, and the machine code for efficient, safe and stable execution of the fast feature matching library is obtained, thereby completing the construction of the fast feature matching library.

[0078] Step S103, compiling the detection rules into a corresponding rule matching tree;

[0079] As mentioned above, the second layer in the dual-layer feature matching architecture of the present application also involves the application of a rule matching tree, which may specifically involve the compilation and construction of the rule matching tree.

[0080] It should be noted that the compilation object of the rule matching tree does not involve the fast features obtained by the previous step S102, but only involves the detection rules involved in step S101. Unlike the prior art, when constructing and compiling a fast feature rule matching tree based on the AC algorithm, the fast features will be compiled in, resulting in the fast features being matched twice, affecting performance. However, under the setting here in the present application, the fast feature detection can be avoided twice in the matching process based on the rule matching tree, thereby avoiding unnecessary consumption and improving matching and query performance.

[0081] Similar to compiling the fast feature matching library previously, here, by compiling the detection rules, we obtain the machine code for efficient, secure, and stable execution of the rule matching tree, thus completing the construction of the rule matching tree.

[0082] Specifically, in terms of software, the compilation and processing of the rule matching tree can also be referred to Figure 4 An example schematic diagram of the code involved in the compilation rule matching tree of the present application is shown for a more vivid understanding.

[0083] Further, it can be understood that the rule matching tree here is a tree structure type of data. In this regard, among the different types of tree structures that can be adopted in the present application, the Trie tree structure can be specifically adopted.

[0084] Specifically, the Trie tree is a variant of a hash tree, which is suitable for counting, sorting and saving a large number of strings (but not limited to strings). It uses the common prefix of the strings to reduce the query time and minimize unnecessary string comparisons. The query efficiency is higher than that of the hash tree, which can bring better matching efficiency in details for this application.

[0085] Correspondingly, as an exemplary embodiment, the specific Trie tree (rule matching tree) construction process, or the rule matching tree compilation process involved in compiling the detection rules into the corresponding rule matching tree, may specifically include the following processing contents:

[0086] 1) If the root node is empty, apply for the root node;

[0087] 2) For the currently processed linked list data, skip the fast features and continue to traverse downward;

[0088] 3) For the first member of the non-quick matching feature, apply for a child node (child node) child, the child pointer (child node pointer) of the root node points to the child node child, and then loop the process until the last member, no longer apply for a new child node, apply for a leaf node leaf, and finally the corresponding child node of the second member points to the leaf node leaf.

[0089] Taking the detection rule 1 mentioned above as an example, the corresponding rule matching tree may involve the following processing content:

[0090] Traverse the linked list corresponding to rule 1

[0091] 1) If the root node is empty, apply for the root node.

[0092] 2) The type of member 1 ( / ^530\s+(Login|User) / ) is a quick match feature, so no node is requested and the linked list is traversed downwards.

[0093] 3) The type of member 2 (tmsr-poc-vghiy) is not a fast matching feature, and the child node child1 is applied for, and the child pointer of root points to child1

[0094] 4) The type of member 3 (LIKE) is not a quick match feature, and the child node child2 is applied. The child pointer of child1 points to child2

[0095] 5) Member 3 (LIKE) is the last member of the connection, and applies for the leaf node leaf. The child pointer of child1 points to leaf

[0096] 6) The linked list traversal of other rules is the same as the operation method of rule 1

[0097] For the three detection rules mentioned above, the rule matching tree constructed can refer to Figure 5 An example schematic diagram of the rule matching tree of the present application is shown for a more vivid understanding.

[0098] Step S104, based on the fast feature matching database and the rule matching tree, configure the SQL injection attack detection configuration strategy, wherein in the SQL injection attack detection strategy, the traffic message to be detected is processed by hyperscan based on the fast feature matching database for fast feature matching. If it hits, it continues to match with the rule matching tree. If it hits again, the traffic message to be detected is responded to by SQL injection attack.

[0099] It can be understood that after obtaining the fast feature matching database through step S102 and the rule matching tree through step S103, they can be used to build the two-layer feature matching architecture designed in this application. Corresponding to the subsequent specific applications of the two-layer feature matching architecture, the SQL injection attack detection configuration strategy that can be loaded and executed by the configuration device can be configured according to the corresponding processing logic.

[0100] In this SQL injection attack detection strategy, the traffic packets to be detected involved in actual applications are first processed by hyperscan for fast feature matching based on the fast feature matching database. If a hit is found, the traffic packets are matched with the rule matching tree. If a hit is found again, a SQL injection attack response is performed on the traffic packets to be detected.

[0101] It is easy to see that the SQL injection attack detection strategy can not only determine whether the traffic message to be detected has the nature of an SQL injection attack and whether it belongs to an SQL injection attack, but also trigger a corresponding attack response if it is judged to be so, so as to alleviate and eliminate the impact and security risks brought about, achieve better linkage processing, and take into account both user experience and network security performance.

[0102] It is worth adding that, in the prior art, the specific fast feature matching is implemented by PCRE based on the fast feature matching tree constructed based on the AC algorithm, and PCRE itself also has the problems of low matching performance and consumption of CPU resources. The present application uses Hyperscan to perform fast feature matching processing, which can effectively alleviate this problem in practical applications.

[0103] Among them, in the SQL injection attack detection strategy, the SQL injection attack response specifically includes at least one of logging, blocking and alarming.

[0104] Of course, in specific applications, the three types of response methods mentioned here, namely logging, blocking and alarming, can be further increased or decreased and can be configured according to actual needs to meet the diverse business processing requirements in actual situations.

[0105] In addition, for the second layer of the two-layer feature matching architecture designed by the present application, the present application can also introduce a queue mechanism to achieve a more efficient matching effect overall.

[0106] Specifically, as an exemplary embodiment, in the SQL injection attack detection strategy, when the traffic message to be detected continues to be matched with the rule matching tree, the matching result of the traffic message to be detected and the fast feature matching database is first put into the queue, and then matched with the rule matching tree by traversing the different matching results contained in the queue.

[0107] For this processing, you can also combine Figure 6 An example schematic diagram of the flow message (data packet) detection logic of the present application is shown for a more vivid understanding.

[0108] Further, for the fast feature matching processing of the first layer, you can also refer to Figure 7 The following is an example schematic diagram of the code involved in the fast feature matching processing of the present application. For the second-level query result insertion queue processing, you can also refer to Figure 8 The example schematic diagram of the code involved in the query result insertion queue processing of the present application is shown. For the second-level rule matching tree matching processing, you can also refer to Fig. 9An example schematic diagram of the code involved in the rule matching tree matching process of the present application is shown to provide a more vivid understanding.

[0109] In this way, after completing the configuration of the above SQL injection attack detection configuration strategy, you can put it into actual use and perform corresponding SQL injection attack detection on the access traffic involved in the enterprise network.

[0110] Correspondingly, as an exemplary embodiment, the method of the present application may further include:

[0111] Get the target traffic message to be detected currently;

[0112] Execute the SQL injection attack detection strategy and process the target traffic packets.

[0113] Among them, it can be understood that the target traffic message is usually a traffic message that is directly sent to the processing device and processed by the SQL injection attack detection configuration policy involved in this application by default, or it can be a traffic message with special processing requirements on the local or other device side, and is handed over to the processing device for processing through the SQL injection attack detection configuration policy involved in this application, or it can also be a traffic message that needs to be processed by the SQL injection attack detection configuration policy involved in this application under manual / manual settings of the staff.

[0114] That is to say, in actual applications, traffic messages with corresponding SQL injection attack detection requirements can be processed through the SQL injection attack detection configuration strategy involved in this application.

[0115] As for the processing results of the target traffic message (if an attack response is performed, it is the response result), local result recording, remote result recording, result display, result prompt or further analysis and processing can be continued. Obviously, further specific data application processing that may be involved in the processing results is more flexible and can be processed according to pre-configured or real-time configured data application policies / rules.

[0116] Finally, for the above solution content, in general, for network security, this application designs a novel two-layer feature matching architecture, which uses hyperscan to build a fast feature matching library for the first layer, and continues to perform subsequent fast feature matching based on regular expressions. The rule matching tree in the second layer is not compiled using fast features. This can significantly improve the matching performance, efficiently and accurately determine whether the traffic message to be detected needs to respond to an SQL injection attack, and meet the needs of high-quality network security work.

[0117] The above is an introduction to the SQL injection attack detection method provided by the present application. In order to facilitate better implementation of the SQL injection attack detection method provided by the present application, the present application also provides a SQL injection attack detection device from the perspective of functional modules.

[0118] See also Fig.10 , Fig.10 This is a structural diagram of the SQL injection attack detection device of the present application. In the present application, the SQL injection attack detection device 1000 may specifically include the following structure:

[0119] A rule acquisition unit 1001 is used to acquire a detection rule for an SQL injection attack, wherein the detection rule is a detection rule configured for a user behavior event determined to be an SQL injection attack;

[0120] The database compiling unit 1002 is used to extract key features from the rule content of the detection rule as fast features, and then string them together with other members in a linked list form to obtain corresponding linked list data, and use hyperscan to compile the linked list data to obtain a corresponding fast feature matching database, wherein the fast feature is the first member in the linked list data;

[0121] A matching tree compiling unit 1003, used to compile the detection rules into a corresponding rule matching tree;

[0122] The policy configuration unit 1004 is used to configure the SQL injection attack detection configuration policy based on the fast feature matching database and the rule matching tree. In the SQL injection attack detection policy, the traffic message to be detected is processed by hyperscan for fast feature matching based on the fast feature matching database. If a hit is found, the match is continued with the rule matching tree. If a hit is found again, a SQL injection attack response is performed on the traffic message to be detected.

[0123] As an exemplary embodiment, the database compiling unit 1002 is further configured to:

[0124] Add the data in linked list form to the hyperscan container.

[0125] As another exemplary embodiment, the rule matching tree specifically adopts a Trie tree.

[0126] As another exemplary embodiment, the rule matching tree compilation process involved in compiling the detection rule into the corresponding rule matching tree includes the following processing contents:

[0127] 1) If the root node is empty, apply for the root node;

[0128] 2) For the currently processed linked list data, skip the fast features and continue to traverse downward;

[0129] 3) For the first member of the non-quick matching feature, apply for the child node child, the child pointer of the root node points to the child node child, and then loop the process until the last member, no longer apply for a new child node, apply for the leaf node leaf, and finally the corresponding child node of the second member points to the leaf node leaf.

[0130] As another exemplary embodiment, in the SQL injection attack detection strategy, when the traffic message to be detected continues to be matched with the rule matching tree, the matching result of the traffic message to be detected and the fast feature matching database is first put into the queue, and then matched with the rule matching tree by traversing the different matching results contained in the queue.

[0131] As another exemplary embodiment, in the SQL injection attack detection strategy, the SQL injection attack response specifically includes at least one of logging, blocking, and alarming.

[0132] As another exemplary embodiment, the apparatus further includes an application unit 1005, configured to:

[0133] Get the target traffic message to be detected currently;

[0134] Execute the SQL injection attack detection strategy and process the target traffic packets.

[0135] This application also provides a processing device from the perspective of hardware structure, see Fig.11 , Fig.11 1 shows a schematic diagram of the structure of the processing device of the present application. Specifically, the processing device of the present application may include a processor 1101, a memory 1102, and an input / output device 1103. The processor 1101 is used to execute the computer program stored in the memory 1102 to implement the following Figure 1 The steps of the SQL injection attack detection method in the corresponding embodiment; or, the processor 1101 is used to execute the computer program stored in the memory 1102 to implement the following Fig.10 Corresponding to the functions of each unit in the embodiment, the memory 1102 is used to store the processor 1101 executing the above Figure 1 The computer program required by the SQL injection attack detection method in the corresponding embodiment.

[0136] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 1102, and executed by the processor 1101 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0137] The processing device may include, but is not limited to, a processor 1101, a memory 1102, and an input / output device 1103. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 1101, the memory 1102, the input / output device 1103, etc. are connected via a bus.

[0138] The processor 1101 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0139] The memory 1102 can be used to store computer programs and / or modules. The processor 1101 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 1102 and calling the data stored in the memory 1102. The memory 1102 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0140] When the processor 1101 is used to execute the computer program stored in the memory 1102, the following functions can be implemented:

[0141] Obtaining a detection rule for an SQL injection attack, wherein the detection rule is a detection rule configured for a user behavior event determined to be an SQL injection attack;

[0142] Extract key features from the content of the detection rules as fast features, and then string them together with other members in a linked list form to obtain corresponding linked list data, and use hyperscan to compile the linked list data to obtain the corresponding fast feature matching database, in which the fast feature is the first member in the linked list data;

[0143] Compile the detection rules into corresponding rule matching trees;

[0144] Based on the fast feature matching database and the rule matching tree, configure the SQL injection attack detection configuration strategy. In the SQL injection attack detection strategy, the traffic message to be detected is processed by hyperscan based on the fast feature matching database for fast feature matching. If it hits, it continues to match with the rule matching tree. If it hits again, the traffic message to be detected will respond to the SQL injection attack.

[0145] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the SQL injection attack detection device, processing device and its corresponding units described above can refer to the following. Figure 1 The description of the SQL injection attack detection method in the corresponding embodiment will not be repeated here.

[0146] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0147] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the SQL injection attack detection method in the corresponding embodiment, the specific operations can refer to the following Figure 1 The description of the SQL injection attack detection method in the corresponding embodiment will not be repeated here.

[0148] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0149] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the SQL injection attack detection method in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the SQL injection attack detection method in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0150] The SQL injection attack detection method, apparatus, processing device, and computer-readable storage medium provided by the present application are introduced in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of ​​the present application. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A SQL injection attack detection method, characterized in that: The method comprises: Acquire a detection rule for an SQL injection attack, wherein the detection rule is a detection rule configured for a user behavior event determined to be an SQL injection attack; Extract key features from the rule content of the detection rule as fast features, and then string them together with other members in a linked list form to obtain corresponding linked list data, and use hyperscan to compile the linked list data to obtain a corresponding fast feature matching database, wherein the fast feature is the first member in the linked list data; Compiling the detection rules into a corresponding rule matching tree; Based on the fast feature matching database and the rule matching tree, a SQL injection attack detection configuration strategy is configured, wherein in the SQL injection attack detection strategy, the traffic message to be detected is processed by the hyperscan for fast feature matching based on the fast feature matching database. If a hit is found, the hyperscan continues to match the rule matching tree. If a hit is found again, a SQL injection attack response is performed on the traffic message to be detected.

2. The method according to claim 1, characterized in that Before using hyperscan to compile the data in the linked list form, the method includes: Add the data in the linked list form to the hyperscan container.

3. The method according to claim 1, characterized in that The rule matching tree specifically adopts a Trie tree.

4. The method according to claim 3, characterized in that The rule matching tree compilation process involved in compiling the detection rule into a corresponding rule matching tree includes the following processing contents: 1) If the root node is empty, apply for the root node; 2) For the data in the linked list form currently being processed, skip the fast features therein and continue to traverse downward; 3) For the first member that is not the quick matching feature, apply for a child node child, the child pointer of the root node points to the child node child, and then loop the process until the last member, no longer apply for a new child node, apply for a leaf node leaf, and finally the corresponding child node of the second member points to the leaf node leaf.

5. The method according to claim 1, characterized in that In the SQL injection attack detection strategy, when the traffic message to be detected continues to be matched with the rule matching tree, the matching result of the traffic message to be detected and the fast feature matching database is first put into a queue, and then matched with the rule matching tree by traversing the different matching results contained in the queue.

6. The method according to claim 1, characterized in that In the SQL injection attack detection strategy, the SQL injection attack response specifically includes at least one of logging, blocking and alarming.

7. The method according to claim 1, characterized in that The method further comprises: Get the target traffic message to be detected currently; Execute the SQL injection attack detection strategy and process the target traffic message.

8. A SQL injection attack detection device, characterized in that: The device comprises: A rule acquisition unit, used to acquire a detection rule for an SQL injection attack, wherein the detection rule is a detection rule configured for a user behavior event determined to be an SQL injection attack; A database compilation unit, used for extracting key features from the rule content of the detection rule as fast features, and then stringing them together with other members in a linked list form to obtain corresponding data in the linked list form, and using hyperscan to compile the data in the linked list form to obtain a corresponding fast feature matching database, wherein the fast feature is the first member in the linked list form data; A matching tree compiling unit, used for compiling the detection rule into a corresponding rule matching tree; A policy configuration unit is used to configure an SQL injection attack detection configuration policy based on the fast feature matching database and the rule matching tree, wherein in the SQL injection attack detection policy, the traffic message to be detected is processed by the hyperscan for fast feature matching based on the fast feature matching database, and if a hit is found, the hyperscan continues to match the rule matching tree, and if a hit is found again, the traffic message to be detected is responded to as an SQL injection attack.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images