A method, apparatus and processing device for detecting SQL injection attacks

Abstract

This application provides a method, apparatus, and processing device for detecting SQL injection attacks. It designs a novel two-layer feature matching architecture. The first layer uses hyperscan to build a fast feature matching library, and then continues to perform subsequent fast feature matching based on regular expressions. The rule matching tree in the second layer is not compiled using fast features. This can significantly improve matching performance, efficiently and accurately determine whether the traffic packets to be detected need to respond to SQL injection attacks, and meet the requirements of high-quality network security work.

Description

Technical Field

[0001] This application relates to the field of network security, specifically to a method, apparatus, and processing device for detecting SQL injection attacks. Background Technology

[0002] Structured Query Language (SQL) injection attacks are a type of cyberattack that is often encountered in network security work. They refer to attackers inserting malicious SQL statements into input boxes or other data input fields of web applications, tricking the application into executing them as legitimate SQL commands, in order to illegally obtain sensitive information from the database, tamper with data, execute system commands, or achieve other malicious purposes.

[0003] For enterprise / company network security work, appropriate attack detection strategies can be configured to capture relevant characteristics to determine whether traffic packets contain SQL injection attacks or belong to SQL network attacks, and attack response can be initiated immediately.

[0004] The AC algorithm, commonly used in existing technologies, is used to compile fast feature matching trees for fast feature matching. The AC algorithm (Aho-Corasick algorithm) is a string search algorithm used to match substrings in a finite set of "dictionaries" in an input string. The difference from ordinary string matching is that it matches all dictionary strings at the same time. The algorithm has an amortized time complexity of approximately linear, which is about the length of the string plus the number of all matches.

[0005] However, the inventors of this application discovered that the AC algorithm only supports strings, and because it needs to find all the matching numbers, if each substring matches each other (e.g., the dictionary is a, aa, aaa, aaaa, and the input string is aaaa), the time complexity of the algorithm will be approximately a quadratic function of matching. In other words, the fast feature matching tree built based on the AC algorithm has limitations in matching performance, which will affect the detection performance of SQL injection attacks. Summary of the Invention

[0006] This application provides a method, apparatus, and processing device for detecting SQL injection attacks. It designs a novel two-layer feature matching architecture. The first layer uses hyperscan to build a fast feature matching library, and then continues to perform subsequent fast feature matching based on regular expressions. The rule matching tree in the second layer is not compiled using fast features. This can significantly improve matching performance, efficiently and accurately determine whether the traffic packets to be detected need to respond to SQL injection attacks, and meet the requirements of high-quality network security work.

[0007] Firstly, this application provides a method for detecting SQL injection attacks, the method including:

[0008] Obtain the detection rules for SQL injection attacks, where the detection rules are the detection rules configured for user behavior events that are determined to be SQL injection attacks;

[0009] Key features are extracted from the content of the detection rules as fast features, and then linked with the other members in a linked list to obtain the corresponding linked list data. Hyperscan is used to compile the linked list data to obtain the corresponding fast feature matching database, in which the fast feature is the first member in the linked list data.

[0010] The detection rules are compiled into a corresponding rule matching tree;

[0011] Based on a fast feature matching database and a rule matching tree, a SQL injection attack detection strategy is configured. In this strategy, the traffic packets to be detected are processed by Hyperscan using fast feature matching based on the fast feature matching database. If a match is found, the packets are then matched against the rule matching tree. If a match is found again, an SQL injection attack response is initiated for the traffic packets to be detected.

[0012] Secondly, this application provides an SQL injection attack detection device, the device comprising:

[0013] The rule acquisition unit is used to acquire detection rules for SQL injection attacks, wherein the detection rules are the detection rules configured for user behavior events that are determined to be SQL injection attacks;

[0014] The database compilation unit is used to extract key features from the rule content of the detection rules as fast features, and then link them with the other members in the form of a linked list to obtain the corresponding linked list data. Hyperscan is used to compile the linked list data to obtain the corresponding fast feature matching database, in which the fast feature is the first member in the linked list data.

[0015] The matching tree compilation unit is used to compile detection rules into corresponding rule matching trees;

[0016] The strategy configuration unit is used to configure SQL injection attack detection configuration strategies based on the fast feature matching database and rule matching tree. In the SQL injection attack detection strategy, the traffic packets to be detected are processed by hyperscan for fast feature matching based on the fast feature matching database. If a match is found, the matching continues with the rule matching tree. If a match is found again, an SQL injection attack response is initiated for the traffic packets to be detected.

[0017] Thirdly, this application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor invokes the computer program in the memory, it executes the method provided by the first aspect of this application or any possible implementation of the first aspect of this application.

[0018] Fourthly, this application provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to perform the method provided in the first aspect of this application or any possible implementation thereof.

[0019] From the above, it can be concluded that this application has the following beneficial effects:

[0020] For network security, this application designs a novel two-layer feature matching architecture. The first layer uses hyperscan to build a fast feature matching library, and then continues to perform fast feature matching based on regular expressions. The rule matching tree in the second layer is not compiled using fast features. This can significantly improve matching performance, efficiently and accurately determine whether the traffic packets to be detected need to be responded to for SQL injection attacks, and meet the requirements of high-quality network security work. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the SQL injection attack detection method of this application.

[0023] Figure 2 An example diagram illustrating the code involved in adding operations to the container of this application;

[0024] Figure 3 This is a schematic diagram of an example of the code involved in compiling the fast feature matching library for this application.

[0025] Figure 4 This is a schematic diagram of an example of the code involved in the compilation rule matching tree of this application;

[0026] Figure 5 This is a schematic diagram of an example of a rule matching tree in this application;

[0027] Figure 6 This is a schematic diagram illustrating an example of the traffic packet detection logic in this application;

[0028] Figure 7 This is an example diagram illustrating the code involved in the fast feature matching process of this application;

[0029] Figure 8 A schematic diagram illustrating an example of the code involved in inserting query results into a queue for this application;

[0030] Figure 9 This is a schematic diagram of an example of the code involved in the rule matching tree matching process of this application;

[0031] Figure 10 This is a schematic diagram of a structure of the SQL injection attack detection device of this application;

[0032] Figure 11 This is a schematic diagram of one type of processing equipment used in this application. Detailed Implementation

[0033] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0034] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules is not necessarily limited to those explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or devices. The naming or numbering of steps appearing in this application does not imply that the steps in the method flow must be performed in the chronological / logical order indicated by the naming or numbering. The execution order of named or numbered process steps can be changed according to the desired technical purpose, as long as the same or similar technical effect is achieved.

[0035] The module division described in this application is a logical division. In practical applications, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection between modules shown or discussed may be through some interfaces, and the indirect coupling or communication connection between modules may be electrical or other similar forms, none of which are limited in this application. Furthermore, the modules or sub-modules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules. Some or all of the modules may be selected to achieve the purpose of the solution in this application according to actual needs.

[0036] Before introducing the SQL injection attack detection method provided in this application, we will first introduce the background content involved in this application.

[0037] The SQL injection attack detection method, apparatus, and computer-readable storage medium provided in this application can be applied to processing devices. A novel two-layer feature matching architecture is designed. The first layer is built using hyperscan to construct a fast feature matching library, and subsequent fast feature matching is performed based on regular expressions. The rule matching tree in the second layer is not compiled using fast features. This can significantly improve matching performance, efficiently and accurately determine whether the traffic packets to be detected need to respond to SQL injection attacks, and meet the requirements of high-quality network security work.

[0038] The SQL injection attack detection method mentioned in this application can be executed by an SQL injection attack detection device, or by different types of processing devices such as network security devices, servers, physical hosts, or user equipment (UE) that integrate the SQL injection attack detection device. The SQL injection attack detection device can be implemented in hardware or software. The UE can be a terminal device such as a smartphone, tablet, laptop, desktop computer, or personal digital assistant (PDA). The processing devices can be configured in a device cluster.

[0039] It is understandable that the processing device that executes the SQL injection attack detection method of this application, or that carries the application service corresponding to the SQL injection attack detection method of this application, is usually a device node responsible for network security in the enterprise / company's internal network, such as firewalls, intrusion prevention systems, and other types of network security devices. Alternatively, the processing device can also be other types of network nodes (such as servers, physical hosts, or even UE devices). Furthermore, with the flexible and ever-changing application requirements in actual applications, the processing device can also be a third-party device outside the enterprise's internal network, providing SQL injection attack detection services to the enterprise's internal network as a third-party service. This is also possible in practice. Therefore, this application does not impose too many restrictions on the specific device form or type of the processing device.

[0040] The SQL injection attack detection method provided in this application will now be introduced.

[0041] First, refer to Figure 1 , Figure 1 This paper illustrates a flowchart of the SQL injection attack detection method of this application. The SQL injection attack detection method provided by this application may specifically include the following steps S101 to S104:

[0042] Step S101: Obtain the detection rules for SQL injection attacks, wherein the detection rules are the detection rules configured for user behavior events that are determined to be SQL injection attacks;

[0043] Understandably, the initial configuration work for the automatic detection of SQL injection attacks involves acquiring the corresponding detection rules and processing them into SQL injection attack detection strategies / rules that the device can execute automatically.

[0044] Specifically, this detection rule is configured for user behavior events identified as SQL injection attacks. At this point, the rule is not used or run directly. Its main purpose is to describe the characteristics of traffic packets of user behavior events that have the nature of SQL injection attacks and belong to SQL injection attacks. The user behavior events involved are usually real user behavior events. Of course, in some cases, they can also be modified based on real user behavior events or simulated user behavior events obtained directly through scenario simulation, in order to further meet more diverse business processing needs.

[0045] In practice, the acquisition and processing of detection rules can be done through manual input, receiving from other devices, or reading locally. In addition, it can be done by acquiring existing data or configuring data in real time, all of which are possible in practice.

[0046] Furthermore, in practical applications, the solution proposed in this application is usually initiated in the form of a task, which may involve configuring SQL injection attack detection strategies. The specific method of obtaining the task is the same as the above method of obtaining and processing the detection rules.

[0047] When a task exists, the corresponding detection rules can be obtained by following the task information.

[0048] Furthermore, to promote a more adaptive and automated SQL injection attack detection effect, the detection rules obtained here can be specifically configured for the specific devices and their specific application scenarios (both are preset) that will subsequently execute the corresponding SQL injection attack detection processing using the SQL injection attack detection configuration strategy configured in this application. In other words, the detection rules obtained here are customized for the subsequent processing devices, rather than using the general detection rules as commonly understood. At the same time, this setting also corresponds to the possibility that the devices configuring the SQL injection attack detection configuration strategy and the devices using the SQL injection attack detection configuration strategy may differ in actual situations.

[0049] At the same time, considering the specific devices and application scenarios for subsequent SQL injection attack detection and processing, we can also consider the changes in conditions that the previously determined specific devices and application scenarios may face in subsequent applications. In other words, we can introduce a condition change prediction mechanism as a reference factor for details to configure highly adaptable and compatible detection rules. In this way, while maintaining the advantages of customization, it also has adaptability and stability, further ensuring excellent SQL injection attack detection results in practical applications.

[0050] Step S102: Extract key features from the rule content of the detection rule as fast features, and then link them with the other members in the form of a linked list to obtain the corresponding linked list data. Use Hyperscan to compile the linked list data to obtain the corresponding fast feature matching database, where the fast features are the first and second members in the linked list data.

[0051] Understandably, based on the detection rules obtained above, we can proceed with the construction of the fast feature matching library involved in the first layer of the two-layer feature matching architecture of this application (there is also a second layer in the architecture, which involves the application of rule matching trees).

[0052] In existing technologies, SQL injection attack detection can also involve fast feature matching. However, it is important to note that existing technologies use the AC algorithm to construct the fast feature matching tree. The AC algorithm only supports strings, and because it needs to find all matches, if each substring matches each other (e.g., the dictionary is a, aa, aaa, aaaa, and the input string is aaaa), the algorithm's time complexity will be approximately a quadratic function of matching. In other words, the fast feature matching tree built based on the AC algorithm has limitations in matching performance, which will affect the detection performance of SQL injection attacks.

[0053] In response, this application considers introducing hyperscan to build a fast feature matching library in a specially designed two-layer feature matching architecture, and continues to use hyperscan for fast feature matching processing.

[0054] Hyperscan inherently involves the use of regular expressions. Therefore, when introducing Hyperscan to build a fast feature matching library (a type of regular expression matching library) and when performing matching processing based on the fast feature matching library, the application of regular expressions is involved. In this way, feature matching targets can be completed efficiently and accurately based on regular expressions, thereby enabling high-quality judgment of SQL injection attacks.

[0055] Hyperscan further enhances its practicality in real-world network scenarios by adding specific syntax and working modes. Meanwhile, the use of numerous efficient algorithms and IntelSIMD* instructions contributes to high-performance matching. It also supports open-source intrusion prevention / intrusion detection systems, broadening its application. Hyperscan demonstrates significant performance advantages when processing large sets of regular expressions and massive amounts of data. Highly optimized, it fully utilizes modern CPU instruction sets, such as SSE4.2 and AVX2, to achieve parallel processing, greatly improving matching speed. It is suitable for specific business scenarios involving network intrusion detection, such as those described in this application, which require processing large amounts of complex regular expression rules and high-speed data streams.

[0056] In the specific construction process of the fast feature matching library, it is necessary to first transform the detection rules obtained earlier, which may involve the extraction of fast features and the generation of linked list data.

[0057] Fast features are key features that can be considered during the feature matching process to achieve fast matching. Fast features need to be parsed and extracted from the original feature content.

[0058] As an example, this application's solution can handle the following three detection rules in practical applications:

[0059] Rule 1: tcp(msg:"SQL injection attack"; content:"regex:" / ^530\s+(Login|User) / ",fast_pattern"; content:"tmsr-poc-vghiy");

[0060] content: "LIKE";)

[0061] Rule 2: tcp(msg:"SQL injection attack"; content:"regex:" / SELECT\ / *{2}\ / IFNULL / ",fast_pattern"content:"AND";)

[0062] Rule 3: tcp(msg:"Cross-site scripting attack"; content:"tmsr-poc-vghiy"; content:"IFNULL"; content:"regex:"DELETE")

[0063] Next, the above three detection rules are further analyzed to extract the corresponding fast features. Specifically, there are the following three fast features:

[0064] The fast matching feature of rule 1 is / ^530\s+(Login|User) /

[0065] Rule 2's fast matching feature / SELECT\ / *{2}\ / IFNULL] /

[0066] The fast matching feature of rule 3 is tmsr-poc-vghiy

[0067] Next, the fast feature can be used as the first member of the linked list data, and the other extracted features / members can be chained together to obtain the following 3 linked lists:

[0068] (Linked list 1):->Member 1( / [^\x20-\x7e\r\n]{3} / )->Member 2(tmsr-poc-vghiy)->Member 3(LIKE)

[0069] (Linked list 2):->Member 1( / SELECT\ / *{2}\ / IFNULL / )->Member 2(AND)

[0070] (Linked List 3):->Member 1 (tmsr-poc-vghiy)->Member 2 (IFNULL)->Member 3 (DELETE)

[0071] Thus, we obtain a linked list that corresponds to the detection rules mentioned above and can be used to build a fast feature matching library via hyperscan.

[0072] Furthermore, as an exemplary embodiment herein, the method of this application may further include, before compiling the linked list data using hyperscan, the following:

[0073] Add the linked list data to the hyperscan container.

[0074] It is understood that in this embodiment, corresponding to the application of hyperscan, the operation of adding linked list data to the container involved in hyperscan is involved, so that hyperscan can more conveniently identify, locate and use it.

[0075] The container addition operation here can also be combined with... Figure 2 The diagram shown is an example of the code involved in the container addition operation of this application, for a more intuitive understanding.

[0076] For Hyperscan's compilation and processing of the fast feature matching library based on linked list data, please refer to [link / reference needed]. Figure 3 The diagram shown is an example of the code involved in compiling the fast feature matching library of this application, for a more intuitive understanding.

[0077] In this way, the fast feature matching library is compiled for the linked list data, and the efficient, safe and stable machine code for the fast feature matching library is obtained, thus completing the construction of the fast feature matching library.

[0078] Step S103: Compile the detection rules into a corresponding rule matching tree;

[0079] As mentioned earlier, the second layer of the two-layer feature matching architecture in this application also involves the application of a rule matching tree, which specifically involves the compilation and construction of the rule matching tree.

[0080] It is important to note that the compilation object of the rule matching tree does not involve the fast features processed in step S102, but only the detection rules involved in step S101. Unlike existing technologies that compile fast features into the rule matching tree based on the AC algorithm, resulting in double matching of fast features and impacting performance, the configuration in this application avoids double detection of fast features during the matching process based on the rule matching tree, thus avoiding unnecessary overhead and improving matching and query performance.

[0081] Similar to compiling the fast feature matching library mentioned earlier, this section obtains efficient, safe, and stable machine code for the rule matching tree by compiling the detection rules, thus completing the construction of the rule matching tree.

[0082] Specifically, regarding software, for the compilation and processing of rule matching trees, you can refer to... Figure 4 The diagram shown is an example of the code involved in the compilation rule matching tree of this application, for a more intuitive understanding.

[0083] Furthermore, it is understood that the rule matching tree here is a tree-structured data. In this application, among the different types of tree structures that can be adopted, a Trie tree structure can be specifically adopted.

[0084] Specifically, a Trie tree is a variant of a hash tree, suitable for counting, sorting, and storing large amounts of strings (but not limited to strings). It utilizes the common prefixes of strings to reduce query time and minimizes unnecessary string comparisons, resulting in higher query efficiency than a hash tree. This can bring better matching efficiency to this application in terms of details.

[0085] Correspondingly, as an exemplary embodiment, the specific process of constructing a Trie tree (rule matching tree), or in other words, the compilation of detection rules into the corresponding rule matching tree, may include the following processing:

[0086] 1) If the root node is empty, request a root node;

[0087] 2) For the currently processed linked list data, skip the fast features and continue traversing downwards;

[0088] 3) For the first member of a non-fast matching feature, request a child node (child node), and the child pointer (child node pointer) of the root node points to the child node (child). Then, process in a loop until the last member. When the last member is reached, no new child node is requested. Instead, a leaf node (leaf) is requested. The corresponding child node of the second-to-last member points to the leaf node (leaf).

[0089] Taking the aforementioned detection rule 1 as an example, the corresponding rule matching tree can involve the following processing:

[0090] Traversing the linked list corresponding to rule 1

[0091] 1) If the root node is empty, request a root node.

[0092] 2) Member 1( / ^530\s+(Login|User) / ) is of type quick matching feature, so no node is requested and the linked list is traversed downwards.

[0093] 3) Member 2 (tmsr-poc-vghiy) is not a fast matching feature, so a child node child1 is requested, and the root's child pointer points to child1.

[0094] 4) Member 3 (LIKE) is not a fast matching feature, so a child node child2 is requested, and the child pointer of child1 points to child2.

[0095] 5) Member 3 (LIKE) is the last member of the connection, so a leaf node is requested, and the child pointer of child1 points to leaf.

[0096] 6) The linked list traversal for other rules is performed in the same way as for rule 1.

[0097] For the three detection rules mentioned above, the constructed rule matching tree can be referenced. Figure 5 The following is a schematic diagram of an example of the rule matching tree of this application, for a more intuitive understanding.

[0098] Step S104: Configure an SQL injection attack detection strategy based on the fast feature matching database and rule matching tree. In the SQL injection attack detection strategy, the traffic packets to be detected are processed by hyperscan using fast feature matching based on the fast feature matching database. If a match is found, the matching continues with the rule matching tree. If a match is found again, an SQL injection attack response is initiated for the traffic packets to be detected.

[0099] It is understandable that after obtaining the fast feature matching database through step S102 and the rule matching tree through step S103, it can be used to build the two-layer feature matching architecture designed in this application. Corresponding to the specific application of the two-layer feature matching architecture, the SQL injection attack detection configuration strategy that the device can load and execute can be configured according to the corresponding processing logic.

[0100] In this SQL injection attack detection strategy, the traffic packets to be detected in actual application are first processed by hyperscan based on a fast feature matching database. If a match is found, it continues to be matched with a rule matching tree. If a match is found again, an SQL injection attack response is initiated on the traffic packets to be detected.

[0101] It is easy to see that the SQL injection attack detection strategy can not only determine whether the traffic packets to be detected have the nature of SQL injection attacks and belong to SQL injection attacks, but also trigger corresponding attack responses when the determination is yes, so as to mitigate and eliminate the impact and security risks, achieve better linkage processing, and take into account both user experience and network security performance.

[0102] It is worth adding that in the existing technology, the specific fast feature matching is implemented by PCRE based on the fast feature matching tree built on the AC algorithm. However, PCRE itself has the problem of low matching performance and high CPU resource consumption. This application uses Hyperscan for fast feature matching processing, which can effectively alleviate this problem in practical applications.

[0103] In the SQL injection attack detection strategy, the SQL injection attack response specifically includes at least one of logging, blocking, and alerting.

[0104] Of course, in specific applications, the three response methods mentioned here—logging, blocking, and alarming—can be added or removed. They can be configured according to actual needs to meet diverse business processing requirements in real-world situations.

[0105] Furthermore, for the second layer of the two-layer feature matching architecture designed in this application, a queue mechanism can be introduced to achieve a more efficient matching effect overall.

[0106] Specifically, as an exemplary embodiment, in the SQL injection attack detection strategy, during the process of matching the traffic packet to be detected with the rule matching tree, the matching result of the traffic packet to be detected with the fast feature matching database is first queued, and then the different matching results contained in the queue are matched with the rule matching tree.

[0107] For this part of the processing, it can also be combined with Figure 6 The diagram shown is an example of the traffic packet (data packet) detection logic of this application, for a more intuitive understanding.

[0108] Furthermore, for the fast feature matching processing of the first layer, you can also refer to... Figure 7 The diagram shown is an example of the code involved in the fast feature matching process of this application. For the second-level query result insertion queue processing, please refer to... Figure 8 The diagram shown is an example of the code involved in the query result insertion queue processing of this application. For the second-level rule matching tree matching processing, please refer to... Figure 9The diagram shown is an example of the code involved in the rule matching tree matching process of this application, for a more intuitive understanding.

[0109] Once the SQL injection attack detection configuration strategy has been configured, it can be put into practical use to perform corresponding SQL injection attack detection on the access traffic involved in the enterprise network.

[0110] Correspondingly, as an exemplary embodiment, the method of this application may further include:

[0111] Obtain the target traffic packet to be detected;

[0112] Implement SQL injection attack detection strategies and process target traffic packets.

[0113] It is understood that the target traffic packets are usually traffic packets that are sent directly to the processing device and are processed by default according to the SQL injection attack detection configuration strategy involved in this application, or they may be traffic packets with special processing requirements on the local or other device side, and are handed over to the processing device for processing according to the SQL injection attack detection configuration strategy involved in this application, or they may be traffic packets that need to be processed according to the SQL injection attack detection configuration strategy involved in this application under the manual / manual settings of the staff.

[0114] In other words, traffic packets with corresponding SQL injection attack detection requirements can be processed in practical applications using the SQL injection attack detection configuration strategy involved in this application.

[0115] As for the processing results of the target traffic packets (or the specific response results if an attack response is executed), further local result recording, remote result recording, result display, result prompts, or further analysis and processing can be performed. Obviously, the specific data application processing involved in the processing results is quite flexible and can be processed according to the pre-configured or real-time configured data application strategies / rules.

[0116] Finally, regarding the above solutions, this application presents a novel two-layer feature matching architecture for network security. It uses Hyperscan to build a fast feature matching library for the first layer, and continues to perform fast feature matching based on regular expressions. The rule matching tree in the second layer is not compiled using fast features. This significantly improves matching performance, efficiently and accurately determining whether the traffic packets to be detected need to be responded to with SQL injection attacks, thus meeting the requirements of high-quality network security work.

[0117] The above is an introduction to the SQL injection attack detection method provided in this application. To facilitate better implementation of the SQL injection attack detection method provided in this application, this application also provides an SQL injection attack detection device from the perspective of functional modules.

[0118] See Figure 10 , Figure 10 This is a schematic diagram of one possible structure of the SQL injection attack detection device of this application. In this application, the SQL injection attack detection device 1000 may specifically include the following structure:

[0119] The rule acquisition unit 1001 is used to acquire detection rules for SQL injection attacks, wherein the detection rules are detection rules configured for user behavior events that are determined to be SQL injection attacks;

[0120] The database compilation unit 1002 is used to extract key features from the rule content of the detection rules as fast features, and then link them with the other members in the form of a linked list to obtain the corresponding linked list data. Hyperscan is used to compile the linked list data to obtain the corresponding fast feature matching database, wherein the fast feature is the first member in the linked list data.

[0121] The matching tree compilation unit 1003 is used to compile the detection rules into the corresponding rule matching tree;

[0122] The strategy configuration unit 1004 is used to configure the SQL injection attack detection configuration strategy based on the fast feature matching database and the rule matching tree. In the SQL injection attack detection strategy, the traffic packets to be detected are processed by hyperscan for fast feature matching based on the fast feature matching database. If a match is found, the matching continues with the rule matching tree. If a match is found again, an SQL injection attack response is initiated for the traffic packets to be detected.

[0123] As an exemplary embodiment, the database compilation unit 1002 is further configured to:

[0124] Add the linked list data to the hyperscan container.

[0125] As yet another exemplary embodiment, the rule matching tree specifically adopts a Trie tree.

[0126] As another exemplary embodiment, the compilation process of compiling detection rules into the corresponding rule matching tree includes the following steps:

[0127] 1) If the root node is empty, request a root node;

[0128] 2) For the currently processed linked list data, skip the fast features and continue traversing downwards;

[0129] 3) For the first member of a non-fast matching feature, request a child node (child), and the child pointer of the root node points to the child node (child). Then, process in a loop until the last member. When the last member is reached, no new child node is requested. Instead, a leaf node (leaf) is requested. The corresponding child node of the second-to-last member points to the leaf node (leaf).

[0130] As another exemplary embodiment, in the SQL injection attack detection strategy, during the process of matching the traffic packet to be detected with the rule matching tree, the matching result of the traffic packet to be detected with the fast feature matching database is first queued, and then the different matching results contained in the queue are matched with the rule matching tree.

[0131] As another exemplary embodiment, in the SQL injection attack detection strategy, the SQL injection attack response specifically includes at least one of logging, blocking, and alerting.

[0132] As another exemplary embodiment, the device further includes an application unit 1005, configured to:

[0133] Obtain the target traffic packet to be detected;

[0134] Implement SQL injection attack detection strategies and process target traffic packets.

[0135] This application also provides a processing device from a hardware architecture perspective, see [link / reference]. Figure 11 , Figure 11 This diagram illustrates a structural schematic of the processing device of this application. Specifically, the processing device may include a processor 1101, a memory 1102, and an input / output device 1103. The processor 1101 executes the computer program stored in the memory 1102 to implement, for example... Figure 1 The corresponding steps of the SQL injection attack detection method in the embodiment; or, when the processor 1101 executes the computer program stored in the memory 1102, it implements as follows: Figure 10 Corresponding to the functions of each unit in the embodiment, the memory 1102 is used to store the functions executed by the processor 1101 as described above. Figure 1 The computer program required for the SQL injection attack detection method in the corresponding embodiment.

[0136] For example, a computer program may be divided into one or more modules / units, one or more of which are stored in memory 1102 and executed by processor 1101 to complete this application. One or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in a computer device.

[0137] The processing device may include, but is not limited to, processor 1101, memory 1102, and input / output device 1103. Those skilled in the art will understand that the illustrations are merely examples of the processing device and do not constitute a limitation on the processing device. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the processing device may also include network access devices, buses, etc., and processor 1101, memory 1102, input / output device 1103, etc., are connected via a bus.

[0138] The processor 1101 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the processing device, connecting various parts of the device through various interfaces and lines.

[0139] The memory 1102 can be used to store computer programs and / or modules. The processor 1101 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 1102 and by calling the data stored in the memory 1102. The memory 1102 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function, etc.; the data storage area may store data created according to the use of the processing device, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0140] When processor 1101 executes a computer program stored in memory 1102, it can specifically perform the following functions:

[0141] Obtain the detection rules for SQL injection attacks, where the detection rules are the detection rules configured for user behavior events that are determined to be SQL injection attacks;

[0142] Key features are extracted from the content of the detection rules as fast features, and then linked with the other members in a linked list to obtain the corresponding linked list data. Hyperscan is used to compile the linked list data to obtain the corresponding fast feature matching database, in which the fast feature is the first member in the linked list data.

[0143] The detection rules are compiled into a corresponding rule matching tree;

[0144] Based on a fast feature matching database and a rule matching tree, a SQL injection attack detection strategy is configured. In this strategy, the traffic packets to be detected are processed by Hyperscan using fast feature matching based on the fast feature matching database. If a match is found, the packets are then matched against the rule matching tree. If a match is found again, an SQL injection attack response is initiated for the traffic packets to be detected.

[0145] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the SQL injection attack detection device, processing equipment, and its corresponding units described above can be found in [reference needed]. Figure 1 The description of the SQL injection attack detection method in the corresponding embodiment will not be repeated here.

[0146] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0147] Therefore, this application provides a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute the present application. Figure 1 The steps of the SQL injection attack detection method in the corresponding embodiment can be found in the following example. Figure 1 The description of the SQL injection attack detection method in the corresponding embodiment will not be repeated here.

[0148] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0149] Because of the instructions stored in the computer-readable storage medium, the present application can be executed as described above. Figure 1 The steps of the SQL injection attack detection method in the corresponding embodiment can therefore achieve the results of this application. Figure 1 The beneficial effects that the SQL injection attack detection method in the corresponding embodiment can achieve are detailed in the preceding description and will not be repeated here.

[0150] The SQL injection attack detection method, apparatus, processing device, and computer-readable storage medium provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting SQL injection attacks, characterized in that, The method includes: Obtain the detection rules for SQL injection attacks, wherein the detection rules are the rules configured to detect user behavior events that are determined to be SQL injection attacks; Key features are extracted from the rule content of the detection rules as fast features, and then linked with the other members in a linked list to obtain the corresponding linked list data. Hyperscan is used to compile the linked list data to obtain the corresponding fast feature matching database, wherein the fast features are the first member in the linked list data. The detection rules are compiled into a corresponding rule matching tree; Based on the fast feature matching database and the rule matching tree, an SQL injection attack detection strategy is configured. In the SQL injection attack detection strategy, the traffic packets to be detected are processed by hyperscan based on the fast feature matching database. If a match is found, the matching continues with the rule matching tree. If a match is found again, an SQL injection attack response is initiated on the traffic packets to be detected. The rule matching tree specifically adopts a Trie tree.

2. The method according to claim 1, characterized in that, Before compiling the linked list data using hyperscan, the method includes: Add the linked list data to the hyperscan container.

3. The method according to claim 1, characterized in that, The process of compiling the detection rules into the corresponding rule matching tree includes the following steps: 1) If the root node is empty, request the aforementioned root node; 2) For the linked list data being processed, skip the fast features and continue traversing downwards; 3) For the first member that is not the fast feature, request a child node child, and the child pointer of the root node points to the child node child. Then process in a loop until the last member. When no new child node is requested, request a leaf node leaf, and the corresponding child node of the last second member points to the leaf node leaf.

4. The method according to claim 1, characterized in that, In the SQL injection attack detection strategy, during the process of matching the traffic packet to be detected with the rule matching tree, the matching result of the traffic packet to be detected with the fast feature matching database is first queued, and then the different matching results contained in the queue are matched with the rule matching tree.

5. The method according to claim 1, characterized in that, In the SQL injection attack detection strategy, the SQL injection attack response specifically includes at least one of logging, blocking, and alarming.

6. The method according to claim 1, characterized in that, The method further includes: Obtain the target traffic packet to be detected; The SQL injection attack detection strategy is executed to process the target traffic packets.

7. A device for detecting SQL injection attacks, characterized in that, The device includes: The rule acquisition unit is used to acquire detection rules for SQL injection attacks, wherein the detection rules are rules configured for detecting user behavior events that are determined to be SQL injection attacks. The database compilation unit is used to extract key features as fast features from the rule content of the detection rules, and then link them with the other members in the form of a linked list to obtain the corresponding linked list data. Hyperscan is used to compile the linked list data to obtain the corresponding fast feature matching database, wherein the fast feature is the first member in the linked list data. A matching tree compilation unit is used to compile the detection rules into a corresponding rule matching tree; The strategy configuration unit is used to configure an SQL injection attack detection strategy based on the fast feature matching database and the rule matching tree. In the SQL injection attack detection strategy, the traffic packet to be detected is processed by hyperscan based on the fast feature matching database. If a match is found, it continues to be matched with the rule matching tree. If a match is found again, an SQL injection attack response is performed on the traffic packet to be detected. The rule matching tree specifically adopts a Trie tree.

8. A processing apparatus, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the method as described in any one of claims 1 to 6 when it invokes the computer program in the memory.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the method of any one of claims 1 to 6.

Images