SQL injection attack detection method and system and related equipment

Abstract

The invention discloses an SQL (Structured Query Language) injection attack detection method and system and related equipment, and relates to a network information security technology. The method comprises the steps that multiple collected SQL injection samples serve as training data to be preprocessed; performing three-stage training on the security big model by using the preprocessed training data; the first stage is to perform unsupervised pre-training by using the preprocessed training data, the second stage is to perform first fine tuning by using a Mixture of Experts architecture and a multi-task head form, and the third stage is to perform second fine tuning by using a comparative learning method; and receiving the to-be-detected traffic data, inputting the to-be-detected traffic data into the trained security detection large model, and detecting the SQL injection attack in the to-be-detected traffic data, thereby solving the technical problems that a traditional SQL injection attack detection method has obvious detection capability and insufficient flexibility for complex and changeable advanced SQL injection attacks, and improving the detection efficiency. The technical effect of remarkably improving the accuracy and efficiency of SQL injection attack detection is achieved.

Description

[0001] This application is a divisional application of the invention patent application with the application date of December 18, 2024, application number 202411868544X, and name “SQL injection attack detection method, system and related equipment”. Technical Field

[0002] The present application relates to the field of network information security technology, and in particular to a structured query language (SQL) injection attack detection method, system and related equipment. Background Art

[0003] With the popularization of Internet applications, the number and complexity of network threats are also increasing. Hackers use artificial intelligence technologies such as ChatGPT and FraudGPT to quickly and easily generate highly adversarial attack threats such as SQL injection, which have strong bypass capabilities for traditional security devices. Currently, the methods used in the industry to detect SQL injection mainly include regular rule-based, grammatical semantic analysis, and threat intelligence matching. However, these methods are powerless in the face of advanced network security threats.

[0004] Existing SQL injection detection mainly relies on a fixed rule base, which is difficult to cope with the ever-changing and evolving attack patterns, especially those using complex obfuscation techniques or new attack vectors. Traditional methods are often unable to effectively identify multiple combined attack methods such as highly concealed, multi-layered encoding, protocol anomalies, etc. due to their static characteristics, resulting in a high false alarm rate. Due to the limitations of traditional technology, a large number of false alarms will be generated, making it difficult for security personnel to screen out the real threats and accurately trace the attack source.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present application provide a SQL injection attack detection method, system and related equipment to at least solve the technical problem that traditional SQL injection attack detection methods have obvious insufficient detection capabilities and flexibility for complex and changeable advanced SQL injection attacks (especially attacks using highly adversarial means such as obfuscation, encoding and protocol anomalies).

[0007] According to one aspect of an embodiment of the present application, a SQL injection attack detection method is provided, comprising: collecting a plurality of SQL injection samples, and preprocessing the plurality of SQL injection samples as training data; wherein the SQL injection samples include traffic data related to SQL injection attacks; performing three-stage training on a security big model using the preprocessed training data; wherein the first stage is unsupervised pre-training using the preprocessed training data, the second stage is first fine-tuning using a Mixture of Experts architecture and a multi-task head form, and the third stage is secondary fine-tuning using a comparative learning method; receiving traffic data to be detected, inputting the traffic data to be detected into a trained security detection big model for processing, and detecting SQL injection attacks in the traffic data to be detected.

[0008] Optionally, the traffic data is preprocessed, including: cleaning invisible characters, continuous repeated characters, special characters and redundant spaces in the SQL injection sample, and unifying the message format; dividing the continuous text in the SQL injection sample into independent words or phrases; sorting the high-frequency words in the SQL injection sample, and filtering out stop words; wherein the stop words are words that appear frequently in the text but contribute less to text analysis.

[0009] Optionally, the first fine-tuning using the Mixture of Experts architecture and the multi-task head form includes: training a single SQL injection sample using a cross entropy loss function of a single-label classification task.

[0010] Optionally, secondary fine-tuning is performed using a contrastive learning method, including: the SQL injection samples and white samples are combined into positive and negative sample pairs for contrastive learning; wherein the positive sample pair is composed of two SQL injection samples or two white samples, and the negative sample pair is composed of an SQL injection sample and a white sample, and the contrastive loss is used to make the positive sample pair close in the representation space, and the negative sample pair far away in the representation space.

[0011] Optionally, the traffic data to be detected is input into a trained security detection large model for processing to detect SQL injection attacks in the traffic data to be detected, including: vectorizing the traffic data to be detected to obtain vectorized traffic data to be detected; using the trained security detection large model to detect the vectorized traffic data to be detected, if the vectorized traffic data to be detected contains SQL attack statements, it is determined that the traffic data to be detected has an SQL injection attack.

[0012] Optionally, the method further includes: performing threat analysis on the detected SQL injection attack, characterizing the attack purpose, determining the attack payload, determining the attack method, analyzing the attack results, and generating countermeasures.

[0013] Optionally, threat analysis, attack purpose characterization, attack payload determination, attack method determination, attack result analysis and countermeasure generation are performed on the detected SQL injection attack, including: threat type analysis of the detected SQL injection attack, and output of the corresponding attack type; wherein the attack type includes command injection and Java deserialization; analysis is performed in combination with the attack type, message content and attack payload, and the corresponding attack purpose is output; wherein the attack purpose includes network sniffing and remote code execution; analysis of the attack payload obfuscation means is performed, and corresponding tools are called for decoding and restoration; analysis of the utilization principle and harmful result of the attack payload is performed in combination with the context, and corresponding interpretation content is generated; analysis of whether there are clues of successful attack is performed in combination with the analysis result of the attack payload and the response message, and corresponding result judgment is given; if the analysis result is that the attack is successful, corresponding disposal suggestions are generated according to the attack type.

[0014] According to another aspect of an embodiment of the present application, a SQL injection attack detection system is provided, comprising: a data preprocessing module, used to collect multiple SQL injection samples, and preprocess the multiple SQL injection samples as training data; wherein the SQL injection samples include traffic data related to SQL injection attacks; a model training module, used to perform three-stage training on a large security model using the preprocessed training data; wherein the first stage is unsupervised pre-training using the preprocessed training data, the second stage is first fine-tuning using a Mixture of Experts architecture and a multi-task head form, and the third stage is secondary fine-tuning using a comparative learning method; an attack detection module, used to receive traffic data to be detected, input the traffic data to be detected into a trained large security detection model for processing, and detect SQL injection attacks in the traffic data to be detected.

[0015] According to another aspect of an embodiment of the present application, an electronic device is provided, including: a processor, and a memory storing a program, wherein the program includes instructions, and when the instructions are executed by the processor, the processor executes the SQL injection attack detection method described above.

[0016] According to another aspect of an embodiment of the present application, a non-transitory machine-readable medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the SQL injection attack detection method described above.

[0017] In the embodiment of the present application, a large number of SQL injection samples are first collected and preprocessed as training data, and then the security model is trained in three stages: unsupervised pre-training, first fine-tuning based on the Mixture of Experts architecture, and secondary fine-tuning by contrastive learning. The security detection model trained in this way can effectively identify various types of SQL injection attacks, including those highly obfuscated and concealed attack methods. When receiving the traffic data to be detected, these data can be input into the trained large model for processing to achieve efficient detection of SQL injection attacks, thereby solving the technical problem that the traditional SQL injection attack detection method has obvious detection capabilities and insufficient flexibility for complex and changeable advanced SQL injection attacks (especially attacks using highly adversarial means such as obfuscation, encoding, and protocol anomalies), and achieving the technical effect of significantly improving the accuracy and efficiency of SQL injection attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can be obtained based on these drawings without creative work.

[0019] Figure 1 A flowchart of a SQL injection attack detection method provided in an embodiment of the present application;

[0020] Figure 2 A schematic diagram of the training data preparation phase, model development phase, and model application phase provided in an embodiment of the present application;

[0021] Figure 3 A schematic diagram of implementing the forward propagation and back propagation processes in a model between a CPU and a GPU provided in an embodiment of the present application;

[0022] Figure 4 A schematic diagram of a three-stage training of a large security model provided in an embodiment of the present application;

[0023] Figure 5 A schematic diagram of a SQL injection attack detection system provided in an embodiment of the present application;

[0024] Figure 6 A schematic diagram of the safety model analysis and judgment process provided in the embodiment of the present application;

[0025] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the embodiments of the present application can be implemented in various forms and should not be interpreted as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the embodiments of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0027] According to one aspect of an embodiment of the present application, a method for detecting a SQL injection attack is provided. Figure 1 The flowchart of the SQL injection attack detection method provided in the embodiment of the present application is as follows: Figure 1 As shown, the method comprises the following steps:

[0028] Step S102, collecting multiple SQL injection samples, and pre-processing the multiple SQL injection samples as training data; wherein the SQL injection samples include traffic data related to SQL injection attacks.

[0029] Step S104, using the preprocessed training data to perform three-stage training on the security model; wherein the first stage is unsupervised pre-training using the preprocessed training data, the second stage is the first fine-tuning using the Mixture of Experts architecture and the multi-task head form, and the third stage is the secondary fine-tuning through the comparative learning method.

[0030] Step S106, receiving the traffic data to be detected, inputting the traffic data to be detected into the trained security detection model for processing, and detecting SQL injection attacks in the traffic data to be detected.

[0031] The above-mentioned trained security detection model supports injection attack detection on various databases, and is particularly good at detecting various combined attack methods such as syntax obfuscation, multi-layer encoding, and protocol anomalies. It makes up for the shortcomings of traditional defense technology and filters the key information of SQL injection, thereby effectively preventing website servers from being attacked by SQL injection.

[0032] In the embodiment of the present application, a large number of SQL injection samples are first collected and preprocessed as training data, and then the security model is trained in three stages: unsupervised pre-training, first fine-tuning based on the Mixture of Experts architecture, and secondary fine-tuning by contrastive learning. The security detection model trained in this way can effectively identify various types of SQL injection attacks, including those highly obfuscated and concealed attack methods. When receiving the traffic data to be detected, these data can be input into the trained large model for processing to achieve efficient detection of SQL injection attacks, thereby solving the technical problem that the traditional SQL injection attack detection method has obvious detection capabilities and insufficient flexibility for complex and changeable advanced SQL injection attacks (especially attacks using highly adversarial means such as obfuscation, encoding, and protocol anomalies), and achieving the technical effect of significantly improving the accuracy and efficiency of SQL injection attack detection.

[0033] Figure 2 The schematic diagram of the training data preparation stage, model development stage and model application stage provided in the embodiment of the present application is as follows: Figure 2 As shown in the figure, the processes of data facilities, training facilities and application facilities correspond to the training data preparation stage, model development stage and model application stage respectively. The training data preparation stage, model development stage and model application stage are explained below.

[0034] Training data preparation stage: There are eight types of raw data for training security detection models, namely network device data, terminal device data, threat intelligence data, code script data, security document data, security advice data, vulnerability data and general corpus data. The collected data is stored in the database in JSON or CSV format. Data preprocessing plays a vital role in the field of natural language processing (NLP) security. First, data preprocessing helps to clean and normalize text data, thereby reducing potential security risks. By removing malicious code, tokenizing text and filtering sensitive information, the risk of malicious attacks and data leakage can be effectively reduced. Secondly, data preprocessing can help build a more robust and reliable NLP security model. By removing noise data, processing missing values ​​and balancing data sets, the accuracy and robustness of the model can be improved, so as to better respond to security threats. Finally, data preprocessing also helps to protect user privacy and comply with relevant regulations. Through means such as anonymization, desensitization and encryption, user personal information can be effectively protected to ensure the compliance and security of the data processing process.

[0035] At the same time, not all prepared data can be used. For the specific goal of SQL injection detection, data needs to be processed again. During the training process, according to the characteristics of model learning, massive data is converted into fine-tuned data in a specific format to improve the ability to understand the attack and defense confrontation mainly based on SQL injection.

[0036] The prepared data includes pre-training scenario data and instruction fine-tuning scenario data. The pre-training scenario data consists of general corpus and domain corpus, and the instruction fine-tuning scenario data consists of domain rough-tuning corpus and domain fine-tuning corpus. For example, general corpus includes but is not limited to CC, GitHub and Wikipedia. The data volume of general corpus is about 1024G in total. Domain corpus includes but is not limited to Web attack traffic, pre-research documents, security tool traffic data and malicious code script data. The data volume of domain corpus is about 200G security corpus in total. Domain rough-tuning corpus includes but is not limited to SQL injection, Java code injection, Java deserialization, malicious encrypted communication, command execution, webshell upload, malicious script, information leakage and XSS attack. The data volume of domain rough-tuning corpus is about 50 million labeled data in total. Domain fine-tuning corpus includes but is not limited to vulnerability explanation, malicious traffic explanation data, command line interpretation content, security sample interpretation, vulnerability attack success sample, obfuscated payload explanation, comparative learning data set, webshell script analysis and difficult samples. The data volume of domain fine-tuning corpus is about 5 million security domain QA pairs in total.

[0037] Model development stage: Use the processed massive security-related data to pre-train the model. Here, the model architecture uses a mixture of experts, and each expert model is trained with different data. And because the model parameters are huge, in order to improve the training efficiency of the model, the detection large model combines data parallelism, tensor parallelism, and pipeline parallelism to speed up. In the coarse tuning stage, by mixing massive unlabeled data and a small amount of labeled security scenario data, using semi-supervised learning strategies, data of different sources and quality are efficiently utilized. This method of joint supervised training and self-supervised learning objectives helps solve the problem of mismatch between pre-training and downstream tasks, and enables the large model to have certain general security capabilities. In the fine tuning stage, by using high-quality labeled data and difficult sample data, and adding comparative learning auxiliary tasks, the model can further improve its performance in security confrontation scenarios, and at the same time enhance the robustness of the security detection large model in different downstream tasks.

[0038] Model application stage: The large security detection model mainly uses four methods to improve the reasoning performance, namely knowledge distillation, model quantization, model pruning and attention mechanism optimization. Knowledge distillation is a model compression technology that transfers the knowledge of large and complex models to small models to reduce the size and reasoning time of the model while maintaining high accuracy. Model quantization converts the floating-point parameters in the model into low-precision integer representations to reduce the storage and computing requirements of the model. Model pruning simplifies the model structure by removing redundant or unimportant parameters, thereby increasing the reasoning speed and reducing resource consumption. Attention mechanism optimization improves the attention mechanism in the model to make the model more efficient and accurate when processing data.

[0039] At the same time, in order to improve the efficiency of model calculation, by transferring part of the calculation and parameter storage to the CPU for execution, a single GPU can efficiently train large-scale neural networks. Through specific algorithms, the optimal calculation and data partitioning strategy between the CPU and GPU is determined to reduce communication bottlenecks, improve training efficiency, and effectively increase the model scale under unit computing power.

[0040] Figure 3 A schematic diagram of the forward propagation and reverse propagation process in the model implemented between the CPU and the GPU provided in the embodiment of the present application, such as Figure 3 As shown in the figure, forward pass: Tensor1 is the input tensor, which represents the input data of the model; Op1 is an operation, which represents a certain calculation or transformation of the input tensor; Y1 is the result of the Op1 operation, which represents the output after Op1 processing; Op2 is another operation, which represents further calculation or transformation of Y1; Y2 is the result of the Op2 operation, which represents the final output after Op2 processing. Backward pass: Op2-BP is the back propagation part of the Op2 operation, which represents the calculation of the gradient of the Op2 operation; Op1-BP is the back propagation part of the Op1 operation, which represents the calculation of the gradient of the Op1 operation. Tensor Flow: Tensor1 means that in the forward propagation, the input tensor Tensor1 becomes Y1 after the Op1 operation, and Y1 becomes Y2 after the Op2 operation; Tensor2 means that in the reverse propagation, the gradient is calculated starting from Y2, and the gradients of Op2 and Op1 are calculated through Op2-BP and Op1-BP respectively. Therefore, the forward propagation starts from the input tensor Tensor1, and after the Op1 and Op2 operations, the output Y2 is finally obtained. The reverse propagation starts from the output Y2, and the gradient is calculated through Op2-BP and Op1-BP to update the model parameters.

[0041] As an optional embodiment, the traffic data is preprocessed, including: cleaning invisible characters, continuous repeated characters, special characters and redundant spaces in the SQL injection samples, and unifying the message format; dividing the continuous text in the SQL injection samples into independent words or phrases; sorting the high-frequency words in the SQL injection samples, and filtering out stop words; wherein stop words are words that appear frequently in the text but contribute less to text analysis.

[0042] The purpose of text cleaning is to remove noise and unnecessary information from the text, thereby fundamentally improving the quality and security of the content generated by the model. For example, invisible characters, consecutive repeated characters, special characters, and extra spaces in SQL injection HTTP messages can be removed. In addition, the format of the message needs to be unified, for example, all text content is converted to lowercase to reduce the impact of different representations of the same word on the model.

[0043] Word segmentation is the process of dividing continuous text into independent words or phrases. In SQL injection sample processing, word segmentation is particularly important because there are no obvious word boundaries. Optionally, the word segmentation method of BPE is used.

[0044] Stop words refer to words that appear frequently in text but contribute little to text analysis. The TF-IDF algorithm is used to sort the high-frequency words in all SQL injection samples, and filter out high-frequency words that contribute little to classification. Removing stop words can reduce the dimension of the text and improve the training efficiency of the model.

[0045] Figure 4 A schematic diagram of a three-stage training of a large security model provided in an embodiment of the present application, such as Figure 4As shown in the figure, compared with the two-stage training method (pre-training + fine-tuning) of the general large model, the detection large model pioneered a three-stage training method. The first stage is unsupervised pre-training of large-scale corpus (security + general), the second stage fine-tuning uses the Mixture of Experts architecture and multi-task head for the first fine-tuning, and the third stage is fine-tuned by contrastive learning method, which makes the model more robust and greatly reduces the hallucination problem of the model. Specifically in high-confusion confrontation (multi-layer encoding, protocol anomalies, grammar confusion, etc.): the model learns more than dozens of confusion confrontation methods for each SQL attack method, including but not limited to encoding confusion confrontation, grammar confusion confrontation, protocol confusion confrontation, data compression confusion, and the combined attack behavior of these confusion methods. Compared with the traditional single-label classification task, each sample can only have one label, but the high-confusion attack is infinitely variable, so the traditional SQL attack recognition has a high rate of misjudgment and missed judgment. This solution uses the Mixture of Experts architecture and multi-task head for the first fine-tuning at the high-confusion confrontation level, and the third stage is fine-tuned by contrastive learning method. Aiming at the specific goal of SQL injection detection, the second stage of fine-tuning uses high-quality SQL injection attack annotated data and difficult sample data, and adds contrastive learning auxiliary tasks. Not only positive samples (correct questions) but also negative samples (wrong questions) are used to further improve the performance of SQL injection attack prediction results, reduce hallucinations, and enhance robustness on different downstream tasks. Through the above three-stage large model training method, the new SQL detection engine has the ability to resist high confusion (multiple attack combinations).

[0046] As an optional embodiment, the Mixture of Experts architecture and the multi-task head are used for the first fine-tuning, including: using the cross entropy loss function of the single-label classification task to train a single SQL injection sample.

[0047] In the two-stage fine-tuning stage, the cross entropy loss function of the single-label classification task is used (the binary classification task is included in it). For a single sample, it is assumed that the true distribution is , the distribution of network output is The total number of categories is , then in this case, the calculation formula of the cross entropy loss function is: ; As an optional embodiment, secondary fine-tuning is performed through a contrastive learning method, including: SQL injection samples and white samples are combined into positive and negative sample pairs for contrastive learning; wherein the positive sample pair is composed of two SQL injection samples or two white samples, and the negative sample pair is composed of an SQL injection sample and a white sample, and the contrast loss is used to make the positive sample pair close in the representation space and the negative sample pair far away in the representation space.

[0048] In the three-stage contrastive learning fine-tuning stage, SQL injection samples and white samples are paired into contrastive learning data sets. The positive sample pair is composed of two SQL injection samples or two white samples, and the negative sample pair is composed of SQL injection samples and white samples. The contrast loss is used to make the positive sample pairs (similar sample pairs) close in the representation space, while the negative sample pairs (dissimilar sample pairs) are far away. The calculation formula is: ; in, Indicates the label, represents a positive sample pair, represents a negative sample pair, represents the Euclidean distance of sample pairs, is a hyperparameter representing the minimum distance between pairs of negative samples.

[0049] As an optional embodiment, the traffic data to be detected is input into a trained security detection large model for processing to detect SQL injection attacks in the traffic data to be detected, including: vectorizing the traffic data to be detected to obtain vectorized traffic data to be detected; using the trained security detection large model to detect the vectorized traffic data to be detected, if the vectorized traffic data to be detected contains SQL attack statements, it is determined that the traffic data to be detected has an SQL injection attack.

[0050] The security detection big model is based on traffic understanding + attack understanding. From the perspective of a "security expert", it will conduct threat analysis on the web traffic transmitted in the network to check whether the network contains data packets that conform to SQL statements. After the HTTP traffic in the network is sent to the security detection big model for detection, it will still be vectorized first. The vectorized traffic will be directly handed over to the big model for reasoning. It can be understood that the vectorized traffic is the "language" that the security detection big model can understand. Because the big model has mastered various SQL syntax structures through learning, if the vectorized traffic contains SQL attack statements, the security detection big model can directly identify them based on attack and defense understanding and characterize them as SQL injection attacks.

[0051] As an optional embodiment, the above method also includes: performing threat analysis on the detected SQL injection attack, characterizing the attack purpose, determining the attack payload, determining the attack method, analyzing the attack results, and generating countermeasures.

[0052] Figure 6 A schematic diagram of the safety model analysis and judgment process provided in the embodiment of the present application is as follows: Figure 6 As shown, threat analysis, attack purpose characterization, attack payload determination, attack method determination, attack result analysis and countermeasure generation of the detected SQL injection attack include: threat type analysis of the detected SQL injection attack, and output of the corresponding attack type; wherein the attack types include command injection and Java deserialization; analysis is performed in combination with the attack type, message content and attack payload, and the corresponding attack purpose is output; wherein the attack purposes include network sniffing and remote code execution; analysis of the attack payload obfuscation means, and calling of the corresponding tools for decoding and restoration; analysis of the utilization principle and harmful result of the attack payload in combination with the context, and generation of the corresponding interpretation content; analysis of whether there are clues of successful attack in combination with the analysis results of the attack payload and the response message, and giving the corresponding result judgment; if the analysis result is that the attack is successful, the corresponding disposal suggestion is generated according to the attack type.

[0053] Optionally, when restoring and analyzing the attack statement, the attack result is qualitatively analyzed by combining the attack payload in the request and the analysis result of the response message. For example, the large model will first briefly explain what attack obfuscation means (such as base64 encoding, URL encoding, etc.) the payload uses. If there is no obvious obfuscation means, no description will be given; the large model will restore the payload one by one according to the obfuscation means, and try its best to restore the obfuscated payload to the most simplified payload content, and display it intuitively.

[0054] When an SQL injection attack is identified, the security detection model combines the attack type, full message content, and attack payload to analyze the attacker's intentions, such as obtaining sensitive user information through SQL statements, exporting sensitive data tables through SQL statements, executing system command operations through SQL statements, and writing malicious files.

[0055] When analyzing attack methods, the security detection model will combine the context of the payload in the request, briefly analyze the utilization principle of the payload, and analyze the possible harm after its execution based on the specific content in the message.

[0056] When analyzing the attack results, the security detection model will understand the intent of the payload and analyze the response message based on the intent to see if there is any possible echo content of the payload, so as to determine whether the attack is successful. The basis for the analysis will be clearly displayed (for example, if the response status code is 404 and there is no payload-related echo in the response message, it is considered that the attack has failed).

[0057] During the model deployment process, the security detection large model needs to be integrated into the existing security system to achieve real-time detection and defense against SQL injection attacks. During the deployment process, the compatibility, performance, and scalability of the model need to be considered. In order to ensure the stable operation of the model in different environments, sufficient testing and optimization are required. In addition, a complete monitoring and maintenance mechanism needs to be established to deal with potential model degradation and changes in attack patterns. During the continuous optimization and iteration of the model, new security data and feedback information need to be continuously collected to continuously improve the detection capability and accuracy of the model. Through regular model updates and training, it can be ensured that the detection large model can adapt to the ever-changing attack methods and security threats.

[0058] The following example problem about SQL malicious traffic detection compares the security detection model (SecurityGPT) provided in the embodiment of the present application with the traditional model (Control 1, Control 2) in terms of effect verification, as shown in Table 1.

[0059] Question: Is it possible that the following traffic is malicious SQL traffic? Traffic example: GET / index.php?id=%1%29%20%A%N%D%20%51%3%3D%3D%B%M%S_%P%P%E.%R%E%C%E%V%E_%M%E%S%A%G%E%28%C%H%R%28%85%29%7 C%7C%7C%H%R%28%97%29%7C%7C%a%H%R%28%76%29%7C%7C%H%R%28%99%29%2C%51%29%20%A%N%D%20%28%81%4%9%3D%81%4%9 HTTP / 1.1 Accept-Encoding: gzip,deflate Host: 10.251.0.189 Accept: * / * User-Agent: Mozilla / 4.0 (compatible; MSIE 6.01; Windows NT 6.0) Connection: close Cache-Control: no-cache Table 1 Model effect verification: Table 1

[0060] Table 1 above shows the accuracy of different models in detecting SQL injection attacks. SecurityGPT has the highest accuracy, reaching 98.34%.

[0061] Furthermore, compared with traditional network security detection technology, the security detection model has the following significant advantages and improvements:

[0062] a) Stronger detection capabilities: The security detection model absorbs multiple levels of knowledge, including code semantics, asset information, threat intelligence, and security attack and defense. Through the training of massive traffic, code, security logs and other specific security data, the security model can achieve highly accurate SQL injection attack traffic detection and interpretation.

[0063] b) Various SQL injection threats have generalization capabilities: Benefiting from the training of massive security knowledge, the large security detection model has strong generalization capabilities and can effectively detect advanced SQL injection threats such as Web 0day vulnerabilities, highly adversarial obfuscation, protocol bypass, etc.

[0064] c) Automatic identification and interpretation of SQL injection: The security detection model can automatically identify meaningless characters in obfuscated code lines, remove them based on its understanding, and restore them to the original commands. This capability enables the model to not only detect attacks, but also interpret and judge logic, thereby helping operators understand hidden threats.

[0065] d) Advanced SQL injection threat detection: In the fight against SQL vulnerabilities, the security detection big model can identify and block advanced and hidden attacks. Traditional detection mainly uses rules and semantic engines, while the security detection big model uses big model technology to more deeply understand the attacker's language intentions, strategies, attack techniques and behavior patterns, thereby more effectively detecting such attacks.

[0066] Through these advantages and improvements, the security detection model has significantly improved the accuracy and efficiency of SQL injection detection, and can better cope with complex and changing network security threats.

[0067] According to another aspect of an embodiment of the present application, a SQL injection attack detection system is provided. Figure 5 A schematic diagram of a SQL injection attack detection system provided in an embodiment of the present application is shown in FIG. Figure 5As shown, the SQL injection attack detection system includes: a data preprocessing module 602, a model training module 604 and an attack detection module 606. The SQL injection attack detection system is described in detail below.

[0068] The data preprocessing module 602 is used to collect multiple SQL injection samples and preprocess the multiple SQL injection samples as training data; wherein the SQL injection samples include traffic data related to SQL injection attacks.

[0069] The model training module 604 is used to perform three-stage training on the large security model using the preprocessed training data; the first stage is unsupervised pre-training using the preprocessed training data, the second stage is the first fine-tuning using the Mixture of Experts architecture and the multi-task head form, and the third stage is the secondary fine-tuning through the comparative learning method.

[0070] The attack detection module 606 is used to receive the traffic data to be detected, input the traffic data to be detected into the trained security detection model for processing, and detect SQL injection attacks in the traffic data to be detected.

[0071] In an embodiment of the present application, the system first collects and preprocesses a large number of SQL injection samples as training data, and then performs three-stage training on the security model: unsupervised pre-training, first fine-tuning based on the Mixture of Experts architecture, and secondary fine-tuning by contrastive learning. The security detection model trained in this way can effectively identify various types of SQL injection attacks, including those highly obfuscated and concealed attack methods. When receiving the traffic data to be detected, these data can be input into the trained large model for processing to achieve efficient detection of SQL injection attacks, thereby solving the technical problem that the traditional SQL injection attack detection method has obvious detection capabilities and insufficient flexibility for complex and changeable advanced SQL injection attacks (especially attacks using highly adversarial means such as obfuscation, encoding, and protocol anomalies), and achieving the technical effect of significantly improving the accuracy and efficiency of SQL injection attack detection.

[0072] It should be noted here that the above-mentioned data preprocessing module 602, model training module 604 and attack detection module 606 correspond to steps S102 to S106 in the method embodiment, and the examples and application scenarios implemented by the above-mentioned modules are the same as those of the corresponding steps, but are not limited to the contents disclosed in the above-mentioned method embodiment.

[0073] Optionally, the data preprocessing module 602 includes: a text cleaning unit, which is used to clean invisible characters, continuous repeated characters, special characters and redundant spaces in the SQL injection sample and unify the message format; a text segmentation unit, which is used to segment the continuous text in the SQL injection sample into independent words or phrases; a text screening unit, which is used to sort the high-frequency words in the SQL injection sample and screen out stop words; wherein stop words are words that appear frequently in the text but contribute less to the text analysis.

[0074] Optionally, the above-mentioned model training module 604 includes: a model fine-tuning unit, which is used to train a single SQL injection sample using a cross entropy loss function of a single-label classification task.

[0075] Optionally, the above-mentioned model training module 604 includes: a model fine-tuning unit, used to combine SQL injection samples and white samples into positive and negative sample pairs for comparative learning; wherein, the positive sample pair is composed of two SQL injection samples or two white samples, and the negative sample pair is composed of SQL injection samples and white samples, and the contrast loss is used to make the positive sample pair close in the representation space, and the negative sample pair far away in the representation space.

[0076] Optionally, the above-mentioned attack detection module 606 includes: a vectorization processing unit, which is used to vectorize the traffic data to be detected to obtain vectorized traffic data to be detected; an attack detection unit, which is used to use a trained large security detection model to detect the vectorized traffic data to be detected. If the vectorized traffic data to be detected contains SQL attack statements, it is determined that there is an SQL injection attack in the traffic data to be detected.

[0077] Optionally, the above system also includes: an attack analysis and measure generation module, which is used to perform threat analysis, attack purpose characterization, attack payload analysis, attack method analysis, attack result analysis and countermeasure generation on the detected SQL injection attack.

[0078] Optionally, the above-mentioned attack analysis and measure generation module includes: a first analysis unit, which is used to perform threat type analysis on the detected SQL injection attack and output the corresponding attack type; wherein the attack types include command injection and Java deserialization; a second analysis unit, which is used to analyze in combination with the attack type, message content and attack payload, and output the corresponding attack purpose; wherein the attack purpose includes network sniffing and remote code execution; a third analysis unit, which is used to analyze the attack payload obfuscation method and call the corresponding tool for decoding and restoration; a fourth analysis unit, which is used to analyze the utilization principle and harmful result of the attack payload in combination with the context, and generate corresponding interpretation content; a fifth analysis unit, which is used to analyze whether there are clues of successful attack in combination with the analysis results of the attack payload and the response message, and give a corresponding result judgment; a measure generation unit, which is used to generate corresponding disposal suggestions according to the attack type if the analysis result is that the attack is successful.

[0079] According to another aspect of an embodiment of the present application, an electronic device is provided, including: a processor, and a memory storing a program, wherein the program includes instructions, and when the instructions are executed by the processor, the processor executes the SQL injection attack detection method of the embodiment of the present application.

[0080] According to another aspect of an embodiment of the present application, a non-transitory machine-readable medium storing computer instructions is provided, where the computer instructions are used to enable a computer to execute the SQL injection attack detection method of the embodiment of the present application.

[0081] The embodiment of the present application further provides a computer program product, including a computer program, wherein the computer program, when executed by a processor of a computer, is used to enable the computer to execute the SQL injection attack detection method of the embodiment of the present application.

[0082] refer to Figure 7 , the structural block diagram of the electronic device that can be used as the server or client of the embodiment of the present application will now be described, which is an example of the hardware device that can be applied to various aspects of the present application. The electronic device is intended to represent various forms of digital electronic computer equipment, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples, and are not intended to limit the implementation of the present application described and / or required herein.

[0083] like Figure 7As shown, the electronic device includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 to a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0084] Multiple components in the electronic device are connected to the I / O interface 705, including: an input unit 706, an output unit 707, a storage unit 708, and a communication unit 709. The input unit 706 can be any type of device that can input information to the electronic device, and the input unit 706 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 707 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 708 can include but is not limited to a disk, an optical disk. The communication unit 709 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, and a wireless communication transceiver, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0085] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing units, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present application may be implemented as a computer program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via a ROM 702 and / or a communication unit 709. In some embodiments, the computing unit 701 may be configured to perform the above method in any other appropriate manner (e.g., by means of firmware).

[0086] The computer program for implementing the method of the embodiment of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0087] In the context of the embodiments of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared systems, devices, or equipment, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0088] It should be noted that the term "including" and its variations used in the embodiments of the present application are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present application are illustrative and not restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0089] The various steps described in the method implementation methods provided in the embodiments of the present application can be performed in different orders and / or in parallel. In addition, the method implementation methods may include additional steps and / or omit the steps shown. The scope of protection of the present application is not limited in this respect.

[0090] The term "embodiment" in this specification refers to specific features, structures or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. The various embodiments in this specification are described in a related manner, and the same or similar parts between the various embodiments refer to each other. In particular, for the device, equipment, and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment.

[0091] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A SQL injection attack detection method, characterized in that: include: Receive traffic data to be detected, input the traffic data to be detected into a trained security detection model for processing, and detect SQL injection attacks in the traffic data to be detected; Wherein, the method further comprises: Perform threat analysis, attack purpose characterization, attack payload analysis, attack method analysis, attack result analysis, and countermeasure generation for detected SQL injection attacks, specifically: Perform threat type analysis on detected SQL injection attacks and output corresponding attack types; wherein the attack types include command injection and Java deserialization; Analyze the attack type, message content and attack payload, and output the corresponding attack purpose; wherein the attack purpose includes network sniffing and remote code execution; Analyze the attack payload obfuscation methods and call corresponding tools to decode and restore; Analyze the attack payload’s utilization principle and harmful consequences based on the context and generate corresponding interpretation content; Combined with the analysis results of the attack payload and the response message, analyze whether there are clues of successful attack and give corresponding result judgment; If the analysis result is that the attack is successful, corresponding disposal suggestions are generated based on the attack type.

2. The SQL injection attack detection method according to claim 1, characterized in that: Inputting the traffic data to be detected into the trained security detection model for processing, detecting SQL injection attacks in the traffic data to be detected, including: Vectorizing the flow data to be detected to obtain vectorized flow data to be detected; The trained security detection large model is used to detect the vectorized traffic data to be detected. If the vectorized traffic data to be detected contains SQL attack statements, it is determined that the traffic data to be detected has an SQL injection attack.

3. A SQL injection attack detection system, characterized in that: include: An attack detection module is used to receive the traffic data to be detected, input the traffic data to be detected into the trained security detection model for processing, and detect SQL injection attacks in the traffic data to be detected; The system also includes: an attack analysis and measures generation module, which is used to perform threat analysis, attack purpose characterization, attack payload analysis, attack method analysis, attack result analysis, and countermeasure generation on the detected SQL injection attack; The attack analysis and measures generation module includes: A first analysis unit is used to analyze the threat type of the detected SQL injection attack and output the corresponding attack type; wherein the attack type includes command injection and Java deserialization; A second analysis unit is used to analyze the attack type, message content and attack payload, and output a corresponding attack purpose; wherein the attack purpose includes network sniffing and remote code execution; The third analysis unit is used to analyze the attack payload obfuscation method and call the corresponding tool to decode and restore; The fourth analysis unit is used to analyze the utilization principle and harmful result of the attack payload in combination with the context and generate corresponding interpretation content; A fifth analysis unit, used to analyze whether there are clues of successful attack based on the analysis results of the attack payload and the response message, and give a corresponding result judgment; The measure generation unit is used to generate corresponding disposal suggestions according to the attack type if the analysis result is that the attack is successful.

4. An electronic device comprising: A processor and a memory storing a program, wherein the program includes instructions, and when the instructions are executed by the processor, the processor executes the SQL injection attack detection method according to any one of claims 1 to 2.

5. A non-transitory machine-readable medium storing computer instructions, characterized in that: The computer instructions are used to enable the computer to execute the SQL injection attack detection method according to any one of claims 1 to 2.

Images