SQL injection attack identification method and system based on deep learning
By combining the BERT and WGAN models to capture the deep semantic features and data distribution of SQL statements, the problem that traditional methods have difficulty in identifying SQL injection attacks in complex scenarios is solved, and high-precision and adaptive attack identification capabilities are achieved.
Patent Information
- Application Number
- CN202510798129.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-16
- Publication Date
- 2025-10-03
AI Technical Summary
Existing traditional SQL injection attack prevention technologies have limited defense effectiveness when facing complex application scenarios and new attack methods. Traditional machine learning methods find it difficult to effectively learn the complex structure and semantic features of SQL statements.
Combining the BERT and WGAN models, the bidirectional encoder of BERT is used to capture the deep semantic features of SQL statements. The WGAN generator and discriminator learn the data distribution characteristics of SQL injection attacks through adversarial training, generating samples similar to real attack samples to improve recognition capabilities.
It significantly improves the recognition accuracy and generalization ability of SQL injection attacks, reduces the false alarm rate, has adaptive learning capabilities, can continuously adapt to new attack patterns, and is easy to integrate into existing network security architecture.
Smart Images
Figure CN120743925A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of SQL recognition technology, and in particular to a method and system for identifying SQL injection attacks based on deep learning. Background Art
[0002] In the digital age, network applications widely rely on databases to store and manage data. As a key language for interacting with databases, SQL's security is paramount. SQL injection attacks are a common and highly destructive cyberattack. By maliciously inserting SQL code snippets into user input or other data sources, attackers exploit vulnerabilities in applications that lack sufficient input validation to illegally obtain sensitive database information, tamper with data, or perform malicious operations such as leaking user accounts and passwords and compromising database integrity. This can lead to significant financial losses, reputational damage, and compromised user privacy for businesses.
[0003] Traditional SQL injection attack prevention techniques primarily include input filtering and parameterized queries. Input filtering prevents potential attacks by checking user input for specific dangerous characters or patterns. However, this approach is prone to false positives and false negatives, as legitimate input can contain similar combinations of dangerous characters, and attackers can employ various encoding and distortion techniques to circumvent simple filtering mechanisms. Parameterized queries improve security to a certain extent, but their effectiveness remains limited for complex application scenarios and emerging attack methods.
[0004] With the development of machine learning technology, machine learning-based SQL injection attack identification methods have gradually attracted attention. Early machine learning methods such as rule-based classifiers and support vector machines (SVMs) have been applied in this field. However, these traditional machine learning methods often struggle to automatically learn sufficiently effective feature representations when processing text data with complex structure and semantics, such as SQL statements. For example, rule-based methods require the careful design of numerous rules and are difficult to adapt to ever-changing attack patterns. SVMs can also face challenges in computational efficiency and generalization when processing large-scale, high-dimensional data.
[0005] In view of this, it is necessary to study a SQL injection attack identification method and system based on deep learning. Summary of the Invention
[0006] In response to the problems in the prior art, the present invention provides a method and system for identifying SQL injection attacks based on deep learning, combining BERT with WGAN for application in SQL injection attack identification. BERT (Bidirectional Encoder Representations from Transformers), as an advanced pre-trained language model, performs excellently in a variety of natural language processing tasks. It can capture the bidirectional semantic information of the text and is very suitable for semantic modeling of SQL statements. At the same time, generative adversarial networks (GANs) and their variants have demonstrated powerful capabilities in areas such as image generation and data enhancement. Among them, WGAN (Wasserstein Generative Adversarial Network) can better generate high-quality data distributions by improving the training stability and optimization objectives of GANs. Therefore, the present invention can improve the recognition accuracy and generalization ability of SQL injection attacks to cope with the increasingly complex and changing network security threat environment. The specific technical solutions are as follows:
[0007] A SQL injection attack identification method based on deep learning includes the following steps:
[0008] Step S1, collecting historical SQL query real data and SQL query data to be tested from multiple actual application scenarios and preprocessing them to obtain preprocessed historical SQL query real data and SQL query data to be tested;
[0009] Step S2: converting the pre-processed historical SQL query real data and the SQL query data to be tested into vector form to obtain a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested;
[0010] Step S3: Input the vector sequence of historical SQL query real data and the vector sequence of the SQL query data to be tested into the BERT model to obtain the historical SQL real feature vector and the vector sequence of the SQL query data to be tested;
[0011] Step S4, constructing a WGAN model, wherein the WGAN model includes a WGAN generator and a WGAN discriminator;
[0012] Step S5: Using historical SQL real feature vectors to train the WGAN generator to obtain a trained WGAN generator; using the trained WGAN generator to generate simulated SQL injection attack samples;
[0013] Step S6: Use historical SQL real feature vectors and simulated SQL injection attack samples to train the WGAN discriminator to obtain a trained WGAN discriminator;
[0014] Step S7: Input the vector sequence of the SQL query data to be tested into the trained WGAN discriminator to obtain the injection attack category of the SQL query data to be tested.
[0015] Preferably, the pre-processing of the historical SQL query real data in step S1 includes URL decoding, normalization, word segmentation, and tagging of the historical SQL query statements in the historical SQL query real data.
[0016] Preferably, pre-processing the SQL query data to be tested includes performing URL decoding, normalization processing, and word segmentation processing on the SQL query statement to be tested in the SQL query data to be tested.
[0017] Preferably, in step S2, the Word2Vec tool is selected to convert the preprocessed historical SQL query real data and the SQL query data to be tested into vector form, so as to obtain a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested.
[0018] Preferably, step S3 inputs the vector sequence of historical SQL query real data and the vector sequence of the SQL query data to be tested into the BERT model to obtain the historical SQL real feature vector and the vector sequence of the SQL query data to be tested, specifically comprising the following steps:
[0019] Map the vector sequence of historical SQL query real data and the vocabulary units of the vector of the SQL query data to be tested to corresponding indexes through the BERT vocabulary table and convert them into the input vector required by the BERT model;
[0020] The input vector is fed into the BERT model, and the input SQL query statement is encoded through the BERT model's bidirectional encoder, capturing the complex relationships between keywords, operators, and data types in the SQL statement and their contextual information, to obtain the true feature vector of historical SQL and the vector sequence of the SQL query data to be tested.
[0021] Preferably, in step S5, the WGAN generator is trained using the historical SQL real feature vector to obtain the trained WGAN generator, which specifically includes:
[0022] The historical SQL real feature vector is concatenated with the random noise vector to obtain the concatenated vector and used as the input vector of the WGAN generator.
[0023] The WGAN generator includes multiple layers of fully connected layers. The concatenated vectors are input into the WGAN generator, and simulated SQL injection attack samples similar to real SQL query data are gradually generated through nonlinear transformation.
[0024] Preferably, in step S6, the WGAN discriminator is trained using historical SQL real feature vectors and simulated SQL injection attack samples to obtain the trained WGAN discriminator, specifically comprising:
[0025] Wasserstein distance is used as the loss function. During the training process, the convergence of the WGAN model is achieved by alternately optimizing the parameters of the generator and discriminator.
[0026] A deep learning-based SQL injection attack identification system, applying the method described above, includes:
[0027] The data collection and processing module is used to collect historical SQL query real data and SQL query data to be tested from multiple actual application scenarios and perform preprocessing to obtain the preprocessed historical SQL query real data and SQL query data to be tested;
[0028] A vector conversion module is used to convert the pre-processed historical SQL query real data and the SQL query data to be tested into vector form, thereby obtaining a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested;
[0029] The BERT model module is used to input the vector sequence of historical SQL query real data and the vector sequence of the SQL query data to be tested into the BERT model to obtain the real feature vector of the historical SQL and the vector sequence of the SQL query data to be tested;
[0030] A model construction module is used to construct a WGAN model, which includes a WGAN generator and a WGAN discriminator. A generator module is used to train the WGAN generator using real feature vectors of historical SQL statements to obtain a trained WGAN generator. The trained WGAN generator is used to generate simulated SQL injection attack samples.
[0031] The discriminator module is used to train the WGAN discriminator using the real feature vectors of historical SQL and simulated SQL injection attack samples to obtain a trained WGAN discriminator;
[0032] The data recognition module inputs the vector sequence of the SQL query data to be tested into the trained WGAN discriminator to obtain the injection attack category of the SQL query data to be tested.
[0033] A computer-readable storage medium includes a stored program, wherein when the program is run, the device where the computer-readable storage medium is located is controlled to execute the SQL injection attack identification method based on deep learning.
[0034] A processor is used to run a program, wherein the program executes the SQL injection attack identification method based on deep learning when running.
[0035] Compared with the prior art, the present invention has the following beneficial effects:
[0036] In the present invention, the bidirectional encoder of the BERT model can comprehensively consider the contextual information before and after the SQL statement and capture the deep semantic features in the SQL statement. For example, it can understand the complex relationship between keywords, operators and data types in the SQL statement, as well as their meanings in different contexts. This semantic understanding ability provides rich semantic information for the WGAN generator and discriminator, making the generated samples and the discriminant results more accurate. Through adversarial training, the generator and discriminator of WGAN can learn the distribution characteristics of SQL injection attack data. Combined with the semantic information provided by the BERT model, the generator can generate samples that are similar to real SQL injection attack samples in data distribution. The discriminator can identify these samples more accurately, thereby improving the ability to identify SQL injection attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly describes the drawings required for the specific embodiments or the description of the prior art. Similar elements or parts are generally identified by similar reference numerals throughout the drawings. Elements or parts in the drawings are not necessarily drawn to scale.
[0038] Figure 1 Flow chart of the method of the present invention.
[0039] Figure 2 This is a diagram of the BERT-WGAN network model architecture of the present invention.
[0040] Figure 3 This is a system principle diagram of the present invention. DETAILED DESCRIPTION
[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.
[0042] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.
[0043] It should also be understood that the terms used in the present specification are only for the purpose of describing particular embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise.
[0044] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
[0045] Example 1:
[0046] like Figure 1 and Figure 2 As shown, this embodiment provides a SQL injection attack identification method based on deep learning to improve the recognition rate of SQL injection attacks and achieve the purpose of more accurately identifying SQL injection attacks. The bidirectional encoder of the BERT model can capture the deep semantic information of SQL statements and provide rich semantic features for the WGAN model. Through adversarial training, the WGAN model can learn the distribution characteristics of SQL injection attack data and generate samples similar to real attack samples, thereby improving the recognition accuracy and generalization ability of the model. The Word2Vec tool is used to convert text data into vector form to capture the semantic relationship between words, providing high-quality input data for the model. Specifically, the following steps are included:
[0047] Step S1 collects and preprocesses historical SQL query data and test SQL query data from multiple real-world application scenarios to obtain preprocessed historical SQL query data and test SQL query data. These real-world application scenarios include, but are not limited to, various web applications, database management system logs, and network monitoring data to ensure data diversity and comprehensiveness.
[0048] The preprocessing of the historical SQL query real data includes URL decoding, normalization, word segmentation, and tagging of the historical SQL query statements in the historical SQL query real data.
[0049] Preprocessing the SQL query data to be tested includes URL decoding, normalization processing, and word segmentation processing on the SQL query statements to be tested in the SQL query data to be tested.
[0050] Among them, URL decoding specifically restores the encoded special characters to their original form to ensure the accuracy of the data.
[0051] Normalization processing specifically unifies the data format, for example, unifying SQL keywords of different case forms into a standard format, removing redundant spaces and special symbols, making the data consistent and facilitating subsequent processing.
[0052] Word segmentation involves using specialized word segmentation tools to accurately segment SQL query statements into individual words or meaningful symbolic units based on SQL syntax rules and semantic information, providing a foundation for subsequent vectorization operations. The word segmenter divides SQL statements into individual words or subword units based on the vocabulary of the pre-trained model. For example, the statement "SELECT * FROM users WHERE age>18" will be segmented into units such as "SELECT", "*", "FROM", "users", "WHERE", "age", ">", and "18".
[0053] The annotation process specifically involves annotating the category of the SQL statement, that is, annotating the corresponding label (normal or attack).
[0054] It also includes using data augmentation techniques to expand the training set, such as randomly inserting irrelevant characters in SQL queries, deleting some characters, or replacing certain keywords with synonyms to simulate input errors or variations that may occur in the real world.
[0055] Step S2: convert the pre-processed historical SQL query real data and the SQL query data to be tested into vector form to obtain a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested.
[0056] Specifically, the Word2Vec tool is selected to convert the preprocessed historical SQL query real data and the SQL query data to be tested into vector form, and a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested are obtained, with a vector dimension of 128.
[0057] Based on the good performance of the Word2Vec tool in text semantic representation in the field of natural language processing, the tool is used to convert the preprocessed text data into vector form.
[0058] The text vectorization process involves tokenization, vocabulary building, and index creation. Tokenization is the process of breaking a text string into words or lexical units. For SQL queries, this means breaking the query into lexical units such as SELECT, *, FROM, and users; building a vocabulary containing all unique words, which will be used to map each word to a unique integer index; and finally, mapping each word to an integer index, which will be used to train the Word2Vec model.
[0059] There are two main architectures for Word2Vec: CBOW (Continuous Bag of Words) and Skip-Gram. CBOW predicts the current word based on the context, while Skip-Gram predicts the context based on the current word.
[0060] By training on a large-scale corpus (including SQL-related text data), Word2Vec can learn semantic relationships and contextual information between words. In this paper, each word in the SQL query data is mapped to a low-dimensional vector, so that semantically similar words are close in distance in the vector space. This allows the entire SQL query statement to be represented as a vector sequence, providing a suitable input data format for the WGAN model.
[0061] Step S3: Input the vector sequence of historical SQL query real data and the vector sequence of the SQL query data to be tested into the BERT model to obtain the historical SQL real feature vector and the vector sequence of the SQL query data to be tested. This specifically includes the following steps:
[0062] Map the vector sequence of historical SQL query real data and the vocabulary units of the vector of the SQL query data to be tested to corresponding indexes through the BERT vocabulary table, and convert them into the input vector required by the BERT model (such as the sequence of [CLS] and [SEP] tags);
[0063] The input vector is fed into the BERT model, and the input SQL query statement is encoded through the BERT model's bidirectional encoder, capturing the complex relationships between keywords, operators, and data types in the SQL statement and their contextual information, to obtain the true feature vector of historical SQL and the vector sequence of the SQL query data to be tested.
[0064] BERT outputs a fixed-dimensional feature vector that represents the semantic information of the entire SQL query. For example, for the above SQL statement, BERT outputs a feature vector with a dimension of 768 (using BERT-Base as an example).
[0065] In this paper, the BERT model's bidirectional encoder comprehensively considers the contextual information before and after SQL statements, capturing the deep semantic features of SQL statements. For example, it can understand the complex relationships between keywords, operators, and data types in SQL statements, as well as their meanings in different contexts. This semantic understanding capability provides rich semantic information to the WGAN generator and discriminator, making the generated samples and discriminant results more accurate.
[0066] This step also involves pre-training and fine-tuning the BERT model. Specifically, a large-scale SQL statement dataset is used to pre-train the BERT model. The pre-training dataset can include normal SQL query statements collected from public SQL corpora, as well as statements generated by crawling SQL code from open source projects.
[0067] The pre-training task uses a masked language model (MLM) task, which randomly masks some words in the input sequence and asks the model to predict these masked words. In this way, BERT can learn the semantic structure and contextual relationships of SQL statements.
[0068] After pre-training, the BERT model is applied to the SQL injection attack identification task of the present invention. In the fine-tuning stage, the BERT model is fine-tuned using labeled SQL injection attack samples and normal SQL query samples.
[0069] The goal of fine-tuning is to enable the BERT model to better capture the semantic differences between SQL injection attack statements and normal SQL queries. For example, by introducing characteristic SQL injection attack vocabulary (such as UNION, SELECT, --, etc.) and attack patterns during fine-tuning, BERT can learn how these attack features are represented in context. During the fine-tuning phase, the BERT model is combined with the WGAN generator and discriminator, and the BERT model parameters are fine-tuned to make its output feature vector more suitable for WGAN training.
[0070] Through pre-training and fine-tuning of the BERT model, the model can learn universal language representations on large-scale text data. This pre-training gives the model better generalization capabilities and adaptability to different types of SQL injection attack patterns.
[0071] The output feature vector of the BERT model is used as the input of the WGAN generator to generate samples similar to real SQL injection attack samples.
[0072] Step S4: Construct a WGAN model, which includes a WGAN generator and a WGAN discriminator. A major challenge with GANs is unstable training. During training, the discriminator is likely to converge too quickly, causing the loss to reach zero, thus failing to achieve the desired interactive game effect. WGANs effectively address this issue. The main architecture of WGANs is similar to traditional GANs, consisting of a generator and a discriminator. The key difference lies in their loss functions.
[0073] Step S5: Use the historical SQL real feature vectors to train the WGAN generator to obtain a trained WGAN generator; use the trained WGAN generator to generate simulated SQL injection attack samples. Specifically, it includes:
[0074] The historical SQL real feature vector is concatenated with the random noise vector to obtain the concatenated vector and used as the input vector of the WGAN generator. For example, if the feature vector dimension of BERT output is 768 and the random noise vector dimension is 128, the input dimension of the generator is 896.
[0075] The WGAN generator adopts a multi-layer neural network architecture, including multiple fully connected layers. The concatenated vectors are input into the WGAN generator, and simulated SQL injection attack samples similar to real SQL query data are gradually generated through nonlinear transformation.
[0076] By introducing random noise, the generator can not only utilize the semantic information provided by BERT, but also introduce diversity through random noise to generate different SQL injection attack samples.
[0077] Step S6: Use historical SQL real feature vectors and simulated SQL injection attack samples to train the WGAN discriminator to obtain a trained WGAN discriminator. The discriminator is composed of a multi-layer neural network and is used to distinguish between real SQL query data and fake samples generated by the generator. Specifically, it includes:
[0078] The trained WGAN generator is used to generate a large number of simulated SQL injection attack samples, covering a wide range of possible injection methods and attack modes. At the same time, some real normal SQL query data is selected and mixed to construct a training dataset for the anomaly detection model.
[0079] The training dataset is sourced from data collected from multiple real-world application scenarios, including various web applications, database management system logs, network monitoring data, etc. This includes public SQL injection datasets (such as SQLiDB and SQLmap) and SQL query statements generated by crawling open source projects.
[0080] The dataset contains both normal SQL queries and SQL injection attack statements. The attack statements cover common injection types, such as union-based injection, error-based injection, and Boolean blind injection. The average length of normal SQL queries in the dataset is 50 lexical units, while the average length of SQL injection attack statements is 60 lexical units.
[0081] The common keywords (such as SELECT, FROM, WHERE) contained in the dataset have different frequencies of occurrence in normal and attack statements, and the combination and occurrence positions of keywords in attack statements are more complex.
[0082] The data format is that each data contains a SQL query statement and its corresponding label (normal or attack).
[0083] The dataset is divided into training set, validation set and test set, with proportions of 70%, 15% and 15% respectively.
[0084] The dataset contains 100,000 records, of which 60% are normal SQL query statements and 40% are SQL injection attack statements.
[0085] According to the data characteristics and actual needs, the density-based local outlier factor (LOF) algorithm is selected to build a model, and the selected model is trained using a training dataset. This allows the model to learn the characteristic differences between normal SQL query data and abnormal (injection attack) data, thereby having the ability to identify potential SQL injection attacks.
[0086] The Wasserstein distance is used as the loss function. During training, the WGAN model converges by alternately optimizing the parameters of the generator and discriminator. First, the generator parameters are fixed, and the discriminator is trained using real SQL query data and samples generated by the generator, enabling it to accurately distinguish between the two. Then, the discriminator parameters are fixed, and the generator parameters are adjusted based on the discriminator's feedback, making the generator samples more difficult for the discriminator to identify. Through multiple iterations of training, the model's performance is continuously improved, enabling the generator to generate samples with characteristics similar to real SQL injection attack data.
[0087] The loss function of the WGAN discriminator is:
[0088]
[0089] Where E is the expected value, which represents the average of a random variable of a distribution, and x represents the distribution of real data P. data The data points sampled in , P data represents the true data distribution, D(x) represents the output of the discriminator D for the true data point x, and z is the output from the prior noise distribution P zThe random noise sampled in , G(z) is the sample generated by the generator G.
[0090] Wasserstein distance is also called Earth-Mover distance, or EMD for short. It calculates the loss by measuring the distance between the detection or segmentation result and the true annotation. Specifically, it uses Wasserstein distance as a metric, represents the detection or segmentation result as a probability distribution, and represents the true annotation as a uniform distribution. The formula is:
[0091] Where γ is the joint distribution, which means considering P r , and P j The distribution of E (x,y)～ γ represents the expected value of the sample pair (x,y) drawn from the joint distribution γ, and ||xy|| represents the distance between samples x and y.
[0092] The Wasserstein distance is used as the loss function. Compared with the JS divergence or KL divergence commonly used in traditional GAN models, the Wasserstein distance can more stably measure the difference between generated samples and real samples, helping the generator to generate higher quality and more realistic samples, while enabling the discriminator to more accurately judge the authenticity of the samples.
[0093] Furthermore, during WGAN model training, the parameters of the BERT model are fixed, while the parameters of the generator and discriminator are alternately optimized. Using the Wasserstein distance as the loss function, the samples generated by the generator are made closer to real SQL injection attack samples, while the discriminator can more accurately identify attack samples. The training results of WGAN are further optimized by adjusting the weights of the BERT model's output feature vectors.
[0094] Finally, cross-validation is used to evaluate the performance of the WGAN model and determine the optimal parameters of the WGAN model.
[0095] The traditional method (SVM) has an accuracy of 80%, a recall of 70%, and an F1 value of 74%. The accuracy of this method is 95%, the recall is 93%, and the F1 value is 94%.
[0096] The recognition performance of different attack types is as follows:
[0097] Union-based injection attack: accuracy 96%, recall 94%, and F1 value 95%.
[0098] Error-based injection attack: 94% precision, 92% recall, and 93% F1 value.
[0099] Injection attack based on Boolean blind injection: accuracy 93%, recall 91%, and F1 value 92%.
[0100] The model convergence speed is as follows:
[0101] During the training process of the WGAN model, the loss function values of the generator and discriminator gradually stabilized and converged quickly. After 100 epochs of training, the model performance basically reached the optimal level.
[0102] The model generalization capabilities are as follows:
[0103] On the test set, the model achieved an accuracy of 94%, a recall of 92%, and an F1 value of 93% for unseen attack samples, demonstrating good generalization ability.
[0104] The WGAN discriminator inputs include real SQL query data (normal and attack samples) and samples generated by the generator. The feature vectors extracted by BERT are also used to enhance the discriminant's discriminative ability, enabling it to more accurately identify SQL injection attack samples. The discriminator optimizes its parameters by learning the differences between real and generated samples, thereby improving the recognition accuracy of SQL injection attacks.
[0105] Through adversarial training, the WGAN generator and discriminator can learn the distribution characteristics of SQL injection attack data. Combined with the semantic information provided by the BERT model, the generator can generate samples with a data distribution similar to real SQL injection attack samples. The discriminator can then more accurately identify these samples, thereby improving its ability to identify SQL injection attacks.
[0106] WGAN's adversarial training mechanism can further enhance the model's generalization capabilities, enabling it to maintain high recognition accuracy even when faced with new, unseen attack samples. Combining the BERT model's bidirectional encoder with the WGAN generator and discriminator fully leverages BERT's semantic understanding capabilities and WGAN's data generation capabilities, giving the model a significant advantage in capturing the deep semantic information and data distribution characteristics of SQL statements, significantly improving its ability to identify SQL injection attacks.
[0107] Step S7: Input the vector sequence of the SQL query data to be tested into the trained WGAN discriminator to obtain the injection attack category of the SQL query data to be tested.
[0108] By integrating the deep semantic understanding of BERT with the data generation capabilities of WGAN, this paper provides an efficient and accurate method for identifying SQL injection attacks. This method not only significantly improves recognition accuracy and recall, reduces false alarm rates, but also surpasses traditional methods in key performance indicators. This method can monitor and defend against SQL injection attacks in real time, reducing manual intervention and management costs while maintaining system availability and stability. Furthermore, it possesses adaptive learning capabilities, can continuously adapt to new attack patterns, and is easily integrated into existing network security architectures, providing data-driven support for network security decision-making, effectively defending against adversarial attacks, and demonstrating strong scalability and foresight.
[0109] The present invention constructs a deep learning-based SQL injection attack identification method. This method significantly improves the ability to identify SQL injection attacks by combining the technical advantages of BERT and WGAN. The core of the present invention is to utilize the deep semantic understanding ability of the BERT model and the data generation ability of WGAN to enhance the recognition accuracy and generalization ability of the model. And through URL decoding, normalization processing and word segmentation, high-quality input data is provided to the model. At the same time, the Word2Vec tool is used to convert text data into vector form to capture the semantic relationship between words. Finally, a WGAN model including a generator and a discriminator is designed and trained, and the Wasserstein distance is used as the loss function to improve the stability of model training and the quality of generated samples. The samples generated by the WGAN generator are used to train the discriminator to effectively identify potential SQL injection attacks.
[0110] This method not only improves the accuracy of SQL injection attack recognition and reduces false positive rates, but also possesses adaptive learning capabilities, enabling it to continuously adapt to new attack patterns. Furthermore, this method can be easily integrated into existing network security architectures, providing data-driven support for network security decision-making and effectively defending against adversarial attacks, demonstrating strong scalability and foresight.
[0111] Experimental results on a large-scale real-world dataset show that compared with traditional SQL injection attack identification methods, this method has significantly improved performance indicators such as accuracy, recall, and F1 value. It can more accurately identify SQL injection attacks and provide an effective technical means to ensure the security of network databases.
[0112] Example 2:
[0113] like Figure 3 As shown, based on the same inventive concept as Example 1, this embodiment provides a SQL injection attack identification system based on deep learning, applying the method described above, including:
[0114] The data collection and processing module is used to collect historical SQL query real data and SQL query data to be tested from multiple actual application scenarios and perform preprocessing to obtain the preprocessed historical SQL query real data and SQL query data to be tested;
[0115] A vector conversion module is used to convert the pre-processed historical SQL query real data and the SQL query data to be tested into vector form, thereby obtaining a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested;
[0116] The BERT model module is used to input the vector sequence of historical SQL query real data and the vector sequence of the SQL query data to be tested into the BERT model to obtain the real feature vector of the historical SQL and the vector sequence of the SQL query data to be tested;
[0117] A model construction module, used to construct a WGAN model, wherein the WGAN model includes a WGAN generator and a WGAN discriminator;
[0118] The generator module is used to train the WGAN generator using the real feature vectors of historical SQL to obtain a trained WGAN generator; the trained WGAN generator is used to generate simulated SQL injection attack samples;
[0119] The discriminator module is used to train the WGAN discriminator using the real feature vectors of historical SQL and simulated SQL injection attack samples to obtain a trained WGAN discriminator;
[0120] The data recognition module inputs the vector sequence of the SQL query data to be tested into the trained WGAN discriminator to obtain the injection attack category of the SQL query data to be tested.
[0121] Example 3:
[0122] Based on the same inventive concept as Example 1, this embodiment provides a computer-readable storage medium, which includes a stored program. When the program is running, the device where the computer-readable storage medium is located is controlled to execute the SQL injection attack identification method based on deep learning.
[0123] Example 4:
[0124] Based on the same inventive concept as Example 1, this embodiment provides a processor, which is used to run a program, wherein the program executes the SQL injection attack identification method based on deep learning when running.
[0125] Those skilled in the art will appreciate that the modules of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition of each example has been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0126] In the embodiments provided by the present invention, it should be understood that the division of modules is merely a logical function division, and there may be other division methods in actual implementation, for example, multiple modules can be combined into one module, one module can be split into multiple modules, or some features can be ignored, etc.
[0127] In addition, the functional modules in various embodiments of the present invention may be integrated into a single processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or software functional modules.
[0128] If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-0nly Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc., various media that can store program code.
[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and description of the present invention.
Claims
1. A SQL injection attack identification method based on deep learning, characterized in that: The following steps are involved: Step S1, collecting historical SQL query real data and SQL query data to be tested from multiple actual application scenarios and preprocessing them to obtain preprocessed historical SQL query real data and SQL query data to be tested; Step S2: converting the pre-processed historical SQL query real data and the SQL query data to be tested into vector form to obtain a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested; Step S3: Input the vector sequence of historical SQL query real data and the vector sequence of the SQL query data to be tested into the BERT model to obtain the historical SQL real feature vector and the vector sequence of the SQL query data to be tested; Step S4, constructing a WGAN model, wherein the WGAN model includes a WGAN generator and a WGAN discriminator; Step S5: Using historical SQL real feature vectors to train the WGAN generator to obtain a trained WGAN generator; using the trained WGAN generator to generate simulated SQL injection attack samples; Step S6: Use historical SQL real feature vectors and simulated SQL injection attack samples to train the WGAN discriminator to obtain a trained WGAN discriminator; Step S7: Input the vector sequence of the SQL query data to be tested into the trained WGAN discriminator to obtain the injection attack category of the SQL query data to be tested.
2. The method for identifying SQL injection attacks based on deep learning according to claim 1, characterized in that: The pre-processing of the historical SQL query real data in step S1 includes URL decoding, normalization, word segmentation, and tagging of the historical SQL query statements in the historical SQL query real data.
3. The method for identifying SQL injection attacks based on deep learning according to claim 1, characterized in that: Preprocessing the SQL query data to be tested includes URL decoding, normalization processing, and word segmentation processing on the SQL query statements to be tested in the SQL query data to be tested.
4. The method for identifying SQL injection attacks based on deep learning according to claim 1, characterized in that: In step S2, the Word2Vec tool is specifically selected to convert the pre-processed historical SQL query real data and the SQL query data to be tested into vector form, so as to obtain a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested.
5. The method for identifying SQL injection attacks based on deep learning according to claim 1, characterized in that: Step S3 inputs the vector sequence of historical SQL query real data and the vector sequence of the SQL query data to be tested into the BERT model to obtain the historical SQL real feature vector and the vector sequence of the SQL query data to be tested. Specifically, the following steps are included: Map the vector sequence of historical SQL query real data and the vocabulary units of the vector of the SQL query data to be tested to corresponding indexes through the BERT vocabulary table and convert them into the input vector required by the BERT model; The input vector is fed into the BERT model, and the input SQL query statement is encoded through the BERT model's bidirectional encoder, capturing the complex relationships between keywords, operators, and data types in the SQL statement and their contextual information, to obtain the true feature vector of historical SQL and the vector sequence of the SQL query data to be tested.
6. The method for identifying SQL injection attacks based on deep learning according to claim 1, characterized in that: In step S5, the WGAN generator is trained using the historical SQL real feature vector to obtain the trained WGAN generator, which specifically includes: The historical SQL real feature vector is concatenated with the random noise vector to obtain the concatenated vector and used as the input vector of the WGAN generator. The WGAN generator includes multiple layers of fully connected layers. The concatenated vectors are input into the WGAN generator, and simulated SQL injection attack samples similar to real SQL query data are gradually generated through nonlinear transformation.
7. The method for identifying SQL injection attacks based on deep learning according to claim 1, characterized in that: In step S6, the WGAN discriminator is trained using historical SQL real feature vectors and simulated SQL injection attack samples to obtain a trained WGAN discriminator. Specifically, the following steps are performed: Wasserstein distance is used as the loss function. During the training process, the convergence of the WGAN model is achieved by alternately optimizing the parameters of the generator and discriminator.
8. A SQL injection attack identification system based on deep learning, characterized in that: Applying the method according to any one of claims 1 to 7, comprising: The data collection and processing module is used to collect historical SQL query real data and SQL query data to be tested from multiple actual application scenarios and perform preprocessing to obtain the preprocessed historical SQL query real data and SQL query data to be tested; A vector conversion module is used to convert the pre-processed historical SQL query real data and the SQL query data to be tested into vector form, thereby obtaining a vector sequence of the historical SQL query real data and a vector sequence of the SQL query data to be tested; The BERT model module is used to input the vector sequence of historical SQL query real data and the vector sequence of the SQL query data to be tested into the BERT model to obtain the real feature vector of the historical SQL and the vector sequence of the SQL query data to be tested; A model construction module, used to construct a WGAN model, wherein the WGAN model includes a WGAN generator and a WGAN discriminator; The generator module is used to train the WGAN generator using the real feature vectors of historical SQL to obtain a trained WGAN generator; the trained WGAN generator is used to generate simulated SQL injection attack samples; The discriminator module is used to train the WGAN discriminator using the real feature vectors of historical SQL and simulated SQL injection attack samples to obtain a trained WGAN discriminator; The data recognition module inputs the vector sequence of the SQL query data to be tested into the trained WGAN discriminator to obtain the injection attack category of the SQL query data to be tested.
9. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein: When the program is running, the device where the computer-readable storage medium is located is controlled to execute the SQL injection attack identification method based on deep learning as described in any one of claims 1 to 7.
10. A processor, characterized in that: The processor is used to run a program, wherein the program, when running, executes the SQL injection attack identification method based on deep learning according to any one of claims 1 to 7.