Safety control method and system for network based on different scenes

Abstract

The invention discloses a security management and control method and system for a network based on different scenes, and the method comprises the steps: carrying out the SQL injection detection of each request parameter based on a first interception rule when the number of elements in a to-be-responded queue is detected to be smaller than a preset number, and obtaining an SQL injection detection result; when it is detected that the number of elements in the to-be-responded queue reaches a preset number, SQL injection detection is conducted on all the request parameters at the same time based on a second interception rule, and an SQL injection detection result is obtained; and executing a corresponding response operation based on an SQL injection detection result obtained by the first interception rule or the second interception rule and the to-be-responded request parameter. According to the method, corresponding SQL injection detection schemes can be provided for different scenes, and the response speed of large-batch SQL access in a large-batch SQL access request scene within a short time can be increased.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security protection, in particular to a network security management and control method and system based on different scenes. BACKGROUND

[0002] In a web application, user input data is passed from the front-end page to the back-end database, and the back-end database uses these input data to construct SQL query statements. Among them, SQL injection is a means of hacking websites, which uses the vulnerabilities of website programs to secretly insert some malicious code into database queries to bypass login verification, steal data, or even control the database.

[0003] In related technologies, mature SQL injection detection schemes have been provided, including whitelist or blacklist mechanisms or SQL syntax tree analysis. The whitelist mechanism uses regular expressions to define a "safe character set" that allows input, only allowing users to input what is considered "safe", and rejecting any input that does not meet the whitelist rules. For example, only letters, numbers, and underscores are allowed. The blacklist mechanism blocks user input of data containing malicious content by matching dangerous characters or keywords using regular expressions. For example, the regular expression may filter out common SQL injection characters or key phrases such as --, ;, 'OR', '1=1'. SQL syntax tree analysis parses SQL statements into syntax tree structures, then traverses and analyzes the key nodes (such as OR, AND) to detect whether there is an injection behavior (such as extra conditions, bypass logic). For example, a tree has a root node SELECT, below which are FROM and WHERE sub-trees, and the WHERE sub-tree further branches out a logic node OR, which further branches out two conditions: username='admin' and '1'='1'. When traversing the two conditions: username='admin' and '1'='1' branched out below the logic node OR, it is determined that an injection behavior has occurred.

[0004] The above SQL injection detection scheme has good results when facing a small amount of SQL access request scenarios in a short period of time, but when facing a large number of SQL access request scenarios in a short period of time, there is a problem of low SQL injection detection efficiency, resulting in slow SQL access response. Therefore, different SQL injection detection schemes need to be provided for different scenarios. SUMMARY

[0005] The present application aims to at least solve one of the technical problems in the prior art, and provide a network security management method and system based on different scenarios, which can provide corresponding SQL injection detection schemes for different scenarios and can speed up the response speed of a large number of SQL access requests in a short time.

[0006] To achieve the above-mentioned application purposes, the present application provides the following technical solutions:

[0007] In a first aspect, a network security management method based on different scenarios is provided, which comprises:

[0008] When the number of elements in the to-be-responded queue is detected to be less than the preset number, the SQL injection detection is performed on each request parameter based on the first interception rule to obtain the SQL injection detection result; wherein each element in the to-be-responded queue is respectively each to-be-responded request parameter received; the first interception rule comprises SQL injection detection based on a blacklist mechanism or a whitelist mechanism or a SQL syntax tree analysis;

[0009] When the number of elements in the to-be-responded queue is detected to reach the preset number, the SQL injection detection is performed on each request parameter based on the second interception rule to obtain the SQL injection detection result; wherein the second interception rule is that the preset number of elements in the to-be-responded queue are converted into sub-grayscale images according to a preset rule, each sub-grayscale image is spliced into a total grayscale image of a first preset size, and the total grayscale image is subjected to binary classification inference based on a trained target neural network model; based on the result of the binary classification inference on the total grayscale image, the result of the SQL injection detection performed on the plurality of request parameters corresponding to the preset number of elements in the to-be-responded queue is obtained;

[0010] Based on the SQL injection detection result obtained based on the first interception rule or the second interception rule and the to-be-responded request parameter, a corresponding response operation is performed.

[0011] As a further improvement, the target neural network model is obtained by training a plurality of sets of training data, each set of training data in the plurality of sets of training data comprising: a total grayscale image of a first preset size obtained by splicing each sub-grayscale image converted from a set of preset number of request parameters, and a label for marking whether the set of preset number of request parameters corresponding to the total grayscale image has a SQL injection behavior.

[0012] As a further improvement, the method further comprises:

[0013] when the SQL injection detection result obtained based on the second interception rule indicates that there is a SQL injection behavior in the group of preset number of request parameters corresponding to the total gray image, the total gray image is divided along the longitudinal axis direction of the image coordinate system to obtain two initial first-level gray images;

[0014] After the two initial first-level gray images are respectively expanded to the first preset size, two final first-level gray images are obtained;

[0015] The two final first-level gray images of the first preset size are input into the trained target neural network for binary classification reasoning;

[0016] Based on the result of binary classification reasoning on the final first-level gray image, it is determined whether the plurality of request parameters corresponding to the two final first-level gray images respectively exist SQL injection behavior.

[0017] As a further improvement, the converting the preset number of elements in the to-be-responded queue into a sub-gray image according to a preset rule specifically includes:

[0018] According to a preset encoding table, the characters of the request parameters corresponding to each element in the to-be-responded queue are encoded one by one to obtain an encoding sequence;

[0019] Based on the encoding sequence, a gray value sequence corresponding to each request parameter is obtained;

[0020] According to a preset strategy, the pixel values of the corresponding positions in the template image of the second preset size are adjusted to be consistent with the gray value sequence to obtain the sub-gray image.

[0021] As a further improvement, the target neural network is a feedforward neural network, the first preset size is 1 pixel*M pixel, the second preset size corresponding to the sub-gray image is 1 pixel*N pixel, and the preset number is w; wherein M, N, and w are all positive integer variables not less than 2, and M=w*N;

[0022] After the step of converting the preset number of elements in the to-be-responded queue into a sub-gray image according to a preset rule, and before the step of splicing each sub-gray image into a total gray image of a first preset size, the method further includes:

[0023] Obtain the character length L of the request parameters corresponding to each element in the to-be-responded queue;

[0024] Define the elements with character length L=N in the to-be-responded queue as the first type of elements;

[0025] When it is detected that the target string composed of the tail character of the first type of element in the to-be-responded queue and the head character of the next element adjacent to the first type of element belongs to an abnormal combination, all elements in the to-be-responded queue are rearranged into a first intermediate sequence; wherein the target string composed of the tail character of the first type of element in the first intermediate sequence and the head character of the next element adjacent to the first type of element does not belong to an abnormal combination.

[0026] The step of splicing each sub-gray scale image into a total gray scale image with a first preset size comprises the following steps:

[0027] According to the arrangement order of each element in the first intermediate sequence, the arrangement order of the second preset size of the sub-gray scale image corresponding to each element is determined.

[0028] According to the arrangement order of the sub-gray scale image, w sub-gray scale images are arranged in ascending order along the horizontal axis direction to obtain a total gray scale image with a first preset size of 1 pixel*M pixel; wherein there is no interval and overlapping area between each adjacent sub-gray scale image arranged in ascending order along the horizontal axis direction.

[0029] As a further improvement, the step of converting the preset number of elements in the to-be-responded queue into a sub-gray scale image according to a preset rule comprises the following steps:

[0030] According to a preset encoding table, the characters of the request parameters corresponding to each element in the first intermediate sequence are encoded one by one to obtain an encoding sequence.

[0031] Based on the encoding sequence, a gray value sequence corresponding to each request parameter is obtained.

[0032] According to a preset strategy, the pixel values of the corresponding positions in the template image with a second preset size are adjusted to be consistent with the gray value sequence to obtain the sub-gray scale image.

[0033] The preset strategy comprises:

[0034] If the second preset size is 1 pixel*N pixel, starting from the pixel point with the smallest number in the image coordinate system where the template image is located, the gray values of each pixel point in the template image are adjusted in ascending order of the number to the values corresponding to each element in the gray value sequence, and if the length of the gray value sequence is less than N, the gray values of the pixel points in the template image that have no corresponding relationship with the gray value sequence are set to a default gray value, which is different from any value in the encoding table; wherein the number of the pixel point is the horizontal coordinate of the pixel point; the number of pixel points in the template image is not less than the length of the gray value sequence.

[0035] As a further improvement, the target neural network is a convolutional neural network, the first preset size is M pixels*M pixels, the second preset size corresponding to the sub-grayscale image is N pixels*N pixels, and the preset number is w; wherein M, N, and w are all positive integer variables not less than 2, and w^(0.5) is a positive integer; and M*M=w*N*N;

[0036] After the step of converting the preset number of elements in the to-be-responded queue into sub-grayscale images according to the preset rule, and before the step of splicing each sub-grayscale image into a total grayscale image of a first preset size, the method further comprises:

[0037] Obtaining the character length L of the request parameters corresponding to each element in the to-be-responded queue;

[0038] Defining the elements in the to-be-responded queue with a character length L≤N*N-4*(N-1) as second-type elements;

[0039] When it is detected that the number of second-type elements in the to-be-responded queue is not less than 0.5*w and the arrangement order k of the second-type elements in the to-be-responded queue does not meet condition one below, rearranging all elements in the to-be-responded queue into a second intermediate sequence; wherein when the arrangement order p of the second-type elements in the sequence obtained by rearranging all elements in the to-be-responded queue meets condition two below, the sequence is defined as the second intermediate sequence;

[0040] Condition one: when k mod 2*w^(0.5)≤w^(0.5), k mod 2=1; when k mod 2*w^(0.5)>w^(0.5), k mod 2=0;

[0041] Condition two: when p mod 2*w^(0.5)≤w^(0.5), p mod 2=1; when p mod 2*w^(0.5)>w^(0.5), p mod 2=0; wherein k and p are positive integer variables; mod is the remainder operator;

[0042] The step of splicing each sub-grayscale image into a total grayscale image of a first preset size specifically comprises:

[0043] According to the arrangement order of each element in the second intermediate sequence, determining the arrangement order of the sub-grayscale image corresponding to each element with a second preset size of N pixels*N pixels;

[0044] Dividing the w sub-grayscale images into w^(0.5) image groups; wherein the arrangement order of the sub-grayscale images in each image group is continuous; and the number of sub-grayscale images in each image group is the same;

[0045] For each image group, w^(0.5) sub-gray scale pictures arranged in order are arranged from small to large along the horizontal axis direction to obtain one intermediate gray scale picture with a size of N pixels*M pixels, and a total of w^(0.5) intermediate gray scale pictures with a size of N pixels*M pixels are obtained;

[0046] The w^(0.5) intermediate gray scale pictures with a size of N pixels*M pixels are arranged from small to large along the vertical axis direction according to the order of the numbers of the image groups from small to large to obtain a total gray scale picture with a first preset size of M pixels*M pixels; wherein there is no interval and overlapping area between each adjacent sub-gray scale picture arranged from small to large along the horizontal axis direction and arranged from small to large along the vertical axis direction; the number of the image group is the minimum value of the arrangement order corresponding to each sub-gray scale picture contained in the image group.

[0047] As a further improvement, the w is even, and the method further comprises:

[0048] In the second intermediate sequence, the positions corresponding to the arrangement orders q of condition three are all set to the second type of elements;

[0049] Condition three: q mod w^(0.5)=1 and q mod w^(0.5)=(0.5*w^(0.5)+1) and q≤w^(0.5) and 0.5*w<q≤0.5*w+w^(0.5); wherein q is a positive integer variable.

[0050] As a further improvement, the request parameters corresponding to the second type of elements in the second intermediate sequence are defined as the second type of request parameters,

[0051] The converting of the preset number of elements in the second intermediate sequence into sub-gray scale pictures according to the preset rule specifically comprises:

[0052] According to the preset encoding table, the characters of the request parameters corresponding to each element in the to-be-responded queue are encoded one by one to obtain an encoding sequence;

[0053] Based on the encoding sequence, a gray value sequence corresponding to each request parameter is obtained;

[0054] According to a preset strategy, the pixel values of the corresponding positions in the template image with the second preset size are adjusted to be consistent with the gray value sequence to obtain the sub-gray scale picture;

[0055] The preset strategy comprises:

[0056] If the second preset size is N pixels*N pixels, for the second type of request parameter, starting from the pixel point with the smallest number in the specified region of the image coordinate system where the template image is located, the gray values of the pixel points in the specified region are sequentially adjusted to the values corresponding to the elements in the gray value sequence corresponding to the second type of request parameter in ascending order of the numbers of the pixel points in the specified region;

[0057] For other request parameters that do not belong to the second type of request parameter, starting from the pixel point with the smallest number in the image coordinate system where the template image is located, the gray values of the pixel points in the template image are sequentially adjusted to the values corresponding to the elements in the gray value sequence corresponding to the other request parameters that do not belong to the second type of request parameter in ascending order of the numbers of the pixel points in the template image;

[0058] Wherein, the number of the pixel point is two digits, the ten digits are the horizontal coordinates of the pixel point, and the unit digits are the vertical coordinates of the pixel point; the number of the pixel point in the specified region is not less than the length of the gray value sequence; the range of the number a*10+b of the pixel point in the specified region meets the following four conditions:

[0059] Condition four: 1

[0060] The second aspect, the present application also provides a kind of network based on different scene security management and control system, comprising: memory, processor and storage in memory and can be run on processor Computer program, the processor executes the program and executes the steps of the above network based on different scene security management and control method.

[0061] Beneficial effect: compared with prior art, the network based on different scene security management and control method and system provided by the present application can provide corresponding SQL injection detection scheme for different scenes, and can speed up the response speed of a large number of SQL access in a short time. Wherein, the second interception rule can obtain the SQL injection detection result of multiple request parameters at the same time, so as to improve the detection efficiency of SQL injection. Since binary classification reasoning is adopted, the output dimension is less, compared with multi-dimensional reasoning, the calculation amount of the embodiment is less, so the reasoning speed is faster.

[0062] Additional aspects and advantages of the application will be described in part below, some will become apparent from the following description, or will be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0063] The application will be further described below in conjunction with the drawings and examples.

[0064] Figure 1 A flowchart of a network security management method based on different scenarios in an embodiment;

[0065] Figure 2 A flowchart of a network security management method based on different scenarios in another embodiment;

[0066] Figure 3 A schematic diagram of the principle of dividing the total gray image along the vertical axis direction in an embodiment;

[0067] Figure 4 A schematic diagram of the principle of expanding the primary gray image to the first preset size in an embodiment;

[0068] Figure 5 A flowchart of converting the request parameter into a sub-gray image in an embodiment;

[0069] Figure 6 A schematic diagram of the principle of converting the request parameter into a sub-gray image in an embodiment;

[0070] Figure 7 A schematic diagram of the principle of adjusting the to-be-responded queue to the first intermediate sequence in an embodiment;

[0071] Figure 8 A schematic diagram of the principle of splicing each sub-gray image into a total gray image of the first preset size in an embodiment;

[0072] Figure 9 A schematic diagram of the principle of converting the request parameter into a sub-gray image in another embodiment;

[0073] Figure 10 A schematic diagram of the numbering of each pixel point in the template image corresponding to the sub-gray image in an embodiment;

[0074] Figure 11 A schematic diagram of the principle of adjusting the to-be-responded queue to the first intermediate sequence in another embodiment. DETAILED DESCRIPTION

[0075] This part will describe the specific embodiments of the present application in detail, and the preferred embodiments of the present application are shown in the accompanying drawings, which serve to supplement the description in the text part of the description and enable people to intuitively and visually understand each technical feature and the overall technical scheme of the present application, but it cannot be understood as a limitation on the protection scope of the present application.

[0076] In an embodiment, as shown in Figure 1 , a network security management method based on different scenarios is provided, which comprises:

[0077] In step S202, when the server detects that the number of elements in the to-be-responded queue is less than the preset number, the server performs SQL injection detection on each piece of request parameter based on a first interception rule to obtain a SQL injection detection result. Each element in the to-be-responded queue is a piece of received to-be-responded request parameter. The first interception rule includes SQL injection detection based on a blacklist mechanism or a whitelist mechanism or SQL syntax tree analysis.

[0078] In step S204, when the server detects that the number of elements in the to-be-responded queue is greater than the preset number, the server simultaneously performs SQL injection detection on each piece of request parameter based on a second interception rule to obtain a SQL injection detection result. The second interception rule is to convert the preset number of elements in the to-be-responded queue into sub-grayscale images according to a preset rule, splice each sub-grayscale image into a total grayscale image of a first preset size, and perform binary classification inference on the total grayscale image based on a trained target neural network model. Based on the result of the binary classification inference on the total grayscale image, the result of the simultaneous SQL injection detection on the multiple pieces of request parameter corresponding to the preset number of elements in the to-be-responded queue is obtained.

[0079] In step S206, the server performs a corresponding response operation based on the SQL injection detection result obtained based on the first interception rule or the second interception rule and the to-be-responded request parameter.

[0080] Specifically, when multiple clients simultaneously access the database on the server, the request parameters input by users on the multiple clients are transmitted to the server through a front-end page. The server constructs a SQL query statement based on the received request parameters, and thus responds to the request parameters to operate the database. In an example, the server stores the received request parameters in a to-be-responded queue, that is, each element in the to-be-responded queue is a piece of request parameter received from the multiple clients respectively, and the request parameters that have been responded to are removed from the to-be-responded queue.

[0081] In one example, the preset number is 64, that is, when it is detected that the number of elements in the to-be-responded queue is less than 64, the server performs SQL injection detection on each request parameter based on the first interception rule in the order of time when each request parameter is added to the to-be-responded queue. The specific first interception rule includes SQL injection detection based on a blacklist mechanism or a whitelist mechanism or SQL syntax tree analysis, and the SQL injection detection based on the blacklist mechanism or the whitelist mechanism or the SQL syntax tree analysis belongs to the conventional technical means in the art, which is not described here. When it is detected that the number of elements in the to-be-responded queue reaches 64, the server performs SQL injection detection on each request parameter based on the second interception rule to obtain a SQL injection detection result. Specifically, the second interception rule can obtain the SQL injection detection result of multiple request parameters at the same time, thereby improving the detection efficiency of SQL injection. It can be understood that, since binary classification reasoning is adopted, the dimension of the output is less, and compared with multi-dimensional reasoning, the calculation amount of the embodiment is less, and therefore the reasoning speed is faster. Therefore, the network security management and control method provided in the embodiment can provide a corresponding SQL injection detection scheme for different scenes, and can speed up the response speed of a large number of SQL access requests in a short time.

[0082] Specifically, the target neural network model is obtained by training using a plurality of sets of training data, each set of training data including: a total gray scale image of a first preset size obtained by splicing a plurality of sub-gray scale images converted from a set of a plurality of request parameters, and a label for marking whether the set of a plurality of request parameters corresponding to the total gray scale image has a SQL injection behavior. The specific training process of the neural network model belongs to the prior art, which is not described here.

[0083] Using the neural network model can identify whether a plurality of request parameters has a SQL injection behavior at one time, for example, when the total gray scale image corresponding to 64 request parameters is input into the neural network model and the result is that there is no SQL injection behavior, the SQL injection detection of the 64 request parameters can be completed at one time, without the need for SQL injection detection of each request parameter one by one, thereby improving the response efficiency of the 64 request parameters. It can be seen that the embodiment has higher efficiency for the scene of a large number of requests in a short time. When there are only a small number of requests in a short time, the first interception rule is triggered to perform injection detection, so that the detection scheme provided in the embodiment is applicable to various scenes.

[0084] As shown in FIG. 1, Figure 2 The method further includes:

[0085] Step S302, when the SQL injection detection result obtained based on the second interception rule indicates that there is a SQL injection behavior in the group of a preset number of request parameters corresponding to the total gray image, the total gray image is evenly divided along the longitudinal axis direction of the image coordinate system to obtain two initial first-level gray images.

[0086] Step S304, after the two initial first-level gray images are respectively expanded to the first preset size, two final first-level gray images are obtained.

[0087] Step S306, the two final first-level gray images of the first preset size are input into the trained target neural network for binary classification inference.

[0088] Step S308, based on the result of the binary classification inference on the final first-level gray image, it is determined whether the plurality of request parameters corresponding to the two final first-level gray images respectively exist SQL injection behavior.

[0089] Specifically, as shown in Figure 3 and Figure 4 , after the total gray image is evenly divided along the longitudinal axis direction of the image coordinate system (i.e. the u-axis direction in Figure 3 ), two initial first-level gray images are obtained, and then the two initial first-level gray images are respectively expanded to the first preset size to obtain two final first-level gray images. As shown in Figure 4 , in this embodiment, the preset number is 64, the size of each sub-gray image is 5 pixels*5 pixels, then the size of the total gray image is 40 pixels*40 pixels, the size of the two initial first-level gray images is 20 pixels*40 pixels, and the first preset size is 40 pixels*40 pixels. Therefore, in this embodiment, expanding each initial first-level gray image to the first preset size specifically includes:

[0090] copying each initial first-level gray image to obtain a copy gray image with the same size and content as the original initial first-level gray image;

[0091] splicing the copy gray image and the original initial first-level gray image to expand the initial first-level gray image to the first preset size, and the spliced image is the final first-level gray image.

[0092] As shown in Figure 4 , one of the final first-level gray images obtained by splicing only includes half of the 64 (i.e. the preset number) request parameters, i.e. 32 request parameters corresponding to the sub-gray image; at the same time, since the size of the final first-level gray image after splicing is the same as that of the total gray image, the above-mentioned target neural network model can be directly used for binary classification inference, without the need for training and using a new model, only one model can be applied to SQL injection behavior detection of different number of request parameters, with lower cost and better universality.

[0093] It should be noted that when the final level gray map is half of the preset number (64 in this embodiment), i.e. 32 request parameters corresponding to the image, the result obtained after the binary classification inference prompts that one of the final level gray maps does not exist SQL injection behavior, then the 32 request parameters corresponding to the final level gray map are all judged to be safe, and the server can respond to these request parameters to perform the corresponding response operation. If the other final level gray map exists SQL injection behavior, then the final level gray map is further divided along the horizontal axis direction of the image coordinate system to obtain two initial second level gray maps, and then the two initial second level gray maps are expanded to the first preset size to obtain two final second level gray maps (for the same reason, each final second level gray map corresponds to one fourth of the preset number (64 in this embodiment), i.e. 16 request parameters), and the two final second level gray maps of the first preset size are input into the trained target neural network for binary classification inference. According to the result of the binary classification inference, the detection result of whether 16 request parameters exist SQL injection behavior can be obtained.

[0094] In one embodiment, as shown in Figure 5 the preset number of elements in the to-be-responded queue are converted into a sub-gray map according to a preset rule, specifically including:

[0095] Step S402, encoding each character of the request parameter corresponding to each element in the to-be-responded queue according to a preset encoding table to obtain an encoding sequence.

[0096] Step S404, obtaining a gray value sequence corresponding to each request parameter based on the encoding sequence.

[0097] Step S406, adjusting the pixel value of the corresponding position in the template image of the second preset size to be consistent with the gray value sequence according to a preset strategy to obtain the sub-gray map.

[0098] Specifically, when encoding each character, the numerical value corresponding to each character is determined according to the ASCII code, i.e. each character takes the decimal corresponding to its ASCII code as the corresponding gray value. For example, a request parameter with the content of '1'or 1 = 1--', the request parameter includes a total of 12 characters including spaces, and the number of characters is defined as the character length L of the request parameter in this paper, i.e. the character length of the request parameter is 12. As shown in Figure 6As shown, the numerical values of each character are determined as the gray value according to the corresponding decimal of the ASCII code, and the encoding sequence is {49, 39, 32, 111, 114, 32, 49, 61, 49, 32, 45, 45}. The gray value sequence corresponding to the request parameter is directly set to be the same as the encoding sequence corresponding to the request parameter, that is, the gray value sequence is also {49, 39, 32, 111, 114, 32, 49, 61, 49, 32, 45, 45}.

[0099] As shown in the formula (1), the gray value sequence corresponding to the request parameter is obtained by adjusting the gray values of the pixels in the template image according to the preset strategy. Figure 6 As shown in the formula (1), the gray value sequence corresponding to the request parameter is obtained by adjusting the gray values of the pixels in the template image according to the preset strategy.

[0100] As shown in the formula (1), the gray value sequence corresponding to the request parameter is obtained by adjusting the gray values of the pixels in the template image according to the preset strategy. Figure 6 As shown in the formula (1), the gray value sequence corresponding to the request parameter is obtained by adjusting the gray values of the pixels in the template image according to the preset strategy.

[0101] Embodiment one:

[0102] In one embodiment, the target neural network is a feedforward neural network, the first preset size is 1 pixel*M pixels, the second preset size corresponding to the sub-gray image is 1 pixel*N pixels, and the preset number is w; wherein M, N, and w are all positive integer variables not less than 2, and M=w*N.

[0103] After the step of converting the preset number of elements in the to-be-responded queue into a sub-gray image according to the preset rule, and before the step of splicing each sub-gray image into a total gray image of a first preset size, the method further comprises:

[0104] Step S502, obtaining the character length L of the request parameter corresponding to each element in the to-be-responded queue.

[0105] Step S504, defining the element with character length L=N in the to-be-responded queue as a first type of element.

[0106] Step S506, when it is detected that the target string composed of the tail character of the first type element in the to-be-responded queue and the head character of the next element adjacent to the first type element belongs to the abnormal combination, the elements in the to-be-responded queue are rearranged into a first intermediate sequence; wherein the target string composed of the tail character of the first type element in the first intermediate sequence and the head character of the next element adjacent to the first type element does not belong to the abnormal combination.

[0107] For example, when the request parameters corresponding to a first type element and the next element of the first type element vector both do not exist injection behavior, but the target string composed of the tail character of the first type element and the head character of the next element adjacent to the first type element is -- or or, it may be misjudged as existing injection behavior in the binary classification reasoning of the target neural network, so these target strings are defined as belonging to the abnormal combination. Specifically, the target strings corresponding to the abnormal combination are pre-configured for matching in step S506. The target strings corresponding to the abnormal combination are determined by engineers according to the strings in the request parameters commonly existing SQL injection behavior, for example, -- or or commonly used when SQL injection.

[0108] As shown in Figure 7 When it is detected that the target string composed of the tail character of the first type element in the to-be-responded queue and the head character of the next element adjacent to the first type element belongs to the abnormal combination, the elements in the to-be-responded queue are rearranged to obtain the first intermediate sequence, and the target string composed of the tail character of the first type element in the first intermediate sequence and the head character of the next element adjacent to the first type element does not belong to the abnormal combination. As shown in Figure 7 When the element 2 in the to-be-responded queue is a first type element and the target string composed of the tail character of the element 2 and the head character of the next element 3 adjacent to the element 2 belongs to the abnormal combination, the positions of the element 2 and the element 3 are exchanged to eliminate the abnormal combination, thereby reducing the errors of the neural network reasoning result caused by the abnormal combination, that is, improving the accuracy of the neural network reasoning.

[0109] The first preset size total gray scale image is obtained by splicing the sub gray scale images, and the splicing specifically includes:

[0110] Step S508, according to the arrangement order of each element in the first intermediate sequence, the arrangement order of the second preset size sub gray scale image corresponding to each element is determined.

[0111] Step S510, according to the arrangement order of the sub-gray scale maps, sequentially arrange w sub-gray scale maps from small to large along the horizontal axis direction to obtain a total gray scale map with a first preset size of 1 pixel*M pixels; wherein there is no interval and overlapping area between each adjacent sub-gray scale map arranged from small to large along the horizontal axis direction.

[0112] According to steps S508 to S510, the total gray scale map with a first preset size of 1 pixel*M pixels is obtained, and the total gray scale map is input into the target neural network to perform binary classification inference to detect SQL injection of multiple request parameters.

[0113] In one embodiment, the conversion of the preset number of elements in the to-be-responded queue into a sub-gray scale map according to the preset rule specifically includes:

[0114] Step S511, encode the characters of the request parameters corresponding to each element in the first intermediate sequence one by one according to a preset encoding table to obtain an encoding sequence.

[0115] Step S512, obtain a gray value sequence corresponding to each request parameter based on the encoding sequence.

[0116] Step S513, according to a preset strategy, adjust the pixel values of the corresponding positions in the template image with a second preset size to be consistent with the gray value sequence to obtain the sub-gray scale map.

[0117] The preset encoding table is an ASCII code encoding table. When encoding each character, the numerical value corresponding to each character is determined according to the ASCII code, that is, the decimal corresponding to the ASCII code of each character is taken as the corresponding gray value. For example, a request parameter with the content of 1’or 1=1-- includes a total of 12 characters including spaces, and the number of characters is defined as the character length L of the request parameter in this paper, that is, the character length of the request parameter is 12. As shown in Figure 6 According to the decimal corresponding to the ASCII code, the numerical value of each character is determined as the gray value to obtain an encoding sequence of {49, 39, 32, 111, 114, 32, 49, 61, 49, 32, 45, 45}. The gray value sequence corresponding to the request parameter is directly set to be the same as the encoding sequence corresponding to the request parameter, that is, the gray value sequence is also {49, 39, 32, 111, 114, 32, 49, 61, 49, 32, 45, 45}. As shown in Figure 6 In one example, the template image with a second preset size is a one-dimensional image with a length of 25 pixels (that is, the size of the image is 1 pixel*25 pixels), and the gray value sequence has a total of 12 elements, so the preset strategy is to sequentially adjust the gray values of the first 12 pixels in the one-dimensional template image to the numerical values corresponding to the elements in the gray value sequence, and the gray values of the other position pixels in the one-dimensional template image are all set to 0 by default.

[0118] The preset strategy includes, in general:

[0119] If the second preset size is 1 pixel*N pixel, starting from the pixel point with the smallest number in the image coordinate system in which the template image is located, the gray scale values of the pixel points in the template image are adjusted in order from small to large, and if the length of the gray scale value sequence is less than N, the gray scale values of the pixel points in the template image that do not have a corresponding relationship with the gray scale value sequence are set to a default gray scale value, which is different from any value in the encoding table; wherein the number of pixel points in the template image is not less than the length of the gray scale value sequence. As shown in Figure 6 The horizontal axis is v and the vertical axis is u.

[0120] Embodiment two:

[0121] In one embodiment, the target neural network is a convolutional neural network, the first preset size is M pixel*M pixel, the second preset size corresponding to the sub-gray scale image is N pixel*N pixel, and the preset number is w; wherein M, N, and w are all positive integer variables not less than 2, and w^(0.5) is a positive integer; and M*M=w*N*N;

[0122] After the step of converting the preset number of elements in the to-be-responded queue into sub-gray scale images according to the preset rule, and before the step of splicing each sub-gray scale image into a total gray scale image with a first preset size, the method further includes:

[0123] Step S602, obtaining the character length L of the request parameter corresponding to each element in the to-be-responded queue.

[0124] Step S604, defining the elements with a character length L≤N*N-4*(N-1) in the to-be-responded queue as second-type elements.

[0125] For example, if a certain element in the to-be-responded queue is 'OR 1=1, the character length of which is 8, the element is a second-type element.

[0126] Step S606, detecting that the number of second-type elements in the to-be-responded queue is not less than 0.5*w and the arrangement order k of the second-type elements in the to-be-responded queue does not meet condition one, and rearranging all elements in the to-be-responded queue into a second intermediate sequence; wherein when the arrangement order p of the second-type elements in the sequence obtained by rearranging all elements in the to-be-responded queue meets condition two, the sequence is defined as the second intermediate sequence.

[0127] Condition 1: When kmod 2*w^(0.5)≤w^(0.5), k mod 2=1; when kmod 2*w^(0.5)>w^(0.5), k mod 2=0.

[0128] Condition 2: When p mod 2*w^(0.5)≤w^(0.5), p mod 2=1; when p mod 2*w^(0.5)>w^(0.5), p mod 2=0; where k and p are both positive integer variables; mod is the modulo operator.

[0129] The step of stitching together the individual grayscale images into a single grayscale image of a first preset size specifically includes:

[0130] Step S608: Determine the arrangement order of the sub-grayscale images with a second preset size of N pixels * N pixels corresponding to each element according to the arrangement order of each element in the second intermediate sequence.

[0131] Step S610: Divide the w sub-grayscale images into w^(0.5) image groups; wherein the sub-grayscale images in each image group are arranged in a continuous order; and the number of sub-grayscale images in each image group is the same.

[0132] For each image group, according to the arrangement order of the sub-grayscale images, w^(0.5) consecutive sub-grayscale images are arranged from smallest to largest along the horizontal axis to obtain an intermediate grayscale image of size N pixels * M pixels corresponding to each image group, resulting in a total of w^(0.5) intermediate grayscale images of size N pixels * M pixels.

[0133] According to the image group numbers in ascending order, w^(0.5) intermediate grayscale images of size N pixels * M pixels are arranged in ascending order along the vertical axis to obtain a total grayscale image of the first preset size M pixels * M pixels; wherein, there are no gaps or overlapping areas between adjacent sub-grayscale images arranged in ascending order along the horizontal axis and in ascending order along the vertical axis; the image group number is the minimum value of the arrangement order of each sub-grayscale image contained in the image group.

[0134] Specifically, when no second intermediate sequence exists, the order of elements in the response queue is used as the order of the sub-grayscale images, referring to... Figure 8 When w=64, N=5, M=40, v is the horizontal axis, and u is the vertical axis, for a queue of 64 elements to be responded to, there are 64 corresponding sub-grayscale images. Therefore, they can be divided into 8 image groups. For example, image group 1 has elements 1 to 8 corresponding to the sub-grayscale images. Figure 1 To the grayscale Figure 8arranged along the horizontal axis direction, obtaining an intermediate gray scale with a size of 5 pixels * 40 pixels Figure 1 By analogy, the image group 8 is arranged along the horizontal axis direction by the corresponding pair of the element 57 to the element 64 corresponding to the sub-gray scale 57 to the sub-gray scale 64, obtaining an intermediate gray scale with a size of 5 pixels * 40 pixels Figure 8 . Among them, the image group 1 contains the sub-gray scale Figure 1 to the sub-gray scale Figure 8 , and the arrangement order of the sub-gray scale Figure 1 to the sub-gray scale Figure 8 is the arrangement order of the sub-gray scale Figure 1 . It can be known that the numbering of the image group 1 to the image group 8 has a small to large change, so the corresponding intermediate gray scale Figure 1 to the intermediate gray scale Figure 8 of the image group 1 to the image group 8 will be arranged along the vertical axis direction in turn, and finally a total gray scale with a size of 40 pixels * 40 pixels is spliced. For example, the total gray scale is spliced by 8 * 8 sub-gray scales, and there are 8 in each row and 8 in each column. 8 sub-gray scales in each row form an intermediate gray scale, and each sub-gray scale has a size of 5 pixels * 5 pixels. The size of each intermediate gray scale is 5 pixels * 40 pixels. At this time, 2 * w^(0.5) = 16, w^(0.5) = 8, that is, condition one is that when k mod 16 ≤ 8, k mod 2 = 1; when k mod 16 > 8, k mod 2 = 0. Condition two is that when p mod 16 ≤ 8, p mod 2 = 1; when p mod 16 > 8, p mod 2 = 0.

[0135] It should be noted that when it is detected that the number of the second type of elements in the to-be-responded queue is not less than 0.5*w and the arrangement order k of the second type of elements in the to-be-responded queue in the to-be-responded queue meets the following condition one, it means that in the total gray scale, the positions adjacent to the sub-gray scale corresponding to the second type of elements in the positive and negative directions of the vertical axis and the positive and negative directions of the horizontal axis are all the sub-gray scale corresponding to the second type of elements, which means that in the total gray scale, any two pixel points belonging to two adjacent sub-gray scales will not be directly adjacent, so there will be no situation that the pixel points belonging to two adjacent sub-gray scales together form a certain specific image feature in space. If the specific image feature is the same as the image feature of the SQL injection behavior, it may be recognized by the convolution kernel when the convolution neural network architecture is used to perform binary classification reasoning on the total gray scale, and it may be misjudged by the convolution neural network as having SQL injection behavior.

[0136] Therefore, in the embodiment, when it is detected that the number of the second type of elements in the to-be-responded queue is not less than 0.5*w and the arrangement order k of the second type of elements in the to-be-responded queue in the to-be-responded queue does not meet condition one, all elements in the to-be-responded queue are rearranged into a second intermediate sequence. Wherein, when the arrangement order p of the second type of elements in the sequence obtained by rearranging all elements in the to-be-responded queue meets condition two, the sequence is defined as the second intermediate sequence. As shown in Figure 11 When the arrangement order k of the second type of elements in the to-be-responded queue in the to-be-responded queue does not meet condition one, the position of the second type of elements in the to-be-responded queue is adjusted, and the arrangement order p of the second type of elements in the second intermediate sequence after adjustment meets condition two. It can be seen that in the second intermediate sequence, any two pixel points belonging to adjacent two sub-grayscale images in the total grayscale image will not be directly adjacent, so there will be no case that pixel points belonging to two adjacent sub-grayscale images together form a certain specific image feature in space, thus eliminating the problem of being misjudged by the convolutional neural network as having SQL injection behavior.

[0137] Specifically, Figure 9 An example in which the second type of elements corresponds to a sub-grayscale image is shown. In this example, the request parameter corresponding to the second type of elements is 'OR 1=1, and the one-dimensional and two-dimensional sub-grayscale images corresponding thereto are as shown in FIGS. 9 and 10. It can be seen that in the ASCII code, the character corresponding to 0 is NUL, i.e., a null character, and it is prohibited to include a null character in the request parameter in databases such as MySQL and PostgreSQL, so since the gray scale values of the edge pixels of the sub-grayscale image corresponding to the second type of elements are all 0, when a non-second type of element, such as Figure 6 The request parameter corresponding to the first type of element '1'or 1=1-- is a non-second type of element, the four adjacent sub-grayscale images above, below, left and right of the non-second type of element are all the sub-grayscale images corresponding to the second type of elements, i.e., there will be no case that pixel points belonging to two adjacent sub-grayscale images together form a certain specific image feature in space, thus eliminating the problem of being misjudged by the convolutional neural network as having SQL injection behavior.

[0138] It should be noted that if it is detected that the number of the second type of elements in the to-be-responded queue is less than 0.5*w, then the scheme corresponding to embodiment one is used for detecting the SQL injection behavior.

[0139] In an example, the w is an even number, and the method further comprises:

[0140] In the second intermediate sequence, the positions corresponding to the arrangement orders q meeting condition three are all set to the second type of elements.

[0141] Condition 3: q mod w^(0.5) = 1 and q mod w^(0.5) = (0.5 * w^(0.5) + 1) and q ≤ w^(0.5) and 0.5 * w < q ≤ 0.5 * w + w^(0.5); where q is a positive integer variable.

[0142] It should be noted that when w = 64, w^(0.5) = 8, (0.5*w^(0.5) + 1) = 5, 0.5*w = 32, 0.5*w + w^(0.5) = 40. That is, in this example, condition three is: q mod 8 = 1 and q mod 8 = 5 and q ≤ 8 and 32 < q ≤ 40; specifically, when the sign condition is 3, in Figure 3 The 28 sub-grayscale images corresponding to the first row, fifth row, first column, and fifth column are all sub-grayscale images corresponding to the second type of elements. When the target using the convolutional neural network architecture executes steps S302 to S306, it can be guaranteed that any two pixels belonging to two adjacent sub-grayscale images in the two final first-level grayscale images will not be directly adjacent. Therefore, spatially, there will be no situation where pixels belonging to two adjacent sub-grayscale images jointly form a certain image feature, thus eliminating the problem of being misjudged as having SQL injection behavior by the convolutional neural network.

[0143] In one example, the request parameters corresponding to the second type of elements in the second intermediate sequence are defined as the second type of request parameters.

[0144] The step of converting a preset number of elements in the second intermediate sequence into a sub-grayscale image according to a preset rule specifically includes:

[0145] Step S611: Encode each character of the request parameter corresponding to each element in the queue to be responded to according to the preset encoding table to obtain the encoding sequence;

[0146] Step S612: Obtain the grayscale value sequence corresponding to each request parameter based on the encoded sequence;

[0147] Step S613: According to a preset strategy, adjust the pixel values ​​at the corresponding positions in the template image of the second preset size to be consistent with the gray value sequence to obtain the sub-grayscale image;

[0148] The default encoding table is the ASCII encoding table. When encoding each character, the numerical value corresponding to each character is determined according to its ASCII code. That is, each character is represented by its corresponding decimal value based on its ASCII code. For example, a request parameter containing 'OR 1=1', which includes spaces and consists of 8 characters, is defined as the character length L of this request parameter in this article. Therefore, the character length of this request parameter is 8. Figure 9As shown, the values of the characters are determined as the gray values according to the corresponding decimal of the ASCII code, and the encoding sequence is {39, 32, 79, 82, 32, 49, 61, 49}. The gray value sequence corresponding to the request parameter is directly set to be the same as the encoding sequence corresponding to the request parameter, that is, the gray value sequence is also {39, 32, 79, 82, 32, 49, 61, 49}. As shown in the following table, the gray value sequence corresponding to the request parameter is directly set to be the same as the encoding sequence corresponding to the request parameter. Figure 9 As shown, in one example, the template image of the second preset size is a two-dimensional image with a length of 25 pixel points (that is, the size of the image is 5 pixels*5 pixels), and the gray value sequence has a total of 8 elements, so the preset strategy is to sequentially adjust the gray values of the first 8 pixels in the two-dimensional template image to the values corresponding to the elements in the gray value sequence, and the gray values of the other position pixels in the two-dimensional template image are all set to 0 by default.

[0149] Specifically, the preset strategy includes:

[0150] If the second preset size is N pixels*N pixels, for the second type of request parameter, starting from the pixel point with the smallest number in the specified region of the image coordinate system where the template image is located, the gray values of the pixel points in the specified region are sequentially adjusted to the values corresponding to the elements in the gray value sequence corresponding to the second type of request parameter in the order of the numbers of the pixel points in the specified region from small to large.

[0151] For other request parameters that do not belong to the second type of request parameter, starting from the pixel point with the smallest number in the image coordinate system where the template image is located, the gray values of the pixel points in the template image are sequentially adjusted to the values corresponding to the elements in the gray value sequence corresponding to the other request parameters that do not belong to the second type of request parameter in the order of the numbers of the pixel points in the template image from small to large.

[0152] Wherein, the number of the pixel point is two digits, the ten's place is the horizontal coordinate of the pixel point, and the unit's place is the vertical coordinate of the pixel point; the number of the pixel points in the specified region is not less than the length of the gray value sequence; the range of the number a*10+b of the pixel points in the specified region meets the following condition four:

[0153] Condition four: 1

[0154] Specifically, when N=5, refer to Figure 10 , Figure 10 (a) is the number of each pixel point in the template image corresponding to a sub-gray image, Figure 10 The dashed box in (b) is the specified region. The numbers of the pixel points in the specified region include 22, 23, 24, 32, 33, 34, 42, 43, and 44 in order from small to large, a total of 9 pixel points.

[0155] In one embodiment, a network security management system based on different scenarios is also provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to perform the steps of the network security management method based on different scenarios. The steps of the network security management method based on different scenarios can be the steps of the network security management method based on different scenarios in the above embodiments.

[0156] In one embodiment, a computer readable storage medium is also provided, which stores computer executable instructions for causing a computer to perform the steps of the network security management method based on different scenarios. The steps of the network security management method based on different scenarios can be the steps of the network security management method based on different scenarios in the above embodiments.

[0157] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRA), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0158] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not contradict, they should be considered within the scope of the present disclosure.

Claims

1. A network security management method based on different scenarios, characterized in that, The method comprises: When it is detected that the number of elements in the to-be-responded queue is less than a preset number, performing SQL injection detection on each piece of request parameter based on a first interception rule to obtain a SQL injection detection result; wherein each element in the to-be-responded queue is respectively each piece of to-be-responded request parameter received; the first interception rule comprises SQL injection detection based on a blacklist mechanism or a whitelist mechanism or SQL syntax tree analysis; When it is detected that the number of elements in the to-be-responded queue reaches the preset number, performing SQL injection detection on each piece of request parameter based on a second interception rule to obtain a SQL injection detection result; wherein the second interception rule is that, after converting the preset number of elements in the to-be-responded queue into sub-gray scale images according to a preset rule, splicing each sub-gray scale image into a total gray scale image of a first preset size, and performing binary classification reasoning on the total gray scale image based on a trained target neural network model; based on the result of the binary classification reasoning on the total gray scale image, obtaining the result of performing SQL injection detection on the plurality of pieces of request parameter corresponding to the preset number of elements in the to-be-responded queue at the same time; Based on the SQL injection detection result obtained based on the first interception rule or the second interception rule and the to-be-responded request parameter, performing a corresponding response operation.

2. The network security management method according to claim 1, characterized in that: The target neural network model is obtained by training a plurality of sets of training data, and each set of training data comprises a total gray scale image of a first preset size obtained by splicing sub-gray scale images converted from a set of a preset number of request parameters, and a label for marking whether the set of a preset number of request parameters corresponding to the total gray scale image has a SQL injection behavior.

3. The network security management method based on different scenes according to claim 2, characterized in that, The method further comprises: When the SQL injection detection result obtained based on the second interception rule indicates that the set of a preset number of request parameters corresponding to the total gray scale image has a SQL injection behavior, dividing the total gray scale image along the vertical axis of the image coordinate system to obtain two initial first-level gray scale images; After respectively expanding the two initial first-level gray scale images to the first preset size, obtaining two final first-level gray scale images; Inputting the two final first-level gray scale images of the first preset size into the trained target neural network to perform binary classification reasoning; Based on the result of the binary classification reasoning on the final first-level gray scale images, respectively determining whether the plurality of pieces of request parameter corresponding to the two final first-level gray scale images has a SQL injection behavior.

4. The network security management method based on different scenes according to claim 1, wherein, The converting the preset number of elements in the to-be-responded queue into sub-gray scale images according to a preset rule comprises: Encoding the characters of the request parameter corresponding to each element in the to-be-responded queue according to a preset encoding table to obtain an encoding sequence; Based on the encoding sequence, obtaining a gray value sequence corresponding to each request parameter; According to a preset strategy, adjusting the pixel values of the corresponding positions in the template image of the second preset size to be consistent with the gray value sequence to obtain the sub-gray scale image.

5. The network security management method based on different scenes according to claim 4, wherein, The target neural network is a feedforward neural network, the first preset size is 1 pixel*M pixel, the second preset size of the sub-gray scale image is 1 pixel*N pixel, and the preset number is w; wherein M, N and w are all positive integer variables not less than 2, and M=w*N; After the step of converting the preset number of elements in the to-be-responded queue into sub-gray scale images according to the preset rule, and before the step of splicing the sub-gray scale images into a total gray scale image of the first preset size, the method further comprises: obtaining the character length L of the request parameter corresponding to each element in the to-be-responded queue; defining the element with the character length L=N in the to-be-responded queue as a first type of element; when it is detected that the target string composed of the tail character of the first type of element in the to-be-responded queue and the head character of the element adjacent to the first type of element belongs to an abnormal combination, rearranging all the elements in the to-be-responded queue into a first intermediate sequence; wherein the target string composed of the tail character of the first type of element in the first intermediate sequence and the head character of the element adjacent to the first type of element does not belong to an abnormal combination; the step of splicing the sub-gray scale images into a total gray scale image of the first preset size specifically comprises: determining the arrangement order of the sub-gray scale images of the second preset size of 1 pixel*N pixel corresponding to each element according to the arrangement order of each element in the first intermediate sequence; arranging the w sub-gray scale images in the arrangement order of the sub-gray scale images from small to large along the horizontal axis direction to obtain a total gray scale image of the first preset size of 1 pixel*M pixel; wherein there is no interval and overlapping area between each adjacent sub-gray scale image arranged from small to large along the horizontal axis direction.

6. The network security management method based on different scenes according to claim 5, wherein, the step of converting the preset number of elements in the to-be-responded queue into sub-gray scale images according to the preset rule specifically comprises: encoding the characters of the request parameter corresponding to each element in the first intermediate sequence according to the preset encoding table to obtain an encoding sequence; obtaining the gray value sequence corresponding to each request parameter based on the encoding sequence; adjusting the pixel value of the corresponding position in the template image of the second preset size to be consistent with the gray value sequence according to the preset strategy to obtain the sub-gray scale image; the preset strategy comprises: if the second preset size is 1 pixel*N pixel, starting from the pixel point with the smallest number in the image coordinate system where the template image is located, adjusting the gray values of the pixel points in the template image in the order of the number from small to large to the values corresponding to each element in the gray value sequence, if the length of the gray value sequence is less than N, setting the gray values of the pixel points in the template image without corresponding relationship with the gray value sequence to a default gray value, the default gray value is different from any value in the encoding table; wherein the number of the pixel point is the horizontal coordinate of the pixel point; the number of the pixel points in the template image is not less than the length of the gray value sequence.

7. The network security management method based on different scenes according to claim 4, characterized in that, The target neural network is a convolutional neural network, the first preset size is M pixels*M pixels, the second preset size of the sub-gray scale image corresponding to each element is N pixels*N pixels, and the preset number is w; wherein M, N, and w are all positive integer variables not less than 2, and w^(0.5) is a positive integer; and M*M=w*N*N; After the step of converting the preset number of elements in the to-be-responded queue into sub-gray scale images according to the preset rule, and before the step of splicing the sub-gray scale images into a total gray scale image of the first preset size, the method further comprises: obtaining the character length L of the request parameters corresponding to each element in the to-be-responded queue; defining the elements in the to-be-responded queue with the character length L≤N*N-4*(N-1) as second-type elements; when it is detected that the number of the second-type elements in the to-be-responded queue is not less than 0.5*w and the arrangement order k of the second-type elements in the to-be-responded queue does not meet condition one, rearranging all the elements in the to-be-responded queue into a second intermediate sequence; wherein when the arrangement order p of the second-type elements in the sequence obtained by rearranging all the elements in the to-be-responded queue meets condition two, the sequence is defined as the second intermediate sequence; condition one: when k mod 2*w^(0.5)≤w^(0.5), k mod 2=1; when k mod 2*w^(0.5)>w^(0.5), k mod 2=0; condition two: when p mod 2*w^(0.5)≤w^(0.5), p mod 2=1; when p mod 2*w^(0.5)>w^(0.5), p mod 2=0; wherein k and p are positive integer variables; mod is a remainder operator symbol; the step of splicing the sub-gray scale images into a total gray scale image of the first preset size specifically comprises: determining the arrangement order of the sub-gray scale image corresponding to each element with the second preset size of N pixels*N pixels according to the arrangement order of each element in the second intermediate sequence; dividing the w sub-gray scale images into w^(0.5) image groups; wherein the arrangement order of the sub-gray scale images in each image group is continuous; and the number of the sub-gray scale images in each image group is the same; for each image group, arranging w^(0.5) sub-gray scale images with continuous arrangement orders from small to large along the horizontal axis direction to obtain an intermediate gray scale image with the size of N pixels*M pixels corresponding to each image group, and a total of w^(0.5) intermediate gray scale images with the size of N pixels*M pixels are obtained; arranging the w^(0.5) intermediate gray scale images with the size of N pixels*M pixels from small to large along the vertical axis direction according to the order of the numbers of the image groups from small to large to obtain a total gray scale image with the first preset size of M pixels*M pixels; wherein there is no interval and overlapping area between each adjacent sub-gray scale image arranged from small to large along the horizontal axis direction and from small to large along the vertical axis direction; the number of the image group is the minimum value of the arrangement orders of the sub-gray scale images contained in the image group.

8. The network security management method based on different scenes according to claim 7, characterized in that, The w is an even number, and the method further comprises: In the second intermediate sequence, the positions corresponding to the arrangement orders q of the third condition are set with the second type of elements; The third condition is q mod w^(0.5) = 1 and q mod w^(0.5) = (0.5*w^(0.5)+1) and q<=w^(0.5) and 0.5*w 9. The network security management method based on different scenes according to claim 7, characterized in that, The request parameters corresponding to the second type of elements in the second intermediate sequence are defined as second type of request parameters, The method further comprises: According to a preset encoding table, the characters of the request parameters corresponding to each element in the to-be-responded queue are encoded one by one to obtain an encoding sequence; Based on the encoding sequence, a gray value sequence corresponding to each request parameter is obtained; According to a preset strategy, the pixel values of the corresponding positions in the second preset size template image are adjusted to be consistent with the gray value sequence to obtain the sub-gray scale image; The preset strategy comprises: If the second preset size is N pixels*N pixels, for the second type of request parameters, starting from the pixel point with the smallest number in the specified region of the image coordinate system where the template image is located, the gray values of the pixel points in the specified region are sequentially adjusted to be the values corresponding to the elements in the gray value sequence corresponding to the second type of request parameters in the order of increasing numbers of the pixel points in the specified region; For other request parameters that do not belong to the second type of request parameters, starting from the pixel point with the smallest number in the image coordinate system where the template image is located, the gray values of the pixel points in the template image are sequentially adjusted to be the values corresponding to the elements in the gray value sequence corresponding to the other request parameters that do not belong to the second type of request parameters in the order of increasing numbers of the pixel points in the template image; Wherein, the number of the pixel point is two digits, the ten digits are the horizontal coordinates of the pixel point, and the individual digits are the vertical coordinates of the pixel point; the number of the pixel points in the specified region is not less than the length of the gray value sequence; the range of the number a*10+b of the pixel points in the specified region meets the following condition four: The fourth condition is 1 10. A network security management system based on different scenarios, comprising: The memory, the processor, and the computer program stored in the memory and executable on the processor, characterized in that the processor executes the program to execute the steps of the network-based security management and control method according to different scenarios in any one of claims 1 to 9.

Images